fix(e2ee): stop revoked verifications from resurfacing on sync (#417)

## Summary

Cross-device verification sync could let a revoked verification come
back. `publishVerificationsToServer` skipped publishing when the map was
empty (leaving a stale node on the server), and the merge was an
additive union — so a removal on one device was re-added from another
device's stale copy, or replayed by the server from an older signed
snapshot.

This replaces the union merge with a **versioned, last-writer-wins
snapshot**:

- Every publish carries a monotonic `version`, and the empty map is now
always published, so revoking the last verification overwrites the
server node instead of leaving the old one.
- A fetched snapshot is applied only when its `version` is strictly
newer than the highest already applied (persisted locally), then
*replaces* local state — additions, fingerprint changes, and removals
all converge across devices.
- The monotonic gate also rejects a server replaying an older but
genuinely signed snapshot, closing the trust-rollback path (a signature
proves authorship, not freshness).

The merge decision now lives in a pure `planVerificationUpdate`; the
plugin applies it (set + clear) under the existing remote-sync guard.
Legacy (`v1`) snapshots decode to version `0` and are still picked up
once.

Author: mremond

apps/fluux/src/e2ee/OpenPGPPluginBase.ts

@@ -85,8 +85,10 @@ import {
 import {
   VERIFICATIONS_NODE,
   fetchVerificationsFromServer,
-  mergeVerifications,
+  loadAppliedVerificationsVersion,
+  planVerificationUpdate,
   publishVerificationsToServer,
+  saveAppliedVerificationsVersion,
 } from './verificationSync'
 import {
   clearKeyChangeAlert,
@@ -1007,11 +1009,11 @@ export abstract class OpenPGPPluginBase implements E2EEPlugin {
       )
       if (!remote) return
       const local = useVerifiedPeerKeysStore.getState().verifiedFingerprintByJid
-      const { hasNewEntries, merged } = mergeVerifications(remote, local)
-      if (!hasNewEntries) return
-      for (const [jid, fp] of Object.entries(merged)) {
-        if (!local[jid]) setPeerVerified(jid, fp)
-      }
+      const plan = planVerificationUpdate(remote, local, loadAppliedVerificationsVersion())
+      if (!plan.apply) return
+      for (const { jid, fingerprint } of plan.toSet) setPeerVerified(jid, fingerprint)
+      for (const jid of plan.toClear) clearPeerVerified(jid)
+      saveAppliedVerificationsVersion(plan.version)
     } catch {
       // Non-blocking — local store is always the source of truth.
     } finally {
@@ -1028,13 +1030,19 @@ export abstract class OpenPGPPluginBase implements E2EEPlugin {
       if (!this.ownBundle || !this.ctx) return
       const ctx = this.ctx
       const ownPublicArmored = this.ownBundle.publicArmored
+      // Reserve the next version above the highest we've applied/published.
+      // Real versions start at 1; 0 is reserved for legacy (v1) snapshots.
+      const nextVersion = Math.max(loadAppliedVerificationsVersion(), 0) + 1
       void publishVerificationsToServer(
         ctx,
         (plaintext, recipientKey) =>
           this.encryptToRecipient(ctx.account.jid, recipientKey, plaintext),
         ownPublicArmored,
         verifications,
-      ).catch(() => {})
+        nextVersion,
+      )
+        .then(() => saveAppliedVerificationsVersion(nextVersion))
+        .catch(() => {})
     }, 500)
   }
 

apps/fluux/src/e2ee/SequoiaPgpPlugin.test.ts

@@ -3416,9 +3416,13 @@ describe('SequoiaPgpPlugin', () => {
     function buildVerificationsPepItem(
       ownFp: string,
       verifications: Record<string, string>,
+      version?: number,
       signerFp: string = ownFp,
     ): PEPItem {
-      const json = JSON.stringify({ v: 1, ts: 1000, verifications })
+      const json =
+        version === undefined
+          ? JSON.stringify({ v: 1, ts: 1000, verifications })
+          : JSON.stringify({ v: 2, ts: 1000, version, verifications })
       const encoded = btoa(unescape(encodeURIComponent(json)))
       const armored = `OPENPGP-STUB:${ownFp}:${signerFp}:${encoded}`
       const b64Armored = btoa(unescape(encodeURIComponent(armored)))
@@ -3432,6 +3436,23 @@ describe('SequoiaPgpPlugin', () => {
       }
     }
 
+    // Reverse the plugin's publish encoding: data child holds
+    // base64(makeOpenPgpArmor('OPENPGP-STUB:<recipient>:<sender>:<base64-json>')).
+    function decodePublishedVerifications(item: PEPItem): {
+      version?: number
+      verifications: Record<string, string>
+    } {
+      const dataChild = item.payload.children.find(
+        (c): c is XMLElementData => typeof c !== 'string' && c.name === 'data',
+      )
+      const dataText = dataChild?.children[0]
+      if (typeof dataText !== 'string') throw new Error('no data child in published item')
+      const armored = decodeURIComponent(escape(atob(dataText)))
+      const stub = readOpenPgpArmorPayloadForTest(armored)
+      const payloadB64 = stub.slice('OPENPGP-STUB:'.length).split(':')[2]
+      return JSON.parse(decodeURIComponent(escape(atob(payloadB64))))
+    }
+
     it('seeds the local verified-peers store from the server node on init', async () => {
       const { ctx, peerPublish } = makeContext('me@example.com')
       // Pre-seed so we know the fingerprint before init.
@@ -3473,7 +3494,7 @@ describe('SequoiaPgpPlugin', () => {
       peerPublish(
         'me@example.com',
         VERIFICATIONS_NODE,
-        buildVerificationsPepItem(fp, { 'mallory@example.com': 'MALLORY_FP' }, 'ATTACKER_FP'),
+        buildVerificationsPepItem(fp, { 'mallory@example.com': 'MALLORY_FP' }, undefined, 'ATTACKER_FP'),
       )
       await plugin.init(ctx)
       await new Promise((r) => setTimeout(r, 0))
@@ -3591,5 +3612,129 @@ describe('SequoiaPgpPlugin', () => {
         vi.useRealTimers()
       }
     })
+
+    it('publishes an empty snapshot when the last verification is revoked, and it does not resurrect on resync', async () => {
+      vi.useFakeTimers()
+      try {
+        let verificationsCb: ((item: PEPItem) => void) | null = null
+        const { ctx, published } = makeContext('me@example.com')
+        ctx.xmpp.subscribePEP = (_jid, node, cb) => {
+          if (node === VERIFICATIONS_NODE) verificationsCb = cb
+          return { unsubscribe: () => {} }
+        }
+        const fp = 'FP_REVOKE_TEST'
+        fake.accounts.set('me@example.com', {
+          fingerprint: fp,
+          publicArmored: makeOpenPgpArmor(
+            'PGP PUBLIC KEY BLOCK',
+            `Fingerprint: ${fp}\nUID: xmpp:me@example.com\nKind: public\nRotation: 0\n`,
+          ),
+          keychainBacked: true,
+        })
+        await plugin.init(ctx)
+
+        const store = await import('@/stores/verifiedPeerKeysStore')
+        store.setPeerVerified('alice@example.com', 'ALICE_FP')
+        await vi.advanceTimersByTimeAsync(600)
+        store.clearPeerVerified('alice@example.com')
+        await vi.advanceTimersByTimeAsync(600)
+
+        // The empty map is published (not skipped), overwriting the server node.
+        const verNodes = published.filter((p) => p.node === VERIFICATIONS_NODE)
+        const lastPayload = decodePublishedVerifications(verNodes[verNodes.length - 1].item)
+        expect(lastPayload.verifications).toEqual({})
+
+        // The server now serves that empty snapshot; a resync must not resurrect alice.
+        verificationsCb!({ id: 'current', payload: { name: '', attrs: {}, children: [] } })
+        for (let i = 0; i < 10; i++) await Promise.resolve()
+        await vi.advanceTimersByTimeAsync(600)
+        expect(store.isPeerVerified('alice@example.com', 'ALICE_FP')).toBe(false)
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('ignores a replayed older snapshot from the server (no trust rollback)', async () => {
+      let verificationsCb: ((item: PEPItem) => void) | null = null
+      let currentItem: PEPItem | null = null
+      const { ctx } = makeContext('me@example.com')
+      ctx.xmpp.subscribePEP = (_jid, node, cb) => {
+        if (node === VERIFICATIONS_NODE) verificationsCb = cb
+        return { unsubscribe: () => {} }
+      }
+      ctx.xmpp.queryPEP = async (_jid, node) =>
+        node === VERIFICATIONS_NODE && currentItem ? [currentItem] : []
+      const fp = 'FP_REPLAY_TEST'
+      fake.accounts.set('me@example.com', {
+        fingerprint: fp,
+        publicArmored: makeOpenPgpArmor(
+          'PGP PUBLIC KEY BLOCK',
+          `Fingerprint: ${fp}\nUID: xmpp:me@example.com\nKind: public\nRotation: 0\n`,
+        ),
+        keychainBacked: true,
+      })
+      await plugin.init(ctx)
+      const store = await import('@/stores/verifiedPeerKeysStore')
+
+      // A newer snapshot (version 5): bob is verified, alice already revoked elsewhere.
+      currentItem = buildVerificationsPepItem(fp, { 'bob@example.com': 'BOB_FP' }, 5)
+      verificationsCb!({ id: 'current', payload: { name: '', attrs: {}, children: [] } })
+      await new Promise((r) => setTimeout(r, 0))
+      expect(store.isPeerVerified('bob@example.com', 'BOB_FP')).toBe(true)
+      expect(store.isPeerVerified('alice@example.com', 'ALICE_FP')).toBe(false)
+
+      // The server replays an OLDER snapshot (version 1) that still trusts alice.
+      currentItem = buildVerificationsPepItem(
+        fp,
+        { 'alice@example.com': 'ALICE_FP', 'bob@example.com': 'BOB_FP' },
+        1,
+      )
+      verificationsCb!({ id: 'current', payload: { name: '', attrs: {}, children: [] } })
+      await new Promise((r) => setTimeout(r, 0))
+
+      // Rollback rejected: alice is NOT resurrected, bob is untouched.
+      expect(store.isPeerVerified('alice@example.com', 'ALICE_FP')).toBe(false)
+      expect(store.isPeerVerified('bob@example.com', 'BOB_FP')).toBe(true)
+    })
+
+    it('clears a locally-verified peer that a newer remote snapshot drops', async () => {
+      let verificationsCb: ((item: PEPItem) => void) | null = null
+      let currentItem: PEPItem | null = null
+      const { ctx } = makeContext('me@example.com')
+      ctx.xmpp.subscribePEP = (_jid, node, cb) => {
+        if (node === VERIFICATIONS_NODE) verificationsCb = cb
+        return { unsubscribe: () => {} }
+      }
+      ctx.xmpp.queryPEP = async (_jid, node) =>
+        node === VERIFICATIONS_NODE && currentItem ? [currentItem] : []
+      const fp = 'FP_DROP_TEST'
+      fake.accounts.set('me@example.com', {
+        fingerprint: fp,
+        publicArmored: makeOpenPgpArmor(
+          'PGP PUBLIC KEY BLOCK',
+          `Fingerprint: ${fp}\nUID: xmpp:me@example.com\nKind: public\nRotation: 0\n`,
+        ),
+        keychainBacked: true,
+      })
+
+      const store = await import('@/stores/verifiedPeerKeysStore')
+      // Seed local state BEFORE init so the store subscription (attached during
+      // init) does not schedule a publish from these writes.
+      store.useVerifiedPeerKeysStore.setState({
+        verifiedFingerprintByJid: {
+          'alice@example.com': 'ALICE_FP',
+          'bob@example.com': 'BOB_FP',
+        },
+      })
+      await plugin.init(ctx)
+
+      // Another device published a newer snapshot (version 5) that dropped alice.
+      currentItem = buildVerificationsPepItem(fp, { 'bob@example.com': 'BOB_FP' }, 5)
+      verificationsCb!({ id: 'current', payload: { name: '', attrs: {}, children: [] } })
+      await new Promise((r) => setTimeout(r, 0))
+
+      expect(store.isPeerVerified('alice@example.com', 'ALICE_FP')).toBe(false)
+      expect(store.isPeerVerified('bob@example.com', 'BOB_FP')).toBe(true)
+    })
   })
 })