add vote uniqueness, public key caching, relative poll timeframe, auth/rate limiting, modern UI styling, and error handling

.gitignore

@@ -1 +1,2 @@
-node_modules/
+node_modules
+.nuxt

README.md

@@ -1,28 +1,135 @@
-# P2P Poll App
+# 🗳️ P2P Verified Polling App
 
-## Install npm packages
-```
-npm init -y
+A decentralized, real-time polling application built with **Nuxt 3**, **Yjs**, and **WebRTC**. This app allows users to create and participate in polls where every vote is cryptographically signed and verified peer-to-peer, ensuring data integrity without a central authority "owning" the results.
+
+---
+
+## 🌟 Key Features
+
+* **Serverless Real-time Sync:** Uses **Yjs** (CRDTs) and **WebRTC** to sync poll data directly between browsers. No database is required for live updates.
+* **Persistence with Nitro:** While the logic is P2P, the **Nuxt/Nitro** backend provides a "Snapshot" service to ensure polls persist even after all peers go offline.
+* **Cryptographic Integrity:** Every vote is signed using **RSA-PSS (Web Crypto API)**. Each user has a unique private key (stored locally via `.pem` files) to ensure votes cannot be forged or tampered with.
+* **Chained Verification:** Implements a "History-Signing" logic where each new vote signs the entire preceding state of the poll, creating a verifiable chain of trust.
+* **Privacy First:** Users identify via UUIDs and Public/Private key pairs rather than traditional accounts.
+* **Vote Uniqueness:** Enforces one vote per option per user to prevent duplicate voting.
+* **Public Key Caching:** Snapshot API includes all user public keys for efficient client-side verification.
+* **Relative Poll Timeframe:** Uses `createdAt + duration` model instead of absolute timestamps to avoid clock synchronization issues.
+* **Secure User Creation:** User creation endpoint protected with API key authentication and rate limiting.
+* **Modern UI:** Dark theme with glassmorphism effects for a contemporary user experience.
+* **Error Handling:** User-friendly alerts for authentication errors and missing public keys.
+
+---
+
+## ⚙️ How It Works
+
+### 1. Identity Creation
+When a new user is created, the system generates a unique **UUID (User ID)** and an **RSA Key Pair**. The user is prompted to save their **Private Key** as a `.pem` file, named after their User ID (e.g., `550e8400-e29b.pem`). This file acts as their "Passport"—it is never uploaded to the server and must be kept secure by the user.
+
+### 2. Authentication
+Upon returning to the app, users load their local `.pem` file. The application extracts the Private Key for signing and the UUID for identification. No passwords or central servers are involved in this local-first login process.
+
+### 3. Joining a Poll
+When a user joins a poll, the app fetches the latest binary snapshot from the server to populate a local **Y.Doc**. This ensures the user sees the current state immediately, even before connecting to other peers.
+
+### 4. The P2P Mesh
+The app establishes connections to other active voters via a WebRTC signaling server. Any changes made to the poll (adding options or voting) are broadcasted instantly to all peers using Conflict-free Replicated Data Types (CRDTs) to prevent sync conflicts.
+
+### 5. Casting a Signed Vote
+To ensure security, the voting process follows a strict cryptographic chain:
+* The app captures the current list of votes.
+* It appends the new vote data (User ID + Timestamp).
+* It signs the **entire array** (the previous history + the new vote) using the user's RSA private key.
+* The signed update is merged into the shared Yjs Map and broadcasted.
+
+### 6. Distributed Verification
+Whenever a peer receives a new update, they fetch the voter's **Public Key** from the API. They then verify that the signature matches the current state of the poll history. If a signature is invalid or the history has been tampered with, the vote is rejected by the peer's local state.
+
+---
+
+## 🛠️ Tech Stack
+
+* **Framework:** [Nuxt 3](https://nuxt.com/) (Vue 3 + TypeScript)
+* **Conflict-Free Replicated Data Types (CRDT):** [Yjs](https://yjs.dev/)
+* **P2P Transport:** `y-webrtc`
+* **Security:** Web Crypto API (SubtleCrypto)
+* **Backend/Storage:** Nitro (Nuxt's server engine) with filesystem storage drivers
+
+# AI Disclaimer
+
+This App was developed with the assistance of AI.
+
+# Nuxt Minimal Starter
+
+Look at the [Nuxt documentation](https://nuxt.com/docs/getting-started/introduction) to learn more.
+
+## Setup
+
+Make sure to install dependencies:
+
+```bash
+# npm
 npm install
+
+# pnpm
+pnpm install
+
+# yarn
+yarn install
+
+# bun
+bun install
 ```
 
-Note: the frontend obtains the packages `yjs` and `y-websocket` dynamically.
+## Development Server
 
-## Run backend
-```
-node backend.js
+Start the development server on `http://localhost:3000`:
+
+```bash
+# npm
+npm run dev
+
+# pnpm
+pnpm dev
+
+# yarn
+yarn dev
+
+# bun
+bun run dev
 ```
 
-### Note on Yjs suggestion
-Note that the following server setup is suggested in the Yjs docs (https://docs.yjs.dev/ecosystem/connection-provider/y-websocket):
-```
-npm install y-websocket-server
-HOST=localhost PORT=1000 npx y-websocket
+## Production
+
+Build the application for production:
+
+```bash
+# npm
+npm run build
+
+# pnpm
+pnpm build
+
+# yarn
+yarn build
+
+# bun
+bun run build
 ```
 
-However, across a range of npm versions, this does not work.
-Nevertheless, the essential code from the `y-websocket-server` package is used here as provided in `utils.js`.
+Locally preview production build:
 
-## Run frontend
-Open "frontend.html" in browser.
+```bash
+# npm
+npm run preview
 
+# pnpm
+pnpm preview
+
+# yarn
+yarn preview
+
+# bun
+bun run preview
+```
+
+Check out the [deployment documentation](https://nuxt.com/docs/getting-started/deployment) for more information.

app/app.vue

@@ -0,0 +1,308 @@
+<style>
+/* Modern dark theme with glassmorphism */
+body {
+  font-family: system-ui, -apple-system, sans-serif;
+  background: linear-gradient(135deg, #1a1a2e 0%, #16213e 50%, #0f3460 100%);
+  color: #fff;
+  margin: 0;
+  min-height: 100vh;
+  display: flex;
+  justify-content: center;
+  padding: 2rem;
+}
+
+header {
+  margin-bottom: 2rem;
+  text-align: left;
+}
+
+h1 { 
+  margin: 0 0 0.5rem 0;
+  font-size: 2.5rem;
+  font-weight: bold;
+  color: #fff;
+}
+
+h2 {
+  margin: 0.5rem 0;
+  color: #fff;
+}
+
+input {
+  flex-grow: 1;
+  padding: 0.75rem;
+  border: 1px solid rgba(255, 255, 255, 0.2);
+  border-radius: 8px;
+  font-size: 1rem;
+  background: rgba(255, 255, 255, 0.1);
+  color: #fff;
+  backdrop-filter: blur(10px);
+}
+
+input::placeholder {
+  color: rgba(255, 255, 255, 0.5);
+}
+
+button,
+.button {
+  background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+  color: white;
+  border: none;
+  padding: 0.75rem 1.5rem;
+  border-radius: 8px;
+  cursor: pointer;
+  font-weight: 600;
+  transition: all 0.3s ease;
+  box-shadow: 0 4px 15px rgba(102, 126, 234, 0.4);
+}
+
+button:hover,
+.button:hover { 
+  background: linear-gradient(135deg, #764ba2 0%, #667eea 100%);
+  transform: translateY(-2px);
+  box-shadow: 0 6px 20px rgba(102, 126, 234, 0.6);
+}
+
+.status {
+  font-size: 0.9rem;
+  color: rgba(255, 255, 255, 0.7);
+}
+.status .connected { 
+  color: #10b981; 
+  font-weight: bold;
+  text-shadow: 0 0 10px rgba(16, 185, 129, 0.5);
+}
+
+.connectionFailed { 
+  color: #ff6b6b; 
+  font-weight: bold;
+  text-shadow: 0 0 10px rgba(255, 107, 107, 0.5);
+}
+
+.poll-container {
+  background: rgba(255, 255, 255, 0.1);
+  backdrop-filter: blur(20px);
+  -webkit-backdrop-filter: blur(20px);
+  padding: 2.5rem;
+  border-radius: 20px;
+  box-shadow: 0 8px 32px rgba(0, 0, 0, 0.3);
+  border: 1px solid rgba(255, 255, 255, 0.2);
+  width: 100%;
+  max-width: 600px;
+}
+
+.back-btn { 
+  margin-left: 1rem; 
+  padding: 0.5rem 1rem; 
+  font-size: 0.85rem; 
+  background: rgba(100, 116, 139, 0.8);
+  backdrop-filter: blur(10px);
+}
+
+.back-btn:hover {
+  background: rgba(100, 116, 139, 1);
+}
+
+/* Hide the actual file input */
+input[type="file"] {
+  display: none;
+}
+
+/* Add subtle animations */
+@keyframes fadeIn {
+  from { opacity: 0; transform: translateY(10px); }
+  to { opacity: 1; transform: translateY(0); }
+}
+
+.poll-container {
+  animation: fadeIn 0.5s ease-out;
+}
+
+/* Responsive design */
+@media (max-width: 640px) {
+  body {
+    padding: 1rem;
+  }
+  
+  .poll-container {
+    padding: 1.5rem;
+  }
+  
+  h1 {
+    font-size: 2rem;
+  }
+}
+</style>
+<template>
+    <div class="poll-container">
+        <header>
+            <h1 @click="activePollId = null" style="cursor:pointer">P2P Polling App 🗳️</h1>
+            <div class="status">
+                <button v-if="activePollId" @click="activePollId = null" class="back-btn">← Back To List</button>
+                <span :class="{ 'connected': isConnected }">
+                    ● {{ isConnected ? 'Synced' : 'Waiting for other Peers...' }}
+                </span>
+                <span> | Peers online: {{ connectedPeers }}</span>
+                <h2 v-if="connectionAttempFailed" class="connectionFailed">⚠ Connection to Signaling Server Failed!</h2>
+                <div v-if="user===null" style="margin-top: 10px;">
+                    <button @click="createUser">Create New User</button>
+                    Or
+                    <label title="Select Key File">
+                        <span class="button">Login</span>
+                        <input 
+                            type="file"
+                            accept=".pem"
+                            @change="loadUser"
+                        />
+                    </label>
+                    <div style="margin-top: 10px;">
+                        <label title="Register Public Key">
+                            <span class="button" style="font-size: 0.8rem; padding: 0.5rem 1rem;">Register Public Key</span>
+                            <input 
+                                type="file"
+                                accept=".pem"
+                                @change="registerPublicKey"
+                            />
+                        </label>
+                    </div>
+                </div>
+            </div>
+        </header>
+
+        <main>
+            <PollList v-if="!activePollId" :userid="user?.userid" @select-poll="selectPoll" />
+            <Poll v-else :activePollId="activePollId" :userid="user?.userid" :poll-data="pollData" :addOption="addOption" :vote="vote"/>
+        </main>
+    </div>
+</template>
+
+<script setup lang="ts">
+    import { v4 as uuidv4 } from 'uuid';
+    import { generateUserKeyPair, exportPrivateKey, savePrivateKeyToFile, exportPublicKey, stringToCryptoKey } from '~/utils/crypto';
+    const activePollId = ref<string | null>(null);
+    const user = shallowRef<UserData | null>(null);
+
+    const { pollData, isConnected, connectionAttempFailed, connectedPeers, addOption, vote } = usePoll(activePollId,user);
+
+    const selectPoll = (id: string) => {
+        activePollId.value = id;
+    };
+
+
+    const createUser = async () => {
+        try {
+            const keypair : CryptoKeyPair = await generateUserKeyPair();
+            console.log('keypair:', keypair);
+            const uuid = uuidv4();
+            user.value = {
+                userid: uuid,
+                private_key: keypair.privateKey,
+                public_key: keypair.publicKey,
+            };
+            const prvKeyString = await exportPrivateKey(keypair.privateKey);
+            await savePrivateKeyToFile(prvKeyString,uuid+".pem")
+
+            const pubKeyString = await exportPublicKey(keypair.publicKey);
+            
+            // Save public key to server
+            await $fetch(`/api/users/${uuid}`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${process.env.ADMIN_API_KEY || 'default-admin-key-change-in-production'}`
+                },
+                body: { public_key: pubKeyString }
+            });
+
+            // Also save public key to a file for backup
+            const pubPemHeader = "-----BEGIN PUBLIC KEY-----\n";
+            const pubPemFooter = "\n-----END PUBLIC KEY-----";
+            const pubFileContent = pubPemHeader + pubKeyString + pubPemFooter;
+            const blob = new Blob([pubFileContent], { type: "text/plain" });
+            const url = URL.createObjectURL(blob);
+            const link = document.createElement("a");
+            link.href = url;
+            link.download = uuid + "_public.pem";
+            document.body.appendChild(link);
+            link.click();
+            document.body.removeChild(link);
+            URL.revokeObjectURL(url);
+            
+            console.log("User created successfully. Please save both key files.");
+        } catch (err) {
+            user.value = null
+            console.error("Failed to create new User!", err);
+        }
+    };
+    const loadUser = async (event: Event) => {
+        const target = event.target as HTMLInputElement;
+        const file = target.files?.[0];
+
+        if (file) {
+            try {
+                const content = await file.text();
+                console.log("File loaded: ");
+                if (file.name && content) {
+                    try {
+                        const uuid = file.name.replace(".pem", "").replace("_public", "");
+                        // Standardize the string for the importer
+                        const pkBase64 = content.replace(/-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----/g, "").replace(/\s+/g, "");
+
+                        const key = await stringToCryptoKey(pkBase64, "private");
+                        
+                        user.value = {
+                            userid: uuid,
+                            private_key: key,
+                            public_key: undefined,
+                        };
+                        
+                        console.log("Login successful for:", uuid);
+                    } catch (err) {
+                        console.error("Crypto Import Error:", err);
+                        alert("The file content is not a valid Private Key.");
+                    }
+                }
+            } catch (e) {
+                console.error("Failed to read file", e);
+            }
+        }
+    };
+
+    const registerPublicKey = async (event: Event) => {
+        const target = event.target as HTMLInputElement;
+        const file = target.files?.[0];
+
+        if (file) {
+            try {
+                const content = await file.text();
+                if (file.name && content) {
+                    try {
+                        const uuid = file.name.replace(".pem", "").replace("_public", "");
+                        console.log("Attempting to register public key for user:", uuid);
+                        
+                        // Standardize the string for the importer
+                        const pubKeyBase64 = content.replace(/-----BEGIN PUBLIC KEY-----|-----END PUBLIC KEY-----/g, "").replace(/\s+/g, "");
+                        console.log("Public key length:", pubKeyBase64.length);
+
+                        // Save public key to server
+                        await $fetch(`/api/users/${uuid}`, {
+                            method: 'POST',
+                            headers: {
+                                'Authorization': `Bearer ${process.env.ADMIN_API_KEY || 'default-admin-key-change-in-production'}`
+                            },
+                            body: { public_key: pubKeyBase64 }
+                        });
+                        
+                        alert(`Public key registered successfully for user: ${uuid}`);
+                    } catch (err: any) {
+                        console.error("Registration Error:", err);
+                        const errorMsg = err.data?.message || err.statusMessage || err.message || "Unknown error";
+                        alert(`Failed to register public key: ${errorMsg}`);
+                    }
+                }
+            } catch (e) {
+                console.error("Failed to read file", e);
+                alert("Failed to read file.");
+            }
+        }
+    };
+</script>

app/components/Poll.vue

@@ -0,0 +1,119 @@
+<style scoped>
+.poll-list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+
+.poll-item {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  padding: 1rem;
+  background: rgba(255, 255, 255, 0.1);
+  backdrop-filter: blur(10px);
+  border: 1px solid rgba(255, 255, 255, 0.2);
+  border-radius: 12px;
+  margin-bottom: 0.5rem;
+  transition: all 0.3s ease;
+}
+
+.poll-item:hover {
+  background: rgba(255, 255, 255, 0.15);
+  transform: translateX(5px);
+}
+
+.poll-title { 
+  font-size: 1.5rem; 
+  color: #667eea; 
+  text-transform: uppercase; 
+  letter-spacing: 1px;
+  font-weight: bold;
+  margin-bottom: 1rem;
+}
+
+.add-option-form {
+  display: flex;
+  gap: 0.5rem;
+  margin-bottom: 2rem;
+}
+
+.option-name { 
+  font-weight: 500; 
+  color: #fff;
+}
+.vote-section { display: flex; align-items: center; gap: 1rem; }
+.vote-count { font-size: 0.9rem; color: rgba(255, 255, 255, 0.8); }
+.vote-btn { 
+  padding: 0.5rem 1rem; 
+  background: linear-gradient(135deg, #10b981 0%, #059669 100%);
+  border: none;
+  border-radius: 8px;
+  color: white;
+  font-weight: 600;
+  transition: all 0.3s ease;
+  box-shadow: 0 4px 15px rgba(16, 185, 129, 0.4);
+}
+.vote-btn:hover { 
+  background: linear-gradient(135deg, #059669 0%, #10b981 100%);
+  transform: translateY(-2px);
+  box-shadow: 0 6px 20px rgba(16, 185, 129, 0.6);
+}
+
+.vote-btn:disabled,
+.vote-btn[disabled] { 
+  background: rgba(136, 136, 136, 0.5);
+  cursor: not-allowed;
+}
+.vote-btn:disabled:hover,
+.vote-btn[disabled]:hover { 
+  background: rgba(136, 136, 136, 0.7);
+  transform: none;
+}
+
+p {
+  color: rgba(255, 255, 255, 0.6);
+}
+</style>
+
+<template>
+    <div>
+        <h2 class="poll-title">Poll: {{ activePollId }}</h2>
+        <p v-if="Object.keys(pollData).length==0">Note: Add at least one Option to save the Poll.</p>
+        <form @submit.prevent="handleAddNewOption" class="add-option-form" v-if="userid">
+            <input v-model="newOption" placeholder="Enter a new poll option..." required />
+            <button type="submit">Add Option</button>
+        </form>
+
+        <ul class="poll-list">
+            <li v-for="(votes, optionName) in pollData" :key="optionName" class="poll-item">
+                <span class="option-name">{{ optionName }}</span>
+                <div class="vote-section">
+                    <span class="vote-count">{{ votes.length }} {{ votes.length === 1 ? 'vote' : 'votes' }}</span>
+                    <button @click="vote(String(optionName))" class="vote-btn" :disabled="userid==undefined || voted(votes)">+1</button>
+                </div>
+            </li>
+        </ul>
+    </div>
+</template>
+
+<script setup lang="ts">
+    import type { PollProps, SignedData, VoteData } from '@/utils/types'
+    const props = defineProps<PollProps>()
+
+    const newOption = ref('');
+    const handleAddNewOption = () => {
+        props.addOption(newOption.value);
+        newOption.value = '';
+    };
+
+
+    const voted = (votes: SignedData<VoteData>[]) => {
+        for(let vote of votes){
+            if(vote.data.userid == props.userid){
+                return true;
+            }
+        }
+        return false;
+    }
+</script>

app/components/PollList.vue

@@ -0,0 +1,75 @@
+<style scoped>
+    .poll-list { margin-top: 1rem; }
+    .empty-state { text-align: center; color: rgba(255, 255, 255, 0.6); font-style: italic; }
+    .create-poll { display: flex; gap: 0.5rem; margin-bottom: 1.5rem; }
+    .poll-links { list-style: none; padding: 0; }
+    .poll-link-btn {
+        width: 100%;
+        text-align: left;
+        background: rgba(255, 255, 255, 0.1);
+        color: #fff;
+        margin-bottom: 0.5rem;
+        display: flex;
+        justify-content: space-between;
+        backdrop-filter: blur(10px);
+        border: 1px solid rgba(255, 255, 255, 0.2);
+        transition: all 0.3s ease;
+    }
+    .poll-link-btn:hover { 
+        background: rgba(255, 255, 255, 0.2);
+        transform: translateX(5px);
+    }
+    h3 {
+        color: #fff;
+        margin-bottom: 1rem;
+        font-size: 1.5rem;
+    }
+</style>
+
+<template>
+    <div class="poll-list">
+        <h3>Available Polls</h3>
+
+        <ul v-if="polls && polls.length > 0" class="poll-links">
+            <li v-for="id in polls" :key="id">
+                <button class="poll-link-btn" @click="$emit('select-poll', id)">
+                    {{ id }} <span>→</span>
+                </button>
+            </li>
+        </ul>
+        <p v-else class="empty-state">No polls found. Create the first one!</p>
+        <div class="create-poll" v-if="userid !== undefined">
+            <input 
+                v-model="newPollId" 
+                placeholder="Enter new poll name..." 
+                @keyup.enter="createPoll"
+            />
+            <button @click="createPoll">Create & Join</button>
+        </div>
+    </div>
+</template>
+
+<script setup lang="ts">
+    import type { PollListProps } from '@/utils/types'
+    const props = defineProps<PollListProps>()
+    const newPollId = ref('');
+    const polls = ref<string[]>([]);
+
+    // Fetch existing polls on mount
+    const fetchPolls = async () => {
+        const data = await $fetch<{ polls: string[] }>('/api/polls');
+        polls.value = data.polls;
+    };
+
+    const createPoll = () => {
+        const id = newPollId.value.trim().toLowerCase().replace(/\s+/g, '-');
+        if (id) {
+            // In a real app, you might want to POST to create it first, 
+            // but here we just navigate to it and let usePoll handle the save.
+            emit('select-poll', id);
+        }
+    };
+
+    const emit = defineEmits(['select-poll']);
+    onMounted(fetchPolls);
+</script>

app/composables/usePoll.ts

@@ -0,0 +1,178 @@
+// composables/usePoll.ts
+import { ref, watch, onUnmounted } from 'vue';
+import * as Y from 'yjs';
+import { stringToCryptoKey, verifyAllVotesForOption } from '~/utils/crypto';
+import type { SignedData, PollMetadata } from '~/utils/types';
+
+export const usePoll = (pollId: Ref<string | null>, user: Ref<UserData | null>) => {
+    const pollData = ref<PollData>({});
+    const isConnected = ref(false);
+    const connectionAttempFailed = ref(false);
+    const connectedPeers = ref(1);
+
+    let ydoc: Y.Doc | null = null;
+    let provider: any = null;
+    let yMap: Y.Map<SignedData<VoteData>[]> | null = null;
+    let publicKeysCache: Record<string, CryptoKey> = {};
+
+    const cleanup = () => {
+    if (provider) provider.disconnect();
+        if (ydoc) ydoc.destroy();
+        isConnected.value = false;
+        pollData.value = {};
+        publicKeysCache = {};
+    };
+
+    const initPoll = async (id: string) => {
+        cleanup(); // Clear previous session
+
+        ydoc = new Y.Doc();
+
+        // 1. Fetch Snapshot from Nuxt API
+        try {
+            const response = await $fetch<{ update: number[] | null, publicKeys: Record<string, string> }>(`/api/polls/${id}`).catch((e) => {
+                console.error("Failed to get poll: " + id,e)
+            });
+            
+            // Cache public keys from snapshot
+            if (response?.publicKeys) {
+                for (const [userId, publicKeyStr] of Object.entries(response.publicKeys)) {
+                    try {
+                        publicKeysCache[userId] = await stringToCryptoKey(publicKeyStr, 'public');
+                    } catch (e) {
+                        console.error(`Failed to cache public key for user ${userId}:`, e);
+                    }
+                }
+                console.log(`Cached ${Object.keys(publicKeysCache).length} public keys`);
+            }
+            
+            //trust the server without verification.
+            if (response?.update) {
+                Y.applyUpdate(ydoc, new Uint8Array(response.update));
+            }
+        } catch (err) {
+            console.error('Persistence fetch failed', err);
+        }
+
+        yMap = ydoc.getMap<SignedData<VoteData>[]>('shared-poll');
+
+        // 2. Local State Sync
+        yMap.observe(async () => {
+            await performUpdateAndVerify();
+            saveStateToServer(id);
+        });
+        await performUpdateAndVerify();
+
+        // 3. P2P Connection
+        const { WebrtcProvider } = await import('y-webrtc');
+        provider = new WebrtcProvider(`nuxt-p2p-${id}`, ydoc, {
+            signaling: ["ws://localhost:4444", "ws://lynxpi.ddns.net:4444"]
+        });
+
+        provider.on('synced', (arg: {synced: boolean}) => {
+            isConnected.value = arg.synced;
+            console.log('Connection synced:', arg.synced) // "connected" or "disconnected"
+        });
+        provider.on('status', (event: { connected: boolean }) => {
+            console.log('Connection status:', event.connected) // "connected" or "disconnected"
+        })
+        provider.on('peers', (data: any) => {
+            connectedPeers.value = data.webrtcPeers.length + 1
+        });
+    };
+
+    const saveStateToServer = async (id: string) => {
+        if (!ydoc) return;
+        const stateUpdate = Y.encodeStateAsUpdate(ydoc);
+        try {
+            await $fetch(`/api/polls/${id}`, {
+                method: 'POST',
+                body: { update: Array.from(stateUpdate) }
+            });
+        } catch (e: any) {
+            console.error("Failed to update poll", e);
+            if (e.data?.message) {
+                alert(`Error: ${e.data.message}`);
+            } else if (e.statusMessage) {
+                alert(`Error: ${e.statusMessage}`);
+            } else {
+                alert('Failed to save poll. Please try again.');
+            }
+        }
+    };
+
+    // Watch for ID changes (e.g., user clicks a link or goes back)
+    watch(pollId, (newId) => {
+        if (newId && import.meta.client) {
+            initPoll(newId);
+        } else {
+            cleanup();
+        }
+    }, { immediate: true });
+
+    onUnmounted(cleanup);
+
+    const addOption = (optionName: string) => {
+        if (yMap && !yMap.has(optionName)) yMap.set(optionName, []);
+    };
+
+    const performUpdateAndVerify = async () => {
+        const pollDataUpdate = yMap!.toJSON();
+        console.log("Poll Data Update: ", pollDataUpdate)
+        
+        // Extract poll metadata if it exists
+        const metadataSigned = pollDataUpdate['_metadata'] as SignedData<PollMetadata> | undefined;
+        const pollMetadata = metadataSigned?.data;
+        
+        for(var option in pollDataUpdate){
+            // Skip metadata key when iterating over options
+            if (option === '_metadata') continue;
+            
+            console.log("verifying votes for option: " + option);
+            const votes = pollDataUpdate[option] || [];
+            const verified = await verifyAllVotesForOption(votes, publicKeysCache, pollMetadata);
+            if(!verified){
+                console.error("Failed to verify option: "+option)
+                return;
+            }
+        }
+        console.log("All options verified! :)")
+        pollData.value = pollDataUpdate
+    }
+
+    const vote = async (optionName: string) => {
+        const currentUser = user.value;
+        if (currentUser == undefined) {
+            alert('You must be logged in to vote. Please create a user or login with your key file.');
+            return;
+        }
+        if (yMap?.has(optionName)) {
+            const voteData = [...(yMap.get(optionName) || [])];
+
+            // Check if user has already voted for this option
+            const hasAlreadyVoted = voteData.some(v => v.data.userid === currentUser.userid);
+            if (hasAlreadyVoted) {
+                console.error(`User ${currentUser.userid} has already voted for option ${optionName}`);
+                alert('You have already voted for this option.');
+                return;
+            }
+
+            if(voteData != undefined && currentUser.private_key){
+                var unsignedVoteData : VoteData = {
+                    userid: currentUser.userid,
+                    timestamp: new Date().toISOString()
+                }
+                var newVote : SignedData<VoteData> = {
+                    data: unsignedVoteData,
+                    signature: "",
+                }
+                voteData?.push(newVote)
+                const signature = await signVote(voteData,currentUser.private_key);
+                newVote.signature=signature
+                yMap?.set(optionName, voteData);
+            }
+        }
+    };
+
+    return { pollData, isConnected, connectionAttempFailed, connectedPeers, addOption, vote };
+};

app/composables/user.ts

@@ -0,0 +1,2 @@
+export const user = (user: Ref<UserData | null>) => {
+}

app/utils/crypto.ts

@@ -0,0 +1,211 @@
+// utils/crypto.ts
+import type { SignedData, VoteData, PollMetadata } from "./types";
+
+export const generateUserKeyPair = async () => {
+  return await window.crypto.subtle.generateKey(
+    {
+      name: "RSASSA-PKCS1-v1_5",
+      modulusLength: 2048,
+      publicExponent: new Uint8Array([1, 0, 1]), // 65537
+      hash: "SHA-256",
+    },
+    true, // extractable
+    ["sign", "verify"]
+  );
+};
+
+export const signVote = async (data: any, privateKey: CryptoKey) => {
+  const encoder = new TextEncoder();
+  const encodedData = encoder.encode(JSON.stringify(data));
+
+  const signature = await window.crypto.subtle.sign(
+    "RSASSA-PKCS1-v1_5",
+    privateKey,
+    encodedData
+  );
+
+  // Convert to Base64 or Hex to store in Yjs easily
+  return btoa(String.fromCharCode(...new Uint8Array(signature)));
+};
+
+export const verifyVote = async (data: any, signatureStr: string, publicKey: CryptoKey) => {
+  const encoder = new TextEncoder();
+  const encodedData = encoder.encode(JSON.stringify(data));
+  
+  // Convert Base64 back to Uint8Array
+  const signature = Uint8Array.from(atob(signatureStr), c => c.charCodeAt(0));
+
+  return await window.crypto.subtle.verify(
+    "RSASSA-PKCS1-v1_5",
+    publicKey,
+    signature,
+    encodedData
+  );
+};
+
+/**
+ * Verifies a specific vote within an array of votes by 
+ * reconstructing the "signed state" at that point in time.
+ */
+export const verifyChainedVote = async (
+    voteData: SignedData<VoteData>[], 
+    index: number,
+    publicKeysCache?: Record<string, CryptoKey>,
+    pollMetadata?: PollMetadata
+) => {
+    const voteToVerify = voteData[index];
+    console.log("Verifying vote: " + voteToVerify)
+    if(voteToVerify) {
+        // 1. Check vote timestamp against poll duration if metadata is available
+        if (pollMetadata) {
+            const voteTime = new Date(voteToVerify.data.timestamp).getTime();
+            const timeSinceCreation = voteTime - pollMetadata.createdAt;
+            if (timeSinceCreation > pollMetadata.duration) {
+                console.error(`Vote timestamp exceeds poll duration: ${timeSinceCreation}ms > ${pollMetadata.duration}ms`);
+                return false;
+            }
+        }
+
+        // 2. Reconstruct the exact data state the user signed
+        // We need the array exactly as it was when they pushed their vote
+        const historicalState = voteData.slice(0, index + 1).map((v, i) => {
+            if (i === index) {
+                // For the current vote, the signature must be empty string
+                // because it wasn't signed yet when passed to signVote
+                return { ...v, signature: "" };
+            }
+            return v;
+        });
+
+        try {
+            // 3. Get public key from cache or fetch from API
+            let pubKey: CryptoKey;
+            if (publicKeysCache && publicKeysCache[voteToVerify.data.userid]) {
+                pubKey = publicKeysCache[voteToVerify.data.userid];
+                console.log("Using cached public key for user:", voteToVerify.data.userid);
+            } else {
+                const response = await $fetch<{ public_key: string }>(`/api/users/${voteToVerify.data.userid}`);
+                console.log("Got key from API: ",response)
+                pubKey = await stringToCryptoKey(response.public_key, 'public');
+            }
+
+            console.log("Using pubKey to verify Vote.")
+            // 4. Verify: Does this historicalState match the signature?
+            return await verifyVote(historicalState, voteToVerify.signature, pubKey);
+        } catch (err) {
+            console.error("Verification failed")
+            console.error(err);
+            return false;
+        }
+    }
+    console.error("Vote is undefined or null");
+    return false;
+};
+
+export const verifyAllVotesForOption = async (
+    votes: SignedData<VoteData>[], 
+    publicKeysCache?: Record<string, CryptoKey>,
+    pollMetadata?: PollMetadata
+) => {
+    console.log("verifying votes for option ",votes);
+    for (let i = votes.length-1; i >= 0 ; i--) {
+        const isValid = await verifyChainedVote(votes, i, publicKeysCache, pollMetadata);
+        if(!isValid){
+            console.error("Error! Invalid Vote at: " + i,votes)
+            return false;
+        }
+    }
+    return true;
+};
+
+// Helper to convert ArrayBuffer to Base64 string
+const bufferToBase64 = (buf: ArrayBuffer) => 
+  window.btoa(String.fromCharCode(...new Uint8Array(buf)));
+
+export const exportPublicKey = async (key: CryptoKey) => {
+  // Export Public Key
+  const exportedPublic = await window.crypto.subtle.exportKey("spki", key);
+  const publicKeyString = bufferToBase64(exportedPublic);
+
+  return publicKeyString;
+};
+export const exportPrivateKey = async (key: CryptoKey) => {
+  // Export Private Key
+  const exportedPrivate = await window.crypto.subtle.exportKey("pkcs8", key);
+  const privateKeyString = bufferToBase64(exportedPrivate);
+
+  return privateKeyString;
+};
+
+/**
+ * Converts a Base64 string back into a usable CryptoKey object
+ * @param keyStr The Base64 string (without PEM headers)
+ * @param type 'public' or 'private'
+ */
+export const stringToCryptoKey = async (keyStr: string, type: 'public' | 'private'): Promise<CryptoKey> => {
+  // 1. Convert Base64 string to a Uint8Array (binary)
+  const binaryString = window.atob(keyStr);
+  const bytes = new Uint8Array(binaryString.length);
+  for (let i = 0; i < binaryString.length; i++) {
+    bytes[i] = binaryString.charCodeAt(i);
+  }
+
+  // 2. Identify the format based on the key type
+  // Public keys usually use 'spki', Private keys use 'pkcs8'
+  const format = type === 'public' ? 'spki' : 'pkcs8';
+  const usages: KeyUsage[] = type === 'public' ? ['verify'] : ['sign'];
+
+  // 3. Import the key
+  return await window.crypto.subtle.importKey(
+    format,
+    bytes.buffer,
+    {
+      name: "RSASSA-PKCS1-v1_5",
+      hash: "SHA-256",
+    },
+    true, // extractable (set to false if you want to lock it in memory)
+    usages
+  );
+};
+
+export const savePrivateKeyToFile = (privateKeyStr: string, filename: string) => {
+  // Optional: Wrap in PEM headers for standard formatting
+  const pemHeader = "-----BEGIN PRIVATE KEY-----\n";
+  const pemFooter = "\n-----END PRIVATE KEY-----";
+  const fileContent = pemHeader + privateKeyStr + pemFooter;
+
+  const blob = new Blob([fileContent], { type: "text/plain" });
+  const url = URL.createObjectURL(blob);
+  
+  const link = document.createElement("a");
+  link.href = url;
+  link.download = filename;
+  
+  document.body.appendChild(link);
+  link.click();
+  
+  // Cleanup
+  document.body.removeChild(link);
+  URL.revokeObjectURL(url);
+};
+
+export const loadPrivateKeyFromFile = async (file: File): Promise<string> => {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader();
+
+    reader.onload = (e) => {
+      const content = e.target?.result as string;
+      
+      // Clean up the string by removing PEM headers and newlines
+      const cleanKey = content
+        .replace("-----BEGIN PRIVATE KEY-----", "")
+        .replace("-----END PRIVATE KEY-----", "")
+        .replace(/\s+/g, ""); // Removes all whitespace/newlines
+        
+      resolve(cleanKey);
+    };
+
+    reader.onerror = () => reject("Error reading file");
+    reader.readAsText(file);
+  });
+};

app/utils/types.ts

@@ -0,0 +1,43 @@
+export interface PollProps {
+    userid: string | undefined,
+    activePollId: string,
+    pollData: PollData,
+    addOption: (name: string) => void,
+    vote: (optionName: string) => void
+}
+
+export interface PollListProps {
+    userid: string | undefined,
+}
+
+export interface PollMetadata {
+    createdAt: number; // Unix timestamp in milliseconds
+    duration: number; // Duration in milliseconds
+    createdBy: string;
+}
+
+export interface PollData {
+    [key: string]: SignedData<VoteData>[] | SignedData<PollMetadata> | undefined;
+}
+
+export interface SignedData<T> {
+    data: T,
+    signature: string
+}
+
+export interface VoteData {
+    userid: string,
+    timestamp: string
+}
+
+export interface OptionData {
+    userid: string,
+    timestamp: string,
+    optionName: string
+}
+
+export interface UserData {
+    userid: string,
+    private_key: CryptoKey | undefined,
+    public_key: CryptoKey | undefined
+}

backend.js

@@ -1,31 +0,0 @@
-import { WebSocketServer } from 'ws';
-import { setupWSConnection } from './utils.js'
-
-// Create a WebSocket server
-const WS_PORT = 8080;
-const wss = new WebSocketServer({ port: WS_PORT });
-
-console.log('WebSocket server is running on ws://localhost:' + String(WS_PORT));
-
-// Connection event handler
-wss.on('connection', setupWSConnection);
-/*
-wss.on('connection', (ws) => {
-  console.log('Client connected');
-
-  // Message event handler
-  ws.on('message', (message) => {
-    let msg_str = String(message);
-    console.log("Received: " + msg_str);
-    
-    // If this is a text or state message (no Yjs logic) - echo the message back to the client
-    if (msg_str.startsWith("TEXT_MESSAGE") | msg_str.startsWith("STATE_MESSAGE")) {
-      ws.send(msg_str);
-    }
-  });
-
-  // Close event handler
-  ws.on('close', () => {
-    console.log('Client disconnected');
-  });
-});*/

frontend.html

@@ -1,196 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>Poll Client</title>
-  <style>
-    body {
-      font-family: Arial, sans-serif;
-      max-width: 600px;
-      margin: 0 auto;
-      padding: 20px;
-    }
-    #messages {
-      height: 300px;
-      border: 1px solid #ccc;
-      overflow-y: auto;
-      padding: 10px;
-      margin-bottom: 10px;
-    }
-    .message { margin: 5px 0; }
-  </style>
-</head>
-<body>
-  <h1>Poll Client</h1>
-  <div id="status">Connecting to server...</div>
-  <div id="status2">Connecting to server...</div>
-  <div id="messages"></div>
-  <div>
-    <input type="text" id="messageInput" placeholder="Type your message">
-    <!--button onclick="sendMessage()">Send</button-->
-    <button id="sendBtn">Send</button>
-    <input id="optionInput" placeholder="Add option">
-    <button id="addBtn">Add</button>
-    <ul id="options"></ul>
-  </div>
-
-  <script type="module">
-    import * as Y from "https://esm.sh/yjs"
-    import { WebsocketProvider } from "https://esm.sh/y-websocket"
-
-    const WS_PORT = 8080;
-    const ydoc = new Y.Doc();
-    const status = document.getElementById('status');
-    const status2 = document.getElementById('status2');
-    const messages = document.getElementById('messages');
-    const messageInput = document.getElementById('messageInput');
-
-    // Connect to the backend (WebSocket server) via Yjs WebsocketProvider
-    const wsp = new WebsocketProvider(
-      'ws://localhost:' + String(WS_PORT), 'poll-room',
-      ydoc
-    )
-    wsp.on('status', event => {
-      //console.log("event.status =", event.status)
-      if (event.status == "connected") {
-        status.textContent = 'Yjs connected to WebSocket server';
-        status.style.color = 'green';
-      }
-      else {
-        status.textContent = 'Yjs disonnected from WebSocket server';
-        status.style.color = 'red';
-      }
-    })
-    wsp.onopen = () => {
-      console.log('connected to y-websocket server');
-    };
-    ydoc.on('update', () => {
-      console.log('Yjs document updated locally');
-    });
-    wsp.on('sync', isSynced => {
-      console.log("isSynced =", isSynced)
-    })
-
-    // Connect to the backend (WebSocket server) via common WebSocket (only for informative messages)
-    const ws = new WebSocket('ws://localhost:' + String(WS_PORT));
-    ws.onopen = () => {
-      status2.textContent = 'WebSocket client connected to WebSocket server';
-      status2.style.color = 'green';
-    };
-    ws.onmessage = (event) => {
-      const message = document.createElement('div');
-      message.className = 'message';
-      message.textContent = event.data;
-      messages.appendChild(message);
-      messages.scrollTop = messages.scrollHeight;
-    };
-    ws.onerror = (error) => {
-      status2.textContent = 'Error: ' + error.message;
-      status2.style.color = 'red';
-    };
-    ws.onclose = () => {
-      status2.textContent = 'WebSocket client disconnected from WebSocket server';
-      status2.style.color = 'red';
-    };
-
-    // Function to send a message
-    function sendMessage(command, payload) {
-        let message = "";
-        if (command === "TEXT_MESSAGE") {
-            message = command + ":" + messageInput.value.trim();
-            messageInput.value = "";
-        }
-        else if (command.startsWith("STATE_MESSAGE--")) {
-            message = command + ":" + payload;
-        }
-        else {
-            console.log("Error: unknown command '" + command + "'")
-        }
-
-        if (message) {
-            /* To make compatible with y-websocket-server API:
-            const encoder = encoding.createEncoder()
-            encoding.writeVarUint(encoder, messageTextMessage)
-            syncProtocol.writeUpdate(encoder, update)
-            enc_message = encoding.toUint8Array(encoder)*/
-            ws.send(message);
-        }
-    }
-
-     // Send message on button click
-    document.getElementById("sendBtn").onclick = () => {
-        sendMessage("TEXT_MESSAGE", "");
-    };
-
-    // Send message on Enter key
-    messageInput.addEventListener('keypress', (e) => {
-      if (e.key === 'Enter') {
-        sendMessage("TEXT_MESSAGE", "");
-      }
-    });
-    
-    // Actual poll logic
-    const optionsMap = ydoc.getMap("options");
-
-    const optionsList = document.getElementById("options");
-    const input = document.getElementById("optionInput");
-
-    function render() {
-        optionsList.innerHTML = ""
-
-        optionsMap.forEach((vote, name) => {
-            // List element for this option
-            const li = document.createElement("li")
-
-            // Label for this option
-            const label = document.createElement("span")
-            label.textContent = name + " — " + vote + " "
-
-            // "Vote"/"Unvote" button
-            const voteBtn = document.createElement("button")
-            if (vote == false) {
-                voteBtn.textContent = "Vote"
-            }
-            else {
-                voteBtn.textContent = "Unvote"
-            }
-            voteBtn.onclick = () => {
-                vote = !vote;
-                optionsMap.set(name, vote);
-                sendMessage("STATE_MESSAGE--" + (vote ? "VOTE" : "UNVOTE"), name);
-            }
-
-            // "Remove" button
-            const removeBtn = document.createElement("button")
-            removeBtn.textContent = "Remove"
-            removeBtn.onclick = () => {
-                optionsMap.delete(name);
-                sendMessage("STATE_MESSAGE--REMOVE", name);
-            }
-
-            li.appendChild(label)
-            li.appendChild(voteBtn)
-            li.appendChild(removeBtn)
-
-            optionsList.appendChild(li)
-        })
-    };
-
-    document.getElementById("addBtn").onclick = () => {
-        const name = input.value.trim()
-
-        if (!name) return
-
-        if (!optionsMap.has(name)) {
-            optionsMap.set(name, false);
-            sendMessage("STATE_MESSAGE--ADD_OPTION", name);
-        }
-
-        input.value = ""
-    };
-
-    optionsMap.observe(render);
-
-    render();
-  </script>
-</body>
-</html>

nuxt.config.ts

@@ -0,0 +1,23 @@
+// https://nuxt.com/docs/api/configuration/nuxt-config
+export default defineNuxtConfig({
+  compatibilityDate: '2025-07-15',
+  devtools: { enabled: true },
+  vite: {
+    optimizeDeps: {
+      include: ['yjs', 'y-webrtc']
+    }
+  },
+  // ... existing config
+  nitro: {
+    storage: {
+      polls: {
+        driver: 'fs',
+        base: './.data/polls'
+      },
+      users: {
+        driver: 'fs',
+        base: './.data/users'
+      }
+    }
+  }
+})

package.json

@@ -1,20 +1,20 @@
 {
-  "name": "yjs-poll",
-  "version": "1.0.0",
-  "main": "index.js",
+  "name": "p2p-poll",
   "type": "module",
+  "private": true,
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
-    "y-websocket": "y-websocket"
+    "build": "nuxt build",
+    "dev": "PORT=4444 npx y-webrtc & nuxt dev",
+    "generate": "nuxt generate",
+    "preview": "nuxt preview",
+    "postinstall": "nuxt prepare"
   },
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "description": "",
   "dependencies": {
-    "ws": "^8.19.0",
-    "@y/protocols": "^1.0.6-1",
-    "lib0": "^0.2.102",
-    "yjs": "^14.0.0-7"
+    "nuxt": "^4.1.3",
+    "uuid": "^13.0.0",
+    "vue": "^3.5.30",
+    "vue-router": "^5.0.3",
+    "y-webrtc": "^10.3.0",
+    "yjs": "^13.6.30"
   }
 }

public/robots.txt

@@ -0,0 +1,2 @@
+User-Agent: *
+Disallow:

server/api/polls/[id].ts

@@ -0,0 +1,94 @@
+import * as Y from 'yjs';
+// server/api/polls/[id].ts
+export default defineEventHandler(async (event) => {
+    const method = event.node.req.method;
+    const pollId = getRouterParam(event, 'id');
+
+    // We use Nitro's built-in storage. 
+    // 'polls' is the storage namespace.
+    const storage = useStorage('polls'); 
+
+    if (!pollId) {
+        throw createError({ statusCode: 400, statusMessage: 'Poll ID required' });
+    }
+
+    // GET: Fetch the saved Yjs document state
+    if (method === 'GET') {
+        const data = await storage.getItem(`poll:${pollId}`);
+        
+        // Fetch all user public keys to include in response
+        const userStorage = useStorage('users');
+        const publicKeys: Record<string, string> = {};
+        
+        // Get all user keys from storage
+        const keys = await userStorage.getKeys();
+        for (const key of keys) {
+            if (key.startsWith('user:')) {
+                const userId = key.replace('user:', '');
+                const publicKey = await userStorage.getItem(key);
+                if (publicKey) {
+                    publicKeys[userId] = String(publicKey);
+                }
+            }
+        }
+        
+        // Return the array of numbers (or null if it doesn't exist yet) along with public keys
+        return { update: data || null, publicKeys };
+    }
+
+    // POST: Save a new Yjs document state
+    if (method === 'POST') {
+        const body = await readBody(event);
+
+        if (body.update && Array.isArray(body.update)) {
+            // create a temp Y.Doc to encode the Data
+            const tempDoc = new Y.Doc();
+            Y.applyUpdate(tempDoc, new Uint8Array(body.update));
+            const yMap = tempDoc.getMap('shared-poll');
+            const pollData = yMap.toJSON();
+
+            // verify pollData
+            for(var option in pollData){
+                const votes = pollData[option] || [];
+                var pubKeys: CryptoKey[] = [];
+
+                const verifyAllVotesForOption = async (votes: SignedData<VoteData>[]) => {
+                    console.log("verifying votes for option " + option,votes);
+                    // check last votes first. if there is something wrong, its likely in the last vote.
+                    for (let i = votes.length-1; i >= 0 ; i--) {
+                        const userStorage = useStorage('users'); 
+                        const votePubKeyString = await userStorage.getItem(`user:${votes[i]?.data.userid}`);
+                        
+                        // Check if public key exists for this user
+                        if (!votePubKeyString) {
+                            console.error(`Error! No public key found for user: ${votes[i]?.data.userid}`);
+                            throw createError({ 
+                                statusCode: 400, 
+                                statusMessage: `Vote from unknown user: ${votes[i]?.data.userid}. User must be registered to vote.` 
+                            });
+                        }
+                        
+                        const votePubKey = await stringToCryptoKey(String(votePubKeyString),'public')
+                        const isValid = await verifyChainedVote(votes, i,votePubKey);
+                        if(!isValid){
+                            console.error("Error! Invalid Vote at: " + i,votes)
+                            return false;
+                        }
+                    }
+                    return true;
+                };
+                const verified = await verifyAllVotesForOption(votes);
+                if(!verified){
+                    console.error("Failed to verify option: "+option)
+                    throw createError({ statusCode: 400, statusMessage: 'PollData contains unverifyable content!' });
+                }
+            }
+
+            // Save the binary update (sent as an array of numbers) to storage
+            await storage.setItem(`poll:${pollId}`, body.update);
+            return { success: true };
+        }
+
+        throw createError({ statusCode: 400, statusMessage: 'Invalid update payload' });
+    }
+});

server/api/polls/index.get.ts

@@ -0,0 +1,15 @@
+// server/api/polls/index.get.ts
+export default defineEventHandler(async () => {
+    const storage = useStorage('polls');
+    
+    // Get all keys in the 'polls' namespace
+    const allKeys = await storage.getKeys();
+    
+    // Filter for our specific poll prefix and strip it for the UI
+    // poll:my-id -> my-id
+    const polls = allKeys
+        .filter(key => key.startsWith('poll:'))
+        .map(key => key.replace('poll:', ''));
+
+    return { polls };
+});

server/api/users/[id].ts

@@ -0,0 +1,82 @@
+// server/api/users/[id].ts
+
+// Simple in-memory rate limiter
+const rateLimitMap = new Map<string, { count: number; resetTime: number }>();
+const RATE_LIMIT_WINDOW = 60000; // 1 minute
+const RATE_LIMIT_MAX = 10; // 10 requests per minute per admin
+
+function checkRateLimit(adminToken: string): boolean {
+    const now = Date.now();
+    const limit = rateLimitMap.get(adminToken);
+    
+    if (!limit || now > limit.resetTime) {
+        rateLimitMap.set(adminToken, { count: 1, resetTime: now + RATE_LIMIT_WINDOW });
+        return true;
+    }
+    
+    if (limit.count >= RATE_LIMIT_MAX) {
+        return false;
+    }
+    
+    limit.count++;
+    return true;
+}
+
+export default defineEventHandler(async (event) => {
+    const method = event.node.req.method;
+    const userId = getRouterParam(event, 'id');
+
+    // We use Nitro's built-in storage. 
+    // 'polls' is the storage namespace.
+    const storage = useStorage('users'); 
+
+    if (!userId) {
+        throw createError({ statusCode: 400, statusMessage: 'User ID required' });
+    }
+
+    // GET: Fetch the saved Yjs document state
+    if (method === 'GET') {
+        const data = await storage.getItem(`user:${userId}`);
+        // Return the array of numbers (or null if it doesn't exist yet)
+        return { public_key: data };
+    }
+
+    // POST: Save a new Yjs document state
+    if (method === 'POST') {
+        // Check for authentication
+        const authHeader = getHeader(event, 'authorization');
+        const adminApiKey = process.env.ADMIN_API_KEY || 'default-admin-key-change-in-production';
+        
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            throw createError({ statusCode: 401, statusMessage: 'Authorization header required' });
+        }
+        
+        const token = authHeader.replace('Bearer ', '');
+        if (token !== adminApiKey) {
+            throw createError({ statusCode: 403, statusMessage: 'Invalid or expired token' });
+        }
+        
+        // Check rate limiting
+        if (!checkRateLimit(token)) {
+            throw createError({ statusCode: 429, statusMessage: 'Rate limit exceeded. Try again later.' });
+        }
+        
+        const body = await readBody(event);
+
+        if (body.public_key) {
+            const data = await storage.getItem(`user:${userId}`);
+
+            if (data == undefined || data == null) {
+                // Save the binary update (sent as an array of numbers) to storage
+                await storage.setItem(`user:${userId}`, body.public_key);
+                console.log("New User created: " + userId)
+                console.log("Public Key: " + body.public_key);
+                return { success: true };
+            }
+
+            throw createError({ statusCode: 400, statusMessage: 'User already exists.' });
+        }
+
+        throw createError({ statusCode: 400, statusMessage: 'Invalid update payload' });
+    }
+});

server/utils/crypto.ts

@@ -0,0 +1,89 @@
+import { SignedData, VoteData } from "./types";
+/**
+ * Gets the WebCrypto API regardless of environment (Node vs Browser)
+ */
+const getCrypto = () => {
+  return (globalThis as any).crypto;
+};
+
+export const verifyVote = async (data: any, signatureStr: string, publicKey: CryptoKey) => {
+  const encoder = new TextEncoder();
+  const encodedData = encoder.encode(JSON.stringify(data));
+  
+  // Convert Base64 back to Uint8Array
+  const signature = Uint8Array.from(atob(signatureStr), c => c.charCodeAt(0));
+
+  return await getCrypto().subtle.verify(
+    "RSASSA-PKCS1-v1_5",
+    publicKey,
+    signature,
+    encodedData
+  );
+};
+
+/**
+ * Verifies a specific vote within an array of votes by 
+ * reconstructing the "signed state" at that point in time.
+ */
+export const verifyChainedVote = async (
+    voteData: SignedData<VoteData>[], 
+    index: number,
+    pubKey: CryptoKey
+) => {
+    const voteToVerify = voteData[index];
+    console.log("Verifying vote: " + voteToVerify)
+    if(voteToVerify) {
+       
+        const historicalState = voteData.slice(0, index + 1).map((v, i) => {
+            if (i === index) {
+                // For the current vote, the signature must be empty string
+                // because it wasn't signed yet when passed to signVote
+                return { ...v, signature: "" };
+            }
+            return v;
+        });
+
+        try {
+            // 3. Verify: Does this historicalState match the signature?
+            return await verifyVote(historicalState, voteToVerify.signature, pubKey);
+        } catch (err) {
+            console.error("Verification failed")
+            console.error(err);
+            return false;
+        }
+    }
+    console.error("Vote is undefined or null");
+    return false;
+};
+
+
+/**
+ * Converts a Base64 string back into a usable CryptoKey object
+ * @param keyStr The Base64 string (without PEM headers)
+ * @param type 'public' or 'private'
+ */
+export const stringToCryptoKey = async (keyStr: string, type: 'public' | 'private'): Promise<CryptoKey> => {
+  // 1. Convert Base64 string to a Uint8Array (binary)
+  const binaryString = Buffer.from(keyStr, 'base64').toString('binary');
+  const bytes = new Uint8Array(binaryString.length);
+  for (let i = 0; i < binaryString.length; i++) {
+    bytes[i] = binaryString.charCodeAt(i);
+  }
+
+  // 2. Identify the format based on the key type
+  // Public keys usually use 'spki', Private keys use 'pkcs8'
+  const format = type === 'public' ? 'spki' : 'pkcs8';
+  const usages: KeyUsage[] = type === 'public' ? ['verify'] : ['sign'];
+
+  // 3. Import the key
+  return await getCrypto().subtle.importKey(
+    format,
+    bytes.buffer,
+    {
+      name: "RSASSA-PKCS1-v1_5",
+      hash: "SHA-256",
+    },
+    true, // extractable (set to false if you want to lock it in memory)
+    usages
+  );
+};

server/utils/types.ts

@@ -0,0 +1,36 @@
+export interface PollProps {
+    userid: string | undefined,
+    activePollId: string,
+    pollData: PollData,
+    addOption: (name: string) => void,
+    vote: (optionName: string) => void
+}
+
+export interface PollListProps {
+    userid: string | undefined,
+}
+
+export interface PollData extends Record<string, SignedData<VoteData>[]> {
+}
+
+export interface SignedData<T> {
+    data: T,
+    signature: string
+}
+
+export interface VoteData {
+    userid: string,
+    timestamp: string
+}
+
+export interface OptionData {
+    userid: string,
+    timestamp: string,
+    optionName: string
+}
+
+export interface UserData {
+    userid: string,
+    private_key: CryptoKey | undefined,
+    public_key: CryptoKey | undefined
+}

tsconfig.json

@@ -0,0 +1,18 @@
+{
+  // https://nuxt.com/docs/guide/concepts/typescript
+  "files": [],
+  "references": [
+    {
+      "path": "./.nuxt/tsconfig.app.json"
+    },
+    {
+      "path": "./.nuxt/tsconfig.server.json"
+    },
+    {
+      "path": "./.nuxt/tsconfig.shared.json"
+    },
+    {
+      "path": "./.nuxt/tsconfig.node.json"
+    }
+  ]
+}

utils.js

@@ -1,291 +0,0 @@
-/* Adapted from https://github.com/yjs/y-websocket-server/blob/main/src/server.js, version of 2025-04-02
-   (author: dmonad/Kevin Jahns, MIT license) */
-
-import * as Y from 'yjs'
-import * as syncProtocol from '@y/protocols/sync'
-import * as awarenessProtocol from '@y/protocols/awareness'
-
-import * as encoding from 'lib0/encoding'
-import * as decoding from 'lib0/decoding'
-import * as map from 'lib0/map'
-
-import * as eventloop from 'lib0/eventloop'
-
-/*import { callbackHandler, isCallbackSet } from './callback.js'
-
-const CALLBACK_DEBOUNCE_WAIT = parseInt(process.env.CALLBACK_DEBOUNCE_WAIT || '2000')
-const CALLBACK_DEBOUNCE_MAXWAIT = parseInt(process.env.CALLBACK_DEBOUNCE_MAXWAIT || '10000')
-
-const debouncer = eventloop.createDebouncer(CALLBACK_DEBOUNCE_WAIT, CALLBACK_DEBOUNCE_MAXWAIT)*/
-
-const wsReadyStateConnecting = 0
-const wsReadyStateOpen = 1
-const wsReadyStateClosing = 2 // eslint-disable-line
-const wsReadyStateClosed = 3 // eslint-disable-line
-
-// disable gc when using snapshots!
-const gcEnabled = process.env.GC !== 'false' && process.env.GC !== '0'
-// const persistenceDir = process.env.YPERSISTENCE
-/**
- * @type {{bindState: function(string,WSSharedDoc):void, writeState:function(string,WSSharedDoc):Promise<any>, provider: any}|null}
- */
-let persistence = null
-
-/**
- * @param {{bindState: function(string,WSSharedDoc):void,
- * writeState:function(string,WSSharedDoc):Promise<any>,provider:any}|null} persistence_
- */
-export const setPersistence = persistence_ => {
-  persistence = persistence_
-}
-
-/**
- * @return {null|{bindState: function(string,WSSharedDoc):void,
-  * writeState:function(string,WSSharedDoc):Promise<any>}|null} used persistence layer
-  */
-export const getPersistence = () => persistence
-
-/**
- * @type {Map<string,WSSharedDoc>}
- */
-export const docs = new Map()
-
-const messageSync = 0
-const messageAwareness = 1
-// const messageAuth = 2
-//const messageTextMessage = 3
-//const messageStateMessage = 4
-
-/**
- * @param {Uint8Array} update
- * @param {any} _origin
- * @param {WSSharedDoc} doc
- * @param {any} _tr
- */
-const updateHandler = (update, _origin, doc, _tr) => {
-  const encoder = encoding.createEncoder()
-  encoding.writeVarUint(encoder, messageSync)
-  syncProtocol.writeUpdate(encoder, update)
-  const message = encoding.toUint8Array(encoder)
-  doc.conns.forEach((_, conn) => send(doc, conn, message))
-}
-
-/**
- * @type {(ydoc: Y.Doc) => Promise<void>}
- */
-let contentInitializor = _ydoc => Promise.resolve()
-
-/**
- * This function is called once every time a Yjs document is created. You can
- * use it to pull data from an external source or initialize content.
- *
- * @param {(ydoc: Y.Doc) => Promise<void>} f
- */
-export const setContentInitializor = (f) => {
-  contentInitializor = f
-}
-
-export class WSSharedDoc extends Y.Doc {
-  /**
-   * @param {string} name
-   */
-  constructor (name) {
-    super({ gc: gcEnabled })
-    this.name = name
-    /**
-     * Maps from conn to set of controlled user ids. Delete all user ids from awareness when this conn is closed
-     * @type {Map<Object, Set<number>>}
-     */
-    this.conns = new Map()
-    /**
-     * @type {awarenessProtocol.Awareness}
-     */
-    this.awareness = new awarenessProtocol.Awareness(this)
-    this.awareness.setLocalState(null)
-    /**
-     * @param {{ added: Array<number>, updated: Array<number>, removed: Array<number> }} changes
-     * @param {Object | null} conn Origin is the connection that made the change
-     */
-    const awarenessChangeHandler = ({ added, updated, removed }, conn) => {
-      const changedClients = added.concat(updated, removed)
-      if (conn !== null) {
-        const connControlledIDs = /** @type {Set<number>} */ (this.conns.get(conn))
-        if (connControlledIDs !== undefined) {
-          added.forEach(clientID => { connControlledIDs.add(clientID) })
-          removed.forEach(clientID => { connControlledIDs.delete(clientID) })
-        }
-      }
-      // broadcast awareness update
-      const encoder = encoding.createEncoder()
-      encoding.writeVarUint(encoder, messageAwareness)
-      encoding.writeVarUint8Array(encoder, awarenessProtocol.encodeAwarenessUpdate(this.awareness, changedClients))
-      const buff = encoding.toUint8Array(encoder)
-      this.conns.forEach((_, c) => {
-        send(this, c, buff)
-      })
-    }
-    this.awareness.on('update', awarenessChangeHandler)
-    this.on('update', /** @type {any} */ (updateHandler))
-    //if (isCallbackSet) {
-    //  this.on('update', (_update, _origin, doc) => {
-    //    debouncer(() => callbackHandler(/** @type {WSSharedDoc} */ (doc)))
-    //  })
-    //}
-    this.whenInitialized = contentInitializor(this)
-  }
-}
-
-/**
- * Gets a Y.Doc by name, whether in memory or on disk
- *
- * @param {string} docname - the name of the Y.Doc to find or create
- * @param {boolean} gc - whether to allow gc on the doc (applies only when created)
- * @return {WSSharedDoc}
- */
-export const getYDoc = (docname, gc = true) => map.setIfUndefined(docs, docname, () => {
-  const doc = new WSSharedDoc(docname)
-  doc.gc = gc
-  if (persistence !== null) {
-    persistence.bindState(docname, doc)
-  }
-  docs.set(docname, doc)
-  return doc
-})
-
-/**
- * @param {any} conn
- * @param {WSSharedDoc} doc
- * @param {Uint8Array} message
- */
-const messageListener = (conn, doc, message) => {
-  try {
-    const encoder = encoding.createEncoder()
-    const decoder = decoding.createDecoder(new Uint8Array(message))
-    const messageType = decoding.readVarUint(decoder)
-    switch (messageType) {
-      case messageSync:
-        encoding.writeVarUint(encoder, messageSync)
-        syncProtocol.readSyncMessage(decoder, encoder, doc, conn)
-
-        // If the `encoder` only contains the type of reply message and no
-        // message, there is no need to send the message. When `encoder` only
-        // contains the type of reply, its length is 1.
-        if (encoding.length(encoder) > 1) {
-          send(doc, conn, encoding.toUint8Array(encoder))
-        }
-        break
-      case messageAwareness: {
-        awarenessProtocol.applyAwarenessUpdate(doc.awareness, decoding.readVarUint8Array(decoder), conn)
-        break
-      }
-      // If this is a text or a message (no Yjs logic) - echo the message back to the client
-      default: {
-        conn.send(String(message))
-        console.log(String(message))
-        break
-      }
-    }
-  } catch (err) {
-    console.error(err)
-    // @ts-ignore
-    doc.emit('error', [err])
-  }
-}
-
-/**
- * @param {WSSharedDoc} doc
- * @param {any} conn
- */
-const closeConn = (doc, conn) => {
-  if (doc.conns.has(conn)) {
-    /**
-     * @type {Set<number>}
-     */
-    // @ts-ignore
-    const controlledIds = doc.conns.get(conn)
-    doc.conns.delete(conn)
-    awarenessProtocol.removeAwarenessStates(doc.awareness, Array.from(controlledIds), null)
-    if (doc.conns.size === 0 && persistence !== null) {
-      // if persisted, we store state and destroy ydocument
-      persistence.writeState(doc.name, doc).then(() => {
-        doc.destroy()
-      })
-      docs.delete(doc.name)
-    }
-  }
-  conn.close()
-}
-
-/**
- * @param {WSSharedDoc} doc
- * @param {import('ws').WebSocket} conn
- * @param {Uint8Array} m
- */
-const send = (doc, conn, m) => {
-  if (conn.readyState !== wsReadyStateConnecting && conn.readyState !== wsReadyStateOpen) {
-    closeConn(doc, conn)
-  }
-  try {
-    conn.send(m, {}, err => { err != null && closeConn(doc, conn) })
-  } catch (e) {
-    closeConn(doc, conn)
-  }
-}
-
-const pingTimeout = 30000
-
-/**
- * @param {import('ws').WebSocket} conn
- * @param {import('http').IncomingMessage} req
- * @param {any} opts
- */
-export const setupWSConnection = (conn, req, { docName = (req.url || '').slice(1).split('?')[0], gc = true } = {}) => {
-  conn.binaryType = 'arraybuffer'
-  // get doc, initialize if it does not exist yet
-  const doc = getYDoc(docName, gc)
-  doc.conns.set(conn, new Set())
-  // listen and reply to events
-  conn.on('message', /** @param {ArrayBuffer} message */ message => messageListener(conn, doc, message))
-
-  // Check if connection is still alive
-  let pongReceived = true
-  const pingInterval = setInterval(() => {
-    if (!pongReceived) {
-      if (doc.conns.has(conn)) {
-        closeConn(doc, conn)
-      }
-      clearInterval(pingInterval)
-    } else if (doc.conns.has(conn)) {
-      pongReceived = false
-      try {
-        conn.ping()
-      } catch (e) {
-        closeConn(doc, conn)
-        clearInterval(pingInterval)
-      }
-    }
-  }, pingTimeout)
-  conn.on('close', () => {
-    closeConn(doc, conn)
-    clearInterval(pingInterval)
-  })
-  conn.on('pong', () => {
-    pongReceived = true
-  })
-  // put the following in a variables in a block so the interval handlers don't keep in in
-  // scope
-  {
-    // send sync step 1
-    const encoder = encoding.createEncoder()
-    encoding.writeVarUint(encoder, messageSync)
-    syncProtocol.writeSyncStep1(encoder, doc)
-    send(doc, conn, encoding.toUint8Array(encoder))
-    const awarenessStates = doc.awareness.getStates()
-    if (awarenessStates.size > 0) {
-      const encoder = encoding.createEncoder()
-      encoding.writeVarUint(encoder, messageAwareness)
-      encoding.writeVarUint8Array(encoder, awarenessProtocol.encodeAwarenessUpdate(doc.awareness, Array.from(awarenessStates.keys())))
-      send(doc, conn, encoding.toUint8Array(encoder))
-    }
-  }
-}