@droponair/sdk-js 0.24.1 → 0.24.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.24.2
+
+- Fix: E2EE group message decryption failed because the decrypt AAD bound `recipientId` to the group id instead of the receiving user's own id (which is what the sender encrypts against). Now matches the sender and the other SDKs. Requires sdk-be that preserves the sender timestamp on group notifications.
+
 ## 0.24.1
 
 - Fix: incoming frame classifier misrouted server-pushed Event and Broadcast frames as group messages (protobuf field overlap), so `onBroadcast` never fired and events like `LIMIT_REACHED` were swallowed. Event is now probed with a strict type check before group/broadcast/ack, and group notifications additionally require `senderDeviceId`.

package/dist/core/messaging-client.js

@@ -1580,7 +1580,12 @@ class MessagingClient {
                 plaintext = await this.cryptoService.decrypt(myPayload.encryptedPayload, sharedKey, {
                     messageId: notif.messageId,
                     senderId: notif.fromUserId,
-                    recipientId: notif.groupId,
+                    // AAD recipientId is the receiving user's own id — this MUST match the
+                    // sender's encrypt AAD, which binds recipientId to the target member's
+                    // userId (memberId). Using notif.groupId here (the previous value) never
+                    // matched, so E2EE group messages failed GCM auth on decrypt. android /
+                    // ios / unity already bind this to the recipient's own id.
+                    recipientId: this.currentUserId,
                     timestamp: notif.timestamp,
                 });
             }

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.24.1";
+export declare const SDK_VERSION = "0.24.2";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.24.1';
+exports.SDK_VERSION = '0.24.2';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.24.1",
+  "version": "0.24.2",
   "description": "DropOnAir SDK for end-to-end encrypted messaging",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",