@telecrypt-io/storage 0.2.6 → 0.2.9

package/dist/TeleCryptIOStorage.js

@@ -363,13 +363,20 @@ export class TeleCryptIOStorage {
         return event_id;
     }
     async downloadFile(branch) {
-        const { info } = await branch.getFileInfo();
-        // If the underlying room event couldn't be decrypted (e.g. this device
-        // never received/recovered the megolm session for it), matrix-js-sdk
-        // hands back a placeholder with no usable `info` rather than throwing —
-        // so without this check, callers would hit an opaque
-        // "Cannot read properties of undefined" a few lines down instead of a
-        // clear, actionable error.
+        let info;
+        try {
+            ({ info } = await branch.getFileInfo());
+        }
+        catch {
+            // matrix-js-sdk's MSC3089Branch.getFileInfo() reads `file["url"]` off
+            // the raw event content; when the event is undecryptable on this
+            // device it hands back a placeholder with no `file` block, so that
+            // read throws an opaque "Cannot read properties of undefined" instead
+            // of a useful error. Surface the real cause.
+            throw new Error(`downloadFile: could not read file info from the event — it is likely undecryptable on this device (missing megolm session; try restoring from a Recovery Key)`);
+        }
+        // Belt-and-braces: if a future matrix-js-sdk version returns a
+        // placeholder without throwing, still fail with the clear message.
         if (!info || typeof info.url !== "string") {
             throw new Error("downloadFile: could not read file info from the event — it is likely undecryptable on this device (missing megolm session; try restoring from a Recovery Key)");
         }

package/dist/core/oidc.d.ts

@@ -61,12 +61,18 @@ export declare function isDeviceAccessTokenError(result: DeviceAccessTokenRespon
  * internally by matrix-js-sdk/oidc-client-ts (`mx_oidc_`-prefixed keys) — the
  * caller does not need to manage them; `completeAuthorizationCodeFlow` reads
  * them back after the redirect.
+ *
+ * `deviceId` is optional: when supplied, it is embedded in the requested
+ * scope (MSC2967) so MAS grants THAT device instead of minting a fresh one —
+ * the web UI passes a stable per-browser device id so repeated logins reuse
+ * the same Matrix device instead of accumulating one device per login.
  */
 export declare function beginAuthorizationCodeFlow(opts: {
     authMetadata: OidcClientConfig;
     clientId: string;
     homeserverUrl: string;
     redirectUri: string;
+    deviceId?: string;
 }): Promise<string>;
 /** Completes the authorization-code exchange after the `?code&state` redirect. */
 export declare function completeAuthorizationCodeFlow(code: string, state: string): Promise<{

package/dist/core/oidc.js

@@ -10,6 +10,7 @@
  */
 import { createClient } from "matrix-js-sdk";
 import { registerOidcClient, generateScope, generateOidcAuthorizationUrl, completeAuthorizationCodeGrant, startDeviceAuthorization, waitForDeviceAuthorization, } from "matrix-js-sdk/lib/oidc/index.js";
+import { OidcClient, WebStorageStateStore } from "oidc-client-ts";
 import { CliError } from "./errors.js";
 /**
  * Discovers the OIDC/MAS issuer + endpoints for a homeserver, via
@@ -84,9 +85,41 @@ export function isDeviceAccessTokenError(result) {
  * internally by matrix-js-sdk/oidc-client-ts (`mx_oidc_`-prefixed keys) — the
  * caller does not need to manage them; `completeAuthorizationCodeFlow` reads
  * them back after the redirect.
+ *
+ * `deviceId` is optional: when supplied, it is embedded in the requested
+ * scope (MSC2967) so MAS grants THAT device instead of minting a fresh one —
+ * the web UI passes a stable per-browser device id so repeated logins reuse
+ * the same Matrix device instead of accumulating one device per login.
  */
 export async function beginAuthorizationCodeFlow(opts) {
     const nonce = crypto.randomUUID();
+    if (opts.deviceId) {
+        // matrix-js-sdk's generateOidcAuthorizationUrl hardcodes
+        // generateScope() with no device id, so every login would mint a fresh
+        // Matrix device. Build the URL ourselves with the stable device id in
+        // the requested scope (MSC2967) so MAS grants THAT device — mirroring
+        // matrix-js-sdk's construction exactly (same state store, same user
+        // state shape) so completeAuthorizationCodeFlow still works unchanged.
+        const scope = generateScope(opts.deviceId);
+        const oidcClient = new OidcClient({
+            ...opts.authMetadata,
+            signingKeys: opts.authMetadata.signingKeys ?? undefined,
+            metadata: opts.authMetadata,
+            client_id: opts.clientId,
+            redirect_uri: opts.redirectUri,
+            authority: opts.authMetadata.issuer,
+            response_mode: "query",
+            response_type: "code",
+            scope,
+            stateStore: new WebStorageStateStore({ prefix: "mx_oidc_", store: window.sessionStorage }),
+        });
+        const userState = { homeserverUrl: opts.homeserverUrl, nonce };
+        const request = await oidcClient.createSigninRequest({
+            state: userState,
+            nonce,
+        });
+        return request.url;
+    }
     return generateOidcAuthorizationUrl({
         metadata: opts.authMetadata,
         clientId: opts.clientId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telecrypt-io/storage",
-  "version": "0.2.6",
+  "version": "0.2.9",
   "license": "BUSL-1.1",
   "type": "module",
   "main": "dist/index.js",