image push fix

relay/inc/routes/messages.php

@@ -143,18 +143,49 @@ if ($route === '/api/attachments' && $method === 'POST') {
     $recipient = getTenantByUsername($db, $recipientName);
     if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
 
+    // Decrypt-reencrypt hop, same shape as messages: arrives encrypted with
+    // sender's secret, gets stored at-rest under the inter-tenant key.
+    if (empty($clientTenant['secret_encrypted'])) {
+        jsonResponse(['error' => 'sender has no client secret set — log into the relay UI and configure one in your account'], 400);
+    }
+    $senderSecret = masterDecrypt($clientTenant['secret_encrypted'], $MASTER_KEY);
+    if (!$senderSecret) jsonResponse(['error' => 'sender secret unavailable'], 500);
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set — admin must complete setup'], 500);
+
+    $plainBytes = clientDecrypt($data, $senderSecret);
+    if ($plainBytes === '') jsonResponse(['error' => 'attachment decrypt failed (sender secret mismatch?)'], 400);
+    $storedData = clientEncrypt($plainBytes, $interKey);
+
     $db->prepare('DELETE FROM attachments WHERE recipient_id = :r AND relay_uid = :uid AND filename = :fn')
         ->execute(['r' => $recipient['id'], 'uid' => $relayUid, 'fn' => $filename]);
     $db->prepare('INSERT INTO attachments (recipient_id, relay_uid, filename, data) VALUES (:r, :uid, :fn, :data)')
-        ->execute(['r' => $recipient['id'], 'uid' => $relayUid, 'fn' => $filename, 'data' => $data]);
+        ->execute(['r' => $recipient['id'], 'uid' => $relayUid, 'fn' => $filename, 'data' => $storedData]);
     jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
 }
 
 if ($route === '/api/attachments' && $method === 'GET') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
+    if (empty($clientTenant['secret_encrypted'])) {
+        jsonResponse(['error' => 'no client secret set — log into the relay UI and configure one in your account'], 400);
+    }
     $relayUid = $_GET['relay_uid'] ?? '';
     if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
+
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $recipientSecret = masterDecrypt($clientTenant['secret_encrypted'], $MASTER_KEY);
+    if (!$recipientSecret) jsonResponse(['error' => 'recipient secret unavailable'], 500);
+
     $stmt = $db->prepare('SELECT id, relay_uid, filename, data, created_at FROM attachments WHERE recipient_id = :r AND relay_uid = :uid');
     $stmt->execute(['r' => $clientTenant['id'], 'uid' => $relayUid]);
-    jsonResponse($stmt->fetchAll());
+    $rows = $stmt->fetchAll();
+
+    $out = [];
+    foreach ($rows as $row) {
+        $plainBytes = clientDecrypt($row['data'] ?? '', $interKey);
+        $row['data'] = clientEncrypt($plainBytes, $recipientSecret);
+        $out[] = $row;
+    }
+    jsonResponse($out);
 }