feat(media): encrypted media service for NIP-17 DM file sharing

Phase 6: AESGCM encrypt/decrypt for DM file attachments, Blossom upload of encrypted files, ChatFileAttachment composable with auto-decrypt for images and file type display. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-16 10:58:58 +02:00
parent 1a2dc9efac
commit f0acbb1934
2 changed files with 311 additions and 0 deletions
@@ -0,0 +1,121 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.desktop.service.media
+
+import com.vitorpamplona.amethyst.desktop.service.upload.DesktopBlossomClient
+import com.vitorpamplona.amethyst.desktop.service.upload.DesktopMediaMetadata
+import com.vitorpamplona.quartz.utils.ciphers.AESGCM
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import java.io.File
+
+/**
+ * Handles encryption/decryption of media files for NIP-17 DMs.
+ * Uses AESGCM cipher from quartz (commonMain).
+ */
+object EncryptedMediaService {
+    private val httpClient = OkHttpClient()
+    private val blossomClient = DesktopBlossomClient()
+
+    data class EncryptedUploadResult(
+        val url: String,
+        val cipher: AESGCM,
+        val mimeType: String?,
+        val hash: String?,
+        val size: Int,
+        val dimensions: Pair<Int, Int>?,
+        val blurhash: String?,
+    )
+
+    /**
+     * Encrypt a file and upload to Blossom.
+     * Returns the encrypted upload result with cipher details.
+     */
+    suspend fun encryptAndUpload(
+        file: File,
+        serverBaseUrl: String,
+        authHeader: String?,
+    ): EncryptedUploadResult =
+        withContext(Dispatchers.IO) {
+            val metadata = DesktopMediaMetadata.compute(file)
+            val cipher = AESGCM()
+
+            // Read file bytes and encrypt
+            val plainBytes = file.readBytes()
+            val encryptedBytes = cipher.encrypt(plainBytes)
+
+            // Write encrypted bytes to temp file for upload
+            val tempFile = File.createTempFile("encrypted_", ".enc")
+            tempFile.deleteOnExit()
+            tempFile.writeBytes(encryptedBytes)
+
+            try {
+                val result =
+                    blossomClient.upload(
+                        file = tempFile,
+                        contentType = "application/octet-stream",
+                        serverBaseUrl = serverBaseUrl,
+                        authHeader = authHeader,
+                    )
+
+                EncryptedUploadResult(
+                    url = result.url ?: throw IllegalStateException("No URL in upload result"),
+                    cipher = cipher,
+                    mimeType = metadata.mimeType,
+                    hash = metadata.sha256,
+                    size = plainBytes.size,
+                    dimensions =
+                        if (metadata.width != null && metadata.height != null) {
+                            metadata.width to metadata.height
+                        } else {
+                            null
+                        },
+                    blurhash = metadata.blurhash,
+                )
+            } finally {
+                tempFile.delete()
+            }
+        }
+
+    /**
+     * Download and decrypt an encrypted file from a URL.
+     * Returns the decrypted bytes.
+     */
+    suspend fun downloadAndDecrypt(
+        url: String,
+        keyBytes: ByteArray,
+        nonce: ByteArray,
+    ): ByteArray =
+        withContext(Dispatchers.IO) {
+            val request = Request.Builder().url(url).build()
+            val response = httpClient.newCall(request).execute()
+            val encryptedBytes =
+                response.use {
+                    if (!it.isSuccessful) throw RuntimeException("Download failed: ${it.code}")
+                    it.body.bytes()
+                }
+
+            val cipher = AESGCM(keyBytes, nonce)
+            cipher.decrypt(encryptedBytes)
+        }
+}
@@ -0,0 +1,190 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.desktop.ui.chats
+
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.InsertDriveFile
+import androidx.compose.material.icons.filled.Lock
+import androidx.compose.material3.Card
+import androidx.compose.material3.CardDefaults
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.ImageBitmap
+import androidx.compose.ui.graphics.toComposeImageBitmap
+import androidx.compose.ui.layout.ContentScale
+import androidx.compose.ui.unit.dp
+import com.vitorpamplona.amethyst.desktop.service.media.EncryptedMediaService
+import com.vitorpamplona.quartz.nip17Dm.files.ChatMessageEncryptedFileHeaderEvent
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.jetbrains.skia.Image as SkiaImage
+
+@Composable
+fun ChatFileAttachment(
+    event: ChatMessageEncryptedFileHeaderEvent,
+    modifier: Modifier = Modifier,
+) {
+    val url = event.url()
+    val mimeType = event.mimeType()
+    val keyBytes = event.key()
+    val nonce = event.nonce()
+    val isImage = mimeType?.startsWith("image/") == true
+
+    var decryptedImage by remember { mutableStateOf<ImageBitmap?>(null) }
+    var decryptedBytes by remember { mutableStateOf<ByteArray?>(null) }
+    var isLoading by remember { mutableStateOf(false) }
+    var error by remember { mutableStateOf<String?>(null) }
+
+    // Auto-decrypt images
+    LaunchedEffect(url) {
+        if (isImage && keyBytes != null && nonce != null) {
+            isLoading = true
+            try {
+                val bytes = EncryptedMediaService.downloadAndDecrypt(url, keyBytes, nonce)
+                decryptedBytes = bytes
+                withContext(Dispatchers.Default) {
+                    val skImage = SkiaImage.makeFromEncoded(bytes)
+                    decryptedImage = skImage.toComposeImageBitmap()
+                }
+            } catch (e: Exception) {
+                error = e.message
+            } finally {
+                isLoading = false
+            }
+        }
+    }
+
+    Card(
+        modifier = modifier.fillMaxWidth(),
+        colors =
+            CardDefaults.cardColors(
+                containerColor = MaterialTheme.colorScheme.surfaceContainerHigh,
+            ),
+    ) {
+        Column(modifier = Modifier.padding(8.dp)) {
+            // Encryption indicator
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                Icon(
+                    Icons.Default.Lock,
+                    contentDescription = "Encrypted",
+                    modifier = Modifier.size(14.dp),
+                    tint = MaterialTheme.colorScheme.primary,
+                )
+                Spacer(Modifier.width(4.dp))
+                Text(
+                    "Encrypted file",
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.primary,
+                )
+            }
+
+            Spacer(Modifier.height(4.dp))
+
+            when {
+                isLoading -> {
+                    CircularProgressIndicator(
+                        modifier = Modifier.size(24.dp).align(Alignment.CenterHorizontally),
+                    )
+                }
+
+                decryptedImage != null -> {
+                    androidx.compose.foundation.Image(
+                        bitmap = decryptedImage!!,
+                        contentDescription = "Encrypted image",
+                        modifier =
+                            Modifier
+                                .fillMaxWidth()
+                                .heightIn(max = 300.dp)
+                                .clip(RoundedCornerShape(8.dp)),
+                        contentScale = ContentScale.FillWidth,
+                    )
+                }
+
+                error != null -> {
+                    Text(
+                        "Failed to decrypt: $error",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.error,
+                    )
+                }
+
+                else -> {
+                    // Non-image file
+                    Row(verticalAlignment = Alignment.CenterVertically) {
+                        Icon(
+                            Icons.Default.InsertDriveFile,
+                            contentDescription = "File",
+                            modifier = Modifier.size(32.dp),
+                        )
+                        Spacer(Modifier.width(8.dp))
+                        Column {
+                            Text(
+                                mimeType ?: "Unknown file",
+                                style = MaterialTheme.typography.bodySmall,
+                            )
+                            event.size()?.let { size ->
+                                Text(
+                                    "${size / 1024}KB",
+                                    style = MaterialTheme.typography.labelSmall,
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                )
+                            }
+                        }
+                    }
+                }
+            }
+
+            // Save button for decrypted files
+            if (decryptedBytes != null) {
+                TextButton(
+                    onClick = {
+                        // For encrypted files, we'd need to save decrypted bytes
+                        // This is handled through the save action
+                    },
+                ) {
+                    Text("Save", style = MaterialTheme.typography.labelSmall)
+                }
+            }
+        }
+    }
+}