@telecrypt-io/storage 0.5.25 → 0.5.27

package/dist/core/oidc.js

@@ -35,6 +35,9 @@ const MAX_OIDC_TOKEN_LENGTH = 8192;
 const MAX_OIDC_SCOPE_LENGTH = 4096;
 const MAX_OIDC_CONTACTS = 16;
 const MAX_OIDC_REDIRECT_URIS = 8;
+const LEGACY_MATRIX_SCOPE_PREFIX = "urn:matrix:client:";
+const MSC2967_MATRIX_SCOPE_PREFIX = "urn:matrix:org.matrix.msc2967.client:";
+const MATRIX_SCOPE_PREFIXES = [LEGACY_MATRIX_SCOPE_PREFIX, MSC2967_MATRIX_SCOPE_PREFIX];
 // MAS advertises a 20-minute device-code lifetime. Keep that provider window
 // as the hard upper bound while retaining a finite polling budget.
 const MAX_DEVICE_EXPIRES_IN_SECONDS = 20 * 60;
@@ -791,7 +794,9 @@ export async function waitForDeviceCodeLogin(authMetadata, clientId, session, si
             }, Math.min(OIDC_REQUEST_TIMEOUT_MS, remaining), signal);
             if (response.ok && isValidDeviceAccessTokenResponse(body)) {
                 const tokenResponse = validateDeviceAccessTokenResponse(body);
-                if (!requestedDeviceId || tokenResponse.scope !== generateScope(requestedDeviceId)) {
+                if (!requestedDeviceId ||
+                    typeof tokenResponse.scope !== "string" ||
+                    !scopeMatchesDevice(tokenResponse.scope, requestedDeviceId)) {
                     throw new OidcValidationError("OIDC device authorization returned an unexpected granted scope");
                 }
                 ensureOidcNotCancelled(signal, "device authorization");
@@ -940,9 +945,8 @@ export async function completeAuthorizationCodeFlow(code, state, signal) {
         validateBearerTokenResponse(body);
         validateTokenBounds(body, "authorization code exchange");
         const normalized = normalizeBearerTokenResponseTokenType(body);
-        const expectedScope = generateScope(context.deviceId);
         const grantedScope = normalized.scope;
-        if (typeof grantedScope !== "string" || grantedScope !== expectedScope) {
+        if (typeof grantedScope !== "string" || !scopeMatchesDevice(grantedScope, context.deviceId)) {
             throw new StorageError("OIDC authorization code exchange returned an unexpected granted scope");
         }
         const tokenResponse = {
@@ -975,12 +979,52 @@ export function extractDeviceIdFromScope(scope) {
         return null;
     }
     const tokens = scope.split(/\s+/);
-    const deviceTokens = tokens.filter((token) => token.startsWith("urn:matrix:client:device:"));
+    const deviceTokens = tokens.filter((token) => MATRIX_SCOPE_PREFIXES.some((prefix) => token.startsWith(`${prefix}device:`)));
     if (deviceTokens.length !== 1)
         return null;
-    const deviceId = deviceTokens[0].slice("urn:matrix:client:device:".length);
+    const deviceToken = deviceTokens[0];
+    const prefix = MATRIX_SCOPE_PREFIXES.find((candidate) => deviceToken.startsWith(`${candidate}device:`));
+    if (!prefix)
+        return null;
+    const deviceId = deviceToken.slice(`${prefix}device:`.length);
     return DEVICE_ID_PATTERN.test(deviceId) ? deviceId : null;
 }
+/**
+ * Accepts the legacy Matrix OAuth scope and the current MSC2967 namespace
+ * returned by MAS. The provider may add the standard `openid` scope, but the
+ * API and device grants must remain one exact namespace pair bound to the
+ * device that this client requested.
+ */
+function scopeMatchesDevice(scope, expectedDeviceId) {
+    if (typeof scope !== "string" ||
+        typeof expectedDeviceId !== "string" ||
+        !DEVICE_ID_PATTERN.test(expectedDeviceId) ||
+        scope.length === 0 ||
+        scope.length > MAX_OIDC_SCOPE_LENGTH ||
+        /[\u0000-\u001f\u007f]/.test(scope) ||
+        scope.trim() !== scope ||
+        /\s{2,}/.test(scope)) {
+        return false;
+    }
+    const tokens = scope.split(/\s+/);
+    if (new Set(tokens).size !== tokens.length)
+        return false;
+    return MATRIX_SCOPE_PREFIXES.some((prefix) => {
+        const expected = new Set([
+            `${prefix}api:*`,
+            `${prefix}device:${expectedDeviceId}`,
+            "openid",
+        ]);
+        const required = new Set([
+            `${prefix}api:*`,
+            `${prefix}device:${expectedDeviceId}`,
+        ]);
+        return (tokens.length >= required.size &&
+            tokens.length <= expected.size &&
+            tokens.every((token) => expected.has(token)) &&
+            [...required].every((token) => tokens.includes(token)));
+    });
+}
 function validateMatrixUserId(userId, serverName) {
     try {
         return validateCanonicalMatrixUserId(userId, serverName);
@@ -1120,8 +1164,7 @@ async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedD
             catch {
                 throw new StorageError("OIDC token refresh returned an invalid scope");
             }
-            if (extractDeviceIdFromScope(grantedScope) === null ||
-                grantedScope !== generateScope(expectedDeviceId)) {
+            if (!scopeMatchesDevice(grantedScope, expectedDeviceId)) {
                 throw new StorageError("OIDC token refresh returned an unexpected granted scope");
             }
         }

package/dist/core/operations.js

@@ -248,7 +248,8 @@ function assertTreeEmptyForDeletion(storage, tree, spaces) {
     try {
         files = tree
             .listAllFiles()
-            .filter((file) => !isMarkedFileDeleted(storage, tree.id, file.id));
+            .filter((file) => !isMarkedFileDeleted(storage, tree.id, file.id) &&
+            !isConfirmedDeletedFile(storage.getClient(), tree.id, file));
     }
     catch {
         throw new StorageError("could not enumerate storage files safely");
@@ -333,6 +334,26 @@ function isActiveRelationEvent(event) {
         !Array.isArray(content) &&
         Object.keys(content).length > 0);
 }
+/**
+ * A deleted MSC3089 branch is represented by an authoritative empty state
+ * event. Inactive branches with metadata are historical versions, and a
+ * missing or malformed state cannot prove that the file was deleted.
+ */
+function isConfirmedDeletedFile(client, treeId, file) {
+    if (file.isActive)
+        return false;
+    const stateEvents = readRelationEvents(client, treeId, UNSTABLE_MSC3089_BRANCH.name, file.id);
+    if (!stateEvents || stateEvents.length !== 1)
+        return false;
+    const stateEvent = stateEvents[0];
+    if (relationStateKey(stateEvent) !== file.id)
+        return false;
+    const content = stateEvent.getContent?.();
+    return (typeof content === "object" &&
+        content !== null &&
+        !Array.isArray(content) &&
+        Object.keys(content).length === 0);
+}
 /**
  * Deletion is intentionally narrower than MSC3089TreeSpace.delete(): a local
  * child graph is not proof that the rooms are exclusively owned by this tree.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telecrypt-io/storage",
-  "version": "0.5.25",
+  "version": "0.5.27",
   "license": "BUSL-1.1",
   "type": "module",
   "packageManager": "npm@11.19.0",