feat: strengthen device authentication, linking, session security, an…

apps/backend/src/db/schema.ts

@@ -19,6 +19,30 @@ export const wallets = pgTable('wallets', {
   createdAt: timestamp('created_at').notNull().defaultNow(),
 });
 
+export const devices = pgTable('devices', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  userId: uuid('user_id')
+    .notNull()
+    .references(() => users.id, { onDelete: 'cascade' }),
+  deviceId: text('device_id').notNull(),
+  deviceName: text('device_name').notNull(),
+  platform: text('platform').notNull(),
+  identityPublicKey: text('identity_public_key').notNull(),
+  registrationId: text('registration_id'),
+  isRevoked: boolean('is_revoked').notNull().default(false),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+  updatedAt: timestamp('updated_at').notNull().defaultNow(),
+});
+
+export const devicePrekeys = pgTable('device_prekeys', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  deviceId: uuid('device_id')
+    .notNull()
+    .references(() => devices.id, { onDelete: 'cascade' }),
+  prekey: text('prekey').notNull(),
+  createdAt: timestamp('created_at').notNull().defaultNow(),
+});
+
 // ─── Conversations ────────────────────────────────────────────────────────────
 
 export const conversationTypeEnum = pgEnum('conversation_type', ['dm', 'group']);
@@ -137,6 +161,15 @@ export const tokenTransfersRelations = relations(tokenTransfers, ({ one }) => ({
   }),
 }));
 
+export const devicesRelations = relations(devices, ({ one, many }) => ({
+  user: one(users, { fields: [devices.userId], references: [users.id] }),
+  prekeys: many(devicePrekeys),
+}));
+
+export const devicePrekeysRelations = relations(devicePrekeys, ({ one }) => ({
+  device: one(devices, { fields: [devicePrekeys.deviceId], references: [devices.id] }),
+}));
+
 // ─── Types ────────────────────────────────────────────────────────────────────
 
 export type User = typeof users.$inferSelect;
@@ -150,3 +183,7 @@ export type Message = typeof messages.$inferSelect;
 export type NewMessage = typeof messages.$inferInsert;
 export type TokenTransfer = typeof tokenTransfers.$inferSelect;
 export type NewTokenTransfer = typeof tokenTransfers.$inferInsert;
+export type Device = typeof devices.$inferSelect;
+export type NewDevice = typeof devices.$inferInsert;
+export type DevicePrekey = typeof devicePrekeys.$inferSelect;
+export type NewDevicePrekey = typeof devicePrekeys.$inferInsert;

apps/backend/src/lib/jwt.ts

@@ -11,6 +11,7 @@ const JWT_SECRET: string = SECRET;
 export interface JwtPayload {
   userId: string;
   walletAddress: string;
+  deviceId?: string;
 }
 
 export function signToken(payload: JwtPayload): string {

apps/backend/src/schemas/auth.schemas.ts

@@ -4,11 +4,21 @@ export const ChallengeSchema = z.object({
   walletAddress: z.string().min(1, 'walletAddress is required'),
 });
 
+export const DeviceSchema = z.object({
+  deviceId: z.string().min(1, 'deviceId is required'),
+  deviceName: z.string().min(1, 'deviceName is required'),
+  platform: z.string().min(1, 'platform is required'),
+  identityPublicKey: z.string().min(1, 'identityPublicKey is required'),
+  registrationId: z.string().optional(),
+});
+
 export const VerifySchema = z.object({
   walletAddress: z.string().min(1, 'walletAddress is required'),
   signature: z.string().min(1, 'signature is required'),
   nonce: z.string().min(1, 'nonce is required'),
+  device: DeviceSchema.optional(),
 });
 
 export type ChallengeBody = z.infer<typeof ChallengeSchema>;
+export type DeviceBody = z.infer<typeof DeviceSchema>;
 export type VerifyBody = z.infer<typeof VerifySchema>;