Gate connected-link trust on a secure session; deny forged direct announces the connected shortcut

Residual gap after the rotation-heal containment (#1401): "verified
direct" announces prove the signature but not directness — TTL is
unsigned — so a malicious connected peer can replay a victim's fresh
announce with its TTL restored. When the victim has no live link, the
replayer's link rebinds to the victim's ID and reads as "connected",
and MessageRouter's connected fast-path then trusts it outright: every
DM stalls on a Noise handshake the replayer can never complete and is
silently lost while showing "sent".

Router-level trust gate (no wire change):
- Transport gains canDeliverSecurely(to:) — BLE answers with an
  established Noise session; Nostr keeps its prompt-delivery predicate;
  the protocol default forwards to canDeliverPromptly for transports
  without a forgeable link layer.
- MessageRouter.sendPrivate only trusts a connected link outright when
  it can deliver securely; otherwise it still sends (kicking the
  handshake on a genuine link) but retains a copy and hands a sealed
  copy to couriers, like the reachable path. flushOutbox gets the same
  gate so a flush over an insecure link resends instead of dropping the
  retained copy.

Presence hardening (defense in depth): a "direct" announce arriving on
a link already bound to a different peer no longer shortcuts the
claimed peer into "connected" — only real link state does. Genuine
first-contact and direct announces are unaffected; only the ambiguous
heal path loses the forgeable shortcut.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bitchatTests/BLEServiceCoreTests.swift

@@ -253,6 +253,57 @@ struct BLEServiceCoreTests {
         #expect(ble.currentPeerSnapshots().map(\.peerID).contains(attackerPeerID))
     }
 
+    @Test
+    func replayedDirectAnnounceForAbsentPeerDoesNotForgeConnectivity() async throws {
+        // Residual heal-path gap: the victim has NO live link, so the
+        // identity-owns-a-link containment cannot refuse the rebind. The
+        // replay may steal the link binding, but it must not mark the absent
+        // victim connected (TTL — the directness signal — is unsigned), and
+        // it can never produce a deliverable secure session.
+        let ble = makeService()
+        let attackerPeerID = PeerID(str: "1122334455667788")
+        let attackerLink = "central-attacker-absent-victim"
+        ble._test_seedConnectedPeer(attackerPeerID, nickname: "attacker")
+        ble._test_bindCentral(attackerLink, to: attackerPeerID)
+
+        // The absent victim's fresh signed announce, replayed on the
+        // attacker's bound link with its direct TTL restored.
+        let victimSigner = NoiseEncryptionService(keychain: MockKeychain())
+        let announcement = AnnouncementPacket(
+            nickname: "victim",
+            noisePublicKey: victimSigner.getStaticPublicKeyData(),
+            signingPublicKey: victimSigner.getSigningPublicKeyData(),
+            directNeighbors: nil
+        )
+        let payload = try #require(announcement.encode(), "Failed to encode announcement")
+        let victimPeerID = PeerID(publicKey: announcement.noisePublicKey)
+        let unsigned = BitchatPacket(
+            type: MessageType.announce.rawValue,
+            senderID: Data(hexString: victimPeerID.id) ?? Data(),
+            recipientID: nil,
+            timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
+            payload: payload,
+            signature: nil,
+            ttl: 7
+        )
+        let packet = try #require(victimSigner.signPacket(unsigned), "Failed to sign announce packet")
+
+        #expect(ble._test_recordIngressIfNew(packet: packet, linkID: attackerLink))
+        ble._test_handlePacket(packet, fromPeerID: victimPeerID, preseedPeer: false)
+
+        // The victim becomes known (verified announce) …
+        let known = await TestHelpers.waitUntil(
+            { ble.currentPeerSnapshots().map(\.peerID).contains(victimPeerID) },
+            timeout: TestConstants.longTimeout
+        )
+        #expect(known)
+        // … but the forged direct TTL must not mark it connected, and the
+        // link can never deliver securely, so MessageRouter falls through to
+        // retain + courier instead of trusting the stolen link outright.
+        #expect(!ble.isPeerConnected(victimPeerID))
+        #expect(!ble.canDeliverSecurely(to: victimPeerID))
+    }
+
     @Test
     func ingressRejectsSelfLoopbackBeforeSpoofChecks() async throws {
         let ble = makeService()

bitchatTests/Mocks/MockTransport.swift

@@ -50,6 +50,10 @@ final class MockTransport: Transport {
 
     var connectedPeers: Set<PeerID> = []
     var reachablePeers: Set<PeerID> = []
+    /// Peers with an established secure session. `nil` mirrors the protocol
+    /// default (prompt delivery), so connected peers stay "secure" for tests
+    /// that never care about the distinction.
+    var securePeers: Set<PeerID>?
     var peerNicknames: [PeerID: String] = [:]
     var peerFingerprints: [PeerID: String] = [:]
     var peerNoiseStates: [PeerID: LazyHandshakeState] = [:]
@@ -87,6 +91,10 @@ final class MockTransport: Transport {
         reachablePeers.contains(peerID) || connectedPeers.contains(peerID)
     }
 
+    func canDeliverSecurely(to peerID: PeerID) -> Bool {
+        securePeers?.contains(peerID) ?? canDeliverPromptly(to: peerID)
+    }
+
     func peerNickname(peerID: PeerID) -> String? {
         peerNicknames[peerID]
     }

bitchatTests/ProtocolContractTests.swift

@@ -103,6 +103,9 @@ struct ProtocolContractTests {
         #expect(probe.sentMessages.count == 1)
         #expect(probe.sentMessages.first?.content == "hello")
         #expect(probe.acceptPendingFile(id: "pending") == nil)
+        // Secure delivery defaults to prompt delivery (itself defaulting to
+        // reachability) for transports without a forgeable link layer.
+        #expect(probe.canDeliverSecurely(to: peerID) == false)
     }
 
     @Test

bitchatTests/Services/BLEAnnounceHandlerTests.swift

@@ -8,6 +8,7 @@ struct BLEAnnounceHandlerTests {
         var existingNoisePublicKey: Data?
         var signatureValid = true
         var linkState: (hasPeripheral: Bool, hasCentral: Bool) = (false, false)
+        var linkBoundToOtherPeer = false
         var upsertResult = BLEPeerAnnounceUpdate(isNewPeer: false, wasDisconnected: false, previousNickname: nil)
         var dedupSeenIDs: Set<String> = []
         var shouldEmitReconnectLogResult = true
@@ -41,6 +42,7 @@ struct BLEAnnounceHandlerTests {
                 return recorder.signatureValid
             },
             linkState: { _ in recorder.linkState },
+            linkBoundToOtherPeer: { _, _ in recorder.linkBoundToOtherPeer },
             withRegistryBarrier: { body in
                 recorder.barrierCount += 1
                 body()
@@ -334,6 +336,60 @@ struct BLEAnnounceHandlerTests {
         #expect(recorder.afterglowDelays.count == 1)
     }
 
+    /// TTL is unsigned, so a replayed announce with its TTL restored looks
+    /// "direct" — but it arrives on a link another peer already owns. That
+    /// link must not shortcut the (possibly absent) claimed peer into
+    /// "connected".
+    @Test
+    func directAnnounceOnLinkBoundToAnotherPeerDoesNotMarkConnected() throws {
+        let now = Date(timeIntervalSince1970: 1_000)
+        let noiseKey = Data(repeating: 0x88, count: 32)
+        let peerID = PeerID(publicKey: noiseKey)
+        let packet = try makeAnnouncePacket(
+            noisePublicKey: noiseKey,
+            peerID: peerID,
+            timestamp: timestamp(now),
+            signature: Data(repeating: 0xEE, count: 64)
+        )
+
+        let recorder = Recorder()
+        recorder.linkBoundToOtherPeer = true
+        recorder.upsertResult = BLEPeerAnnounceUpdate(isNewPeer: true, wasDisconnected: false, previousNickname: nil)
+        let handler = makeHandler(recorder: recorder, now: now)
+
+        let result = handler.handle(packet, from: peerID)
+
+        #expect(result?.isDirectAnnounce == true)
+        #expect(result?.isVerified == true)
+        #expect(recorder.upsertCalls.count == 1)
+        #expect(recorder.upsertCalls.first?.isConnected == false)
+    }
+
+    /// A peer with its own live link stays connected even when a copy of its
+    /// announce arrives on someone else's link.
+    @Test
+    func directAnnounceOnForeignLinkKeepsPeerWithOwnLinkConnected() throws {
+        let now = Date(timeIntervalSince1970: 1_000)
+        let noiseKey = Data(repeating: 0x99, count: 32)
+        let peerID = PeerID(publicKey: noiseKey)
+        let packet = try makeAnnouncePacket(
+            noisePublicKey: noiseKey,
+            peerID: peerID,
+            timestamp: timestamp(now),
+            signature: Data(repeating: 0xEE, count: 64)
+        )
+
+        let recorder = Recorder()
+        recorder.linkBoundToOtherPeer = true
+        recorder.linkState = (hasPeripheral: false, hasCentral: true)
+        let handler = makeHandler(recorder: recorder, now: now)
+
+        handler.handle(packet, from: peerID)
+
+        #expect(recorder.upsertCalls.count == 1)
+        #expect(recorder.upsertCalls.first?.isConnected == true)
+    }
+
     @Test
     func announceBackIsSkippedWhenAlreadyMarked() throws {
         let now = Date(timeIntervalSince1970: 1_000)

bitchatTests/Services/MessageRouterTests.swift

@@ -316,6 +316,76 @@ struct MessageRouterTests {
         #expect(couriers.contains(favorite))
     }
 
+    /// Residual gap after the rotation-heal containment: a replayed "direct"
+    /// announce (TTL is unsigned) can bind an absent victim's peer ID to the
+    /// replayer's link, leaving the victim "connected" on a link whose Noise
+    /// handshake can never complete. The connected fast-path must not trust
+    /// that outright: the send still goes out (a genuine link finishes the
+    /// handshake), but a copy is retained and a sealed copy goes to couriers
+    /// so nothing is silently lost.
+    @Test @MainActor
+    func sendPrivate_connectedWithoutSecureSessionRetainsAndDepositsWithCourier() async {
+        let victim = PeerID(str: "00000000000000aa")
+        let victimKey = Data(repeating: 0xBB, count: 32)
+        let courier = PeerID(str: "00000000000000cc")
+        let courierKey = Data(repeating: 0xCC, count: 32)
+
+        let transport = MockTransport()
+        transport.connectedPeers.insert(victim)
+        transport.connectedPeers.insert(courier)
+        transport.securePeers = [] // no established Noise session with anyone
+        transport.updatePeerSnapshots([Self.snapshot(courier, key: courierKey, verified: true)])
+
+        let router = MessageRouter(
+            transports: [transport],
+            courierDirectory: Self.directory(recipient: victim, recipientKey: victimKey)
+        )
+        router.sendPrivate("Hello", to: victim, recipientNickname: "Peer", messageID: "cs1")
+
+        // The send is still attempted (it kicks the handshake on a genuine
+        // link) but not trusted outright: a courier gets a sealed copy now …
+        #expect(transport.sentPrivateMessages.map(\.messageID) == ["cs1"])
+        #expect(transport.sentCourierMessages.count == 1)
+        #expect(transport.sentCourierMessages.first?.messageID == "cs1")
+        #expect(transport.sentCourierMessages.first?.recipientNoiseKey == victimKey)
+        #expect(transport.sentCourierMessages.first?.couriers == [courier])
+
+        // … and the retained copy keeps flushing until a delivery ack — a
+        // flush over the insecure link must resend without dropping it.
+        router.flushOutbox(for: victim)
+        router.flushOutbox(for: victim)
+        #expect(transport.sentPrivateMessages.count == 3)
+        router.markDelivered("cs1")
+        router.flushOutbox(for: victim)
+        #expect(transport.sentPrivateMessages.count == 3)
+    }
+
+    /// With an established secure session the connected fast-path stays
+    /// exactly as before: trusted outright, no retained copy, no courier.
+    @Test @MainActor
+    func sendPrivate_connectedWithSecureSessionIsTrustedOutright() async {
+        let peerID = PeerID(str: "00000000000000ab")
+        let peerKey = Data(repeating: 0xAB, count: 32)
+        let courier = PeerID(str: "00000000000000cc")
+
+        let transport = MockTransport()
+        transport.connectedPeers.insert(peerID)
+        transport.connectedPeers.insert(courier)
+        transport.securePeers = [peerID]
+        transport.updatePeerSnapshots([Self.snapshot(courier, key: Data(repeating: 0xCC, count: 32), verified: true)])
+
+        let router = MessageRouter(
+            transports: [transport],
+            courierDirectory: Self.directory(recipient: peerID, recipientKey: peerKey)
+        )
+        router.sendPrivate("Hello", to: peerID, recipientNickname: "Peer", messageID: "cs2")
+
+        #expect(transport.sentPrivateMessages.map(\.messageID) == ["cs2"])
+        #expect(transport.sentCourierMessages.isEmpty)
+        router.flushOutbox(for: peerID)
+        #expect(transport.sentPrivateMessages.count == 1)
+    }
+
     @Test @MainActor
     func courierBecameAvailable_retriesDepositOnceWithoutDoubleBurn() async {
         let recipient = PeerID(str: "00000000000000aa")