@ethora/chat-component-rn 26.10.5 → 26.10.7

package/lib/module/push/sealedBox.js

@@ -0,0 +1,97 @@
+"use strict";
+
+import { hsalsa, xsalsa20poly1305 } from '@noble/ciphers/salsa.js';
+import { clean, concatBytes, u32, u8, utf8ToBytes } from '@noble/ciphers/utils.js';
+import { x25519 } from '@noble/curves/ed25519.js';
+import { blake2b } from '@noble/hashes/blake2.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
+
+// libsodium's sealed box (`crypto_box_seal` / `crypto_box_seal_open`) on
+// the noble primitives the e2ee code already ships, so the JS side needs
+// no native libsodium. The push service seals every chat push for a
+// device that registered an X25519 public key (ethora-backend,
+// services/push/README.md, "Encrypted pushes"); this is the matching
+// receiver. The iOS notification service extension decrypts the same
+// boxes in Swift with libsodium (plugins/notification-service).
+//
+// Layout: ephemeral public key (32) || crypto_box(message, nonce,
+// recipient pk, ephemeral sk), with crypto_box = XSalsa20-Poly1305 under
+// HSalsa20(X25519 shared secret) and nonce = BLAKE2b-192(epk || rpk).
+// `__tests__/sealedBox.test.ts` pins this against libsodium itself.
+
+export const SEALED_BOX_PUBLIC_KEY_BYTES = 32;
+export const SEALED_BOX_SECRET_KEY_BYTES = 32;
+/** Ephemeral public key (32) + Poly1305 tag (16). */
+export const SEALED_BOX_OVERHEAD_BYTES = 48;
+const NONCE_BYTES = 24;
+const SIGMA = u32(utf8ToBytes('expand 32-byte k'));
+const ZERO_NONCE_PREFIX = new Uint32Array(4);
+export const generateSealedBoxKeyPair = () => {
+  const {
+    secretKey,
+    publicKey
+  } = x25519.keygen();
+  return {
+    publicKey,
+    secretKey
+  };
+};
+export const sealedBoxPublicKeyOf = secretKey => x25519.getPublicKey(secretKey);
+
+/**
+ * The key id the push service derives when the registration carries none:
+ * the first 16 hex characters of SHA-256 over the raw public key. Sent back
+ * as `kid` in every sealed push.
+ */
+export const sealedBoxKeyId = publicKey => bytesToHex(sha256(publicKey)).slice(0, 16);
+
+// crypto_box_beforenm: HSalsa20 over the X25519 shared secret.
+const boxSharedKey = (theirPublicKey, mySecretKey) => {
+  const shared = x25519.getSharedSecret(mySecretKey, theirPublicKey);
+  const words = new Uint32Array(8);
+  hsalsa(SIGMA, u32(shared), ZERO_NONCE_PREFIX, words);
+  clean(shared);
+  return u8(words);
+};
+const sealNonce = (ephemeralPublicKey, recipientPublicKey) => blake2b(concatBytes(ephemeralPublicKey, recipientPublicKey), {
+  dkLen: NONCE_BYTES
+});
+
+/** `crypto_box_seal`: used by the tests and the key tool, not by the app. */
+export function sealedBoxSeal(message, recipientPublicKey) {
+  if (recipientPublicKey.length !== SEALED_BOX_PUBLIC_KEY_BYTES) {
+    throw new Error('sealedBoxSeal: the public key must be 32 bytes');
+  }
+  const ephemeral = generateSealedBoxKeyPair();
+  const key = boxSharedKey(recipientPublicKey, ephemeral.secretKey);
+  const nonce = sealNonce(ephemeral.publicKey, recipientPublicKey);
+  const box = xsalsa20poly1305(key, nonce).encrypt(message);
+  clean(key, ephemeral.secretKey);
+  return concatBytes(ephemeral.publicKey, box);
+}
+
+/**
+ * `crypto_box_seal_open`. Returns null for anything that does not open:
+ * a wrong key, a box for another key, a damaged or truncated box.
+ */
+export function sealedBoxOpen(sealed, publicKey, secretKey) {
+  if (sealed.length < SEALED_BOX_OVERHEAD_BYTES || publicKey.length !== SEALED_BOX_PUBLIC_KEY_BYTES || secretKey.length !== SEALED_BOX_SECRET_KEY_BYTES) {
+    return null;
+  }
+  const ephemeralPublicKey = sealed.subarray(0, SEALED_BOX_PUBLIC_KEY_BYTES);
+  const box = sealed.subarray(SEALED_BOX_PUBLIC_KEY_BYTES);
+  let key = null;
+  try {
+    key = boxSharedKey(ephemeralPublicKey, secretKey);
+    const nonce = sealNonce(ephemeralPublicKey, publicKey);
+    return xsalsa20poly1305(key, nonce).decrypt(box);
+  } catch {
+    return null;
+  } finally {
+    if (key) {
+      clean(key);
+    }
+  }
+}
+//# sourceMappingURL=sealedBox.js.map

package/lib/module/push/sealedBox.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["hsalsa","xsalsa20poly1305","clean","concatBytes","u32","u8","utf8ToBytes","x25519","blake2b","sha256","bytesToHex","SEALED_BOX_PUBLIC_KEY_BYTES","SEALED_BOX_SECRET_KEY_BYTES","SEALED_BOX_OVERHEAD_BYTES","NONCE_BYTES","SIGMA","ZERO_NONCE_PREFIX","Uint32Array","generateSealedBoxKeyPair","secretKey","publicKey","keygen","sealedBoxPublicKeyOf","getPublicKey","sealedBoxKeyId","slice","boxSharedKey","theirPublicKey","mySecretKey","shared","getSharedSecret","words","sealNonce","ephemeralPublicKey","recipientPublicKey","dkLen","sealedBoxSeal","message","length","Error","ephemeral","key","nonce","box","encrypt","sealedBoxOpen","sealed","subarray","decrypt"],"sourceRoot":"../../../src","sources":["push/sealedBox.ts"],"mappings":";;AAAA,SAASA,MAAM,EAAEC,gBAAgB,QAAQ,yBAAyB;AAClE,SAASC,KAAK,EAAEC,WAAW,EAAEC,GAAG,EAAEC,EAAE,EAAEC,WAAW,QAAQ,yBAAyB;AAClF,SAASC,MAAM,QAAQ,0BAA0B;AACjD,SAASC,OAAO,QAAQ,yBAAyB;AACjD,SAASC,MAAM,QAAQ,uBAAuB;AAC9C,SAASC,UAAU,QAAQ,wBAAwB;;AAEnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,MAAMC,2BAA2B,GAAG,EAAE;AAC7C,OAAO,MAAMC,2BAA2B,GAAG,EAAE;AAC7C;AACA,OAAO,MAAMC,yBAAyB,GAAG,EAAE;AAE3C,MAAMC,WAAW,GAAG,EAAE;AACtB,MAAMC,KAAK,GAAGX,GAAG,CAACE,WAAW,CAAC,kBAAkB,CAAC,CAAC;AAClD,MAAMU,iBAAiB,GAAG,IAAIC,WAAW,CAAC,CAAC,CAAC;AAO5C,OAAO,MAAMC,wBAAwB,GAAGA,CAAA,KAAwB;EAC9D,MAAM;IAAEC,SAAS;IAAEC;EAAU,CAAC,GAAGb,MAAM,CAACc,MAAM,CAAC,CAAC;EAChD,OAAO;IAAED,SAAS;IAAED;EAAU,CAAC;AACjC,CAAC;AAED,OAAO,MAAMG,oBAAoB,GAAIH,SAAqB,IACxDZ,MAAM,CAACgB,YAAY,CAACJ,SAAS,CAAC;;AAEhC;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMK,cAAc,GAAIJ,SAAqB,IAClDV,UAAU,CAACD,MAAM,CAACW,SAAS,CAAC,CAAC,CAACK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;;AAE5C;AACA,MAAMC,YAAY,GAAGA,CAACC,cAA0B,EAAEC,WAAuB,KAAiB;EACxF,MAAMC,MAAM,GAAGtB,MAAM,CAACuB,eAAe,CAACF,WAAW,EAAED,cAAc,CAAC;EAClE,MAAMI,KAAK,GAAG,IAAId,WAAW,CAAC,CAAC,CAAC;EAChCjB,MAAM,CAACe,KAAK,EAAEX,GAAG,CAACyB,MAAM,CAAC,EAAEb,iBAAiB,EAAEe,KAAK,CAAC;EACpD7B,KAAK,CAAC2B,MAAM,CAAC;EACb,OAAOxB,EAAE,CAAC0B,KAAK,CAAC;AAClB,CAAC;AAED,MAAMC,SAAS,GAAGA,CAACC,kBAA8B,EAAEC,kBAA8B,KAC/E1B,OAAO,CAACL,WAAW,CAAC8B,kBAAkB,EAAEC,kBAAkB,CAAC,EAAE;EAAEC,KAAK,EAAErB;AAAY,CAAC,CAAC;;AAEtF;AACA,OAAO,SAASsB,aAAaA,CAACC,OAAmB,EAAEH,kBAA8B,EAAc;EAC7F,IAAIA,kBAAkB,CAACI,MAAM,KAAK3B,2BAA2B,EAAE;IAC7D,MAAM,IAAI4B,KAAK,CAAC,gDAAgD,CAAC;EACnE;EACA,MAAMC,SAAS,GAAGtB,wBAAwB,CAAC,CAAC;EAC5C,MAAMuB,GAAG,GAAGf,YAAY,CAACQ,kBAAkB,EAAEM,SAAS,CAACrB,SAAS,CAAC;EACjE,MAAMuB,KAAK,GAAGV,SAAS,CAACQ,SAAS,CAACpB,SAAS,EAAEc,kBAAkB,CAAC;EAChE,MAAMS,GAAG,GAAG1C,gBAAgB,CAACwC,GAAG,EAAEC,KAAK,CAAC,CAACE,OAAO,CAACP,OAAO,CAAC;EACzDnC,KAAK,CAACuC,GAAG,EAAED,SAAS,CAACrB,SAAS,CAAC;EAC/B,OAAOhB,WAAW,CAACqC,SAAS,CAACpB,SAAS,EAAEuB,GAAG,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASE,aAAaA,CAC3BC,MAAkB,EAClB1B,SAAqB,EACrBD,SAAqB,EACF;EACnB,IACE2B,MAAM,CAACR,MAAM,GAAGzB,yBAAyB,IACzCO,SAAS,CAACkB,MAAM,KAAK3B,2BAA2B,IAChDQ,SAAS,CAACmB,MAAM,KAAK1B,2BAA2B,EAChD;IACA,OAAO,IAAI;EACb;EACA,MAAMqB,kBAAkB,GAAGa,MAAM,CAACC,QAAQ,CAAC,CAAC,EAAEpC,2BAA2B,CAAC;EAC1E,MAAMgC,GAAG,GAAGG,MAAM,CAACC,QAAQ,CAACpC,2BAA2B,CAAC;EACxD,IAAI8B,GAAsB,GAAG,IAAI;EACjC,IAAI;IACFA,GAAG,GAAGf,YAAY,CAACO,kBAAkB,EAAEd,SAAS,CAAC;IACjD,MAAMuB,KAAK,GAAGV,SAAS,CAACC,kBAAkB,EAAEb,SAAS,CAAC;IACtD,OAAOnB,gBAAgB,CAACwC,GAAG,EAAEC,KAAK,CAAC,CAACM,OAAO,CAACL,GAAG,CAAC;EAClD,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb,CAAC,SAAS;IACR,IAAIF,GAAG,EAAE;MAACvC,KAAK,CAACuC,GAAG,CAAC;IAAC;EACvB;AACF","ignoreList":[]}

package/lib/module/push/sealedPush.js

@@ -0,0 +1,117 @@
+"use strict";
+
+import { fromBase64 } from '../e2ee/crypto';
+import { sealedBoxKeyId, sealedBoxOpen } from './sealedBox';
+
+// The envelope of an encrypted chat push (ethora-backend,
+// services/push/README.md, "Encrypted pushes"): the FCM `data` map on
+// Android, the custom keys next to `aps` on iOS. Only ids travel in the
+// clear; everything shown to the user is inside `enc`, a sealed box for
+// the key the device registered with its token.
+
+export const SEALED_PUSH_ALG = 'sealed-box-x25519';
+export const SEALED_PUSH_VERSION = '1';
+
+/** What the box holds: the notification the service would have sent in the clear. */
+
+const str = value => typeof value === 'string' ? value : '';
+
+/** The envelope of `data` when it is a sealed chat push, else null. */
+export const sealedPushEnvelopeOf = data => {
+  if (!data || data.alg !== SEALED_PUSH_ALG) {
+    return null;
+  }
+  const enc = str(data.enc);
+  return {
+    v: str(data.v) || SEALED_PUSH_VERSION,
+    alg: SEALED_PUSH_ALG,
+    kid: str(data.kid),
+    jid: str(data.jid),
+    msgID: str(data.msgID),
+    userJid: str(data.userJid),
+    ...(enc ? {
+      enc
+    } : {})
+  };
+};
+export const isSealedPush = data => sealedPushEnvelopeOf(data) !== null;
+const parseContent = plaintext => {
+  try {
+    const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+    if (!parsed || typeof parsed !== 'object') {
+      return null;
+    }
+    return {
+      title: str(parsed.title),
+      body: str(parsed.body),
+      sender: str(parsed.sender),
+      senderJid: str(parsed.senderJid),
+      chat: str(parsed.chat),
+      chatJid: str(parsed.chatJid),
+      msgID: str(parsed.msgID),
+      image: str(parsed.image)
+    };
+  } catch {
+    return null;
+  }
+};
+/**
+ * Open a sealed push with the device key. `key` null means there is no key
+ * on this device. Never throws: every failure names why, so the caller can
+ * show the placeholder and log the reason.
+ */
+export function openSealedPush(envelope, key) {
+  if (!key) {
+    return {
+      ok: false,
+      reason: 'no-key',
+      envelope
+    };
+  }
+  if (envelope.kid && envelope.kid !== sealedBoxKeyId(key.publicKey)) {
+    return {
+      ok: false,
+      reason: 'key-mismatch',
+      envelope
+    };
+  }
+  if (!envelope.enc) {
+    return {
+      ok: false,
+      reason: 'no-ciphertext',
+      envelope
+    };
+  }
+  let sealed;
+  try {
+    sealed = fromBase64(envelope.enc);
+  } catch {
+    return {
+      ok: false,
+      reason: 'bad-ciphertext',
+      envelope
+    };
+  }
+  const plaintext = sealedBoxOpen(sealed, key.publicKey, key.secretKey);
+  if (!plaintext) {
+    return {
+      ok: false,
+      reason: 'bad-ciphertext',
+      envelope
+    };
+  }
+  const content = parseContent(plaintext);
+  if (!content) {
+    return {
+      ok: false,
+      reason: 'bad-content',
+      envelope
+    };
+  }
+  return {
+    ok: true,
+    content,
+    envelope
+  };
+}
+//# sourceMappingURL=sealedPush.js.map

package/lib/module/push/sealedPush.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["fromBase64","sealedBoxKeyId","sealedBoxOpen","SEALED_PUSH_ALG","SEALED_PUSH_VERSION","str","value","sealedPushEnvelopeOf","data","alg","enc","v","kid","jid","msgID","userJid","isSealedPush","parseContent","plaintext","parsed","JSON","parse","TextDecoder","decode","title","body","sender","senderJid","chat","chatJid","image","openSealedPush","envelope","key","ok","reason","publicKey","sealed","secretKey","content"],"sourceRoot":"../../../src","sources":["push/sealedPush.ts"],"mappings":";;AAAA,SAASA,UAAU,QAAQ,gBAAgB;AAC3C,SAASC,cAAc,EAAEC,aAAa,QAAQ,aAAa;;AAE3D;AACA;AACA;AACA;AACA;;AAEA,OAAO,MAAMC,eAAe,GAAG,mBAAmB;AAClD,OAAO,MAAMC,mBAAmB,GAAG,GAAG;;AAgBtC;;AA6BA,MAAMC,GAAG,GAAIC,KAAc,IAAc,OAAOA,KAAK,KAAK,QAAQ,GAAGA,KAAK,GAAG,EAAG;;AAEhF;AACA,OAAO,MAAMC,oBAAoB,GAC/BC,IAAgD,IAClB;EAC9B,IAAI,CAACA,IAAI,IAAIA,IAAI,CAACC,GAAG,KAAKN,eAAe,EAAE;IAAC,OAAO,IAAI;EAAC;EACxD,MAAMO,GAAG,GAAGL,GAAG,CAACG,IAAI,CAACE,GAAG,CAAC;EACzB,OAAO;IACLC,CAAC,EAAEN,GAAG,CAACG,IAAI,CAACG,CAAC,CAAC,IAAIP,mBAAmB;IACrCK,GAAG,EAAEN,eAAe;IACpBS,GAAG,EAAEP,GAAG,CAACG,IAAI,CAACI,GAAG,CAAC;IAClBC,GAAG,EAAER,GAAG,CAACG,IAAI,CAACK,GAAG,CAAC;IAClBC,KAAK,EAAET,GAAG,CAACG,IAAI,CAACM,KAAK,CAAC;IACtBC,OAAO,EAAEV,GAAG,CAACG,IAAI,CAACO,OAAO,CAAC;IAC1B,IAAIL,GAAG,GAAG;MAAEA;IAAI,CAAC,GAAG,CAAC,CAAC;EACxB,CAAC;AACH,CAAC;AAED,OAAO,MAAMM,YAAY,GAAIR,IAAgD,IAC3ED,oBAAoB,CAACC,IAAI,CAAC,KAAK,IAAI;AAErC,MAAMS,YAAY,GAAIC,SAAqB,IAA+B;EACxE,IAAI;IACF,MAAMC,MAAM,GAAGC,IAAI,CAACC,KAAK,CAAC,IAAIC,WAAW,CAAC,CAAC,CAACC,MAAM,CAACL,SAAS,CAAC,CAAC;IAC9D,IAAI,CAACC,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;MAAC,OAAO,IAAI;IAAC;IACxD,OAAO;MACLK,KAAK,EAAEnB,GAAG,CAACc,MAAM,CAACK,KAAK,CAAC;MACxBC,IAAI,EAAEpB,GAAG,CAACc,MAAM,CAACM,IAAI,CAAC;MACtBC,MAAM,EAAErB,GAAG,CAACc,MAAM,CAACO,MAAM,CAAC;MAC1BC,SAAS,EAAEtB,GAAG,CAACc,MAAM,CAACQ,SAAS,CAAC;MAChCC,IAAI,EAAEvB,GAAG,CAACc,MAAM,CAACS,IAAI,CAAC;MACtBC,OAAO,EAAExB,GAAG,CAACc,MAAM,CAACU,OAAO,CAAC;MAC5Bf,KAAK,EAAET,GAAG,CAACc,MAAM,CAACL,KAAK,CAAC;MACxBgB,KAAK,EAAEzB,GAAG,CAACc,MAAM,CAACW,KAAK;IACzB,CAAC;EACH,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF,CAAC;AAOD;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,cAAcA,CAC5BC,QAA4B,EAC5BC,GAAyB,EACH;EACtB,IAAI,CAACA,GAAG,EAAE;IAAC,OAAO;MAAEC,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE,QAAQ;MAAEH;IAAS,CAAC;EAAC;EAC5D,IAAIA,QAAQ,CAACpB,GAAG,IAAIoB,QAAQ,CAACpB,GAAG,KAAKX,cAAc,CAACgC,GAAG,CAACG,SAAS,CAAC,EAAE;IAClE,OAAO;MAAEF,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE,cAAc;MAAEH;IAAS,CAAC;EACxD;EACA,IAAI,CAACA,QAAQ,CAACtB,GAAG,EAAE;IAAC,OAAO;MAAEwB,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE,eAAe;MAAEH;IAAS,CAAC;EAAC;EAC5E,IAAIK,MAAkB;EACtB,IAAI;IACFA,MAAM,GAAGrC,UAAU,CAACgC,QAAQ,CAACtB,GAAG,CAAC;EACnC,CAAC,CAAC,MAAM;IACN,OAAO;MAAEwB,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE,gBAAgB;MAAEH;IAAS,CAAC;EAC1D;EACA,MAAMd,SAAS,GAAGhB,aAAa,CAACmC,MAAM,EAAEJ,GAAG,CAACG,SAAS,EAAEH,GAAG,CAACK,SAAS,CAAC;EACrE,IAAI,CAACpB,SAAS,EAAE;IAAC,OAAO;MAAEgB,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE,gBAAgB;MAAEH;IAAS,CAAC;EAAC;EAC1E,MAAMO,OAAO,GAAGtB,YAAY,CAACC,SAAS,CAAC;EACvC,IAAI,CAACqB,OAAO,EAAE;IAAC,OAAO;MAAEL,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE,aAAa;MAAEH;IAAS,CAAC;EAAC;EACrE,OAAO;IAAEE,EAAE,EAAE,IAAI;IAAEK,OAAO;IAAEP;EAAS,CAAC;AACxC","ignoreList":[]}

package/lib/module/push/sealedPushTask.js

@@ -0,0 +1,187 @@
+"use strict";
+
+import { AppState, Platform } from 'react-native';
+import { pushLog } from '../utils/devLogger';
+import { loadPushSecretKey } from './pushKeyStore';
+import { openSealedPush, sealedPushEnvelopeOf } from './sealedPush';
+
+// Android half of encrypted pushes. A sealed push is data-only, so the OS
+// shows nothing by itself: expo-notifications hands it to a background
+// task (expo-task-manager, foreground, background and killed app alike)
+// and this task opens the box and posts the notification. iOS does the
+// same in the notification service extension; here `registerSealedPushTask`
+// is a no-op.
+//
+// Both packages are optional peers, required lazily: a host that does not
+// want encrypted pushes never pays for them.
+
+export const SEALED_PUSH_TASK = 'ETHORA_SEALED_PUSH';
+const PLACEHOLDER_TITLE = 'New message';
+let registered = false;
+const loadTaskManager = () => {
+  try {
+    return require('expo-task-manager');
+  } catch {
+    return null;
+  }
+};
+const loadNotifications = () => {
+  try {
+    return require('expo-notifications');
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * The FCM data map out of the task payload. expo-notifications passes the
+ * message as `{ notification, data }`; the data keys are on `data`
+ * itself, `data.dataString` carries the same as a JSON string on some
+ * versions, and a Firebase `RemoteMessage` keeps them under `data.data`.
+ */
+export const sealedPushDataOf = payload => {
+  const root = payload && typeof payload === 'object' ? payload : null;
+  if (!root) {
+    return null;
+  }
+  const candidates = [root.data, root];
+  const data = root.data && typeof root.data === 'object' ? root.data : null;
+  if (data) {
+    if (typeof data.dataString === 'string') {
+      try {
+        candidates.unshift(JSON.parse(data.dataString));
+      } catch {
+        // not JSON — fall through to the map itself
+      }
+    }
+    candidates.push(data.data);
+  }
+  for (const candidate of candidates) {
+    if (sealedPushEnvelopeOf(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+};
+const notificationContent = (result, options) => {
+  const {
+    envelope
+  } = result;
+  // What the tap handler (`handlePushPayload` through the host's response
+  // listener) needs: the same ids a plain push carries on `data`.
+  const data = {
+    jid: envelope.jid,
+    msgID: envelope.msgID,
+    userJid: envelope.userJid,
+    sealed: true
+  };
+  if (!result.ok) {
+    return {
+      title: options.placeholderTitle || PLACEHOLDER_TITLE,
+      ...(options.placeholderBody ? {
+        body: options.placeholderBody
+      } : {}),
+      data,
+      sound: 'default'
+    };
+  }
+  const {
+    content
+  } = result;
+  return {
+    title: content.title || content.sender || content.chat || PLACEHOLDER_TITLE,
+    body: content.body,
+    data: {
+      ...data,
+      chatJid: content.chatJid,
+      senderJid: content.senderJid
+    },
+    sound: 'default'
+  };
+};
+
+/**
+ * Open a sealed push and show it. One notification per chat: the room JID
+ * is the identifier, so a newer message replaces the older one the way the
+ * service's collapse key does for plain pushes.
+ */
+export async function presentSealedPush(data, options = {}) {
+  const envelope = sealedPushEnvelopeOf(data);
+  if (!envelope) {
+    return null;
+  }
+  const notifications = loadNotifications();
+  if (!notifications?.scheduleNotificationAsync) {
+    return null;
+  }
+  const result = openSealedPush(envelope, await loadPushSecretKey());
+  // console, not only pushLog: with the app killed this runs headless and
+  // `adb logcat -s ReactNativeJS` is the only place to see it.
+  if (result.ok) {
+    console.log(`[push] sealed push kid=${envelope.kid} opened for ${envelope.jid}`);
+  } else {
+    console.warn(`[push] sealed push kid=${envelope.kid} not opened (${result.reason}), showing the placeholder`);
+    pushLog('warn', `push: sealed push not opened (${result.reason}), showing the placeholder`);
+  }
+  await notifications.scheduleNotificationAsync({
+    identifier: envelope.jid || envelope.msgID || undefined,
+    content: notificationContent(result, options),
+    trigger: options.channelId ? {
+      channelId: options.channelId
+    } : null
+  });
+  return result;
+}
+
+/**
+ * Define and register the background task that renders sealed pushes on
+ * Android. Call it at module scope of a file the app loads first (the
+ * entry file, or the root layout with expo-router): a killed app is
+ * started headless to run it, and the task must exist by then. No-op on
+ * iOS and when expo-task-manager / expo-notifications are not installed.
+ */
+export function registerSealedPushTask(options = {}) {
+  if (Platform.OS !== 'android' || registered) {
+    return registered;
+  }
+  const taskManager = loadTaskManager();
+  const notifications = loadNotifications();
+  if (!taskManager?.defineTask || !notifications?.registerTaskAsync) {
+    pushLog('warn', 'push: expo-task-manager and expo-notifications are needed to show encrypted pushes on Android');
+    return false;
+  }
+  taskManager.defineTask(SEALED_PUSH_TASK, async ({
+    data,
+    error
+  }) => {
+    if (error) {
+      return;
+    }
+    const map = sealedPushDataOf(data);
+    if (!map) {
+      return;
+    }
+    // In the foreground the room is live over XMPP; the host's
+    // notification handler decides about plain pushes there too.
+    if (AppState.currentState === 'active') {
+      return;
+    }
+    try {
+      await presentSealedPush(map, options);
+    } catch (e) {
+      pushLog('warn', 'push: showing a sealed push failed', e);
+    }
+  });
+  registered = true;
+  notifications.registerTaskAsync(SEALED_PUSH_TASK).catch(e => {
+    registered = false;
+    pushLog('warn', 'push: registering the sealed push task failed', e);
+  });
+  return true;
+}
+
+/** Test seam only. */
+export const __resetSealedPushTaskForTests = () => {
+  registered = false;
+};
+//# sourceMappingURL=sealedPushTask.js.map

package/lib/module/push/sealedPushTask.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["AppState","Platform","pushLog","loadPushSecretKey","openSealedPush","sealedPushEnvelopeOf","SEALED_PUSH_TASK","PLACEHOLDER_TITLE","registered","loadTaskManager","require","loadNotifications","sealedPushDataOf","payload","root","candidates","data","dataString","unshift","JSON","parse","push","candidate","notificationContent","result","options","envelope","jid","msgID","userJid","sealed","ok","title","placeholderTitle","placeholderBody","body","sound","content","sender","chat","chatJid","senderJid","presentSealedPush","notifications","scheduleNotificationAsync","console","log","kid","warn","reason","identifier","undefined","trigger","channelId","registerSealedPushTask","OS","taskManager","defineTask","registerTaskAsync","error","map","currentState","e","catch","__resetSealedPushTaskForTests"],"sourceRoot":"../../../src","sources":["push/sealedPushTask.ts"],"mappings":";;AAAA,SAASA,QAAQ,EAAEC,QAAQ,QAAQ,cAAc;AACjD,SAASC,OAAO,QAAQ,oBAAoB;AAC5C,SAASC,iBAAiB,QAAQ,gBAAgB;AAClD,SAASC,cAAc,EAAEC,oBAAoB,QAAmC,cAAc;;AAE9F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,MAAMC,gBAAgB,GAAG,oBAAoB;AAUpD,MAAMC,iBAAiB,GAAG,aAAa;AAEvC,IAAIC,UAAU,GAAG,KAAK;AAEtB,MAAMC,eAAe,GAAGA,CAAA,KAAW;EACjC,IAAI;IACF,OAAOC,OAAO,CAAC,mBAAmB,CAAC;EACrC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF,CAAC;AAED,MAAMC,iBAAiB,GAAGA,CAAA,KAAW;EACnC,IAAI;IACF,OAAOD,OAAO,CAAC,oBAAoB,CAAC;EACtC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAME,gBAAgB,GAAIC,OAAgB,IAAqC;EACpF,MAAMC,IAAI,GAAGD,OAAO,IAAI,OAAOA,OAAO,KAAK,QAAQ,GAAIA,OAAO,GAA+B,IAAI;EACjG,IAAI,CAACC,IAAI,EAAE;IAAC,OAAO,IAAI;EAAC;EACxB,MAAMC,UAAqB,GAAG,CAACD,IAAI,CAACE,IAAI,EAAEF,IAAI,CAAC;EAC/C,MAAME,IAAI,GAAGF,IAAI,CAACE,IAAI,IAAI,OAAOF,IAAI,CAACE,IAAI,KAAK,QAAQ,GAAIF,IAAI,CAACE,IAAI,GAA+B,IAAI;EACvG,IAAIA,IAAI,EAAE;IACR,IAAI,OAAOA,IAAI,CAACC,UAAU,KAAK,QAAQ,EAAE;MACvC,IAAI;QACFF,UAAU,CAACG,OAAO,CAACC,IAAI,CAACC,KAAK,CAACJ,IAAI,CAACC,UAAU,CAAC,CAAC;MACjD,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ;IACAF,UAAU,CAACM,IAAI,CAACL,IAAI,CAACA,IAAI,CAAC;EAC5B;EACA,KAAK,MAAMM,SAAS,IAAIP,UAAU,EAAE;IAClC,IAAIV,oBAAoB,CAACiB,SAAoC,CAAC,EAAE;MAC9D,OAAOA,SAAS;IAClB;EACF;EACA,OAAO,IAAI;AACb,CAAC;AAED,MAAMC,mBAAmB,GAAGA,CAACC,MAA4B,EAAEC,OAA8B,KAAK;EAC5F,MAAM;IAAEC;EAAS,CAAC,GAAGF,MAAM;EAC3B;EACA;EACA,MAAMR,IAAI,GAAG;IACXW,GAAG,EAAED,QAAQ,CAACC,GAAG;IACjBC,KAAK,EAAEF,QAAQ,CAACE,KAAK;IACrBC,OAAO,EAAEH,QAAQ,CAACG,OAAO;IACzBC,MAAM,EAAE;EACV,CAAC;EACD,IAAI,CAACN,MAAM,CAACO,EAAE,EAAE;IACd,OAAO;MACLC,KAAK,EAAEP,OAAO,CAACQ,gBAAgB,IAAI1B,iBAAiB;MACpD,IAAIkB,OAAO,CAACS,eAAe,GAAG;QAAEC,IAAI,EAAEV,OAAO,CAACS;MAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;MACrElB,IAAI;MACJoB,KAAK,EAAE;IACT,CAAC;EACH;EACA,MAAM;IAAEC;EAAQ,CAAC,GAAGb,MAAM;EAC1B,OAAO;IACLQ,KAAK,EAAEK,OAAO,CAACL,KAAK,IAAIK,OAAO,CAACC,MAAM,IAAID,OAAO,CAACE,IAAI,IAAIhC,iBAAiB;IAC3E4B,IAAI,EAAEE,OAAO,CAACF,IAAI;IAClBnB,IAAI,EAAE;MAAE,GAAGA,IAAI;MAAEwB,OAAO,EAAEH,OAAO,CAACG,OAAO;MAAEC,SAAS,EAAEJ,OAAO,CAACI;IAAU,CAAC;IACzEL,KAAK,EAAE;EACT,CAAC;AACH,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeM,iBAAiBA,CACrC1B,IAA6B,EAC7BS,OAA8B,GAAG,CAAC,CAAC,EACG;EACtC,MAAMC,QAAQ,GAAGrB,oBAAoB,CAACW,IAAI,CAAC;EAC3C,IAAI,CAACU,QAAQ,EAAE;IAAC,OAAO,IAAI;EAAC;EAC5B,MAAMiB,aAAa,GAAGhC,iBAAiB,CAAC,CAAC;EACzC,IAAI,CAACgC,aAAa,EAAEC,yBAAyB,EAAE;IAAC,OAAO,IAAI;EAAC;EAE5D,MAAMpB,MAAM,GAAGpB,cAAc,CAACsB,QAAQ,EAAE,MAAMvB,iBAAiB,CAAC,CAAC,CAAC;EAClE;EACA;EACA,IAAIqB,MAAM,CAACO,EAAE,EAAE;IACbc,OAAO,CAACC,GAAG,CAAC,0BAA0BpB,QAAQ,CAACqB,GAAG,eAAerB,QAAQ,CAACC,GAAG,EAAE,CAAC;EAClF,CAAC,MAAM;IACLkB,OAAO,CAACG,IAAI,CAAC,0BAA0BtB,QAAQ,CAACqB,GAAG,gBAAgBvB,MAAM,CAACyB,MAAM,4BAA4B,CAAC;IAC7G/C,OAAO,CAAC,MAAM,EAAE,iCAAiCsB,MAAM,CAACyB,MAAM,4BAA4B,CAAC;EAC7F;EACA,MAAMN,aAAa,CAACC,yBAAyB,CAAC;IAC5CM,UAAU,EAAExB,QAAQ,CAACC,GAAG,IAAID,QAAQ,CAACE,KAAK,IAAIuB,SAAS;IACvDd,OAAO,EAAEd,mBAAmB,CAACC,MAAM,EAAEC,OAAO,CAAC;IAC7C2B,OAAO,EAAE3B,OAAO,CAAC4B,SAAS,GAAG;MAAEA,SAAS,EAAE5B,OAAO,CAAC4B;IAAU,CAAC,GAAG;EAClE,CAAC,CAAC;EACF,OAAO7B,MAAM;AACf;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAAS8B,sBAAsBA,CAAC7B,OAA8B,GAAG,CAAC,CAAC,EAAW;EACnF,IAAIxB,QAAQ,CAACsD,EAAE,KAAK,SAAS,IAAI/C,UAAU,EAAE;IAAC,OAAOA,UAAU;EAAC;EAChE,MAAMgD,WAAW,GAAG/C,eAAe,CAAC,CAAC;EACrC,MAAMkC,aAAa,GAAGhC,iBAAiB,CAAC,CAAC;EACzC,IAAI,CAAC6C,WAAW,EAAEC,UAAU,IAAI,CAACd,aAAa,EAAEe,iBAAiB,EAAE;IACjExD,OAAO,CACL,MAAM,EACN,+FACF,CAAC;IACD,OAAO,KAAK;EACd;EACAsD,WAAW,CAACC,UAAU,CAACnD,gBAAgB,EAAE,OAAO;IAAEU,IAAI;IAAE2C;EAAyC,CAAC,KAAK;IACrG,IAAIA,KAAK,EAAE;MAAC;IAAO;IACnB,MAAMC,GAAG,GAAGhD,gBAAgB,CAACI,IAAI,CAAC;IAClC,IAAI,CAAC4C,GAAG,EAAE;MAAC;IAAO;IAClB;IACA;IACA,IAAI5D,QAAQ,CAAC6D,YAAY,KAAK,QAAQ,EAAE;MAAC;IAAO;IAChD,IAAI;MACF,MAAMnB,iBAAiB,CAACkB,GAAG,EAAEnC,OAAO,CAAC;IACvC,CAAC,CAAC,OAAOqC,CAAC,EAAE;MACV5D,OAAO,CAAC,MAAM,EAAE,oCAAoC,EAAE4D,CAAC,CAAC;IAC1D;EACF,CAAC,CAAC;EACFtD,UAAU,GAAG,IAAI;EACjBmC,aAAa,CAACe,iBAAiB,CAACpD,gBAAgB,CAAC,CAACyD,KAAK,CAAED,CAAU,IAAK;IACtEtD,UAAU,GAAG,KAAK;IAClBN,OAAO,CAAC,MAAM,EAAE,+CAA+C,EAAE4D,CAAC,CAAC;EACrE,CAAC,CAAC;EACF,OAAO,IAAI;AACb;;AAEA;AACA,OAAO,MAAME,6BAA6B,GAAGA,CAAA,KAAY;EACvDxD,UAAU,GAAG,KAAK;AACpB,CAAC","ignoreList":[]}

package/lib/module/roomStore/persistence.js

@@ -65,7 +65,10 @@ const sanitizeUser = user => {
 // on reload before MAM catches up. That needs the fields the bubbles and
 // room-list previews actually read, nothing else. Everything outside this
 // list is either re-derived on render or re-fetched from the server.
-const PERSISTED_MESSAGE_FIELDS = ['id', 'xmppId', 'xmppFrom', 'body', 'date', 'timestamp', 'roomJid', 'isSystemMessage', 'isMediafile', 'isDeleted', 'isEdited', 'isReply', 'showInChannel', 'mainMessage', 'mimetype', 'location', 'locationPreview', 'fileName', 'originalName', 'size', 'langSource',
+const PERSISTED_MESSAGE_FIELDS = ['id', 'xmppId', 'xmppFrom', 'body', 'date', 'timestamp', 'roomJid', 'isSystemMessage', 'isMediafile', 'isDeleted', 'isEdited', 'isReply', 'showInChannel', 'mainMessage', 'mimetype', 'location', 'locationPreview', 'fileName', 'originalName', 'size',
+// Every file of a multi-attach message and its caption: without them a
+// restored album paints as its first file only (see compactAttachments).
+'attachments', 'caption', 'captionMentions', 'langSource',
 // `translations` MUST be here. A previous version of this list dropped
 // it, on the theory that it mirrored the web SDK's persist contract —
 // it doesn't: web's redux-persist config (web/src/roomStore/index.ts)
@@ -131,8 +134,27 @@ const pickDefined = (source, keys) => {
   }
   return out;
 };
+
+// What a restored attachment is rendered from. Ownership and timestamp
+// fields the storage returns, and the sender's local upload state, are not
+// ours to cache and would repeat across up to ten files of every message.
+const PERSISTED_ATTACHMENT_FIELDS = ['attachmentId', 'location', 'locationPreview', 'mimetype', 'originalName', 'fileName', 'size', 'duration', 'width', 'height'];
+const compactAttachments = attachments => {
+  if (!Array.isArray(attachments) || attachments.length === 0) {
+    return undefined;
+  }
+  return attachments.filter(item => item && typeof item === 'object').map(item => pickDefined(item, PERSISTED_ATTACHMENT_FIELDS));
+};
 const compactMessageForPersist = message => {
   const compact = pickDefined(message, PERSISTED_MESSAGE_FIELDS);
+  if (compact.attachments !== undefined) {
+    const attachments = compactAttachments(compact.attachments);
+    if (attachments) {
+      compact.attachments = attachments;
+    } else {
+      delete compact.attachments;
+    }
+  }
   const user = message?.user;
   if (user) {
     compact.user = pickDefined(user, PERSISTED_MESSAGE_USER_FIELDS);
@@ -150,11 +172,14 @@ const sanitizeMessages = messages => {
 /**
  * Room fields that describe ONE session and must never be written to disk:
  * the server's unread snapshot (a moment-in-time number the next /chats/my
- * re-seeds). Volatile slice state that is not on the room at all (jumpWindow,
+ * re-seeds) and the read watermarks other occupants sent this session. Volatile slice state that is not on the room at all (jumpWindow,
  * pendingJump, archivedMessage, usersSet) is never persisted because only
  * `rooms.rooms` is picked from the slice.
  */
-const SESSION_ROOM_FIELDS = ['apiUnreadCount', 'apiUnreadSeededAt'];
+const SESSION_ROOM_FIELDS = ['apiUnreadCount', 'apiUnreadSeededAt',
+// XEP-0333 read watermarks: a peer's "seen" state is re-learned from the
+// live marker stanzas, never restored from a previous session.
+'lastDisplayedByUser'];
 
 /**
  * Rehydrate step: a persisted room must be refetched once per session, so
@@ -250,6 +275,27 @@ const sanitizeMediaData = data => {
   }
   return out;
 };
+
+// Every file of a multi-file failed send, trimmed the same way as `data`.
+// Capped so a corrupt payload cannot grow the cache without bound.
+const MAX_PERSISTED_FAILED_FILES = 10;
+const sanitizeMediaFiles = files => {
+  if (!Array.isArray(files)) {
+    return undefined;
+  }
+  const out = [];
+  for (const file of files.slice(0, MAX_PERSISTED_FAILED_FILES)) {
+    const clean = sanitizeMediaData(file);
+    if (typeof file?.duration === 'number') {
+      clean.duration = file.duration;
+    }
+    if (typeof file?.waveForm === 'string') {
+      clean.waveForm = file.waveForm;
+    }
+    out.push(clean);
+  }
+  return out.length > 0 ? out : undefined;
+};
 const sanitizeFailedMessagePayload = payload => {
   if (!payload || typeof payload !== 'object') {
     return null;
@@ -261,6 +307,8 @@ const sanitizeFailedMessagePayload = payload => {
     return null;
   }
   if (payload.kind === 'media') {
+    const files = sanitizeMediaFiles(payload.files);
+    const caption = typeof payload.caption === 'string' ? payload.caption : undefined;
     return {
       kind: 'media',
       id: payload.id,
@@ -269,7 +317,16 @@ const sanitizeFailedMessagePayload = payload => {
       type: typeof payload.type === 'string' ? payload.type : '',
       isReply: payload.isReply,
       isChecked: payload.isChecked,
-      mainMessage: payload.mainMessage
+      mainMessage: payload.mainMessage,
+      ...(files ? {
+        files
+      } : {}),
+      ...(caption ? {
+        caption
+      } : {}),
+      ...(caption && Array.isArray(payload.captionMentions) ? {
+        captionMentions: payload.captionMentions
+      } : {})
     };
   }
   if (payload.kind === 'text') {
@@ -328,6 +385,16 @@ export function reconstructFailedMessagePayload(message, roomJID) {
   const isChecked = message.showInChannel === 'true';
   const mainMessage = message.mainMessage;
   if (message.isMediafile === 'true') {
+    // A multi-file send keeps every file. Only a file still on this device
+    // has a uri to replay; an uploaded one has no local copy left to send.
+    const localUri = value => typeof value === 'string' && /^(file|content|ph|assets-library):\/\//.test(value) ? value : undefined;
+    const attachments = Array.isArray(message.attachments) ? message.attachments : [];
+    const files = attachments.length > 1 ? attachments.slice(0, MAX_PERSISTED_FAILED_FILES).map(attachment => ({
+      uri: localUri(attachment.localUrl) ?? localUri(attachment.location),
+      name: attachment.originalName || attachment.fileName,
+      type: attachment.mimetype,
+      size: attachment.size !== undefined && attachment.size !== null ? Number(attachment.size) : undefined
+    })) : undefined;
     return {
       kind: 'media',
       id: message.id,
@@ -341,7 +408,13 @@ export function reconstructFailedMessagePayload(message, roomJID) {
       type: message.mimetype || '',
       isReply,
       isChecked,
-      mainMessage
+      mainMessage,
+      ...(files ? {
+        files
+      } : {}),
+      ...(message.caption ? {
+        caption: message.caption
+      } : {})
     };
   }
   return {