@pontalabs/baileys 1.0.2 → 1.0.3

package/lib/Socket/messages-send.js

@@ -360,11 +360,17 @@ const makeMessagesSocket = (config) => {
         if (force) {
             jidsRequiringFetch = jids;
         } else {
-            const addrs = jids.map(jid => (signalRepository.jidToSignalProtocolAddress(jid)));
-            const sessions = await authState.keys.get('session', addrs);
+            // FIX: sebelumnya cuma ngecek "ada record tersimpan atau enggak"
+            // (truthy check di authState.keys.get('session', ...)). Record
+            // yang kosong/stale/rusak (misal device grup yang session-nya
+            // kebentuk tapi gak pernah kepakai/keisi ratchet) tetep truthy,
+            // jadi dianggap "udah punya sesi" padahal libsignal-nya beneran
+            // kosong -> pas encrypt muncul "SessionError: No sessions".
+            // validateSession ngecek session-nya beneran ada & "open" enggak,
+            // bukan cuma record-nya ada.
             for (const jid of jids) {
-                const signalId = signalRepository.jidToSignalProtocolAddress(jid);
-                if (!sessions[signalId]) {
+                const sessionValidation = await signalRepository.validateSession(jid);
+                if (!sessionValidation.exists) {
                     jidsRequiringFetch.push(jid);
                 }
             }

package/lib/Utils/auth-utils.js

@@ -81,92 +81,96 @@ function makeCacheableSignalKeyStore(store, logger, _cache) {
     }
 }
 
-// Module-level specialized mutexes for pre-key operations
-const preKeyMutex = new mutex_1.Mutex()
-const signedPreKeyMutex = new mutex_1.Mutex()
-
-/**
- * Get the appropriate mutex for the key type
- */
-const getPreKeyMutex = (keyType) => {
-    return keyType === 'signed-pre-key' ? signedPreKeyMutex : preKeyMutex
-}
-
 /**
- * Handles pre-key operations with mutex protection
+ * Handles pre-key operations.
+ *
+ * IMPORTANT: locking for this function is provided by the CALLER via the
+ * session-scoped `getKeyTypeMutex(keyType)` mutex (the same one used by
+ * get()/set() for that key type). We intentionally do NOT acquire our own
+ * mutex here anymore.
+ *
+ * Previously this used module-level singleton mutexes (`preKeyMutex`,
+ * `signedPreKeyMutex`) declared OUTSIDE `addTransactionCapability`. Because
+ * those were created once per process (not once per auth state / socket),
+ * every session running in the same Node process shared the exact same
+ * lock. That caused two problems:
+ *   1. Unrelated sessions serialized on each other's pre-key writes
+ *      (needless contention/latency when running multiple accounts).
+ *   2. The lock domain didn't match the one used by get()/withMutexes()
+ *      (`getKeyTypeMutex`), so reads/writes and deletion-validation could
+ *      interleave without real mutual exclusion (TOCTOU race on the
+ *      "does this key still exist" check), which is what let pre-key /
+ *      signed-pre-key state get corrupted under concurrent access.
  */
 async function handlePreKeyOperations(data, keyType, transactionCache, mutations, logger, isInTransaction, state) {
-    const mutex = getPreKeyMutex(keyType)
-    await mutex.runExclusive(async () => {
-        const keyData = data[keyType]
-        if (!keyData)
-            return
-            
-        // Ensure structures exist
-        transactionCache[keyType] = transactionCache[keyType] || {}
-        mutations[keyType] = mutations[keyType] || {}
-        
-        // Separate deletions from updates for batch processing
-        const deletionKeys = []
-        const updateKeys = []
-        
-        for (const keyId in keyData) {
-            if (keyData[keyId] === null) {
-                deletionKeys.push(keyId)
-            }
-            else {
-                updateKeys.push(keyId)
-            }
+    const keyData = data[keyType]
+    if (!keyData)
+        return
+
+    // Ensure structures exist
+    transactionCache[keyType] = transactionCache[keyType] || {}
+    mutations[keyType] = mutations[keyType] || {}
+
+    // Separate deletions from updates for batch processing
+    const deletionKeys = []
+    const updateKeys = []
+
+    for (const keyId in keyData) {
+        if (keyData[keyId] === null) {
+            deletionKeys.push(keyId)
         }
-        
-        // Process updates first (no validation needed)
-        for (const keyId of updateKeys) {
-            if (transactionCache[keyType]) {
-                transactionCache[keyType][keyId] = keyData[keyId]
-            }
-            if (mutations[keyType]) {
-                mutations[keyType][keyId] = keyData[keyId]
-            }
+        else {
+            updateKeys.push(keyId)
         }
-        
-        // Process deletions with validation
-        if (deletionKeys.length === 0)
-            return
-            
-        if (isInTransaction) {
-            // In transaction, only allow deletion if key exists in cache
-            for (const keyId of deletionKeys) {
-                if (transactionCache[keyType]) {
-                    transactionCache[keyType][keyId] = null
-                    if (mutations[keyType]) {
-                        // Mark for deletion in mutations
-                        mutations[keyType][keyId] = null
-                    }
-                }
-                else {
-                    logger.warn(`Skipping deletion of non-existent ${keyType} in transaction: ${keyId}`)
-                }
-            }
-            return
+    }
+
+    // Process updates first (no validation needed)
+    for (const keyId of updateKeys) {
+        if (transactionCache[keyType]) {
+            transactionCache[keyType][keyId] = keyData[keyId]
         }
-        
-        // Outside transaction, batch validate all deletions
-        if (!state)
-            return
-            
-        const existingKeys = await state.get(keyType, deletionKeys)
+        if (mutations[keyType]) {
+            mutations[keyType][keyId] = keyData[keyId]
+        }
+    }
+
+    // Process deletions with validation
+    if (deletionKeys.length === 0)
+        return
+
+    if (isInTransaction) {
+        // In transaction, only allow deletion if key exists in cache
         for (const keyId of deletionKeys) {
-            if (existingKeys[keyId]) {
-                if (transactionCache[keyType])
-                    transactionCache[keyType][keyId] = null
-                if (mutations[keyType])
+            if (transactionCache[keyType]) {
+                transactionCache[keyType][keyId] = null
+                if (mutations[keyType]) {
+                    // Mark for deletion in mutations
                     mutations[keyType][keyId] = null
+                }
             }
             else {
-                logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+                logger.warn(`Skipping deletion of non-existent ${keyType} in transaction: ${keyId}`)
             }
         }
-    })
+        return
+    }
+
+    // Outside transaction, batch validate all deletions
+    if (!state)
+        return
+
+    const existingKeys = await state.get(keyType, deletionKeys)
+    for (const keyId of deletionKeys) {
+        if (existingKeys[keyId]) {
+            if (transactionCache[keyType])
+                transactionCache[keyType][keyId] = null
+            if (mutations[keyType])
+                mutations[keyType][keyId] = null
+        }
+        else {
+            logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+        }
+    }
 }
 
 /**
@@ -179,27 +183,34 @@ function handleNormalKeyOperations(data, key, transactionCache, mutations) {
 }
 
 /**
- * Process pre-key deletions with validation
+ * Process pre-key / signed-pre-key deletions with validation.
+ *
+ * NOTE: this is only ever called from inside a `withMutexes([..., keyType, ...])`
+ * block in `set()` below, which already holds the session-scoped
+ * `getKeyTypeMutex(keyType)` lock for the duration of the call. It must NOT
+ * acquire its own mutex here - `async-mutex`'s Mutex is not reentrant, so
+ * doing so would either deadlock (if it tried to re-acquire the same lock)
+ * or - as in the previous version - silently acquire a *different*, global
+ * lock that gave no real protection at all.
  */
 async function processPreKeyDeletions(data, keyType, state, logger) {
-    const mutex = getPreKeyMutex(keyType)
-    await mutex.runExclusive(async () => {
-        const keyData = data[keyType]
-        if (!keyData)
-            return
-            
-        // Validate deletions
-        for (const keyId in keyData) {
-            if (keyData[keyId] === null) {
-                const existingKeys = await state.get(keyType, [keyId])
-                if (!existingKeys[keyId]) {
-                    logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
-                    if (data[keyType])
-                        delete data[keyType][keyId]
-                }
-            }
+    const keyData = data[keyType]
+    if (!keyData)
+        return
+
+    // Validate deletions
+    const deletionIds = Object.keys(keyData).filter(id => keyData[id] === null)
+    if (deletionIds.length === 0)
+        return
+
+    const existingKeys = await state.get(keyType, deletionIds)
+    for (const keyId of deletionIds) {
+        if (!existingKeys[keyId]) {
+            logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+            if (data[keyType])
+                delete data[keyType][keyId]
         }
-    })
+    }
 }
 
 /**
@@ -403,9 +414,13 @@ const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetwee
                 for (const key_ in data) {
                     const key = key_
                     transactionCache[key] = transactionCache[key] || {}
-                    // Special handling for pre-keys and signed-pre-keys
+                    // Special handling for pre-keys and signed-pre-keys.
+                    // Locked via the session-scoped getKeyTypeMutex(key) so this can't
+                    // interleave with a concurrent non-transactional get()/set() for the
+                    // same key type on this SAME auth state - no cross-session locking,
+                    // no lock-domain mismatch.
                     if (key === 'pre-key' || key === 'signed-pre-key') {
-                        await handlePreKeyOperations(data, key, transactionCache, mutations, logger, true)
+                        await getKeyTypeMutex(key).runExclusive(() => handlePreKeyOperations(data, key, transactionCache, mutations, logger, true))
                     }
                     else {
                         // Normal handling for other key types
@@ -442,7 +457,7 @@ const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetwee
                             // Process pre-keys and signed-pre-keys separately with specialized mutexes
                             for (const key_ in nonSenderKeyData) {
                                 const keyType = key_
-                                if (keyType === 'pre-key') {
+                                if (keyType === 'pre-key' || keyType === 'signed-pre-key') {
                                     await processPreKeyDeletions(nonSenderKeyData, keyType, state, logger)
                                 }
                             }
@@ -457,7 +472,7 @@ const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetwee
                         // Process pre-keys and signed-pre-keys separately with specialized mutexes
                         for (const key_ in data) {
                             const keyType = key_
-                            if (keyType === 'pre-key') {
+                            if (keyType === 'pre-key' || keyType === 'signed-pre-key') {
                                 await processPreKeyDeletions(data, keyType, state, logger)
                             }
                         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pontalabs/baileys",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "PontaLabs Baileys is a lightweight, modern, and customizable WhatsApp Web API library built on Baileys.",
   "keywords": [
     "facebook",