security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

public/plugins/bookmarks/backend.php

@@ -20,6 +20,17 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
         echo json_encode(['error' => 'valid url required']);
         exit;
     }
+    $scheme = strtolower((string)parse_url($url, PHP_URL_SCHEME));
+    if ($scheme !== 'http' && $scheme !== 'https') {
+        http_response_code(400);
+        echo json_encode(['error' => 'only http/https URLs allowed']);
+        exit;
+    }
+    if (!hyprcrdUrlHostIsPublic($url)) {
+        http_response_code(400);
+        echo json_encode(['error' => 'URL host is not publicly reachable']);
+        exit;
+    }
 
     $ch = curl_init($url);
     curl_setopt_array($ch, [
@@ -30,6 +41,7 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
         CURLOPT_USERAGENT      => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)',
         CURLOPT_SSL_VERIFYPEER => true,
     ]);
+    hyprcrdApplySafeCurlOpts($ch);
     $html = curl_exec($ch);
     $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
     $finalUrl = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL) ?: $url;
@@ -63,18 +75,21 @@ PluginManager::instance()->onApiRoute(function (string $route, string $method) {
     }
 
     $faviconData = '';
-    $ch2 = curl_init($faviconUrl);
-    curl_setopt_array($ch2, [
+    $faviconScheme = strtolower((string)parse_url($faviconUrl, PHP_URL_SCHEME));
+    $favCh = ($faviconScheme === 'http' || $faviconScheme === 'https') && hyprcrdUrlHostIsPublic($faviconUrl);
+    $ch2 = $favCh ? curl_init($faviconUrl) : null;
+    if ($ch2) curl_setopt_array($ch2, [
         CURLOPT_RETURNTRANSFER => true,
         CURLOPT_FOLLOWLOCATION => true,
         CURLOPT_MAXREDIRS      => 3,
         CURLOPT_TIMEOUT        => 5,
         CURLOPT_USERAGENT      => 'Mozilla/5.0 (compatible; hyprcrd-bookmarks/1.0)',
     ]);
-    $favBytes = curl_exec($ch2);
-    $favStatus = curl_getinfo($ch2, CURLINFO_HTTP_CODE);
-    $favMime = curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon';
-    curl_close($ch2);
+    if ($ch2) hyprcrdApplySafeCurlOpts($ch2);
+    $favBytes = $ch2 ? curl_exec($ch2) : false;
+    $favStatus = $ch2 ? curl_getinfo($ch2, CURLINFO_HTTP_CODE) : 0;
+    $favMime = $ch2 ? (curl_getinfo($ch2, CURLINFO_CONTENT_TYPE) ?: 'image/x-icon') : 'image/x-icon';
+    if ($ch2) curl_close($ch2);
 
     if ($favBytes && $favStatus >= 200 && $favStatus < 400 && strlen($favBytes) <= 32768) {
         $mime = preg_replace('/;.*$/', '', $favMime);

public/plugins/chat/backend.php

@@ -108,24 +108,20 @@ function chatRelaySettings(): array {
     ];
 }
 
-/** Same envelope format as the existing relay sync (HYPRCRD-RELAY-V1). */
+/** Dual-format envelope shared with the relay sync path. Writes V2
+ *  (AES-GCM + HKDF), reads V2 + legacy V1 (CBC). Delegates to the central
+ *  helpers so the format stays in lock-step with src/bootstrap.php and
+ *  the relay's crypto.php. */
 function chatEncrypt(string $plain, string $relayKey): string {
-    $encKey = substr(hash('sha256', $relayKey), 0, 32);
-    $iv = random_bytes(16);
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-    return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
+    return hyprcrdRelayEncrypt($plain, $relayKey);
 }
 
 function chatDecrypt(string $envelope, string $relayKey): string {
-    if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return '';
-    $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
-    $raw = base64_decode($b64);
-    if (!$raw || strlen($raw) < 17) return '';
-    $encKey = substr(hash('sha256', $relayKey), 0, 32);
-    $iv = substr($raw, 0, 16);
-    $cipher = substr($raw, 16);
-    $result = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-    return $result !== false ? $result : '';
+    // Old behaviour returned '' for non-envelope strings; preserve that.
+    if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) {
+        return '';
+    }
+    return hyprcrdRelayDecrypt($envelope, $relayKey);
 }
 
 function chatGetState(string $key, $default = null) {

public/plugins/collab-buckets/backend.php

@@ -110,32 +110,24 @@
     ");
 })();
 
-/** Encrypt a JSON payload with the local relay_key using the same envelope
- * format the rest of hyprcrd uses (HYPRCRD-RELAY-V1). */
+/** Encrypt a JSON payload with the local relay_key using the shared
+ * dual-format envelope (GCM-V2 writes, V1 read-only fallback lives in
+ * hyprcrdRelayDecrypt). */
 function collabEncryptPayload(array $fields): ?string {
     $key = collabRelaySettings()['key'] ?? '';
     if ($key === '') return null;
-    $encKey = substr(hash('sha256', $key), 0, 32);
     $plain = json_encode($fields);
-    $iv = random_bytes(16);
-    $cipher = openssl_encrypt($plain, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-    if ($cipher === false) return null;
-    return "HYPRCRD-RELAY-V1\n" . base64_encode($iv . $cipher);
+    if ($plain === false) return null;
+    return hyprcrdRelayEncrypt($plain, $key);
 }
 
 /** Decrypt the inverse. Returns an associative array, or null on failure. */
 function collabDecryptPayload(string $envelope): ?array {
-    if (!str_starts_with($envelope, 'HYPRCRD-RELAY-V1')) return null;
-    $b64 = trim(substr($envelope, strlen('HYPRCRD-RELAY-V1') + 1));
-    $raw = base64_decode($b64);
-    if (!$raw || strlen($raw) < 17) return null;
+    if (!str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC) && !str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) return null;
     $key = collabRelaySettings()['key'] ?? '';
     if ($key === '') return null;
-    $encKey = substr(hash('sha256', $key), 0, 32);
-    $iv = substr($raw, 0, 16);
-    $cipher = substr($raw, 16);
-    $plain = openssl_decrypt($cipher, 'aes-256-cbc', $encKey, OPENSSL_RAW_DATA, $iv);
-    if ($plain === false) return null;
+    $plain = hyprcrdRelayDecrypt($envelope, $key);
+    if ($plain === '') return null;
     $data = json_decode($plain, true);
     return is_array($data) ? $data : null;
 }

public/plugins/tests/relay.test.js

@@ -3,8 +3,10 @@ import { describe, it, expect, csrf } from './runner.js?v=4';
 describe('Relay: Push API', () => {
     it('push without config returns error', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        // The GET endpoint echoes the secret directly as `key` (single-user local app).
-        if (settings.url && settings.key) return; // skip if configured
+        // GET only reports `has_key` (boolean) — the secret itself is never
+        // echoed. If a relay is configured the real push may succeed or fail
+        // for other reasons, so skip in that case.
+        if (settings.url && settings.has_key) return; // skip if configured
 
         const res = await fetch('api/relay/push', {
             method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
@@ -16,7 +18,7 @@ describe('Relay: Push API', () => {
 
     it('push without card_id returns error', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        if (!settings.url || !settings.key) return; // card_id check is after config check
+        if (!settings.url || !settings.has_key) return; // card_id check is after config check
         const res = await fetch('api/relay/push', {
             method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
             body: JSON.stringify({}),
@@ -28,7 +30,7 @@ describe('Relay: Push API', () => {
 describe('Relay: Poll API', () => {
     it('poll without config returns 0 pulled', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        if (settings.url && settings.key) return;
+        if (settings.url && settings.has_key) return;
 
         const res = await fetch('api/relay/poll', {
             method: 'POST', headers: { 'X-CSRF-Token': csrf() },