Šepot — end-to-end encrypted messenger

Initial public release. Anonymous on-device identity (no phone number,
e-mail, or password), Signal-protocol cryptography (X3DH + PQXDH, Double
Ratchet, sealed sender) via libsignal, a metadata-minimizing relay,
group chats, disappearing messages, encrypted local storage, optional
Tor transport, and a UI localized into Czech, English, German, Russian,
and Italian.

Monorepo: Flutter client (app/), Rust relay + wire types (rust/),
protobuf definitions (proto/), self-host deploy (deploy/).

Licensed under AGPL-3.0 with an app-store distribution exception (§7).
This commit is contained in:
Julius Joska
2026-07-11 17:06:39 +02:00
commit 8081d98c67
309 changed files with 44102 additions and 0 deletions
@@ -0,0 +1,191 @@
/// Změna PINu ve třech krocích (starý → nový → potvrzení).
///
/// PIN se neověřuje proti hashi, ale unwrapem DEK (Argon2id). Každý pokus
/// proto stojí ~2 s, což je zároveň jediná potřebná ochrana proti hádání.
library;
import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:go_router/go_router.dart';
import 'package:sepot/core/crypto/dek_wrap.dart';
import 'package:sepot/core/l10n/error_messages.dart';
import 'package:sepot/core/l10n/l10n.dart';
import 'package:sepot/core/storage/secure_storage.dart';
import 'package:sepot/core/theme/app_theme.dart';
import 'package:sepot/providers/storage_provider.dart';
import 'package:sepot/widgets/pin_keypad.dart';
enum _Krok { stary, novy, potvrzeni }
class ChangePinScreen extends ConsumerStatefulWidget {
const ChangePinScreen({super.key});
@override
ConsumerState<ChangePinScreen> createState() => _ChangePinScreenState();
}
class _ChangePinScreenState extends ConsumerState<ChangePinScreen> {
_Krok _krok = _Krok.stary;
String _pin = '';
String? _staryPin;
String? _novyPin;
bool _pracuje = false;
String? _chyba;
(String, String) _titulky(AppLocalizations l10n) => switch (_krok) {
_Krok.stary =>
(l10n.pinChangeCurrentTitle, l10n.pinChangeCurrentSubtitle),
_Krok.novy => (l10n.pinChangeNewTitle, l10n.pinChangeNewSubtitle),
_Krok.potvrzeni =>
(l10n.pinChangeConfirmTitle, l10n.pinChangeConfirmSubtitle),
};
void _reset(String chyba) {
setState(() {
_chyba = chyba;
_pin = '';
_staryPin = null;
_novyPin = null;
_krok = _Krok.stary;
_pracuje = false;
});
}
void _klavesa(String k) {
if (_pracuje) return;
setState(() {
_chyba = null;
if (k == 'DEL') {
if (_pin.isNotEmpty) _pin = _pin.substring(0, _pin.length - 1);
return;
}
if (_pin.length < 6) _pin += k;
});
if (_pin.length == 6) _hotovoSest();
}
Future<void> _hotovoSest() async {
final storage = ref.read(storageProvider);
switch (_krok) {
case _Krok.stary:
setState(() => _pracuje = true);
final ok = await storage.verifyPin(_pin);
if (!mounted) return;
if (!ok) {
_reset(context.l10n.pinWrong);
return;
}
setState(() {
_staryPin = _pin;
_pin = '';
_krok = _Krok.novy;
_pracuje = false;
});
case _Krok.novy:
if (_pin == _staryPin) {
setState(() {
_chyba = context.l10n.pinChangeMustDiffer;
_pin = '';
});
return;
}
setState(() {
_novyPin = _pin;
_pin = '';
_krok = _Krok.potvrzeni;
});
case _Krok.potvrzeni:
if (_pin != _novyPin) {
setState(() {
_chyba = context.l10n.pinMismatch;
_pin = '';
_novyPin = null;
_krok = _Krok.novy;
});
return;
}
setState(() => _pracuje = true);
try {
await storage.changePin(oldPin: _staryPin!, newPin: _novyPin!);
} on DecoyPinConflict catch (e) {
if (!mounted) return;
_reset(describeError(context.l10n, e));
return;
} on WrongPinException {
if (!mounted) return;
_reset(context.l10n.pinWrong);
return;
} catch (_) {
if (!mounted) return;
_reset(context.l10n.pinChangeFailed);
return;
}
if (!mounted) return;
ScaffoldMessenger.of(context).showSnackBar(
SnackBar(content: Text(context.l10n.pinChanged)),
);
context.pop();
}
}
@override
Widget build(BuildContext context) {
final (titulek, popis) = _titulky(context.l10n);
return Scaffold(
appBar: AppBar(title: Text(context.l10n.settingsChangePinTitle)),
body: SafeArea(
child: Padding(
padding: const EdgeInsets.all(32),
child: Column(
mainAxisAlignment: MainAxisAlignment.center,
children: [
Text(
titulek,
style: const TextStyle(
fontFamily: kFontSans,
fontSize: 22,
fontWeight: FontWeight.w700,
color: SepotColors.textPrimary,
),
),
const SizedBox(height: 8),
Text(
popis,
style: const TextStyle(
fontSize: 14, color: SepotColors.textSecondary),
),
const SizedBox(height: 40),
PinDots(filled: _pin.length),
if (_chyba != null) ...[
const SizedBox(height: 16),
Text(
_chyba!,
textAlign: TextAlign.center,
style:
const TextStyle(color: SepotColors.error, fontSize: 14),
),
],
if (_pracuje) ...[
const SizedBox(height: 16),
// Argon2id (64 MiB, t=3) — pár sekund je záměr, ne prodleva.
const SizedBox(
width: 20,
height: 20,
child: CircularProgressIndicator(
strokeWidth: 2, color: SepotColors.ember),
),
],
const SizedBox(height: 40),
PinKeypad(onKey: _klavesa, enabled: !_pracuje),
],
),
),
),
);
}
}
+240
View File
@@ -0,0 +1,240 @@
import 'package:flutter/material.dart';
import 'package:flutter/services.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:go_router/go_router.dart';
import 'package:local_auth/local_auth.dart';
import 'package:sepot/core/crypto/dek_wrap.dart';
import 'package:sepot/core/l10n/l10n.dart';
import 'package:sepot/core/theme/app_theme.dart';
import 'package:sepot/providers/storage_provider.dart';
import 'package:sepot/widgets/sepot_logo.dart';
/// Odemykací obrazovka s PINem (+ volitelná biometrie)
class PinLockScreen extends ConsumerStatefulWidget {
const PinLockScreen({super.key});
@override
ConsumerState<PinLockScreen> createState() => _PinLockScreenState();
}
class _PinLockScreenState extends ConsumerState<PinLockScreen> {
String _pin = '';
String? _error;
bool _isVerifying = false;
bool _biometricsAvailable = false;
@override
void initState() {
super.initState();
// Biometrie zapnutá → rovnou nabídnout systémovou výzvu
WidgetsBinding.instance.addPostFrameCallback((_) => _tryBiometrics());
}
Future<void> _tryBiometrics() async {
final unlockReason = context.l10n.pinUnlockTitle;
final storage = ref.read(storageProvider);
if (!await storage.isBiometricsEnabled()) return;
if (mounted) setState(() => _biometricsAvailable = true);
try {
final ok = await LocalAuthentication().authenticate(
localizedReason: unlockReason,
options: const AuthenticationOptions(stickyAuth: true),
);
if (!ok) return; // uživatel zrušil → zůstává PIN
await storage.unlockWithBiometrics();
if (mounted) context.go('/chats');
} catch (_) {
// biometrie nedostupná/selhala — PIN je vždy fallback
}
}
@override
Widget build(BuildContext context) {
return Scaffold(
body: SafeArea(
child: Padding(
padding: const EdgeInsets.all(32),
child: Column(
mainAxisAlignment: MainAxisAlignment.center,
children: [
const SepotLogo(size: 60, showText: false),
const SizedBox(height: 24),
Text(
context.l10n.pinUnlockTitle,
style: const TextStyle(
fontFamily: kFontSans,
fontSize: 24,
fontWeight: FontWeight.w700,
color: SepotColors.textPrimary,
),
),
const SizedBox(height: 8),
Text(
context.l10n.pinEnterPin,
style: const TextStyle(color: SepotColors.textSecondary),
),
const SizedBox(height: 48),
// PIN tečky
Row(
mainAxisAlignment: MainAxisAlignment.center,
children: List.generate(6, (i) {
return Container(
width: 16,
height: 16,
margin: const EdgeInsets.symmetric(horizontal: 8),
decoration: BoxDecoration(
shape: BoxShape.circle,
color: i < _pin.length
? SepotColors.ember
: SepotColors.border,
),
);
}),
),
if (_error != null) ...[
const SizedBox(height: 16),
Text(
_error!,
style: const TextStyle(color: SepotColors.error, fontSize: 14),
),
],
if (_isVerifying) ...[
const SizedBox(height: 16),
const SizedBox(
width: 20,
height: 20,
child: CircularProgressIndicator(
strokeWidth: 2,
color: SepotColors.ember,
),
),
],
const SizedBox(height: 48),
_buildNumpad(),
if (_biometricsAvailable) ...[
const SizedBox(height: 16),
TextButton.icon(
onPressed: _isVerifying ? null : _tryBiometrics,
icon: const Icon(Icons.fingerprint,
color: SepotColors.ember),
label: Text(
context.l10n.pinUnlockWithBiometrics,
style: const TextStyle(color: SepotColors.textSecondary),
),
),
],
],
),
),
),
);
}
Widget _buildNumpad() {
return Column(
children: [
for (final row in [
['1', '2', '3'],
['4', '5', '6'],
['7', '8', '9'],
['', '0', 'DEL'],
])
Padding(
padding: const EdgeInsets.symmetric(vertical: 8),
child: Row(
mainAxisAlignment: MainAxisAlignment.center,
children: row.map((key) {
if (key.isEmpty) return const SizedBox(width: 80, height: 64);
return _buildKey(key);
}).toList(),
),
),
],
);
}
Widget _buildKey(String key) {
final isDelete = key == 'DEL';
return Padding(
padding: const EdgeInsets.symmetric(horizontal: 12),
child: InkWell(
onTap: () => _onKeyPress(key),
borderRadius: BorderRadius.circular(32),
child: Container(
width: 64,
height: 64,
decoration: BoxDecoration(
shape: BoxShape.circle,
color: isDelete ? Colors.transparent : SepotColors.surfaceVariant,
border: isDelete ? null : Border.all(color: SepotColors.border),
),
child: Center(
child: isDelete
? const Icon(
Icons.backspace_outlined,
color: SepotColors.textSecondary,
size: 24,
)
: Text(
key,
style: const TextStyle(
fontFamily: kFontSans,
fontSize: 24,
fontWeight: FontWeight.w500,
color: SepotColors.textPrimary,
),
),
),
),
),
);
}
void _onKeyPress(String key) {
if (_isVerifying) return;
HapticFeedback.lightImpact();
setState(() {
_error = null;
if (key == 'DEL') {
if (_pin.isNotEmpty) {
_pin = _pin.substring(0, _pin.length - 1);
}
} else if (_pin.length < 6) {
_pin += key;
if (_pin.length == 6) {
_verifyPin();
}
}
});
}
Future<void> _verifyPin() async {
setState(() => _isVerifying = true);
try {
// „Ověření" PINu = Argon2id unwrap DEK + otevření SQLCipher DB.
// Špatný PIN = GCM tag nesedí = DB zůstává nečitelná.
await ref.read(storageProvider).unlockWithPin(_pin);
if (mounted) context.go('/chats');
} on WrongPinException {
setState(() {
_error = context.l10n.pinWrong2;
_pin = '';
_isVerifying = false;
});
HapticFeedback.heavyImpact();
} on StateError {
// Wrapped DEK neexistuje — nekonzistentní stav, zpět na onboarding
if (mounted) context.go('/onboarding');
} catch (e) {
setState(() {
_error = context.l10n.pinUnlockError;
_pin = '';
_isVerifying = false;
});
}
}
}
+253
View File
@@ -0,0 +1,253 @@
import 'package:flutter/material.dart';
import 'package:flutter/services.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:go_router/go_router.dart';
import 'package:sepot/core/l10n/l10n.dart';
import 'package:sepot/core/theme/app_theme.dart';
import 'package:sepot/providers/storage_provider.dart';
/// Nastavení PINu (6 číslic)
class PinSetupScreen extends ConsumerStatefulWidget {
const PinSetupScreen({super.key});
@override
ConsumerState<PinSetupScreen> createState() => _PinSetupScreenState();
}
class _PinSetupScreenState extends ConsumerState<PinSetupScreen> {
String _pin = '';
String? _firstPin;
bool _isConfirming = false;
bool _isSaving = false;
String? _error;
@override
Widget build(BuildContext context) {
return Scaffold(
body: SafeArea(
child: Padding(
padding: const EdgeInsets.all(32),
child: Column(
mainAxisAlignment: MainAxisAlignment.center,
children: [
Container(
width: 64,
height: 64,
decoration: BoxDecoration(
shape: BoxShape.circle,
color: SepotColors.ember.withValues(alpha: 0.1),
),
child: const Icon(
Icons.pin_rounded,
size: 32,
color: SepotColors.ember,
),
),
const SizedBox(height: 24),
Text(
_isConfirming
? context.l10n.pinConfirmTitle
: context.l10n.pinSetupTitle,
style: const TextStyle(
fontFamily: kFontSans,
fontSize: 24,
fontWeight: FontWeight.w700,
color: SepotColors.textPrimary,
),
),
const SizedBox(height: 8),
Text(
_isConfirming
? context.l10n.pinConfirmSubtitle
: context.l10n.pinSetupSubtitle,
style: const TextStyle(
fontSize: 14,
color: SepotColors.textSecondary,
),
),
const SizedBox(height: 48),
// PIN tečky
Row(
mainAxisAlignment: MainAxisAlignment.center,
children: List.generate(6, (i) {
return Container(
width: 16,
height: 16,
margin: const EdgeInsets.symmetric(horizontal: 8),
decoration: BoxDecoration(
shape: BoxShape.circle,
color: i < _pin.length
? SepotColors.ember
: SepotColors.border,
border: Border.all(
color: i < _pin.length
? SepotColors.ember
: SepotColors.border,
width: 2,
),
),
);
}),
),
if (_error != null) ...[
const SizedBox(height: 16),
Text(
_error!,
style: const TextStyle(
color: SepotColors.error,
fontSize: 14,
),
),
],
if (_isSaving) ...[
const SizedBox(height: 16),
// Argon2id wrap DEK běží (~sekundy, memory-hard záměrně)
const SizedBox(
width: 20,
height: 20,
child: CircularProgressIndicator(
strokeWidth: 2,
color: SepotColors.ember,
),
),
],
const SizedBox(height: 48),
// Numerická klávesnice
_buildNumpad(),
],
),
),
),
);
}
Widget _buildNumpad() {
return Column(
children: [
for (final row in [
['1', '2', '3'],
['4', '5', '6'],
['7', '8', '9'],
['', '0', 'DEL'],
])
Padding(
padding: const EdgeInsets.symmetric(vertical: 8),
child: Row(
mainAxisAlignment: MainAxisAlignment.center,
children: row.map((key) {
if (key.isEmpty) {
return const SizedBox(width: 80, height: 64);
}
return _buildKey(key);
}).toList(),
),
),
],
);
}
Widget _buildKey(String key) {
final isDelete = key == 'DEL';
return Padding(
padding: const EdgeInsets.symmetric(horizontal: 12),
child: InkWell(
onTap: () => _onKeyPress(key),
borderRadius: BorderRadius.circular(32),
child: Container(
width: 64,
height: 64,
decoration: BoxDecoration(
shape: BoxShape.circle,
color: isDelete
? Colors.transparent
: SepotColors.surfaceVariant,
border: isDelete
? null
: Border.all(color: SepotColors.border),
),
child: Center(
child: isDelete
? const Icon(
Icons.backspace_outlined,
color: SepotColors.textSecondary,
size: 24,
)
: Text(
key,
style: const TextStyle(
fontFamily: kFontSans,
fontSize: 24,
fontWeight: FontWeight.w500,
color: SepotColors.textPrimary,
),
),
),
),
),
);
}
void _onKeyPress(String key) {
if (_isSaving) return;
HapticFeedback.lightImpact();
setState(() {
_error = null;
if (key == 'DEL') {
if (_pin.isNotEmpty) {
_pin = _pin.substring(0, _pin.length - 1);
}
} else if (_pin.length < 6) {
_pin += key;
if (_pin.length == 6) {
_onPinComplete();
}
}
});
}
Future<void> _onPinComplete() async {
if (_firstPin == null) {
// První zadání PINu
setState(() {
_firstPin = _pin;
_pin = '';
_isConfirming = true;
});
} else {
// Potvrzení PINu
if (_pin == _firstPin) {
// PINy se shodují — zabal DEK za Argon2id(PIN); od téhle chvíle
// je PIN klíčem k databázi, ne vizuálním zámkem
setState(() => _isSaving = true);
try {
await ref.read(storageProvider).enablePin(_pin);
} catch (e) {
setState(() {
_error = context.l10n.pinSetupFailed;
_pin = '';
_firstPin = null;
_isConfirming = false;
_isSaving = false;
});
return;
}
if (mounted) {
context.go('/chats');
}
} else {
// PINy se neshodují
setState(() {
_error = context.l10n.pinMismatchRetry;
_pin = '';
_firstPin = null;
_isConfirming = false;
});
}
}
}
}