@droponair/sdk-js 0.30.0 → 0.31.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.31.0
+
+### Fixed
+
+- **People on different platforms could not send to each other.** Public keys are
+  published to a shared directory, and the SDKs disagreed on how to write them:
+  one used the standard base64 alphabet and another the URL-safe one. Each could
+  read what it had written and none could read the others, so encrypting for a
+  member on another platform failed outright with a decoding error, and the send
+  failed for the sender rather than for that member.
+- Keys are now decoded in either alphabet, with or without padding, so a
+  directory shared between platforms works whatever wrote the entry.
+
+### Notes
+
+- Nothing needs republishing: existing entries in either form are readable.
+- This affects any app whose users are on more than one platform.
+
 ## 0.30.0
 
 ### Added

package/dist/core/bytes.d.ts

@@ -1,6 +1,14 @@
 export declare function utf8Encode(value: string): Uint8Array;
 export declare function utf8Decode(value: Uint8Array): string;
 export declare function toBase64(value: Uint8Array): string;
+/**
+ * Decodes base64 in either alphabet, with or without padding.
+ *
+ * Values reaching an SDK are written by whatever device produced them, and the
+ * SDKs did not agree on which alphabet to use: each could read its own and none
+ * could read the others, so two people on different platforms could not send to
+ * each other at all. `atob` is strict, so the input is normalised first.
+ */
 export declare function fromBase64(value: string): Uint8Array;
 export declare function randomBytes(length: number): Uint8Array;
 export declare function concatBytes(...parts: Uint8Array[]): Uint8Array;

package/dist/core/bytes.js

@@ -24,11 +24,23 @@ function toBase64(value) {
     }
     return btoa(binary);
 }
+/**
+ * Decodes base64 in either alphabet, with or without padding.
+ *
+ * Values reaching an SDK are written by whatever device produced them, and the
+ * SDKs did not agree on which alphabet to use: each could read its own and none
+ * could read the others, so two people on different platforms could not send to
+ * each other at all. `atob` is strict, so the input is normalised first.
+ */
 function fromBase64(value) {
+    const normalised = value.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = normalised.length % 4 === 0
+        ? normalised
+        : normalised + '='.repeat(4 - (normalised.length % 4));
     if (typeof Buffer !== 'undefined') {
-        return new Uint8Array(Buffer.from(value, 'base64'));
+        return new Uint8Array(Buffer.from(padded, 'base64'));
     }
-    const binary = atob(value);
+    const binary = atob(padded);
     const out = new Uint8Array(binary.length);
     for (let i = 0; i < binary.length; i += 1) {
         out[i] = binary.charCodeAt(i);

package/dist/version.d.ts

@@ -7,7 +7,7 @@
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-export declare const SDK_VERSION = "0.30.0";
+export declare const SDK_VERSION = "0.31.0";
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/dist/version.js

@@ -10,7 +10,7 @@ exports.PROTOCOL_VERSION = exports.PAYLOAD_FORMAT_VERSION = exports.SDK_VERSION
  *   MINOR, additive feature (e.g. multi-device payloads, new call event type)
  *   PATCH, bug-fix / perf improvement with no wire or API change
  */
-exports.SDK_VERSION = '0.30.0';
+exports.SDK_VERSION = '0.31.0';
 /**
  * Binary encrypted-payload format version.
  * Included as the first byte of every encrypted payload so receivers can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@droponair/sdk-js",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "End-to-end encrypted messaging, voice and video calling SDK. The relay never sees your keys or message content.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",