[PB-4610] Opaque PoC #1690

TamaraFinogina · 2025-10-14T12:44:10Z

Description

This PR is for the PoC for opaque login (just to agree on the API).

During login, we call is2FAorOpaqueNeeded, which tells us if login should be with Opaque or not. The draft implementation for opaque auth is in src/app/auth/services/auth.opaque.ts.

Related Issues

Proof of Concept for PB-4610

Related Pull Requests

SDK with new endpoints

Checklist

Changes have been tested locally.
Unit tests have been written or updated as necessary.
The code adheres to the repository's coding standards.
Relevant documentation has been added or updated.
No new warnings or errors have been introduced.
SonarCloud issues have been reviewed and addressed.
QA Passed

Testing Process

No tests are added yet.

Additional Notes

To build, you need to link the SDK from the opaque PoC PR.

vercel · 2025-10-14T12:44:18Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
drive-web	Ready	Preview	Comment	Oct 17, 2025 7:29am

cloudflare-workers-and-pages · 2025-10-15T09:03:45Z

Deploying drive-web with Cloudflare Pages

Latest commit:	`435b604`
Status:	✅ Deploy successful!
Preview URL:	https://c7c06882.drive-web.pages.dev
Branch Preview URL:	https://opaque-poc.drive-web.pages.dev

View logs

…e password

sg-gs · 2025-10-24T10:27:11Z

src/app/auth/components/LogIn/LogIn.tsx

 import { AuthMethodTypes } from 'app/payment/types';
 import vpnAuthService from 'app/auth/services/vpnAuth.service';
 import envService from 'app/core/services/env.service';
+import { logInOpaque, is2FAorOpaqueNeeded } from '../../services/auth.opaque';


This should be in the auth service, let's not create 'helper' files

sg-gs · 2025-10-24T10:28:06Z

src/app/auth/components/LogIn/LogIn.tsx


    try {
-      const isTfaEnabled = await is2FANeeded(email);
+      const { tfaEnabled: isTfaEnabled, opaqueLogin } = await is2FAorOpaqueNeeded(email);


Could we hide these things under the same functions? Otherwise we mix component-related logic with authentication low-level details, which is far from ideal in terms of maintenance and testability. Let's hide these things under the auth layer.

sg-gs · 2025-10-24T10:28:13Z

src/app/auth/components/LogIn/LogIn.tsx

        };

-        const { token, user, mnemonic } = await authenticateUser(authParams);
+        const { token, user, mnemonic } = await (opaqueLogin ? logInOpaque(authParams) : authenticateUser(authParams));


sg-gs · 2025-10-24T10:28:44Z

src/app/auth/services/auth.crypto.test.ts

+import { generateUserSecrets, encryptUserKeysAndMnemonic, decryptUserKeysAndMnemonic } from './auth.crypto';
+
+describe('Test auth crypto functions', () => {
+  it('test enc/dec of user sercrets', async () => {


Use When-then legends and define clearly what each case is doing / testing

sg-gs · 2025-10-24T10:29:05Z

src/app/auth/services/auth.crypto.test.ts

+
+    const { encMnemonic, encKeys } = await encryptUserKeysAndMnemonic(keys, mnemonic, exportKey);
+
+    const { keys: dec_keys, mnemonic: dec_mnemonic } = await decryptUserKeysAndMnemonic(


Avoid using snake_case, the convention is camelCase

src/app/auth/services/auth.opaque.test.ts

CandelR

When the PRs related to the SDK are merged, I will check this one again :)
internxt/sdk#335

larryrider

check the build action, it seems to be failing right now

TamaraFinogina · 2025-11-24T17:06:10Z

@larryrider, hash library is not working with node less than 20, so tests on 18 fail due to failed build

larryrider · 2025-11-24T17:08:30Z

@larryrider, hash library is not working with node less than 20, so tests on 18 fail due to failed build

@TamaraFinogina We should then update those actions to use node 20 or 22

xabg2 · 2025-11-26T09:55:30Z

src/services/auth.opaque.ts

+  password: string,
+  twoFactorCode: string,
+): Promise<{ token: string; user: UserSettings; mnemonic: string; newToken: string }> => {
+  const { sessionID, user: encUser, sessionKey, exportKey } = await loginOpaque(email, password, twoFactorCode);


Not sure if calling that encUser is the best option since since the user isn't actually encrypted. What about loggedUser or smth like that?

xabg2 · 2025-11-26T09:57:29Z

src/app/auth/services/auth.opaque.ts

+  localStorageService.set('xNewToken', sessionID);
+  await setSessionKey(password, sessionKey);
+
+  Sentry.setUser({


I think Sentry can be safely removed. We do not use it anymore.

xabg2 · 2025-11-26T10:05:48Z

src/services/auth.opaque.ts

+  localStorageService.set('sessionKey', sessionKeyEnc);
+  localStorageService.set('sessionKeySalt', salt);
+};
+
+export const getSessionKey = async (password: string): Promise<Uint8Array> => {
+  const sessionKeyEnc = localStorageService.get('sessionKey') || '';
+  const salt = localStorageService.get('sessionKeySalt') || '';


Perhaps you could create a function in localStorageService called setSessionKey and getSessionKey and manage there the keys/values instead? WDYT?

xabg2 · 2025-11-26T10:10:32Z

src/services/auth.opaque.ts

+    password,
+  });
+  if (!loginResult) {
+    throw new Error('Login failed');


Suggestion: Consider creating a custom error (e.g., LoginFailedError) so it’s clear that the error originates from our code. This makes debugging easier. You can use something like this as a reference.

sonarqubecloud · 2025-12-15T08:53:46Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

TamaraFinogina added 2 commits October 14, 2025 12:29

add opaque

7909f63

Merge remote-tracking branch 'origin/master' into opaque_poc

496bc7a

TamaraFinogina self-assigned this Oct 14, 2025

add disble 2FA

1839209

vercel bot deployed to Preview October 15, 2025 09:02 View deployment

TamaraFinogina added 3 commits October 17, 2025 09:14

add password change, add login after signup

9489a85

Merge remote-tracking branch 'origin/master' into opaque_poc

6a1dcf1

remove extra changes

628aa90

vercel bot deployed to Preview October 17, 2025 07:29 View deployment

TamaraFinogina added 7 commits October 23, 2025 20:57

add tests for opaque versions of signUp, login, disable2FA, and chang…

04077cc

…e password

add new files

44db502

reduce changes in yarn.lock

1bc9d59

reduce changes in types

bf329f2

upgrade internxt-crypto

916fc9c

put is2FAorOpaqueNeeded separately

74868ca

remove 2FA example

76922ee

TamaraFinogina marked this pull request as ready for review October 24, 2025 10:24

TamaraFinogina requested a review from CandelR as a code owner October 24, 2025 10:24

TamaraFinogina requested a review from sg-gs October 24, 2025 10:24

github-actions bot added the ready-for-preview label Oct 24, 2025

sg-gs requested changes Oct 24, 2025

View reviewed changes

TamaraFinogina added 2 commits October 24, 2025 18:28

fix PR comments

10cefd0

fix test description

c65e17c

github-advanced-security bot found potential problems Oct 27, 2025

View reviewed changes

src/app/auth/services/auth.opaque.test.ts Fixed Show fixed Hide fixed

src/app/auth/services/auth.opaque.test.ts Fixed Show fixed Hide fixed

src/app/auth/services/auth.opaque.test.ts Fixed Show fixed Hide fixed

src/app/auth/services/auth.opaque.test.ts Fixed Show fixed Hide fixed

TamaraFinogina added 4 commits October 27, 2025 14:46

don't use localStorage for storing values between tests

080b94e

add more tests

872dd0c

Merge remote-tracking branch 'origin/master' into opaque_poc

c974d3f

fix sonar errors

945e306

TamaraFinogina requested a review from sg-gs October 29, 2025 08:43

Merge branch 'master' into opaque_poc

e1223b0

CandelR reviewed Nov 3, 2025

View reviewed changes

TamaraFinogina and others added 7 commits November 4, 2025 15:36

Merge remote-tracking branch 'origin/master' into opaque_poc

0ab63be

Merge branch 'master' into opaque_poc

4fba4dd

Merge branch 'master' into opaque_poc

ee02788

Merge remote-tracking branch 'origin/master' into opaque_poc

739f848

update sdk, update internext-crypto

994b85e

Merge remote-tracking branch 'origin/master' into opaque_poc

5d0350e

yarn.lock changes

8bcdaa8

TamaraFinogina requested review from larryrider and xabg2 as code owners November 21, 2025 17:11

increase node version

b9be060

larryrider reviewed Nov 24, 2025

View reviewed changes

xabg2 reviewed Nov 26, 2025

View reviewed changes

TamaraFinogina added 6 commits November 26, 2025 11:26

use node 20

b97e446

fix crypto package link

e54ff76

fix pathes

c1dda59

merge master

cac4356

address PR comments

baf3538

merge master

7b8bca5

TamaraFinogina requested a review from a team as a code owner December 5, 2025 11:36

TamaraFinogina requested review from CandelR, larryrider and xabg2 December 5, 2025 11:44

TamaraFinogina added 2 commits December 15, 2025 09:32

Merge remote-tracking branch 'origin/master' into opaque_poc

8a70388

remove diasable 2FA

435b604


		const { encMnemonic, encKeys } = await encryptUserKeysAndMnemonic(keys, mnemonic, exportKey);

		const { keys: dec_keys, mnemonic: dec_mnemonic } = await decryptUserKeysAndMnemonic(

[PB-4610] Opaque PoC #1690

Are you sure you want to change the base?

[PB-4610] Opaque PoC #1690

Conversation

TamaraFinogina commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Related Pull Requests

Checklist

Testing Process

Additional Notes

Uh oh!

vercel bot commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages bot commented Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying drive-web with Cloudflare Pages

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CandelR left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

larryrider left a comment

Choose a reason for hiding this comment

Uh oh!

TamaraFinogina commented Nov 24, 2025

Uh oh!

larryrider commented Nov 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Dec 15, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

TamaraFinogina commented Oct 14, 2025 •

edited

Loading

vercel bot commented Oct 14, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Oct 15, 2025 •

edited

Loading

CandelR left a comment •

edited

Loading