security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/CalDavClient.php

@@ -28,6 +28,7 @@ class CalDavClient
             CURLOPT_TIMEOUT => 30,
             CURLOPT_SSL_VERIFYPEER => true,
         ]);
+        hyprcrdApplySafeCurlOpts($ch);
         if ($body !== '') {
             curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
         }

src/Database.php

@@ -169,5 +169,17 @@ class Database
             )
         ');
         self::$pdo->exec('CREATE INDEX IF NOT EXISTS idx_card_history_card ON card_history(card_id, changed_at DESC)');
+
+        // Login / password-change rate limiting. Keyed by IP so rotating the
+        // session cookie doesn't reset the counter. Old rows are purged at
+        // the top of every login request.
+        self::$pdo->exec('
+            CREATE TABLE IF NOT EXISTS login_attempts (
+                ip TEXT NOT NULL,
+                endpoint TEXT NOT NULL,
+                attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+            )
+        ');
+        self::$pdo->exec('CREATE INDEX IF NOT EXISTS idx_login_attempts_ip_ep ON login_attempts(ip, endpoint, attempted_at)');
     }
 }

src/bootstrap.php

@@ -23,3 +23,95 @@ $pluginManager = PluginManager::instance();
 $pluginManager->scan(__DIR__ . '/../public/plugins');
 $pluginManager->loadDisabled(dirname(DB_PATH) . '/plugins.json');
 $pluginManager->loadBackends(); // require_once enabled backend.php files
+
+// ── SSRF guards ────────────────────────────────────────────────────
+// Used by every outbound cURL that fetches a user-supplied URL.
+// Default: restrict protocols to HTTP(S); caller opts into private-IP
+// blocking when the target should be public-internet-only (bookmarks).
+
+if (!defined('HYPRCRD_SAFE_PROTOS')) {
+    define('HYPRCRD_SAFE_PROTOS', CURLPROTO_HTTP | CURLPROTO_HTTPS);
+}
+
+function hyprcrdApplySafeCurlOpts($ch): void {
+    curl_setopt($ch, CURLOPT_PROTOCOLS, HYPRCRD_SAFE_PROTOS);
+    curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, HYPRCRD_SAFE_PROTOS);
+}
+
+// ── Relay wire crypto ──────────────────────────────────────────────
+// Dual-format envelope used by the relay push/poll path. Mirrors
+// relay/inc/crypto.php exactly — same magic strings, same HKDF info.
+//
+//   HYPRCRD-GCM-V2   (new)    AES-256-GCM + HKDF(SHA-256) + per-cipher salt
+//   HYPRCRD-RELAY-V1 (legacy) AES-256-CBC + substr(hex(sha256())) KDF
+//
+// Encrypt always writes V2. Decrypt accepts either so hyprcrd keeps
+// reading messages and attachments pushed before the v1.10 upgrade.
+
+const HYPRCRD_RELAY_GCM_MAGIC = 'HYPRCRD-GCM-V2';
+const HYPRCRD_RELAY_CBC_MAGIC = 'HYPRCRD-RELAY-V1';
+const HYPRCRD_RELAY_HKDF_INFO = 'hyprcrd-relay-client-v2';
+
+function hyprcrdRelayEncrypt(string $plain, string $secret): string {
+    $salt = random_bytes(16);
+    $nonce = random_bytes(12);
+    $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_RELAY_HKDF_INFO, $salt);
+    $tag = '';
+    $cipher = openssl_encrypt($plain, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag, '', 16);
+    return HYPRCRD_RELAY_GCM_MAGIC . "\n" . base64_encode($salt . $nonce . $cipher . $tag);
+}
+
+function hyprcrdRelayDecrypt(string $envelope, string $secret): string {
+    if (str_starts_with($envelope, HYPRCRD_RELAY_GCM_MAGIC)) {
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_RELAY_GCM_MAGIC) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 16 + 12 + 16 + 1) return '';
+        $salt = substr($raw, 0, 16);
+        $nonce = substr($raw, 16, 12);
+        $tag = substr($raw, -16);
+        $cipher = substr($raw, 28, -16);
+        $key = hash_hkdf('sha256', $secret, 32, HYPRCRD_RELAY_HKDF_INFO, $salt);
+        $plain = openssl_decrypt($cipher, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $nonce, $tag);
+        return $plain !== false ? $plain : '';
+    }
+    if (str_starts_with($envelope, HYPRCRD_RELAY_CBC_MAGIC)) {
+        $b64 = trim(substr($envelope, strlen(HYPRCRD_RELAY_CBC_MAGIC) + 1));
+        $raw = base64_decode($b64, true);
+        if (!$raw || strlen($raw) < 17) return '';
+        $key = substr(hash('sha256', $secret), 0, 32);
+        $iv = substr($raw, 0, 16);
+        $cipher = substr($raw, 16);
+        $result = openssl_decrypt($cipher, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+        return $result !== false ? $result : '';
+    }
+    // Passthrough for already-plaintext fields (legacy relays occasionally
+    // returned title fields unwrapped).
+    return $envelope;
+}
+
+function hyprcrdUrlHostIsPublic(string $url): bool {
+    $host = parse_url($url, PHP_URL_HOST);
+    if (!$host) return false;
+    $host = strtolower(trim($host, '[]'));
+    $ips = [];
+    if (filter_var($host, FILTER_VALIDATE_IP)) {
+        $ips[] = $host;
+    } else {
+        $rec = @dns_get_record($host, DNS_A + DNS_AAAA);
+        foreach ($rec ?: [] as $r) {
+            if (!empty($r['ip'])) $ips[] = $r['ip'];
+            if (!empty($r['ipv6'])) $ips[] = $r['ipv6'];
+        }
+        if (!$ips) {
+            $resolved = @gethostbynamel($host);
+            if ($resolved) $ips = $resolved;
+        }
+    }
+    if (!$ips) return false;
+    foreach ($ips as $ip) {
+        if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+            return false;
+        }
+    }
+    return true;
+}