├── test ├── .mocharc.js ├── setup.mjs ├── fixtures │ ├── key2.asc │ ├── key1.asc │ ├── key5.asc │ ├── key6.asc │ ├── key4.asc │ └── key3.asc ├── integration │ ├── email-test.js │ ├── mongo-test.js │ └── server-test.js └── unit │ ├── email-test.js │ ├── util-test.js │ └── pgp-test.js ├── src ├── view │ ├── footer.html │ ├── removal-success.html │ ├── verify-success.html │ ├── layout.html │ ├── key-armored.html │ ├── index.html │ └── manage.html ├── index.js ├── lib │ ├── csp.js │ ├── templates.js │ ├── log.js │ ├── util.js │ └── closure-library │ │ ├── LICENSE │ │ └── closure │ │ └── goog │ │ └── emailaddress.js ├── route │ ├── www.js │ ├── rest.js │ └── hkp.js ├── static │ ├── js │ │ └── manage.js │ └── css │ │ └── jumbotron-narrow.css ├── server.js ├── tools │ └── clean.js └── modules │ ├── email.js │ ├── mongo.js │ ├── pgp.js │ ├── purify-key.js │ └── public-key.js ├── .gitignore ├── locales ├── en.json └── de.json ├── Changelog.md ├── package.json ├── config └── config.js ├── eslint.config.mjs └── README.md /test/.mocharc.js: -------------------------------------------------------------------------------- 1 | 2 | 'use strict'; 3 | 4 | module.exports = { 5 | recursive: true, 6 | require: ['./test/setup.js'] 7 | }; 8 | -------------------------------------------------------------------------------- /test/setup.mjs: -------------------------------------------------------------------------------- 1 | 'use strict'; 2 | 3 | import * as chai from 'chai'; 4 | import chaiAsPromised from 'chai-as-promised'; 5 | import sinon from 'sinon'; 6 | 7 | import log from '../src/lib/log.js'; 8 | 9 | log.silent = false; 10 | 11 | chai.use(chaiAsPromised); 12 | 13 | global.expect = chai.expect; 14 | global.sinon = sinon; 15 | -------------------------------------------------------------------------------- /src/view/footer.html: -------------------------------------------------------------------------------- 1 | 10 | -------------------------------------------------------------------------------- /src/view/removal-success.html: -------------------------------------------------------------------------------- 1 |

2 | 3 | 6 | 7 |

8 |

9 |

<%= __('removal_success', {email}) %>

10 |

11 |

12 | 13 | <%- include('footer.html') %> 14 | 15 |

16 | -------------------------------------------------------------------------------- /src/index.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2023 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | const init = require('./server'); 9 | const log = require('./lib/log'); 10 | 11 | (async () => { 12 | const server = await init(); 13 | log.info('Server running on %s', server.info.uri); 14 | })(); 15 | 16 | process.on('unhandledRejection', err => { 17 | console.log(err); 18 | process.exit(1); 19 | }); 20 | -------------------------------------------------------------------------------- /src/view/verify-success.html: -------------------------------------------------------------------------------- 1 |

2 | 3 | 6 | 7 |

8 |

9 |

<%= __('verify_success_header', {email}) %>

10 |

<%= __('verify_success_link') %> <%= link %>

11 |

12 |

13 | 14 | <%- include('footer.html') %> 15 | 16 |

17 | -------------------------------------------------------------------------------- /src/lib/csp.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2020 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | exports.plugin = { 9 | name: 'CSP', 10 | async register(server) { 11 | server.ext('onPreResponse', async (request, h) => { 12 | const {response} = request; 13 | if (!response.isBoom) { 14 | response.header('Content-Security-Policy', "default-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; form-action 'self'; base-uri 'self';"); 15 | } 16 | return h.continue; 17 | }); 18 | } 19 | }; 20 | -------------------------------------------------------------------------------- /src/view/layout.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | Mailvelope Key Server 9 | 10 | 11 | 12 | 13 | <%- content %> 14 | 15 | 16 | -------------------------------------------------------------------------------- /test/fixtures/key2.asc: -------------------------------------------------------------------------------- 1 | -----BEGIN PGP PUBLIC KEY BLOCK----- 2 | 3 | xjMEZR7BxRYJKwYBBAHaRw8BAQdAmQqZ2+JpXmfpvFc8Yq05KR45oie+RDff 4 | 8xij0EM74TLNJU1haWx2ZWxvcGUgRGVtbyA8ZGVtb0BtYWlsdmVsb3BlLmNv 5 | bT7CkgQQFgoARAWCZR7BxQWJCWNegAQLCQcICZBMA6RzYsW0zAMVCAoEFgAC 6 | AQIZAQKbAwIeARYhBJBQf7IpZY9x896WqEwDpHNixbTMAADtjwEA9dmFPQXv 7 | jz8HAOsAq6pBkY8qWHiy2EC6xoVkIOo0dEYA/j5zdc4XyPV6HtVari8GdUCq 8 | A9kuKWNw/HQ+n2K06DcLzjgEZR7BxRIKKwYBBAGXVQEFAQEHQC5PC3ZxJJmY 9 | YvUG+GTwHnt66j6c3/2Pvg69joY0Pg0JAwEIB8J+BBgWCAAwBYJlHsHFBYkJ 10 | Y16ACZBMA6RzYsW0zAKbDBYhBJBQf7IpZY9x896WqEwDpHNixbTMAADSBQEA 11 | 9JYBcb0UTTRKguoQyGIhRill7OaAzEvgP3LG6ioJsvwBAK1dxtmtymDe+7Wq 12 | bizTYpcFPbggOxV2dMWsIfDauAIB 13 | =mqy9 14 | -----END PGP PUBLIC KEY BLOCK----- 15 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .DS_Store 2 | .vscode 3 | 4 | # Logs 5 | logs 6 | *.log 7 | npm-debug.log* 8 | 9 | # Runtime data 10 | pids 11 | *.pid 12 | *.seed 13 | 14 | # Directory for instrumented libs generated by jscoverage/JSCover 15 | lib-cov 16 | 17 | # Coverage directory used by tools like istanbul 18 | coverage 19 | 20 | # Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files) 21 | .grunt 22 | 23 | # node-waf configuration 24 | .lock-wscript 25 | 26 | # Compiled binary addons (http://nodejs.org/api/addons.html) 27 | build/Release 28 | 29 | # Dependency directory 30 | node_modules 31 | 32 | # Optional npm cache directory 33 | .npm 34 | 35 | # Optional REPL history 36 | .node_repl_history 37 | 38 | .env 39 | -------------------------------------------------------------------------------- /src/lib/templates.js: -------------------------------------------------------------------------------- 1 | 'use strict'; 2 | 3 | const util = require('./util'); 4 | 5 | function verifyKey({name, email, nonce, origin, keyId, i18n}) { 6 | const link = `${util.url(origin)}/api/v1/key?op=verify&keyId=${keyId}&nonce=${nonce}`; 7 | return { 8 | subject: i18n.__('verify_key_subject'), 9 | text: i18n.__mf('verify_key_text', {name, email, link, host: origin.host}) 10 | }; 11 | } 12 | 13 | function verifyRemove({name, email, nonce, origin, keyId, i18n}) { 14 | const link = `${util.url(origin)}/api/v1/key?op=verifyRemove&keyId=${keyId}&nonce=${nonce}`; 15 | return { 16 | subject: i18n.__('verify_removal_subject'), 17 | text: i18n.__mf('verify_removal_text', {name, email, link, host: origin.host}) 18 | }; 19 | } 20 | 21 | module.exports = {verifyKey, verifyRemove}; 22 | -------------------------------------------------------------------------------- /src/lib/log.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2020 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | const winston = require('winston'); 9 | require('winston-syslog').Syslog; 10 | const config = require('../../config/config'); 11 | 12 | const logger = winston.createLogger({ 13 | level: config.log.level, 14 | levels: winston.config.syslog.levels, 15 | format: winston.format.combine( 16 | winston.format.splat(), 17 | winston.format(info => { 18 | info.message = `${info.message}\n`; 19 | return info; 20 | })(), 21 | winston.format.simple() 22 | ), 23 | exitOnError: false, 24 | transports: [ 25 | config.syslog.host ? new winston.transports.Syslog(config.syslog) : new winston.transports.Console() 26 | ] 27 | }); 28 | 29 | module.exports = logger; 30 | -------------------------------------------------------------------------------- /src/view/key-armored.html: -------------------------------------------------------------------------------- 1 |

2 | 3 | 13 | 14 |

15 |

16 |

<%= query.email ? `Email: ${query.email}` : query.fingerprint ? `Fingerprint: ${query.fingerprint}` : `Key ID: ${query.keyId}` %>

17 |

<%= key.publicKeyArmored %>

18 |

19 |

20 | 21 | <%- include('footer.html') %> 22 | 23 |

24 | -------------------------------------------------------------------------------- /src/route/www.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2020 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | exports.plugin = { 9 | name: 'www', 10 | async register(server, options) { 11 | const routeOptions = { 12 | security: options.server.security 13 | }; 14 | 15 | server.route({ 16 | method: 'GET', 17 | path: '/', 18 | handler: { 19 | view: 'index' 20 | }, 21 | options: routeOptions 22 | }); 23 | 24 | server.route({ 25 | method: 'GET', 26 | path: '/index.html', 27 | handler(request, h) { 28 | return h.redirect('/').permanent(); 29 | }, 30 | options: routeOptions 31 | }); 32 | 33 | server.route({ 34 | method: 'GET', 35 | path: '/manage.html', 36 | handler: { 37 | view: 'manage' 38 | }, 39 | options: routeOptions 40 | }); 41 | } 42 | }; 43 | -------------------------------------------------------------------------------- /locales/en.json: -------------------------------------------------------------------------------- 1 | { 2 | "key_not_found": "Key not found", 3 | "removal_success": "Email address {{email}} removed from the key directory", 4 | "verify_key_comment": "Use Mailvelope/PGP to decrypt the message and click the link", 5 | "verify_key_subject": "Verify your email address", 6 | "verify_key_text": "Hello {name},\n\nplease verify your email address {email} by clicking on the following link:\n\n{link}\n\nAfter verification of your email address, your public key is available in our key directory.\n\nYou can find more info at {host}.\n\nGreetings from the Mailvelope Team", 7 | "verify_removal_subject": "Verify key removal", 8 | "verify_removal_text": "Hello {name},\n\nplease verify removal of your email address {email} from our key server ({host}) by clicking on the following link:\n\n{link}\n\nGreetings from the Mailvelope Team", 9 | "verify_success_header": "Email address {{email}} successfully verified", 10 | "verify_success_link": "Your public OpenPGP key is now available at the following link:" 11 | } 12 | -------------------------------------------------------------------------------- /locales/de.json: -------------------------------------------------------------------------------- 1 | { 2 | "key_not_found": "Schlüssel nicht gefunden", 3 | "removal_success": "E-Mail Adresse {{email}} aus dem Schlüssel Verzeichnis entfernt", 4 | "verify_key_comment": "Mit Mailvelope/PGP entschlüsseln und dann den Link klicken", 5 | "verify_key_subject": "Bestätigen Sie Ihre E-Mail-Adresse", 6 | "verify_key_text": "Hallo {name},\n\nbitte bestätigen Sie Ihre E-Mail-Adresse {email}.\nKlicken Sie hierzu auf den folgenden Link:\n\n{link}\n\nNach der Bestätigung Ihrer E-Mail-Adresse ist ihr öffentlicher Schlüssel in unserem Schlüssel Verzeichnis verfügbar.\n\nWeitere Informationen finden Sie unter {host}.\n\nIhr Mailvelope Team", 7 | "verify_removal_subject": "Entfernen Ihres Schlüssels bestätigen", 8 | "verify_removal_text": "Hallo {name},\n\nbitte bestätigen Sie das Entfernen Ihrer E-Mail-Adresse {email} von unserem Key Server ({host}).\nKlicken Sie hierzu auf den folgenden Link:\n\n{link}\n\nIhr Mailvelope Team", 9 | "verify_success_header": "E-Mail Adresse {{email}} erfolgreich verifiziert", 10 | "verify_success_link": "Ihr öffentlicher OpenPGP Schlüssel ist ab jetzt unter folgendem Link verfügbar:" 11 | } 12 | -------------------------------------------------------------------------------- /Changelog.md: -------------------------------------------------------------------------------- 1 | Mailvelope Key Server Changelog 2 | =============================== 3 | 4 | v4.0.0 5 | ------- 6 | __Nov 3, 2023__ 7 | * Migrate from koa to hapi and major refactoring 8 | * Upgrade OpenPGP.js to v5 9 | * Load configuration from .env file 10 | * Update dependencies 11 | 12 | v3.0.0 13 | ------- 14 | __Mar 4, 2019__ 15 | * Add upload, update and removal for single user IDs 16 | * Migrate to koa 2 with async/await instead of generators 17 | * Use eslint instead of jscs/jshint 18 | * Use winston instead of npmlog 19 | * Use co-body directly instead of koa-body 20 | * Send email message with PGP inline not PGP/MIME 21 | * Use OpenPGP.js directly instead of nodemailer-openpgp plugin 22 | * Use native ES6 string templates instead of nodemailer template engine 23 | * Update OpenPGP.js to 4.4 and other dependencies 24 | 25 | v2.0.0 26 | ------- 27 | __Aug 15, 2017__ 28 | 29 | * Add release npm script for travis deployment 30 | * Use eslint instead of jscs/jshint 31 | * Use ES6 destructuring 32 | * Replace grunt with npm scripts 33 | * Update dependencies 34 | 35 | v1.0.0 36 | ------- 37 | __Jun 13, 2016__ 38 | 39 | * Initial release 40 | -------------------------------------------------------------------------------- /src/static/js/manage.js: -------------------------------------------------------------------------------- 1 | 2 | 'use strict'; 3 | 4 | $('.progress-bar').css('width', '100%'); 5 | 6 | // POST key form 7 | $('#addKey form').submit(async e => { 8 | e.preventDefault(); 9 | $('#addKey .alert').addClass('hidden'); 10 | $('#addKey .progress').removeClass('hidden'); 11 | const publicKeyArmored = $('#addKey textarea').val(); 12 | try { 13 | const response = await fetch('/api/v1/key', {method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({publicKeyArmored})}); 14 | const responseText = await response.text(); 15 | if (!response.ok) { 16 | return alert('addKey', 'danger', responseText); 17 | } 18 | alert('addKey', 'success', responseText); 19 | } catch (e) { 20 | console.log('Fetch error', e); 21 | alert('addKey', 'danger', 'Network did not respond'); 22 | } 23 | }); 24 | 25 | // DELETE key form 26 | $('#removeKey form').submit(async e => { 27 | e.preventDefault(); 28 | $('#removeKey .alert').addClass('hidden'); 29 | $('#removeKey .progress').removeClass('hidden'); 30 | const email = $('#removeKey input[type="email"]').val(); 31 | try { 32 | const response = await fetch(`/api/v1/key?email=${encodeURIComponent(email)}`, {method: 'DELETE'}); 33 | const responseText = await response.text(); 34 | if (!response.ok) { 35 | return alert('removeKey', 'danger', responseText); 36 | } 37 | alert('removeKey', 'success', responseText); 38 | } catch (e) { 39 | console.log('Fetch error', e); 40 | alert('removeKey', 'danger', 'Network did not respond'); 41 | } 42 | }); 43 | 44 | function alert(region, outcome, text) { 45 | $(`#${region} .progress`).addClass('hidden'); 46 | $(`#${region} .alert-${outcome} span`).text(text); 47 | $(`#${region} .alert-${outcome}`).removeClass('hidden'); 48 | } 49 | -------------------------------------------------------------------------------- /test/fixtures/key1.asc: -------------------------------------------------------------------------------- 1 | -----BEGIN PGP PUBLIC KEY BLOCK----- 2 | Version: OpenPGP.js v1.4.1 3 | 4 | xsBNBFZ+SREBCADFXPrLlyXIFHmBcRFEs2nwzID8X3+YmUOvY55+TJbyeggt 5 | Ccgd21JiBNuL3yilZ2HmQbjzmJvuLFIKCBSmGeg3LU3QhcoSdHZu+NtiimuJ 6 | /CruUFD0JJJn0LdV+4R9nlsoUaNtmTfmgS0ErfcICTmzASgjIwk1bKwFN6qh 7 | L+LAVNOU7QL5Jk/6MDUVIU/6sijqGAANAy3aDnFx0x0e0A0QUVdXZU4TUV42 8 | wu31rN39ZhgfHwvSEDZsljh2UvoYgS9uFfmO2CxXhoSsp3LKbwP9Os9atlOr 9 | 7vNOO+nL6GXuBFqNNNycpajiIMBLm6XTeY4ci+EaUX54q7DFUJfamBS3ABEB 10 | AAHNM3NhZmV3aXRobWUgdGVzdHVzZXIgPHNhZmV3aXRobWUudGVzdHVzZXJA 11 | Z21haWwuY29tPsLAcgQQAQgAJgUCVn5JEgYLCQgHAwIJENvAs9krG4bpBBUI 12 | AgoDFgIBAhsDAh4BAAAr6Qf/WWCYCBL2Izau5S+H5zZtCk5Rde51pGw1fsMd 13 | gMlZK7knMUSlfjIEx6C/y5uQRRJc6f44p7B609mCGwW+f91wpAGq4d6O3+BV 14 | 25GDj25UvN8dBW42cufLG7tTSXkDXQNhaWEF15yD7aDOdaWy6OpD66xiR2Rs 15 | vT9BG5la4vIVwQxcMeTg62axTe/uu7IwcxQr1zT9nNvw5lmrF68YqTVl4ArM 16 | axV9yMsbTmjYvS5LmD2vSzRi/OJzfIMYAiTbkSgoF91lFp0rAgq485MEOBjF 17 | T4CnwCVHT8BOjeBi7JnKDb3JN7HGYHX1ZwuaiYJDtkbqHKrTLSmtJJUTJBRs 18 | p14uqM7ATQRWfkkRAQgA2l9OZ2doMLKNhi6JC1Qd1iBWrmMAflbuOstoRz76 19 | C/++VUlVeT7tuOiVJtYgxc1qRgIZEwzZIpM5/p25lX6mrXkgUJd7w8EYbTqa 20 | J9h5jeontZaGHciVRAWyUy35PMevXTt4pKXQvzGS3jXK46ICE2/rxa02sE1N 21 | S1kHCMQnWh89uMpE7sIG2s8QPOYVBHk88hf4M6jGDT2f2pKFwWuJ51z9IZul 22 | wF/my6/rSBkXqhckJCOaq4H1F6iQCV6R0NmEMMe+UYz784mcw9B5JDqYoTux 23 | 3uCPEUeb7kW3M6IdPo2OSEEuvukdQvDmt3jKjnCk5RPKYZYFl9yqFVAf0gbp 24 | EwARAQABwsBfBBgBCAATBQJWfkkTCRDbwLPZKxuG6QIbDAAAJyQH/icIJUhb 25 | AuFntIB/nuX52kubnaXLlQc/erIg4y2aN92+g9ULv2myw6lf+kt5IHQtroR1 26 | MVFSZgHVwSIhrwZqbaZTvi7VZq5NYDjRL1mda+rodhyNQEVM+8Q4XZh7yR8h 27 | TNZn6OsENP1ctxs4J4T/jJL0mdhG/aCkbO4DICAEToViWOmUOpQBJwUI41Wh 28 | qSeCLRV510QasWZVe0o86yCB11gxrg/+xd5XN6Za/pTtz+4KeD3m8ssygdNS 29 | woY7ieO647qE7GagQdWP+4BIYPeEqnRTqyTMxpSivlal2IcEw/Fi0xM97+ER 30 | FtBVBq+eZC88+gSiwcmxsB8s3rMPQhJ6Q0Y= 31 | =/POi 32 | -----END PGP PUBLIC KEY BLOCK----- -------------------------------------------------------------------------------- /package.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "mailvelope-keyserver", 3 | "version": "4.1.0", 4 | "license": "AGPL-3.0", 5 | "repository": { 6 | "type": "git", 7 | "url": "https://github.com/mailvelope/keyserver.git" 8 | }, 9 | "engines": { 10 | "node": ">=20", 11 | "npm": ">=10" 12 | }, 13 | "scripts": { 14 | "start": "node src", 15 | "test": "npm run test:lint && npm run test:unit && npm run test:integration", 16 | "test:lint": "eslint --ignore-pattern \"**/*.min.js\" config src test", 17 | "test:unit": "mocha --require ./test/setup.mjs --recursive ./test/unit", 18 | "test:purify": "mocha --require ./test/setup.mjs --recursive ./test/unit/purify-key-test.js", 19 | "test:public": "mocha --require ./test/setup.mjs --recursive ./test/integration/public-key-test.js", 20 | "test:integration": "mocha --exit --require ./test/setup.mjs --recursive ./test/integration", 21 | "release": "npm run release:install && npm run release:archive", 22 | "release:install": "rm -rf node_modules/ && npm ci --production", 23 | "release:archive": "zip -rq release.zip package.json package-lock.json node_modules/ *.js src/ config/ locales/", 24 | "clean": "node src/tools/clean" 25 | }, 26 | "dependencies": { 27 | "@hapi/boom": "^10.0.1", 28 | "@hapi/hapi": "^21.3.10", 29 | "@hapi/inert": "^7.1.0", 30 | "@hapi/vision": "^7.0.3", 31 | "dotenv": "^16.4.5", 32 | "ejs": "^3.1.10", 33 | "hapi-i18n": "^3.0.1", 34 | "mongodb": "^6.9.0", 35 | "nodemailer": "^6.9.15", 36 | "openpgp": "^5.11.2", 37 | "winston": "^3.14.2", 38 | "winston-syslog": "^2.7.1" 39 | }, 40 | "devDependencies": { 41 | "@eslint/js": "^9.11.1", 42 | "bootstrap": "^3.4.1", 43 | "chai": "^5.1.1", 44 | "chai-as-promised": "^8.0.0", 45 | "eslint": "^9.11.1", 46 | "globals": "^15.9.0", 47 | "jquery": "^3.7.1", 48 | "mocha": "^10.7.3", 49 | "sinon": "^19.0.2", 50 | "supertest": "^7.0.0" 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /config/config.js: -------------------------------------------------------------------------------- 1 | 'use strict'; 2 | 3 | require('dotenv').config(); 4 | const util = require('../src/lib/util'); 5 | 6 | module.exports = { 7 | 8 | log: { 9 | level: process.env.LOG_LEVEL || 'info' 10 | }, 11 | 12 | syslog: { 13 | host: process.env.SYSLOG_HOST, 14 | port: util.parseNumber(process.env.SYSLOG_PORT) 15 | }, 16 | 17 | server: { 18 | port: util.parseNumber(process.env.PORT) ?? 8888, 19 | host: process.env.SERVER_HOST || 'localhost', 20 | cors: util.isTrue(process.env.CORS_HEADER), 21 | security: util.isTrue(process.env.HTTP_SECURITY_HEADER), 22 | csp: util.isTrue(process.env.CSP_HEADER) 23 | }, 24 | 25 | mongo: { 26 | uri: process.env.MONGO_URI, 27 | user: process.env.MONGO_USER, 28 | pass: process.env.MONGO_PASS 29 | }, 30 | 31 | email: { 32 | host: process.env.SMTP_HOST, 33 | port: util.parseNumber(process.env.SMTP_PORT), 34 | tls: util.isTrue(process.env.SMTP_TLS ?? true), 35 | starttls: util.isTrue(process.env.SMTP_STARTTLS ?? true), 36 | pgp: util.isTrue(process.env.SMTP_PGP ?? true), 37 | auth: { 38 | user: process.env.SMTP_USER, 39 | pass: process.env.SMTP_PASS 40 | }, 41 | sender: { 42 | name: process.env.SENDER_NAME, 43 | email: process.env.SENDER_EMAIL 44 | } 45 | }, 46 | 47 | publicKey: { 48 | purgeTimeInDays: util.parseNumber(process.env.PUBLIC_KEY_PURGE_TIME) ?? 14, 49 | uploadRateLimit: util.parseNumber(process.env.UPLOAD_RATE_LIMIT) 50 | }, 51 | 52 | purify: { 53 | purifyKey: util.isTrue(process.env.PURIFY_KEY ?? true), 54 | maxNumUserEmail: util.parseNumber(process.env.MAX_NUM_USER_EMAIL) ?? 20, 55 | maxNumSubkey: util.parseNumber(process.env.MAX_NUM_SUBKEY) ?? 20, 56 | maxNumCert: util.parseNumber(process.env.MAX_NUM_CERT) ?? 5, 57 | maxSizeUserID: util.parseNumber(process.env.MAX_SIZE_USERID) ?? 1024, 58 | maxSizePacket: util.parseNumber(process.env.MAX_SIZE_PACKET) ?? 8383, 59 | maxSizeKey: util.parseNumber(process.env.MAX_SIZE_KEY) ?? 32768 60 | } 61 | 62 | }; 63 | -------------------------------------------------------------------------------- /src/static/css/jumbotron-narrow.css: -------------------------------------------------------------------------------- 1 | /* Space out content a bit */ 2 | body { 3 | padding-top: 20px; 4 | padding-bottom: 20px; 5 | } 6 | 7 | /* Everything but the jumbotron gets side spacing for mobile first views */ 8 | .header, 9 | .marketing, 10 | .footer { 11 | padding-right: 15px; 12 | padding-left: 15px; 13 | } 14 | 15 | /* Custom page header */ 16 | .header { 17 | padding-bottom: 20px; 18 | border-bottom: 1px solid #e5e5e5; 19 | } 20 | /* Make the masthead heading the same height as the navigation */ 21 | .header h3 { 22 | margin-top: 0; 23 | margin-bottom: 0; 24 | line-height: 40px; 25 | } 26 | 27 | /* Custom page footer */ 28 | .footer { 29 | padding-top: 19px; 30 | color: #777; 31 | border-top: 1px solid #e5e5e5; 32 | } 33 | .footer nav { 34 | display: block; 35 | float: right; 36 | } 37 | .footer ul { 38 | display: block; 39 | padding-left: 10px; 40 | } 41 | .footer li { 42 | display: inline; 43 | margin: 0 8px; 44 | } 45 | .footer a { 46 | color: inherit; 47 | } 48 | 49 | /* Customize container */ 50 | @media (min-width: 768px) { 51 | .container { 52 | max-width: 730px; 53 | } 54 | } 55 | .container-narrow > hr { 56 | margin: 30px 0; 57 | } 58 | 59 | /* Main marketing message and sign up button */ 60 | .jumbotron { 61 | text-align: center; 62 | border-bottom: 1px solid #e5e5e5; 63 | } 64 | .jumbotron .btn { 65 | padding: 14px 24px; 66 | font-size: 21px; 67 | } 68 | 69 | /* Supporting marketing content */ 70 | .marketing { 71 | margin: 40px 0; 72 | } 73 | .marketing p + h4 { 74 | margin-top: 28px; 75 | } 76 | .marketing .col-lg-6{ 77 | margin-bottom: 28px; 78 | } 79 | 80 | /* Responsive: Portrait tablets and up */ 81 | @media screen and (min-width: 768px) { 82 | /* Remove the padding we set earlier */ 83 | .header, 84 | .marketing, 85 | .footer { 86 | padding-right: 0; 87 | padding-left: 0; 88 | } 89 | /* Space out the masthead */ 90 | .header { 91 | margin-bottom: 30px; 92 | } 93 | /* Remove the bottom border on the jumbotron for visual effect */ 94 | .jumbotron { 95 | border-bottom: 0; 96 | } 97 | } 98 | -------------------------------------------------------------------------------- /test/integration/email-test.js: -------------------------------------------------------------------------------- 1 | 'use strict'; 2 | 3 | const config = require('../../config/config'); 4 | const Email = require('../../src/modules/email'); 5 | const tpl = require('../../src/lib/templates'); 6 | 7 | describe('Email Integration Tests', function() { 8 | this.timeout(20000); 9 | 10 | let email; 11 | let keyId; 12 | let userId; 13 | let origin; 14 | let publicKeyArmored; 15 | 16 | const recipient = {name: 'Mailvelope Demo', email: 'demo@mailvelope.com'}; 17 | const i18n = { 18 | __: key => key, 19 | __mf: key => key 20 | }; 21 | 22 | before(() => { 23 | publicKeyArmored = require('fs').readFileSync(`${__dirname}/../fixtures/key2.asc`, 'utf8'); 24 | origin = { 25 | protocol: 'http', 26 | host: `localhost:${config.server.port}` 27 | }; 28 | email = new Email(); 29 | email.init(config.email); 30 | }); 31 | 32 | beforeEach(() => { 33 | keyId = '0123456789ABCDF0'; 34 | userId = { 35 | name: recipient.name, 36 | email: recipient.email, 37 | nonce: 'qwertzuioasdfghjkqwertzuio', 38 | publicKeyArmored 39 | }; 40 | }); 41 | 42 | describe('_sendHelper', () => { 43 | it('should work', async () => { 44 | const mailOptions = { 45 | from: {name: email._sender.name, address: email._sender.email}, 46 | to: {name: recipient.name, address: recipient.email}, 47 | subject: 'Hello ✔', // Subject line 48 | text: 'Hello world 🐴', // plaintext body 49 | html: 'Hello world 🐴' // html body 50 | }; 51 | const info = await email._sendHelper(mailOptions); 52 | expect(info).to.exist; 53 | }); 54 | }); 55 | 56 | describe('send verifyKey template', () => { 57 | it('should send plaintext email', async () => { 58 | await email.send({template: tpl.verifyKey, userId, keyId, origin, i18n}); 59 | }); 60 | 61 | it('should send pgp encrypted email', async () => { 62 | await email.send({template: tpl.verifyKey, userId, keyId, publicKeyArmored: userId.publicKeyArmored, origin, i18n}); 63 | }); 64 | }); 65 | 66 | describe('send verifyRemove template', () => { 67 | it('should send plaintext email', async () => { 68 | await email.send({template: tpl.verifyRemove, userId, keyId, origin, i18n}); 69 | }); 70 | }); 71 | }); 72 | -------------------------------------------------------------------------------- /test/fixtures/key5.asc: -------------------------------------------------------------------------------- 1 | -----BEGIN PGP PUBLIC KEY BLOCK----- 2 | Version: GnuPG v2.0.22 (GNU/Linux) 3 | 4 | mI0EUmEvTgEEANyWtQQMOybQ9JltDqmaX0WnNPJeLILIM36sw6zL0nfTQ5zXSS3+ 5 | fIF6P29lJFxpblWk02PSID5zX/DYU9/zjM2xPO8Oa4xo0cVTOTLj++Ri5mtr//f5 6 | GLsIXxFrBJhD/ghFsL3Op0GXOeLJ9A5bsOn8th7x6JucNKuaRB6bQbSPABEBAAG0 7 | JFRlc3QgTWNUZXN0aW5ndG9uIDx0ZXN0QGV4YW1wbGUuY29tPoi5BBMBAgAjBQJS 8 | YS9OAhsvBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQSmNhOk1uQJQwDAP6 9 | AgrTyqkRlJVqz2pb46TfbDM2TDF7o9CBnBzIGoxBhlRwpqALz7z2kxBDmwpQa+ki 10 | Bq3jZN/UosY9y8bhwMAlnrDY9jP1gdCo+H0sD48CdXybblNwaYpwqC8VSpDdTndf 11 | 9j2wE/weihGp/DAdy/2kyBCaiOY1sjhUfJ1GogF49rDRwc7BzAEQAAEBAAAAAAAA 12 | AAAAAAAA/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQN 13 | DAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/ 14 | 2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy 15 | MjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAAFABQDASIAAhEBAxEB/8QAHwAAAQUB 16 | AQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQID 17 | AAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0 18 | NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKT 19 | lJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl 20 | 5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL 21 | /8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHB 22 | CSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpj 23 | ZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3 24 | uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIR 25 | AxEAPwD3+iiigAooooA//9mIuQQTAQIAIwUCUzxDqQIbLwcLCQgHAwIBBhUIAgkK 26 | CwQWAgMBAh4BAheAAAoJEEpjYTpNbkCU9PEEAKMMaXjhGdgDISBXAAEVXL6MB3x1 27 | d/7zBdnUljh1gM34TSKvbeZf7h/1DNgLbJFfSF3KiLViiqRVOumIkjwNIMZPqYtu 28 | WoEcElY50mvTETzOKemCt1GYI0GhOY2uZOVRtQLrkX0CB9r5hEQalkrnjNKlbghj 29 | LfOYu1uARF16cZUWuI0EUmEvTgEEAOkfz7QRWiWk+I6tdMqgEpOLKsFTLHOh3Inz 30 | OZUnccxMRT++J2lDDMhLChz+d0MUxdBq6rrGoEIP2bYE9AjdR1DNedsuwAjnadYI 31 | io6TMzk0ApagqHJcr1jhQfi/0sBhCCX+y0ghK8KAbiYnyXPMQFa9F19CbYaFvrj/ 32 | dXk0N16bABEBAAGJAT0EGAECAAkFAlJhL04CGy4AqAkQSmNhOk1uQJSdIAQZAQIA 33 | BgUCUmEvTgAKCRDghPdEbCAsl7qiBADZpokQgEhe2Cuz7xZIniTcM3itFdxdpRl/ 34 | rrumN0P2cXbcHOMUfpnvwkgZrFEcl0ztvTloTxi7Mzx/c0iVPQXQ4ur9Mjaa5hT1 35 | /9TYNAG5/7ApMHrb48QtWCL0yxcLVC/+7+jUtm2abFMUU4PfnEqzFlkjY4mPalCm 36 | o5tbbszw2VwFBADDZgDd8Vzfyo8r49jitnJNF1u+PLJf7XN6oijzCftAJDBez44Z 37 | ofZ8ahPfkAhJe6opxaqgS47s4FIQVOEJcF9RgwLTU6uooSzA+b9XfNmQu7TWrXZQ 38 | zBlpyHbxDAr9hmXLiKg0Pa11rOPXu7atTZ3C2Ic97WIyoaBUyhCKt8tz6Q== 39 | =MVfN 40 | -----END PGP PUBLIC KEY BLOCK----- 41 | -------------------------------------------------------------------------------- /src/server.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2020 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | const Hapi = require('@hapi/hapi'); 9 | const Vision = require('@hapi/vision'); 10 | const Inert = require('@hapi/inert'); 11 | const ejs = require('ejs'); 12 | const config = require('../config/config'); 13 | const path = require('path'); 14 | const i18n = require('hapi-i18n'); 15 | 16 | const Mongo = require('./modules/mongo'); 17 | const Email = require('./modules/email'); 18 | const PurifyKey = require('./modules/purify-key'); 19 | const PGP = require('./modules/pgp'); 20 | const PublicKey = require('./modules/public-key'); 21 | 22 | const HKP = require('./route/hkp'); 23 | const REST = require('./route/rest'); 24 | const WWW = require('./route/www'); 25 | const CSP = require('./lib/csp'); 26 | 27 | const init = async (conf = config) => { 28 | const server = Hapi.server({ 29 | port: conf.server.port, 30 | host: conf.server.host, 31 | }); 32 | // modules 33 | const mongo = new Mongo(); 34 | await mongo.init(conf.mongo); 35 | const email = new Email(); 36 | email.init(conf.email); 37 | const purify = new PurifyKey(conf.purify); 38 | const pgp = new PGP(purify); 39 | const publicKey = new PublicKey(pgp, mongo, email); 40 | await publicKey.init(); 41 | server.app.publicKey = publicKey; 42 | // views 43 | await server.register(Vision); 44 | server.views({ 45 | engines: { 46 | html: ejs 47 | }, 48 | path: path.join(__dirname, 'view'), 49 | layout: true 50 | }); 51 | // static 52 | await server.register(Inert); 53 | server.route({ 54 | method: 'GET', 55 | path: '/{param*}', 56 | handler: { 57 | directory: { 58 | path: path.join(__dirname, 'static') 59 | } 60 | } 61 | }); 62 | // content security policy 63 | if (conf.server.csp) { 64 | await server.register({plugin: CSP.plugin}); 65 | } 66 | // routes 67 | await server.register({plugin: HKP.plugin, options: conf}); 68 | await server.register({plugin: REST.plugin, options: conf}); 69 | await server.register({plugin: WWW.plugin, options: conf}); 70 | // translation 71 | await server.register({ 72 | plugin: i18n, 73 | options: { 74 | locales: ['de', 'en'], 75 | directory: path.join(__dirname, '../locales'), 76 | languageHeaderField: 'Accept-Language', 77 | defaultLocale: 'en' 78 | } 79 | }); 80 | // start 81 | await server.start(); 82 | return server; 83 | }; 84 | 85 | module.exports = init; 86 | -------------------------------------------------------------------------------- /src/view/index.html: -------------------------------------------------------------------------------- 1 |

2 | 3 | 13 | 14 |

15 |

Secure. Easy.

16 |

The Mailvelope OpenPGP public key server is the first of its kind. It allows automatic public key lookup to make email privacy just as painless as modern messengers.

17 |

Try it now

18 |

19 | 20 |

21 |

22 |

Privacy made Easy

23 |

Automatic key lookup in OpenPGP mail user agents makes reading and writing encrypted email just as painless as modern messenengers.

24 | 25 |

No Web of Trust

26 |

No more key signing parties or publishing your social network online. You can even delete your public key at anytime. Learn more

27 | 28 |

Secure REST API

29 |

The server offers a modern REST API over HTTPS with HSTS and public key pinning that can be integrated into any app architecture. Learn more

30 |

31 | 32 |

33 |

Verify Yourself

34 |

The server verifies email address ownership as well as private key ownership by sending an encrypted verification email.

35 | 36 |

Completely Open

37 |

The code is licensed under the AGPL v3.0 which means you are free to host your own key directory under your domain. Learn more

38 | 39 |

HKP Compatible

40 |

No need to update your current OpenPGP plugin. Just copy and paste hkps://keys.mailvelope.com into your settings and go. Learn more

41 |

42 |

43 | 44 | <%- include('footer.html') %> 45 | 46 |

47 | -------------------------------------------------------------------------------- /src/tools/clean.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2024 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | const config = require('../../config/config'); 9 | const Mongo = require('../modules/mongo'); 10 | const PurifyKey = require('../modules/purify-key'); 11 | const PGP = require('../modules/pgp'); 12 | 13 | const DB_TYPE = 'publickey'; 14 | const KEY_SIZE = 1; // divided by 4/3 gives binary size of key 15 | const MAX_UPLOAD_DATE = new Date(new Date().setDate(new Date().getDate() - config.publicKey.purgeTimeInDays)); // now - purgeTimeInDays 16 | const YEAR = parseInt(process.argv[2] ?? MAX_UPLOAD_DATE.getFullYear()); 17 | 18 | let mongo; 19 | let pgp; 20 | 21 | async function init() { 22 | mongo = new Mongo(); 23 | await mongo.init(config.mongo); 24 | const purify = new PurifyKey({...config.purify, maxNumUserEmail: 60, maxNumSubkey: 25, maxSizeKey: 64 * 1024}); 25 | pgp = new PGP(purify); 26 | } 27 | 28 | function aggregate() { 29 | return mongo.aggregate([ 30 | {$match: {uploaded: {$gte: new Date(YEAR, 0, 1), $lt: new Date(YEAR + 1, 0, 1)}}}, 31 | {$match: {uploaded: {$lt: MAX_UPLOAD_DATE}}}, 32 | {$project: {keySize: {$binarySize: '$publicKeyArmored'}}}, 33 | {$match: {keySize: {$gt: KEY_SIZE}}} 34 | ], DB_TYPE); 35 | } 36 | 37 | async function clean() { 38 | try { 39 | console.log(`Start cleaning year ${YEAR}...`); 40 | await init(); 41 | const result = await aggregate(); 42 | let count = 0; 43 | for await (const document of result) { 44 | await cleanKey(document); 45 | count++; 46 | } 47 | console.log('Number of keys processed:', count); 48 | } catch (e) { 49 | console.log('Error while traversing keys:', e); 50 | } finally { 51 | await mongo.disconnect(); 52 | } 53 | } 54 | 55 | async function cleanKey({_id}) { 56 | const key = await mongo.get({_id}, DB_TYPE); 57 | if (!key.publicKeyArmored) { 58 | console.log('No armored key. Key is not yet verified. Skip'); 59 | return; 60 | } 61 | try { 62 | const purified = await pgp.parseKey(key.publicKeyArmored); 63 | // filter out all unverified user ID and those that are not in the purified set 64 | key.userIds = key.userIds.filter(userId => userId.verified && purified.userIds.some(id => id.email === userId.email)); 65 | if (!key.userIds.length) { 66 | throw new Error('No user ID after comparing with purified key.'); 67 | } 68 | const publicKeyArmored = await pgp.filterKeyByUserIds(key.userIds, purified.publicKeyArmored); 69 | key.publicKeyArmored = publicKeyArmored; 70 | await mongo.replace({_id}, key, DB_TYPE); 71 | } catch (e) { 72 | console.log('Parsing of key failed:', e.message); 73 | await mongo.remove({_id}, DB_TYPE); 74 | console.log(`Key ${key.fingerprint} removed.`); 75 | } 76 | } 77 | 78 | clean(); 79 | -------------------------------------------------------------------------------- /test/unit/email-test.js: -------------------------------------------------------------------------------- 1 | 'use strict'; 2 | 3 | const log = require('../../src/lib/log'); 4 | const Email = require('../../src/modules/email'); 5 | const nodemailer = require('nodemailer'); 6 | 7 | describe('Email Unit Tests', () => { 8 | const sandbox = sinon.createSandbox(); 9 | let email; 10 | let sendFnStub; 11 | 12 | const template = () => ({ 13 | subject: 'foo', 14 | text: 'bar', 15 | html: 'bar' 16 | }); 17 | const sender = { 18 | name: 'Foo Bar', 19 | email: 'foo@bar.com' 20 | }; 21 | const userId1 = { 22 | name: 'name1', 23 | email: 'email1', 24 | nonce: 'qwertzuioasdfghjkqwertzuio' 25 | }; 26 | const keyId = '0123456789ABCDF0'; 27 | const origin = { 28 | protocol: 'http', 29 | host: 'localhost:8888' 30 | }; 31 | const mailOptions = { 32 | from: sender, 33 | to: sender, 34 | subject: 'Hello ✔', // Subject line 35 | text: 'Hello world 🐴', // plaintext body 36 | html: 'Hello world 🐴' // html body 37 | }; 38 | 39 | beforeEach(() => { 40 | sendFnStub = sandbox.stub(); 41 | sandbox.stub(nodemailer, 'createTransport').returns({ 42 | sendMail: sendFnStub 43 | }); 44 | 45 | sandbox.stub(log); 46 | 47 | email = new Email(nodemailer); 48 | email.init({ 49 | host: 'host', 50 | auth: {user: 'user', pass: 'pass'}, 51 | sender 52 | }); 53 | expect(email._sender).to.equal(sender); 54 | }); 55 | 56 | afterEach(() => { 57 | sandbox.restore(); 58 | }); 59 | 60 | describe('send', () => { 61 | beforeEach(() => { 62 | sandbox.stub(email, '_sendHelper').returns(Promise.resolve({response: '250'})); 63 | }); 64 | 65 | it('should work', async () => { 66 | const info = await email.send({template, userId: userId1, keyId, origin}); 67 | 68 | expect(info.response).to.match(/^250/); 69 | }); 70 | }); 71 | 72 | describe('_sendHelper', () => { 73 | it('should work', async () => { 74 | sendFnStub.returns(Promise.resolve({response: '250'})); 75 | 76 | const info = await email._sendHelper(mailOptions); 77 | 78 | expect(info.response).to.match(/^250/); 79 | }); 80 | 81 | it('should log warning for reponse error', async () => { 82 | sendFnStub.returns(Promise.resolve({response: '554'})); 83 | 84 | const info = await email._sendHelper(mailOptions); 85 | 86 | expect(info.response).to.match(/^554/); 87 | expect(log.warning.calledOnce).to.be.true; 88 | }); 89 | 90 | it('should fail', async () => { 91 | sendFnStub.returns(Promise.reject(new Error('boom'))); 92 | 93 | try { 94 | await email._sendHelper(mailOptions); 95 | } catch (e) { 96 | expect(log.error.calledOnce).to.be.true; 97 | expect(e.output.statusCode).to.equal(500); 98 | expect(e.message).to.match(/failed/); 99 | } 100 | }); 101 | }); 102 | }); 103 | -------------------------------------------------------------------------------- /test/integration/mongo-test.js: -------------------------------------------------------------------------------- 1 | 'use strict'; 2 | 3 | const config = require('../../config/config'); 4 | const log = require('../../src/lib/log'); 5 | const Mongo = require('../../src/modules/mongo'); 6 | 7 | describe('Mongo Integration Tests', function() { 8 | this.timeout(20000); 9 | 10 | const DB_TYPE = 'apple'; 11 | const sandbox = sinon.createSandbox(); 12 | const conf = structuredClone(config); 13 | let mongo; 14 | 15 | before(async () => { 16 | sandbox.stub(log); 17 | mongo = new Mongo(); 18 | conf.mongo.uri = `${config.mongo.uri}-int`; 19 | await mongo.init(conf.mongo); 20 | }); 21 | 22 | beforeEach(async () => { 23 | await mongo.clear(DB_TYPE); 24 | }); 25 | 26 | after(async () => { 27 | sandbox.restore(); 28 | await mongo.clear(DB_TYPE); 29 | await mongo.disconnect(); 30 | }); 31 | 32 | describe('create', () => { 33 | it('should insert a document', async () => { 34 | const r = await mongo.create({_id: '0'}, DB_TYPE); 35 | expect(r.acknowledged).to.be.true; 36 | }); 37 | 38 | it('should fail if two with the same ID are inserted', async () => { 39 | let r = await mongo.create({_id: '0'}, DB_TYPE); 40 | expect(r.acknowledged).to.be.true; 41 | try { 42 | r = await mongo.create({_id: '0'}, DB_TYPE); 43 | expect(true).to.be.false; 44 | } catch (e) { 45 | expect(e.message).to.match(/duplicate/); 46 | } 47 | }); 48 | }); 49 | 50 | describe('batch', () => { 51 | it('should insert a document', async () => { 52 | const r = await mongo.batch([{_id: '0'}, {_id: '1'}], DB_TYPE); 53 | expect(r.insertedCount).to.equal(2); 54 | }); 55 | 56 | it('should fail if docs with the same ID are inserted', async () => { 57 | let r = await mongo.batch([{_id: '0'}, {_id: '1'}], DB_TYPE); 58 | expect(r.insertedCount).to.equal(2); 59 | try { 60 | r = await mongo.batch([{_id: '0'}, {_id: '1'}], DB_TYPE); 61 | expect(true).to.be.false; 62 | } catch (e) { 63 | expect(e.message).to.match(/duplicate/); 64 | } 65 | }); 66 | }); 67 | 68 | describe('update', () => { 69 | it('should update a document', async () => { 70 | let r = await mongo.create({_id: '0'}, DB_TYPE); 71 | r = await mongo.update({_id: '0'}, {foo: 'bar'}, DB_TYPE); 72 | expect(r.modifiedCount).to.equal(1); 73 | r = await mongo.get({_id: '0'}, DB_TYPE); 74 | expect(r.foo).to.equal('bar'); 75 | }); 76 | }); 77 | 78 | describe('get', () => { 79 | it('should get a document', async () => { 80 | let r = await mongo.create({_id: '0'}, DB_TYPE); 81 | r = await mongo.get({_id: '0'}, DB_TYPE); 82 | expect(r).to.exist; 83 | }); 84 | }); 85 | 86 | describe('list', () => { 87 | it('should list documents', async () => { 88 | let r = await mongo.batch([{_id: '0', foo: 'bar'}, {_id: '1', foo: 'bar'}], DB_TYPE); 89 | r = await mongo.list({foo: 'bar'}, DB_TYPE); 90 | expect(r).to.deep.equal([{_id: '0', foo: 'bar'}, {_id: '1', foo: 'bar'}], DB_TYPE); 91 | }); 92 | }); 93 | 94 | describe('remove', () => { 95 | it('should remove a document', async () => { 96 | let r = await mongo.create({_id: '0'}, DB_TYPE); 97 | r = await mongo.remove({_id: '0'}, DB_TYPE); 98 | r = await mongo.get({_id: '0'}, DB_TYPE); 99 | expect(r).to.not.exist; 100 | }); 101 | }); 102 | }); 103 | -------------------------------------------------------------------------------- /src/view/manage.html: -------------------------------------------------------------------------------- 1 |

2 | 3 | 13 | 14 |

15 |

16 |

OpenPGP key upload

17 | 20 | 23 | 26 | 30 |

31 |

32 | 33 |

34 |

OpenPGP key lookup

35 | 44 |

45 |

46 | 47 |

48 |

OpenPGP key removal

49 | 52 | 55 | 58 | 66 |

67 |

68 | 69 |

70 |

HKP and REST Apis

71 |

The server offers a modern REST api over HTTPS with HSTS and public key pinning that can be integrated into any app architecture. It is also compatible to the OpenPGP HTTP Keyserver Protocol (HKP). Just copy and paste hkps://keys.mailvelope.com into your current OpenPGP plugin and go. Learn more.

72 |

73 |

74 | 75 | <%- include('footer.html') %> 76 | 77 |

78 | 79 | 80 | 81 | -------------------------------------------------------------------------------- /eslint.config.mjs: -------------------------------------------------------------------------------- 1 | import globals from "globals"; 2 | import js from "@eslint/js"; 3 | 4 | export default [js.configs.recommended, { 5 | files: ["**/*.js"], 6 | languageOptions: { 7 | globals: { 8 | ...globals.node, 9 | ...globals.browser, 10 | ...globals.jquery, 11 | }, 12 | ecmaVersion: 2022, 13 | sourceType: "commonjs", 14 | }, 15 | rules: { 16 | strict: ["error", "global"], 17 | "no-console": 0, 18 | "no-empty": ["error", { 19 | allowEmptyCatch: true, 20 | }], 21 | "require-atomic-updates": 0, 22 | curly: 2, 23 | "no-return-await": 2, 24 | "no-eval": 2, 25 | "no-extend-native": 2, 26 | "no-global-assign": 2, 27 | "no-implicit-coercion": 2, 28 | "no-implicit-globals": 2, 29 | "no-implied-eval": 2, 30 | "no-lone-blocks": 2, 31 | "no-unused-vars": ["error", { 32 | ignoreRestSiblings: true, 33 | caughtErrors: "none" 34 | }], 35 | "no-useless-escape": 0, 36 | "array-bracket-newline": ["warn", "consistent"], 37 | "array-bracket-spacing": 1, 38 | "block-spacing": 1, 39 | 40 | "brace-style": ["warn", "1tbs", { 41 | allowSingleLine: true, 42 | }], 43 | "comma-spacing": 1, 44 | "computed-property-spacing": 1, 45 | "eol-last": 1, 46 | "func-call-spacing": 1, 47 | indent: ["warn", 2, { 48 | MemberExpression: 0, 49 | SwitchCase: 1, 50 | }], 51 | "key-spacing": ["warn", { 52 | mode: "minimum", 53 | }], 54 | "keyword-spacing": 1, 55 | "linebreak-style": 1, 56 | "lines-between-class-members": 1, 57 | "new-parens": ["warn"], 58 | "no-multiple-empty-lines": ["warn", { 59 | max: 1, 60 | }], 61 | "no-trailing-spaces": 1, 62 | "no-var": 1, 63 | "object-curly-newline": ["warn", { 64 | consistent: true, 65 | }], 66 | "object-curly-spacing": ["warn", "never"], 67 | "one-var": ["warn", "never"], 68 | "padded-blocks": ["warn", "never"], 69 | "prefer-object-spread": 1, 70 | quotes: ["warn", "single", { 71 | avoidEscape: true, 72 | }], 73 | semi: ["warn", "always"], 74 | "semi-spacing": 1, 75 | "space-before-blocks": 1, 76 | "space-before-function-paren": ["warn", { 77 | anonymous: "never", 78 | named: "never", 79 | asyncArrow: "always", 80 | }], 81 | "space-in-parens": ["warn", "never"], 82 | "space-infix-ops": 1, 83 | "arrow-body-style": ["warn", "as-needed"], 84 | "arrow-parens": ["warn", "as-needed"], 85 | "arrow-spacing": 1, 86 | "no-useless-constructor": 1, 87 | "object-shorthand": ["warn", "always", { 88 | avoidQuotes: true, 89 | }], 90 | "prefer-arrow-callback": ["warn", { 91 | allowNamedFunctions: true, 92 | }], 93 | "prefer-const": ["warn", { 94 | destructuring: "all", 95 | }], 96 | "prefer-template": 1, 97 | "template-curly-spacing": ["warn", "never"], 98 | "no-template-curly-in-string": "warn", 99 | }, 100 | }, 101 | { 102 | files: ["**/*.mjs"], 103 | languageOptions: { 104 | globals: { 105 | ...globals.node, 106 | ...globals.browser 107 | }, 108 | ecmaVersion: 2022, 109 | sourceType: "module" 110 | } 111 | }, 112 | { 113 | files: ["test/**/*.js"], 114 | languageOptions: { 115 | globals: { 116 | ...globals.mocha, 117 | expect: true, 118 | sinon: true, 119 | }, 120 | }, 121 | rules: { 122 | "no-shadow": 1, 123 | } 124 | }]; 125 | -------------------------------------------------------------------------------- /test/unit/util-test.js: -------------------------------------------------------------------------------- 1 | 'use strict'; 2 | 3 | const util = require('../../src/lib/util'); 4 | 5 | describe('Util Unit Tests', () => { 6 | describe('isString', () => { 7 | it('should be true for string', () => { 8 | expect(util.isString('asdf')).to.be.true; 9 | }); 10 | it('should be true for String object', () => { 11 | expect(util.isString(String('asdf'))).to.be.true; 12 | }); 13 | it('should be true for empty String', () => { 14 | expect(util.isString('')).to.be.true; 15 | }); 16 | it('should be false for undefined', () => { 17 | expect(util.isString(undefined)).to.be.false; 18 | }); 19 | it('should be false for Object', () => { 20 | expect(util.isString({})).to.be.false; 21 | }); 22 | }); 23 | 24 | describe('isTrue', () => { 25 | it('should be true for "true"', () => { 26 | expect(util.isTrue('true')).to.be.true; 27 | }); 28 | it('should be true for true', () => { 29 | expect(util.isTrue(true)).to.be.true; 30 | }); 31 | it('should be false for "false"', () => { 32 | expect(util.isTrue('false')).to.be.false; 33 | }); 34 | it('should be false for false', () => { 35 | expect(util.isTrue(false)).to.be.false; 36 | }); 37 | it('should be true for a random string', () => { 38 | expect(util.isTrue('asdf')).to.be.false; 39 | }); 40 | it('should be true for undefined', () => { 41 | expect(util.isTrue(undefined)).to.be.false; 42 | }); 43 | it('should be true for null', () => { 44 | expect(util.isTrue(null)).to.be.false; 45 | }); 46 | }); 47 | 48 | describe('isKeyId', () => { 49 | it('should be true for 16 byte hex', () => { 50 | expect(util.isKeyId('0123456789ABCDEF')).to.be.true; 51 | }); 52 | it('should be false for 16 byte non-hex', () => { 53 | expect(util.isKeyId('0123456789ABCDEZ')).to.be.false; 54 | }); 55 | it('should be false for 15 byte hex', () => { 56 | expect(util.isKeyId('0123456789ABCDE')).to.be.false; 57 | }); 58 | it('should be false for 17 byte hex', () => { 59 | expect(util.isKeyId('0123456789ABCDEF0')).to.be.false; 60 | }); 61 | it('should be false for undefined', () => { 62 | expect(util.isKeyId(undefined)).to.be.false; 63 | }); 64 | it('should be false for Object', () => { 65 | expect(util.isKeyId({})).to.be.false; 66 | }); 67 | }); 68 | 69 | describe('isFingerPrint', () => { 70 | it('should be true for 40 byte hex', () => { 71 | expect(util.isFingerPrint('0123456789ABCDEF0123456789ABCDEF01234567')).to.be.true; 72 | }); 73 | it('should be false for 40 byte non-hex', () => { 74 | expect(util.isKeyId('0123456789ABCDEF0123456789ABCDEF0123456Z')).to.be.false; 75 | }); 76 | it('should be false for 39 byte hex', () => { 77 | expect(util.isFingerPrint('0123456789ABCDEF0123456789ABCDEF0123456')).to.be.false; 78 | }); 79 | it('should be false for 41 byte hex', () => { 80 | expect(util.isFingerPrint('0123456789ABCDEF0123456789ABCDEF012345678')).to.be.false; 81 | }); 82 | it('should be false for undefined', () => { 83 | expect(util.isFingerPrint(undefined)).to.be.false; 84 | }); 85 | it('should be false for Object', () => { 86 | expect(util.isFingerPrint({})).to.be.false; 87 | }); 88 | }); 89 | 90 | describe('isEmail', () => { 91 | it('should be true valid email', () => { 92 | expect(util.isEmail('a@b.co')).to.be.true; 93 | }); 94 | it('should be false for too short TLD', () => { 95 | expect(util.isEmail('a@b.c')).to.be.false; 96 | }); 97 | it('should be false for no .', () => { 98 | expect(util.isEmail('a@bco')).to.be.false; 99 | }); 100 | it('should be false for no @', () => { 101 | expect(util.isEmail('ab.co')).to.be.false; 102 | }); 103 | it('should be false invalid cahr', () => { 104 | expect(util.isEmail('a<@b.co')).to.be.false; 105 | }); 106 | it('should be false for undefined', () => { 107 | expect(util.isEmail(undefined)).to.be.false; 108 | }); 109 | it('should be false for Object', () => { 110 | expect(util.isEmail({})).to.be.false; 111 | }); 112 | }); 113 | 114 | describe('random', () => { 115 | it('should generate random 32 char hex string', () => { 116 | expect(util.random().length).to.equal(32); 117 | }); 118 | 119 | it('should generate random 16 char hex string', () => { 120 | expect(util.random(8).length).to.equal(16); 121 | }); 122 | }); 123 | 124 | describe('origin', () => { 125 | it('should work', () => { 126 | expect(util.origin({info: {host: 'h'}, server: {info: {protocol: 'https'}}, headers: {}})).to.exist; 127 | }); 128 | }); 129 | 130 | describe('url', () => { 131 | it('should work with resource', () => { 132 | const url = util.url({host: 'localhost', protocol: 'http'}, '/foo'); 133 | expect(url).to.equal('http://localhost/foo'); 134 | }); 135 | 136 | it('should work without resource', () => { 137 | const url = util.url({host: 'localhost', protocol: 'http'}); 138 | expect(url).to.equal('http://localhost'); 139 | }); 140 | }); 141 | }); 142 | -------------------------------------------------------------------------------- /src/route/rest.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2020 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | const Boom = require('@hapi/boom'); 9 | const util = require('../lib/util'); 10 | 11 | /** 12 | * The REST api to provide additional functionality on top of HKP 13 | */ 14 | class REST { 15 | /** 16 | * Create an instance of the REST server 17 | * @param {Object} publicKey An instance of the public key service 18 | * @param {Object} userId An instance of the user id service 19 | */ 20 | constructor(publicKey) { 21 | this._publicKey = publicKey; 22 | } 23 | 24 | /** 25 | * Public key / user ID upload via http POST 26 | * @param {Object} request - hapi request object 27 | * @param {Object} h - hapi response toolkit 28 | */ 29 | async create(request, h) { 30 | const {emails, publicKeyArmored} = request.payload; 31 | if (!publicKeyArmored) { 32 | return Boom.badRequest('No public armored key found'); 33 | } 34 | const origin = util.origin(request); 35 | await this._publicKey.put({emails, publicKeyArmored, origin, i18n: request.i18n}); 36 | return h.response('Upload successful. Check your inbox to verify your email address.').code(200); 37 | } 38 | 39 | /** 40 | * Public key query via http GET 41 | * @param {Object} request - hapi request object 42 | * @param {Object} h - hapi response toolkit 43 | */ 44 | async query(request, h) { 45 | const {op} = request.query; 46 | if (op === 'verify') { 47 | return this.verify(request, h); 48 | } else if (op === 'verifyRemove') { 49 | return this.verifyRemove(request, h); 50 | } 51 | // do READ if no 'op' provided 52 | const {keyId, fingerprint, email} = request.query; 53 | if (!keyId && !fingerprint && ! email || 54 | keyId && !util.isKeyId(keyId) || fingerprint && !util.isFingerPrint(fingerprint) || email && !util.isEmail(email)) { 55 | return Boom.badRequest('Missing parameter: keyId, fingerprint or email.'); 56 | } 57 | return h.response(await this._publicKey.get({keyId, fingerprint, email, i18n: request.i18n})); 58 | } 59 | 60 | /** 61 | * Verify a public key's user id via http GET 62 | * @param {Object} request - hapi request object 63 | * @param {Object} h - hapi response toolkit 64 | */ 65 | async verify(request, h) { 66 | const {keyId, nonce} = request.query; 67 | if (!util.isKeyId(keyId) || !util.isNonce(nonce)) { 68 | throw Boom.badRequest('Invalid parameter keyId or nonce'); 69 | } 70 | const {email} = await this._publicKey.verify({keyId, nonce}); 71 | // create link for sharing 72 | const link = util.url(util.origin(request), `/pks/lookup?op=get&search=${email}`); 73 | return h.view('verify-success', {email, link}); 74 | } 75 | 76 | /** 77 | * Request public key removal via http DELETE 78 | * @param {Object} request - hapi request object 79 | * @param {Object} h - hapi response toolkit 80 | */ 81 | async remove(request, h) { 82 | const {keyId, email} = request.query; 83 | const origin = util.origin(request); 84 | if (!util.isKeyId(keyId) && !util.isEmail(email)) { 85 | throw Boom.badRequest('Invalid parameter keyId or email'); 86 | } 87 | await this._publicKey.requestRemove({keyId, email, origin, i18n: request.i18n}); 88 | return h.response('Check your inbox to verify the removal of your email address.').code(200); 89 | } 90 | 91 | /** 92 | * Verify public key removal via http GET 93 | * @param {Object} request - hapi request object 94 | * @param {Object} h - hapi response toolkit 95 | */ 96 | async verifyRemove(request, h) { 97 | const {keyId, nonce} = request.query; 98 | if (!util.isKeyId(keyId) || !util.isNonce(nonce)) { 99 | throw Boom.badRequest('Invalid parameter keyId or nonce'); 100 | } 101 | const {email} = await this._publicKey.verifyRemove({keyId, nonce}); 102 | return h.view('removal-success', {email}); 103 | } 104 | } 105 | 106 | exports.plugin = { 107 | name: 'REST', 108 | async register(server, options) { 109 | const rest = new REST(server.app.publicKey); 110 | 111 | const routeOptions = { 112 | bind: rest, 113 | cors: options.server.cors, 114 | security: options.server.security, 115 | ext: { 116 | onPreResponse: { 117 | method({response}, h) { 118 | if (!response.isBoom) { 119 | return h.continue; 120 | } 121 | return h.response(response.message).code(response.output.statusCode).type('text/plain'); 122 | } 123 | } 124 | } 125 | }; 126 | 127 | server.route({ 128 | method: 'POST', 129 | path: '/api/v1/key', 130 | handler: rest.create, 131 | options: routeOptions 132 | }); 133 | 134 | server.route({ 135 | method: 'GET', 136 | path: '/api/v1/key', 137 | handler: rest.query, 138 | options: routeOptions 139 | }); 140 | 141 | server.route({ 142 | method: 'DELETE', 143 | path: '/api/v1/key', 144 | handler: rest.remove, 145 | options: routeOptions 146 | }); 147 | } 148 | }; 149 | -------------------------------------------------------------------------------- /src/modules/email.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Copyright (C) 2020 Mailvelope GmbH 3 | * Licensed under the GNU Affero General Public License version 3 4 | */ 5 | 6 | 'use strict'; 7 | 8 | const Boom = require('@hapi/boom'); 9 | const log = require('../lib/log'); 10 | const util = require('../lib/util'); 11 | const openpgp = require('openpgp'); 12 | const nodemailer = require('nodemailer'); 13 | 14 | /** 15 | * A simple wrapper around Nodemailer to send verification emails 16 | */ 17 | class Email { 18 | /** 19 | * Create an instance of the reusable nodemailer SMTP transport. 20 | * @param {String} host SMTP server's hostname: 'smtp.gmail.com' 21 | * @param {Object} auth Auth credential: { user:'user@gmail.com', pass:'pass' } 22 | * @param {Object} sender message 'FROM' field: { name:'Your Support', email:'noreply@exmple.com' } 23 | * @param {String} port (optional) SMTP server's SMTP port. Defaults to 465. 24 | * @param {Boolean} tls (optional) if TSL should be used. Defaults to true. 25 | * @param {Boolean} starttls (optional) force STARTTLS to prevent downgrade attack. Defaults to true. 26 | * @param {Boolean} pgp (optional) if outgoing emails are encrypted to the user's public key. 27 | */ 28 | init({host, port = 465, auth, tls, starttls, pgp, sender}) { 29 | this._transporter = nodemailer.createTransport({ 30 | host, 31 | port, 32 | auth, 33 | secure: tls, 34 | requireTLS: starttls 35 | }); 36 | this._usePGPEncryption = util.isTrue(pgp); 37 | this._sender = sender; 38 | } 39 | 40 | /** 41 | * Send the verification email to the user using a template. 42 | * @param {Object} template the email template function to use 43 | * @param {Object} userId recipient user ID object: { name:'Jon Smith', email:'j@smith.com' } 44 | * @param {String} keyId key ID of public key 45 | * @param {String} publicKeyArmored public key of recipient 46 | * @param {Object} origin origin of the server 47 | * @return {Promise