fix: use Connect encryption key to encrypt app identities

[pcarranzav]

Depends on #276 - please merge that one first and change the base branch.
This simplifies the Connect flow removing an unnecessary wallet signature previously used to encrypt/decrypt the app identity.

[Copilot]

Pull Request Overview

This PR simplifies the Connect flow by removing the unnecessary wallet signature-based encryption for app identities and instead uses the Connect encryption key directly. This change eliminates the nonce field from app identity structures and updates the encryption/decryption methods to use a more straightforward approach.

• Removes nonce field from all app identity schemas and database models
• Replaces wallet signature-based encryption with direct Connect encryption key usage
• Simplifies encryption/decryption functions by removing signer dependency

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/hypergraph/src/messages/types.ts	Removes nonce field from RequestConnectCreateAppIdentity schema
packages/hypergraph/src/connect/types.ts	Removes nonce field from AppIdentityResponse schema
packages/hypergraph/src/connect/identity-encryption.ts	Refactors encryption/decryption to use Connect keys instead of wallet signatures
apps/server/src/index.ts	Updates API endpoint to remove nonce handling
apps/server/src/handlers/create-app-identity.ts	Removes nonce parameter from handler function
apps/server/prisma/schema.prisma	Removes nonce field and unique constraint from AppIdentity model
apps/server/prisma/migrations/*	Database migration to drop nonce column
apps/connect/src/routes/authenticate.tsx	Updates client code to use new encryption method without signer

[Copilot]

The function should handle potential decryption failures and provide a meaningful error message. The cryptoBoxSealOpen function can throw if decryption fails, but there's no error handling or context about what went wrong.

Suggested change

	const keysMsg = cryptoBoxSealOpen({
	ciphertext: ciphertextBytes,
	privateKey: hexToBytes(keys.encryptionPrivateKey),
	publicKey: hexToBytes(keys.encryptionPublicKey),
	});
	let keysMsg: Uint8Array;
	try {
	keysMsg = cryptoBoxSealOpen({
	ciphertext: ciphertextBytes,
	privateKey: hexToBytes(keys.encryptionPrivateKey),
	publicKey: hexToBytes(keys.encryptionPublicKey),
	});
	} catch (error) {
	throw new Error('Decryption failed. Ensure the ciphertext and keys are correct.');
	}

[Copilot]

Should wrap cryptoBoxSealOpen in a try-catch block to provide better error handling. If decryption fails, the error should indicate that the app identity could not be decrypted rather than exposing low-level crypto errors.

Suggested change

	const keysMsg = cryptoBoxSealOpen({
	ciphertext: ciphertextBytes,
	privateKey: hexToBytes(keys.encryptionPrivateKey),
	publicKey: hexToBytes(keys.encryptionPublicKey),
	});
	let keysMsg;
	try {
	keysMsg = cryptoBoxSealOpen({
	ciphertext: ciphertextBytes,
	privateKey: hexToBytes(keys.encryptionPrivateKey),
	publicKey: hexToBytes(keys.encryptionPublicKey),
	});
	} catch (error) {
	throw new Error("Failed to decrypt app identity. Please check the provided keys and ciphertext.");
	}