ZacharyZhang-NY/ELY-Browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(sync): secure encrypted snapshot lifecycle

Browse Source
This commit is contained in:
ZacharyZhang-NY
2026-07-10 06:24:53 -04:00
parent 556c5ff624
commit 540b901fd6
106 changed files with 18026 additions and 3309 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cloudflare/src/account_deletion.ts
+195 -79
View File
@@ -1,12 +1,31 @@
import type { AuthContext } from "./auth.js";
import { authSessionCacheKvKey } from "./auth.js";
import type { ElyD1PreparedStatement, Env } from "./bindings.js";
import { StorageObjectError, deleteKnownObject } from "./storage.js";
import type { ElyD1DatabaseSession, ElyD1PreparedStatement, ElyD1Result, Env } from "./bindings.js";
import { primaryD1Session } from "./bindings.js";
import {
assertDestructiveActionGateResult,
destructiveActionGateIsLive,
destructiveActionGateStatement,
} from "./destructive_action_gate.js";
import { deleteLegacySessionKeys } from "./legacy_auth_kv_cleanup.js";
import {
type RecentDeviceActionProof,
RecentDeviceActionPermissionError,
RecentDeviceActionRequestError,
assertFreshDeviceActionProof,
assertRecentDeviceActionProof,
recentDeviceActionProof,
recentDeviceActionRequestHash,
} from "./recent_device_action_proof.js";
import {
SYNC_R2_ANONYMIZE_USER_QUERY,
SYNC_R2_FENCE_USER_QUERY,
collectSyncR2Garbage,
} from "./sync_r2_gc.js";
const ACCOUNT_DELETION_CONFIRMATION = "delete-elydora-account";
const IDEMPOTENCY_KEY_PATTERN = /^[a-zA-Z0-9._:-]{16,128}$/;
const ACCOUNT_DELETION_EVENT_QUERY = `
SELECT actor_device_id, outcome, subject_id, created_at
SELECT actor_device_id, outcome, subject_id, metadata_hash, created_at
FROM audit_events
WHERE event_id = ? AND event_type = 'account.delete'
`;
@@ -25,19 +44,24 @@ const ACCOUNT_DELETION_COUNTS_QUERY = `
(SELECT COUNT(*) FROM better_auth_user WHERE id = ?) AS users
`;
const ACCOUNT_DELETION_R2_KEYS_QUERY = `
SELECT payload_r2_key AS r2_key
FROM sync_objects
WHERE user_id = ? AND payload_r2_key IS NOT NULL
UNION
SELECT r2_key
FROM sync_snapshots
WHERE user_id = ?
SELECT r2_key FROM sync_r2_gc_candidates
WHERE user_id = ? AND state <> 'deleted'
ORDER BY r2_key ASC
`;
const ACCOUNT_DELETION_SESSION_TOKENS_QUERY = `
SELECT token FROM better_auth_session
WHERE userId = ?
ORDER BY id ASC
`;
const DELETE_SYNC_CHANGE_LOG_QUERY = "DELETE FROM sync_change_log WHERE user_id = ?";
const DELETE_SYNC_TOMBSTONES_QUERY = "DELETE FROM sync_tombstones WHERE user_id = ?";
const DELETE_SYNC_SNAPSHOT_HEADS_QUERY = "DELETE FROM sync_snapshot_heads WHERE user_id = ?";
const DELETE_SYNC_SNAPSHOT_ENCRYPTION_QUERY =
"DELETE FROM sync_snapshot_encryption WHERE user_id = ?";
const DELETE_SYNC_SNAPSHOTS_QUERY = "DELETE FROM sync_snapshots WHERE user_id = ?";
const DELETE_SYNC_OBJECTS_QUERY = "DELETE FROM sync_objects WHERE user_id = ?";
const DELETE_SYNC_VAULT_ENVELOPES_QUERY = "DELETE FROM sync_vault_envelopes WHERE user_id = ?";
const DELETE_SYNC_VAULT_ACCOUNTS_QUERY = "DELETE FROM sync_vault_accounts WHERE user_id = ?";
const DELETE_DEVICE_APPROVALS_QUERY = "DELETE FROM device_approvals WHERE user_id = ?";
const DELETE_USER_DEVICES_QUERY = "DELETE FROM user_devices WHERE user_id = ?";
const DELETE_SESSION_DEVICE_CONTEXTS_QUERY =
@@ -46,20 +70,6 @@ const DELETE_BETTER_AUTH_SESSIONS_QUERY = "DELETE FROM better_auth_session WHERE
const DELETE_BETTER_AUTH_ACCOUNTS_QUERY = "DELETE FROM better_auth_account WHERE userId = ?";
const DELETE_BETTER_AUTH_USER_QUERY = "DELETE FROM better_auth_user WHERE id = ?";
const DELETE_USER_AUDIT_EVENTS_QUERY = "DELETE FROM audit_events WHERE user_id = ?";
const ACCOUNT_DELETION_AUDIT_INSERT_QUERY = `
INSERT INTO audit_events (
event_id,
user_id,
actor_device_id,
event_type,
subject_type,
subject_id,
outcome,
metadata_hash,
created_at
) VALUES (?, NULL, ?, 'account.delete', 'account', ?, 'success', ?, ?)
ON CONFLICT(event_id) DO NOTHING
`;
export interface AccountDeletionDocument {
version: 1;
@@ -86,7 +96,7 @@ export interface AccountDeletionDeletedDocument {
kv_session_cache: number;
}
interface AccountDeletionRequest {
interface AccountDeletionRequest extends RecentDeviceActionProof {
idempotencyKey: string;
}
@@ -94,6 +104,7 @@ interface AccountDeletionEventRow {
actor_device_id: unknown;
outcome: unknown;
subject_id: unknown;
metadata_hash: unknown;
created_at: unknown;
}
@@ -114,6 +125,7 @@ interface AccountDeletionCountsRow {
interface AccountDeletionR2KeyRow {
r2_key: unknown;
}
interface AccountDeletionSessionTokenRow { token: unknown }
type RequestBody = Record<string, unknown>;
@@ -141,32 +153,77 @@ export async function accountDeletionDocument(
const deletion = await accountDeletionRequest(request);
const accountHash = await sha256Hex(textBytes(context.userId));
const idempotencyHash = await sha256Hex(textBytes(deletion.idempotencyKey));
const requestHash = await recentDeviceActionRequestHash({
action: "account.delete",
userId: context.userId,
sessionId: context.sessionId,
deviceId,
confirmation: ACCOUNT_DELETION_CONFIRMATION,
idempotencyKey: deletion.idempotencyKey,
proofCreatedAt: deletion.proofCreatedAt,
actionProof: deletion.actionProof,
});
const eventId = accountDeletionEventId(accountHash, idempotencyHash);
const existingEvent = await env.ELY_DB.prepare(ACCOUNT_DELETION_EVENT_QUERY)
const database = primaryD1Session(env.ELY_DB);
const existingEvent = await database.prepare(ACCOUNT_DELETION_EVENT_QUERY)
.bind(eventId)
.first<AccountDeletionEventRow>();
if (existingEvent !== null) {
return existingDeletionDocument(accountHash, deviceId, deletion, existingEvent);
return existingDeletionDocument(accountHash, deviceId, requestHash, deletion, existingEvent);
}
const signingPublicKey = await assertRecentDeviceActionProof(
database,
context,
"account.delete",
ACCOUNT_DELETION_CONFIRMATION,
deletion.idempotencyKey,
deletion,
);
assertFreshDeviceActionProof(deletion, nowSeconds, true);
const counts = await accountDeletionCounts(env, context.userId);
const r2Keys = await accountDeletionR2Keys(env, context.userId);
for (const key of r2Keys) {
await deleteAccountObject(env, key);
}
await env.ELY_DB.batch(
const counts = await accountDeletionCounts(database, context.userId);
const r2Keys = await accountDeletionR2Keys(database, context.userId);
const sessionTokens = await accountDeletionSessionTokens(database, context.userId);
let results: ElyD1Result[];
try {
results = await database.batch<ElyD1Result>(
accountDeletionStatements(
env,
context.userId,
deviceId,
database,
context,
signingPublicKey,
accountHash,
idempotencyHash,
requestHash,
eventId,
nowSeconds,
),
);
await deleteCurrentSessionCache(env, context.tokenHash);
} catch (error) {
const replayDatabase = primaryD1Session(env.ELY_DB);
const racedEvent = await replayDatabase.prepare(ACCOUNT_DELETION_EVENT_QUERY)
.bind(eventId)
.first<AccountDeletionEventRow>();
if (racedEvent !== null) {
return existingDeletionDocument(accountHash, deviceId, requestHash, deletion, racedEvent);
}
if (!(await destructiveActionGateIsLive(
replayDatabase,
context,
signingPublicKey,
nowSeconds,
))) {
throw new RecentDeviceActionPermissionError("device_action_gate_failed");
}
throw error;
}
assertDestructiveActionGateResult(results[0]);
const kvSessionCache = await cleanupDeletedAccount(
env,
accountHash,
sessionTokens,
context.tokenHash,
nowSeconds,
r2Keys.length,
);
return {
version: 1,
@@ -174,20 +231,22 @@ export async function accountDeletionDocument(
device_id: deviceId,
idempotency_key: deletion.idempotencyKey,
deleted_at: nowSeconds,
deleted: { ...counts, r2_objects: r2Keys.length, kv_session_cache: 1 },
deleted: { ...counts, r2_objects: r2Keys.length, kv_session_cache: kvSessionCache },
};
}
function existingDeletionDocument(
accountHash: string,
deviceId: string,
requestHash: string,
deletion: AccountDeletionRequest,
row: AccountDeletionEventRow,
): AccountDeletionDocument {
if (
row.actor_device_id !== deviceId ||
row.outcome !== "success" ||
row.subject_id !== accountHash
row.subject_id !== accountHash ||
row.metadata_hash !== requestHash
) {
throw new AccountDeletionRequestError("account_deletion_replay_mismatch");
}
@@ -202,10 +261,10 @@ function existingDeletionDocument(
}
async function accountDeletionCounts(
env: Env,
database: ElyD1DatabaseSession,
userId: string,
): Promise<Omit<AccountDeletionDeletedDocument, "r2_objects" | "kv_session_cache">> {
const row = await env.ELY_DB.prepare(ACCOUNT_DELETION_COUNTS_QUERY)
const row = await database.prepare(ACCOUNT_DELETION_COUNTS_QUERY)
.bind(userId, userId, userId, userId, userId, userId, userId, userId, userId, userId, userId)
.first<AccountDeletionCountsRow>();
if (row === null) {
@@ -226,69 +285,126 @@ async function accountDeletionCounts(
};
}
async function accountDeletionR2Keys(env: Env, userId: string): Promise<string[]> {
const result = await env.ELY_DB.prepare(ACCOUNT_DELETION_R2_KEYS_QUERY)
.bind(userId, userId)
async function accountDeletionR2Keys(
database: ElyD1DatabaseSession,
userId: string,
): Promise<string[]> {
const result = await database.prepare(ACCOUNT_DELETION_R2_KEYS_QUERY)
.bind(userId)
.all<AccountDeletionR2KeyRow>();
return result.results.map(r2Key);
}
function accountDeletionStatements(
env: Env,
async function accountDeletionSessionTokens(
database: ElyD1DatabaseSession,
userId: string,
deviceId: string,
): Promise<string[]> {
const result = await database.prepare(ACCOUNT_DELETION_SESSION_TOKENS_QUERY)
.bind(userId)
.all<AccountDeletionSessionTokenRow>();
return result.results.map((row) => {
if (typeof row.token !== "string" || row.token.length === 0) {
throw new AccountDeletionPersistenceError("session_token_invalid");
}
return row.token;
});
}
function accountDeletionStatements(
database: ElyD1DatabaseSession,
context: AuthContext,
signingPublicKey: string,
accountHash: string,
idempotencyHash: string,
requestHash: string,
eventId: string,
nowSeconds: number,
): ElyD1PreparedStatement[] {
const userId = context.userId;
return [
env.ELY_DB.prepare(DELETE_SYNC_CHANGE_LOG_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_SYNC_TOMBSTONES_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_SYNC_SNAPSHOTS_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_SYNC_OBJECTS_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_DEVICE_APPROVALS_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_SESSION_DEVICE_CONTEXTS_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_USER_DEVICES_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_BETTER_AUTH_SESSIONS_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_BETTER_AUTH_ACCOUNTS_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_BETTER_AUTH_USER_QUERY).bind(userId),
env.ELY_DB.prepare(DELETE_USER_AUDIT_EVENTS_QUERY).bind(userId),
env.ELY_DB.prepare(ACCOUNT_DELETION_AUDIT_INSERT_QUERY).bind(
destructiveActionGateStatement(database, context, signingPublicKey, {
eventId,
deviceId,
accountHash,
idempotencyHash,
auditUserId: null,
eventType: "account.delete",
subjectType: "account",
subjectId: accountHash,
metadataHash: requestHash,
}, nowSeconds),
database.prepare(SYNC_R2_FENCE_USER_QUERY).bind(
nowSeconds,
nowSeconds,
nowSeconds,
userId,
),
database.prepare(DELETE_SYNC_CHANGE_LOG_QUERY).bind(userId),
database.prepare(DELETE_SYNC_TOMBSTONES_QUERY).bind(userId),
database.prepare(DELETE_SYNC_SNAPSHOT_HEADS_QUERY).bind(userId),
database.prepare(DELETE_SYNC_SNAPSHOT_ENCRYPTION_QUERY).bind(userId),
database.prepare(DELETE_SYNC_SNAPSHOTS_QUERY).bind(userId),
database.prepare(DELETE_SYNC_OBJECTS_QUERY).bind(userId),
database.prepare(DELETE_SYNC_VAULT_ENVELOPES_QUERY).bind(userId),
database.prepare(DELETE_SYNC_VAULT_ACCOUNTS_QUERY).bind(userId),
database.prepare(DELETE_DEVICE_APPROVALS_QUERY).bind(userId),
database.prepare(DELETE_SESSION_DEVICE_CONTEXTS_QUERY).bind(userId),
database.prepare(DELETE_USER_DEVICES_QUERY).bind(userId),
database.prepare(DELETE_BETTER_AUTH_SESSIONS_QUERY).bind(userId),
database.prepare(DELETE_BETTER_AUTH_ACCOUNTS_QUERY).bind(userId),
database.prepare(DELETE_BETTER_AUTH_USER_QUERY).bind(userId),
database.prepare(DELETE_USER_AUDIT_EVENTS_QUERY).bind(userId),
database.prepare(SYNC_R2_ANONYMIZE_USER_QUERY).bind(nowSeconds, userId, accountHash),
];
}
async function deleteAccountObject(env: Env, key: string): Promise<void> {
async function cleanupDeletedAccount(
env: Env,
accountHash: string,
sessionTokens: string[],
currentTokenHash: string,
nowSeconds: number,
candidateCount: number,
): Promise<number> {
try {
await deleteKnownObject(env.ELY_STORAGE, key);
} catch (error) {
if (error instanceof StorageObjectError) {
throw new AccountDeletionPersistenceError(error.message);
const maxBatches = Math.ceil(candidateCount / 100) + 1;
for (let batch = 0; batch < maxBatches; batch += 1) {
if (await collectSyncR2Garbage(env, nowSeconds, { ownerHash: accountHash, limit: 100 }) < 100) {
break;
}
}
throw error;
} catch {
// Scheduled maintenance drains the durable GC ledger.
}
try {
return await deleteLegacySessionKeys(env, sessionTokens, currentTokenHash);
} catch {
return 0;
}
}
function deleteCurrentSessionCache(env: Env, tokenHash: string): Promise<void> {
return env.ELY_KV.delete(authSessionCacheKvKey(env.ELY_ENVIRONMENT, tokenHash));
}
async function accountDeletionRequest(request: Request): Promise<AccountDeletionRequest> {
const body = await requestBody(request);
assertOnlyFields(body, ["version", "confirmation", "idempotency_key"]);
if (body.version !== 1) {
assertOnlyFields(body, [
"version",
"confirmation",
"idempotency_key",
"proof_created_at",
"action_proof",
]);
if (body.version !== 2) {
throw new AccountDeletionRequestError("version_invalid");
}
if (body.confirmation !== ACCOUNT_DELETION_CONFIRMATION) {
throw new AccountDeletionRequestError("confirmation_invalid");
}
return { idempotencyKey: idempotencyKey(body.idempotency_key) };
try {
return {
idempotencyKey: idempotencyKey(body.idempotency_key),
...recentDeviceActionProof(body.proof_created_at, body.action_proof),
};
} catch (error) {
if (error instanceof RecentDeviceActionRequestError) {
throw new AccountDeletionRequestError(error.message);
}
throw error;
}
}
async function requestBody(request: Request): Promise<RequestBody> {