5adb079e76
Update all five learn documents to match the post-audit codebase:
- Replace references to the deleted server-side X3DH/Double Ratchet (`backend/app/core/encryption/`) with their client-side TypeScript counterparts (`frontend/src/crypto/{x3dh,double-ratchet}.ts`).
- Drop mentions of the removed `RatchetState` and `SkippedMessageKey` PostgreSQL models, the server-generated key paths, and the deprecated `send_encrypted_message` server-encryption method. Add an explicit "why we deleted server-side crypto" rationale in 02-ARCHITECTURE.
- Update API endpoint listings: drop `/encryption/initialize-keys`, `/encryption/rotate-signed-prekey`, `/encryption/opk-count`; add `/auth/me`, `/auth/logout`. Note that all non-auth routes require the session cookie.
- Reflect the new schema: `IdentityKey`, `SignedPrekey`, and `OneTimePrekey` now hold only public material; `User` carries a 64-byte `webauthn_user_handle`.
- Replace the `/ws?user_id=...` example with cookie-authenticated WebSocket usage.
- Remove all line-number references throughout (per the no-line-numbers feedback) — ~300 stripped via regex pass plus targeted prose rewrites.
- Update WebAuthn copy to reflect `UserVerificationRequirement.REQUIRED`, the per-credential-backup-eligibility flag, and challenge-bytes-keyed authentication storage.
- Refresh the file index and project tree to match the trimmed module layout.
|
||
|---|---|---|
| .. | ||
| backend | ||
| conf | ||
| frontend | ||
| learn | ||
| .env.example | ||
| .gitignore | ||
| LICENSE | ||
| README.md | ||
| compose.yml | ||
| dev.compose.yml | ||
| justfile | ||
README.md
██████╗ ██████╗ ██████╗ ██████╗██╗ ██╗ █████╗ ████████╗
██╔══██╗╚════██╗██╔══██╗ ██╔════╝██║ ██║██╔══██╗╚══██╔══╝
██████╔╝ █████╔╝██████╔╝ ██║ ███████║███████║ ██║
██╔═══╝ ██╔═══╝ ██╔═══╝ ██║ ██╔══██║██╔══██║ ██║
██║ ███████╗██║ ╚██████╗██║ ██║██║ ██║ ██║
╚═╝ ╚══════╝╚═╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝
End-to-end encrypted peer-to-peer chat with Signal Protocol (Double Ratchet + X3DH) and WebAuthn/Passkey authentication.
This is a quick overview — security theory, architecture, and full walkthroughs are in the learn modules.
What It Does
- Double Ratchet protocol (Signal) with X3DH key exchange for end-to-end encryption
- WebAuthn/Passkey authentication with discoverable credentials and multi-device support
- Forward secrecy and break-in recovery with out-of-order message handling
- Real-time WebSocket messaging with SurrealDB live queries
- Presence tracking, typing indicators, read receipts, and heartbeat keep-alive
- Alembic database migrations with full test suite
Quick Start
docker compose up -d
Visit http://localhost:8080 to open the application.
[!TIP] This project uses
justas a command runner. Typejustto see all available commands.Install:
curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin
Stack
Backend: FastAPI, PostgreSQL + SQLModel, SurrealDB, Redis, Alembic
Frontend: SolidJS 1.9, TypeScript, Vite 6, Tailwind CSS v4
Learn
This project includes step-by-step learning materials covering security theory, architecture, and implementation.
| Module | Topic |
|---|---|
| 00 - Overview | Prerequisites and quick start |
| 01 - Concepts | Security theory and real-world breaches |
| 02 - Architecture | System design and data flow |
| 03 - Implementation | Code walkthrough |
| 04 - Challenges | Extension ideas and exercises |
License
AGPL 3.0