@droponair/sdk-js 0.24.1 → 0.24.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.24.3
+
+- Fix: broadcasts (and events/acks) misrouted. Inbound Ack/GroupAck discriminators now require a real SCREAMING_SNAKE ack token, so a BroadcastNotification (publisherId in the type slot) is no longer decoded as a GroupAck before reaching the broadcast branch. Completes the frame-classifier fix.
+
+## 0.24.2
+
+- Fix: E2EE group message decryption failed because the decrypt AAD bound `recipientId` to the group id instead of the receiving user's own id (which is what the sender encrypts against). Now matches the sender and the other SDKs. Requires sdk-be that preserves the sender timestamp on group notifications.
+
 ## 0.24.1
 
 - Fix: incoming frame classifier misrouted server-pushed Event and Broadcast frames as group messages (protobuf field overlap), so `onBroadcast` never fired and events like `LIMIT_REACHED` were swallowed. Event is now probed with a strict type check before group/broadcast/ack, and group notifications additionally require `senderDeviceId`.

package/dist/core/messaging-client.js

@@ -1580,7 +1580,12 @@ class MessagingClient {
                 plaintext = await this.cryptoService.decrypt(myPayload.encryptedPayload, sharedKey, {
                     messageId: notif.messageId,
                     senderId: notif.fromUserId,
-                    recipientId: notif.groupId,
+                    // AAD recipientId is the receiving user's own id — this MUST match the
+                    // sender's encrypt AAD, which binds recipientId to the target member's
+                    // userId (memberId). Using notif.groupId here (the previous value) never
+                    // matched, so E2EE group messages failed GCM auth on decrypt. android /
+                    // ios / unity already bind this to the recipient's own id.
+                    recipientId: this.currentUserId,
                     timestamp: notif.timestamp,
                 });
             }

package/dist/transport/protobuf-codec.js

@@ -387,7 +387,9 @@ class ProtobufCodec {
     tryDecodeAck(payload) {
         try {
             const decoded = AckType.decode(payload);
-            if (!decoded.messageId || !decoded.type) {
+            // type must be a real ack type (SCREAMING_SNAKE); otherwise a broadcast /
+            // notification with a UUID or userId in field 2 would false-match as an Ack.
+            if (!decoded.messageId || !decoded.type || !/^[A-Z][A-Z0-9_]*$/.test(decoded.type)) {
                 return null;
             }
             return decoded;
@@ -475,10 +477,11 @@ class ProtobufCodec {
     tryDecodeGroupAck(payload) {
         try {
             const decoded = GroupAckType.decode(payload);
-            // Require type (field 3): an Ack {messageId(1), type(2)} otherwise decodes
-            // as a GroupAck (its type lands in groupId, field 3 stays empty). Real
-            // GroupAcks always carry a type.
-            if (!decoded.messageId || !decoded.groupId || !decoded.type) {
+            // Require type (field 3) to be a real ack type (SCREAMING_SNAKE). Without the
+            // shape check a BroadcastNotification {broadcastId(1), channelId(2),
+            // publisherId(3)} satisfies messageId+groupId+type (publisherId lands in type)
+            // and is misrouted here instead of to the broadcast handler.
+            if (!decoded.messageId || !decoded.groupId || !decoded.type || !/^[A-Z][A-Z0-9_]*$/.test(decoded.type)) {
                 return null;
             }
             return decoded;

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.24.1";
+export declare const SDK_VERSION = "0.24.3";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.24.1';
+exports.SDK_VERSION = '0.24.3';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.24.1",
+  "version": "0.24.3",
   "description": "DropOnAir SDK for end-to-end encrypted messaging",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",