hyprcrd/relay/inc/bootstrap.php

<?php
// Bootstrap: DB connection, master key, schema + migration, common helpers.
// All include files require RELAY_BOOTSTRAPPED to be defined by index.php.

if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }

error_reporting(0);
ini_set('display_errors', '0');

// ── Paths ─────────────────────────────────────────────────────────

$RELAY_ROOT = dirname(__DIR__);
$dbPath = $RELAY_ROOT . '/data/relay.db';
$dbDir = dirname($dbPath);
if (!is_dir($dbDir)) mkdir($dbDir, 0755, true);

// ── Master key ────────────────────────────────────────────────────
//
// Generated on first install, stored in data/master.key (chmod 600,
// blocked from web access via .htaccess). Encrypts everything that
// needs to be recoverable: tenant secrets, the inter-tenant key.

$masterKeyPath = $RELAY_ROOT . '/data/master.key';
if (!file_exists($masterKeyPath)) {
    file_put_contents($masterKeyPath, bin2hex(random_bytes(32)));
    @chmod($masterKeyPath, 0600);
}
$MASTER_KEY = trim(file_get_contents($masterKeyPath));

// ── Database ──────────────────────────────────────────────────────

$db = new PDO('sqlite:' . $dbPath, null, null, [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);
$db->exec('PRAGMA journal_mode = WAL');
$db->exec('PRAGMA foreign_keys = ON');

// ── Schema migration from single-tenant relay ──────────────────────
//
// Old schema (pre-multitenant) had `messages` and `attachments` tables
// without recipient_id/sender_id. CREATE TABLE IF NOT EXISTS would skip
// recreating them, leaving the old shape in place — and inserts with
// the new column list would silently fail. Detect and drop the old
// tables here. Old data is 24h ephemeral so it's a safe drop.

function tableHasColumn(PDO $db, string $table, string $col): bool {
    try {
        $cols = array_column($db->query("PRAGMA table_info($table)")->fetchAll(), 'name');
        return in_array($col, $cols, true);
    } catch (\Throwable $e) {
        return false;
    }
}
function tableExists(PDO $db, string $table): bool {
    try {
        $r = $db->prepare("SELECT name FROM sqlite_master WHERE type='table' AND name = :n");
        $r->execute(['n' => $table]);
        return (bool)$r->fetchColumn();
    } catch (\Throwable $e) {
        return false;
    }
}

if (tableExists($db, 'messages') && !tableHasColumn($db, 'messages', 'recipient_id')) {
    $db->exec('DROP TABLE IF EXISTS messages');
    @error_log('[hyprcrd-relay] migrated: dropped legacy single-tenant messages table');
}
if (tableExists($db, 'attachments') && !tableHasColumn($db, 'attachments', 'recipient_id')) {
    $db->exec('DROP TABLE IF EXISTS attachments');
    @error_log('[hyprcrd-relay] migrated: dropped legacy single-tenant attachments table');
}
// Old single-tenant settings keys (relay_password, relay_key) are unused
// but left in place to allow downgrade.

// v2 → v3 migration: tenants.secret_hash and .secret_encrypted are now
// nullable because users set their own client secret rather than having
// the admin assign one. SQLite can't ALTER COLUMN constraints, so we
// recreate the table while preserving rows.
function tableColumnIsNotNull(PDO $db, string $table, string $col): bool {
    try {
        $cols = $db->query("PRAGMA table_info($table)")->fetchAll();
        foreach ($cols as $c) {
            if ($c['name'] === $col) return (bool)$c['notnull'];
        }
    } catch (\Throwable $e) {}
    return false;
}

if (tableExists($db, 'tenants') && tableColumnIsNotNull($db, 'tenants', 'secret_hash')) {
    $db->exec('PRAGMA foreign_keys = OFF');
    $db->exec('CREATE TABLE tenants_v3_new (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        username TEXT UNIQUE NOT NULL,
        password_hash TEXT NOT NULL,
        secret_hash TEXT,
        secret_encrypted TEXT,
        is_admin INTEGER NOT NULL DEFAULT 0,
        password_changed INTEGER NOT NULL DEFAULT 1,
        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
    )');
    // Copy existing rows but blank the secret columns — old admin-assigned
    // secrets are deprecated; users must re-set their own via the account UI.
    // Non-admin tenants in v2 had admin-set passwords, so force them to change.
    $db->exec('INSERT INTO tenants_v3_new (id, username, password_hash, secret_hash, secret_encrypted, is_admin, password_changed, created_at)
               SELECT id, username, password_hash, NULL, NULL, is_admin,
                      CASE WHEN is_admin = 1 THEN 1 ELSE 0 END,
                      created_at FROM tenants');
    $db->exec('DROP TABLE tenants');
    $db->exec('ALTER TABLE tenants_v3_new RENAME TO tenants');
    $db->exec('PRAGMA foreign_keys = ON');
    @error_log('[hyprcrd-relay] migrated v2->v3: tenant secrets now self-set, non-admin passwords flagged for forced change');
}

// v3.0 → v3.1 migration: add password_changed column if missing
if (tableExists($db, 'tenants') && !tableHasColumn($db, 'tenants', 'password_changed')) {
    $db->exec('ALTER TABLE tenants ADD COLUMN password_changed INTEGER NOT NULL DEFAULT 1');
    // Force non-admin users to change their password (they were admin-set)
    $db->exec('UPDATE tenants SET password_changed = 0 WHERE is_admin = 0');
    @error_log('[hyprcrd-relay] migrated v3.0->v3.1: added password_changed flag, non-admins forced to change');
}

// ── Schema ─────────────────────────────────────────────────────────

$db->exec('CREATE TABLE IF NOT EXISTS tenants (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    username TEXT UNIQUE NOT NULL,
    password_hash TEXT NOT NULL,
    secret_hash TEXT,
    secret_encrypted TEXT,
    is_admin INTEGER NOT NULL DEFAULT 0,
    password_changed INTEGER NOT NULL DEFAULT 1,
    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
)');

$db->exec('CREATE TABLE IF NOT EXISTS settings (
    key TEXT PRIMARY KEY,
    value TEXT
)');

$db->exec('CREATE TABLE IF NOT EXISTS messages (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    recipient_id INTEGER NOT NULL,
    sender_id INTEGER,
    sender_username TEXT,
    title TEXT DEFAULT "",
    body TEXT NOT NULL,
    color TEXT DEFAULT "#38bdf8",
    tags TEXT DEFAULT "",
    relay_uid TEXT DEFAULT NULL,
    fetched INTEGER NOT NULL DEFAULT 0,
    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (recipient_id) REFERENCES tenants(id) ON DELETE CASCADE,
    FOREIGN KEY (sender_id) REFERENCES tenants(id) ON DELETE SET NULL
)');

$db->exec('CREATE TABLE IF NOT EXISTS attachments (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    recipient_id INTEGER NOT NULL,
    relay_uid TEXT NOT NULL,
    filename TEXT NOT NULL,
    data TEXT NOT NULL,
    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (recipient_id) REFERENCES tenants(id) ON DELETE CASCADE
)');

// Chat: separate from `messages` so chat traffic doesnt land in card inboxes.
// Same decrypt-reencrypt hop as messages: arrives encrypted with senders
// secret, stored at-rest under the inter-tenant key, returned re-encrypted
// with the recipients secret.
$db->exec('CREATE TABLE IF NOT EXISTS chat_messages (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    recipient_id INTEGER NOT NULL,
    sender_id INTEGER,
    sender_username TEXT,
    body TEXT NOT NULL,
    fetched INTEGER NOT NULL DEFAULT 0,
    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (recipient_id) REFERENCES tenants(id) ON DELETE CASCADE,
    FOREIGN KEY (sender_id) REFERENCES tenants(id) ON DELETE SET NULL
)');
$db->exec('CREATE INDEX IF NOT EXISTS idx_chat_recipient ON chat_messages(recipient_id, fetched, id)');
// Read receipts: `fetched` (already present) is "delivered" — set when the
// recipient polls /api/chat. `seen` is "seen" — set when the recipient
// opens the thread with the sender via POST /api/chat/seen. The sender
// learns both states by polling GET /api/chat/sent.
$chatCols = $db->query('PRAGMA table_info(chat_messages)')->fetchAll();
$chatColNames = array_column($chatCols, 'name');
if (!in_array('seen', $chatColNames)) {
    $db->exec('ALTER TABLE chat_messages ADD COLUMN seen INTEGER NOT NULL DEFAULT 0');
}
$db->exec('CREATE INDEX IF NOT EXISTS idx_chat_sender_state ON chat_messages(sender_id, id)');

// Collaborative buckets: shared among multiple tenants. Each bucket has one
// owner and a membership set. Buckets persist (not ephemeral) since they are
// the container for ongoing collaboration — cleanup only when deleted.
$db->exec('CREATE TABLE IF NOT EXISTS collab_buckets (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    uid TEXT UNIQUE NOT NULL,
    owner_id INTEGER NOT NULL,
    owner_username TEXT NOT NULL,
    name TEXT NOT NULL,
    color TEXT NOT NULL DEFAULT "#38bdf8",
    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (owner_id) REFERENCES tenants(id) ON DELETE CASCADE
)');
$db->exec('CREATE TABLE IF NOT EXISTS collab_bucket_members (
    bucket_uid TEXT NOT NULL,
    tenant_id INTEGER NOT NULL,
    username TEXT NOT NULL,
    added_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    PRIMARY KEY (bucket_uid, tenant_id),
    FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE
)');
$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_member_tenant ON collab_bucket_members(tenant_id, bucket_uid)');
$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_bucket_updated ON collab_buckets(updated_at)');

// Collab cards: the actual synced content, stored at-rest under the
// inter-tenant key. Payload is an encrypted JSON blob containing title,
// body, color, tags, due_date, position. Tombstoned rows (deleted=1)
// survive for 7 days so late pollers see the deletion.
$db->exec('CREATE TABLE IF NOT EXISTS collab_cards (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    bucket_uid TEXT NOT NULL,
    card_uid TEXT NOT NULL,
    author_username TEXT NOT NULL,
    payload TEXT NOT NULL,
    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    deleted INTEGER NOT NULL DEFAULT 0,
    UNIQUE (bucket_uid, card_uid)
)');
$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_cards_bucket_updated ON collab_cards(bucket_uid, updated_at)');

// Phase 4: advisory edit locks on collab cards. A client that opens the
// editor for a collab card heartbeats into this table every 30s with a
// 60s TTL. Other clients poll the list and show a lock indicator on the
// card. The lock is purely advisory — force-editing is still allowed and
// LWW remains the authoritative conflict resolver.
// Exclusive lock: PRIMARY KEY is (bucket_uid, card_uid). The first writer
// to acquire holds it; everyone else gets a 409 Locked. The previous schema
// had holder_id in the PK, which let multiple users "lock" the same card
// simultaneously — locks were advisory only, and concurrent writers could
// silently overwrite each other through LWW.
//
// Migration: if the existing table still has the 3-column PK, drop it.
// Locks are ephemeral (60s TTL) so dropping discards nothing important.
$lockTableInfo = $db->query("SELECT sql FROM sqlite_master WHERE type='table' AND name='collab_card_locks'")->fetchColumn();
if ($lockTableInfo && stripos($lockTableInfo, 'PRIMARY KEY (bucket_uid, card_uid, holder_id)') !== false) {
    $db->exec('DROP TABLE collab_card_locks');
}
$db->exec('CREATE TABLE IF NOT EXISTS collab_card_locks (
    bucket_uid TEXT NOT NULL,
    card_uid TEXT NOT NULL,
    holder_id INTEGER NOT NULL,
    holder_username TEXT NOT NULL,
    acquired_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    expires_at TEXT NOT NULL,
    PRIMARY KEY (bucket_uid, card_uid),
    FOREIGN KEY (holder_id) REFERENCES tenants(id) ON DELETE CASCADE
)');
$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_card_locks_expires ON collab_card_locks(expires_at)');

$db->exec('CREATE TABLE IF NOT EXISTS sessions (
    id TEXT PRIMARY KEY,
    tenant_id INTEGER NOT NULL,
    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
    expires_at TEXT NOT NULL,
    FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE
)');

$db->exec('CREATE TABLE IF NOT EXISTS rate_limits (
    ip TEXT NOT NULL,
    endpoint TEXT NOT NULL,
    attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
)');

// Cleanup: 24h ephemeral storage, expired sessions, old rate limits
$db->exec("DELETE FROM messages WHERE created_at < datetime('now', '-24 hours')");
$db->exec("DELETE FROM attachments WHERE created_at < datetime('now', '-24 hours')");
// Chat: 7 days, longer than card sync but still ephemeral
$db->exec("DELETE FROM chat_messages WHERE created_at < datetime('now', '-7 days')");
// Collab-card tombstones: 7 days so late pollers still see the delete.
$db->exec("DELETE FROM collab_cards WHERE deleted = 1 AND updated_at < datetime('now', '-7 days')");
// Collab-card locks: drop everything past its TTL on every request.
$db->exec("DELETE FROM collab_card_locks WHERE expires_at < datetime('now')");
$db->exec("DELETE FROM sessions WHERE expires_at < datetime('now')");
$db->exec("DELETE FROM rate_limits WHERE attempted_at < datetime('now', '-5 minutes')");

// ── Common response helper ────────────────────────────────────────

function jsonResponse($data, int $code = 200): void {
    http_response_code($code);
    header('Content-Type: application/json');
    echo json_encode($data);
    exit;
}

// ── Security headers ──────────────────────────────────────────────

header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: no-referrer');
if (!empty($_SERVER['HTTPS']) || ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https') {
    header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
}