@unwanted/matrix-sdk-mini 34.12.0-1

package/lib/rust-crypto/CrossSigningIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CrossSigningIdentity.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/CrossSigningIdentity.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,UAAU,EAAqD,MAAM,oCAAoC,CAAC;AAGnH,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;GAGG;AACH,qBAAa,oBAAoB;IAEzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,UAAU,EAAE,UAAU,EACtB,wBAAwB,EAAE,wBAAwB,EAClD,aAAa,EAAE,uBAAuB;IAG3D;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiFlF;;;;;;OAMG;YACW,iBAAiB;IA+B/B;;;;OAIG;YACW,+BAA+B;CAmBhD"}

package/lib/rust-crypto/CrossSigningIdentity.js

@@ -0,0 +1,157 @@
+import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { logger } from "../logger.js";
+/** Manages the cross-signing keys for our own user.
+ *
+ * @internal
+ */
+export class CrossSigningIdentity {
+  constructor(olmMachine, outgoingRequestProcessor, secretStorage) {
+    this.olmMachine = olmMachine;
+    this.outgoingRequestProcessor = outgoingRequestProcessor;
+    this.secretStorage = secretStorage;
+  }
+
+  /**
+   * Initialise our cross-signing keys by creating new keys if they do not exist, and uploading to the server
+   */
+  bootstrapCrossSigning(opts) {
+    var _this = this;
+    return _asyncToGenerator(function* () {
+      if (opts.setupNewCrossSigning) {
+        yield _this.resetCrossSigning(opts.authUploadDeviceSigningKeys);
+        return;
+      }
+      var olmDeviceStatus = yield _this.olmMachine.crossSigningStatus();
+
+      // Try to fetch cross signing keys from the secret storage
+      var masterKeyFromSecretStorage = yield _this.secretStorage.get("m.cross_signing.master");
+      var selfSigningKeyFromSecretStorage = yield _this.secretStorage.get("m.cross_signing.self_signing");
+      var userSigningKeyFromSecretStorage = yield _this.secretStorage.get("m.cross_signing.user_signing");
+      var privateKeysInSecretStorage = Boolean(masterKeyFromSecretStorage && selfSigningKeyFromSecretStorage && userSigningKeyFromSecretStorage);
+      var olmDeviceHasKeys = olmDeviceStatus.hasMaster && olmDeviceStatus.hasUserSigning && olmDeviceStatus.hasSelfSigning;
+
+      // Log all relevant state for easier parsing of debug logs.
+      logger.log("bootstrapCrossSigning: starting", {
+        setupNewCrossSigning: opts.setupNewCrossSigning,
+        olmDeviceHasMaster: olmDeviceStatus.hasMaster,
+        olmDeviceHasUserSigning: olmDeviceStatus.hasUserSigning,
+        olmDeviceHasSelfSigning: olmDeviceStatus.hasSelfSigning,
+        privateKeysInSecretStorage
+      });
+      if (olmDeviceHasKeys) {
+        if (!(yield _this.secretStorage.hasKey())) {
+          logger.warn("bootstrapCrossSigning: Olm device has private keys, but secret storage is not yet set up; doing nothing for now.");
+          // the keys should get uploaded to 4S once that is set up.
+        } else if (!privateKeysInSecretStorage) {
+          // the device has the keys but they are not in 4S, so update it
+          logger.log("bootstrapCrossSigning: Olm device has private keys: exporting to secret storage");
+          yield _this.exportCrossSigningKeysToStorage();
+        } else {
+          logger.log("bootstrapCrossSigning: Olm device has private keys and they are saved in secret storage; doing nothing");
+        }
+      } /* (!olmDeviceHasKeys) */else {
+        if (privateKeysInSecretStorage) {
+          // they are in 4S, so import from there
+          logger.log("bootstrapCrossSigning: Cross-signing private keys not found locally, but they are available " + "in secret storage, reading storage and caching locally");
+          yield _this.olmMachine.importCrossSigningKeys(masterKeyFromSecretStorage, selfSigningKeyFromSecretStorage, userSigningKeyFromSecretStorage);
+
+          // Get the current device
+          var device = yield _this.olmMachine.getDevice(_this.olmMachine.userId, _this.olmMachine.deviceId);
+          try {
+            // Sign the device with our cross-signing key and upload the signature
+            var request = yield device.verify();
+            yield _this.outgoingRequestProcessor.makeOutgoingRequest(request);
+          } finally {
+            device.free();
+          }
+        } else {
+          logger.log("bootstrapCrossSigning: Cross-signing private keys not found locally or in secret storage, creating new keys");
+          yield _this.resetCrossSigning(opts.authUploadDeviceSigningKeys);
+        }
+      }
+
+      // TODO: we might previously have bootstrapped cross-signing but not completed uploading the keys to the
+      //   server -- in which case we should call OlmDevice.bootstrap_cross_signing. How do we know?
+      logger.log("bootstrapCrossSigning: complete");
+    })();
+  }
+
+  /** Reset our cross-signing keys
+   *
+   * This method will:
+   *   * Tell the OlmMachine to create new keys
+   *   * Upload the new public keys and the device signature to the server
+   *   * Upload the private keys to SSSS, if it is set up
+   */
+  resetCrossSigning(authUploadDeviceSigningKeys) {
+    var _this2 = this;
+    return _asyncToGenerator(function* () {
+      // XXX: We must find a way to make this atomic, currently if the user does not remember his account password
+      // or 4S passphrase/key the process will fail in a bad state, with keys rotated but not uploaded or saved in 4S.
+      var outgoingRequests = yield _this2.olmMachine.bootstrapCrossSigning(true);
+
+      // If 4S is configured we need to update it.
+      if (!(yield _this2.secretStorage.hasKey())) {
+        logger.warn("resetCrossSigning: Secret storage is not yet set up; not exporting keys to secret storage yet.");
+        // the keys should get uploaded to 4S once that is set up.
+      } else {
+        // Update 4S before uploading cross-signing keys, to stay consistent with legacy that asks
+        // 4S passphrase before asking for account password.
+        // Ultimately should be made atomic and resistant to forgotten password/passphrase.
+        logger.log("resetCrossSigning: exporting private keys to secret storage");
+        yield _this2.exportCrossSigningKeysToStorage();
+      }
+      logger.log("resetCrossSigning: publishing public keys to server");
+      for (var req of [outgoingRequests.uploadKeysRequest, outgoingRequests.uploadSigningKeysRequest, outgoingRequests.uploadSignaturesRequest]) {
+        if (req) {
+          yield _this2.outgoingRequestProcessor.makeOutgoingRequest(req, authUploadDeviceSigningKeys);
+        }
+      }
+    })();
+  }
+
+  /**
+   * Extract the cross-signing keys from the olm machine and save them to secret storage, if it is configured
+   *
+   * (If secret storage is *not* configured, we assume that the export will happen when it is set up)
+   */
+  exportCrossSigningKeysToStorage() {
+    var _this3 = this;
+    return _asyncToGenerator(function* () {
+      var exported = yield _this3.olmMachine.exportCrossSigningKeys();
+      /* istanbul ignore else (this function is only called when we know the olm machine has keys) */
+      if (exported !== null && exported !== void 0 && exported.masterKey) {
+        yield _this3.secretStorage.store("m.cross_signing.master", exported.masterKey);
+      } else {
+        logger.error("Cannot export MSK to secret storage, private key unknown");
+      }
+      if (exported !== null && exported !== void 0 && exported.self_signing_key) {
+        yield _this3.secretStorage.store("m.cross_signing.self_signing", exported.self_signing_key);
+      } else {
+        logger.error("Cannot export SSK to secret storage, private key unknown");
+      }
+      if (exported !== null && exported !== void 0 && exported.userSigningKey) {
+        yield _this3.secretStorage.store("m.cross_signing.user_signing", exported.userSigningKey);
+      } else {
+        logger.error("Cannot export USK to secret storage, private key unknown");
+      }
+    })();
+  }
+}
+//# sourceMappingURL=CrossSigningIdentity.js.map

package/lib/rust-crypto/CrossSigningIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CrossSigningIdentity.js","names":["logger","CrossSigningIdentity","constructor","olmMachine","outgoingRequestProcessor","secretStorage","bootstrapCrossSigning","opts","_this","_asyncToGenerator","setupNewCrossSigning","resetCrossSigning","authUploadDeviceSigningKeys","olmDeviceStatus","crossSigningStatus","masterKeyFromSecretStorage","get","selfSigningKeyFromSecretStorage","userSigningKeyFromSecretStorage","privateKeysInSecretStorage","Boolean","olmDeviceHasKeys","hasMaster","hasUserSigning","hasSelfSigning","log","olmDeviceHasMaster","olmDeviceHasUserSigning","olmDeviceHasSelfSigning","hasKey","warn","exportCrossSigningKeysToStorage","importCrossSigningKeys","device","getDevice","userId","deviceId","request","verify","makeOutgoingRequest","free","_this2","outgoingRequests","req","uploadKeysRequest","uploadSigningKeysRequest","uploadSignaturesRequest","_this3","exported","exportCrossSigningKeys","masterKey","store","error","self_signing_key","userSigningKey"],"sources":["../../src/rust-crypto/CrossSigningIdentity.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { OlmMachine, CrossSigningStatus, CrossSigningBootstrapRequests } from \"@matrix-org/matrix-sdk-crypto-wasm\";\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { BootstrapCrossSigningOpts } from \"../crypto-api/index.ts\";\nimport { logger } from \"../logger.ts\";\nimport { OutgoingRequestProcessor } from \"./OutgoingRequestProcessor.ts\";\nimport { UIAuthCallback } from \"../interactive-auth.ts\";\nimport { ServerSideSecretStorage } from \"../secret-storage.ts\";\n\n/** Manages the cross-signing keys for our own user.\n *\n * @internal\n */\nexport class CrossSigningIdentity {\n    public constructor(\n        private readonly olmMachine: OlmMachine,\n        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,\n        private readonly secretStorage: ServerSideSecretStorage,\n    ) {}\n\n    /**\n     * Initialise our cross-signing keys by creating new keys if they do not exist, and uploading to the server\n     */\n    public async bootstrapCrossSigning(opts: BootstrapCrossSigningOpts): Promise<void> {\n        if (opts.setupNewCrossSigning) {\n            await this.resetCrossSigning(opts.authUploadDeviceSigningKeys);\n            return;\n        }\n\n        const olmDeviceStatus: CrossSigningStatus = await this.olmMachine.crossSigningStatus();\n\n        // Try to fetch cross signing keys from the secret storage\n        const masterKeyFromSecretStorage = await this.secretStorage.get(\"m.cross_signing.master\");\n        const selfSigningKeyFromSecretStorage = await this.secretStorage.get(\"m.cross_signing.self_signing\");\n        const userSigningKeyFromSecretStorage = await this.secretStorage.get(\"m.cross_signing.user_signing\");\n        const privateKeysInSecretStorage = Boolean(\n            masterKeyFromSecretStorage && selfSigningKeyFromSecretStorage && userSigningKeyFromSecretStorage,\n        );\n\n        const olmDeviceHasKeys =\n            olmDeviceStatus.hasMaster && olmDeviceStatus.hasUserSigning && olmDeviceStatus.hasSelfSigning;\n\n        // Log all relevant state for easier parsing of debug logs.\n        logger.log(\"bootstrapCrossSigning: starting\", {\n            setupNewCrossSigning: opts.setupNewCrossSigning,\n            olmDeviceHasMaster: olmDeviceStatus.hasMaster,\n            olmDeviceHasUserSigning: olmDeviceStatus.hasUserSigning,\n            olmDeviceHasSelfSigning: olmDeviceStatus.hasSelfSigning,\n            privateKeysInSecretStorage,\n        });\n\n        if (olmDeviceHasKeys) {\n            if (!(await this.secretStorage.hasKey())) {\n                logger.warn(\n                    \"bootstrapCrossSigning: Olm device has private keys, but secret storage is not yet set up; doing nothing for now.\",\n                );\n                // the keys should get uploaded to 4S once that is set up.\n            } else if (!privateKeysInSecretStorage) {\n                // the device has the keys but they are not in 4S, so update it\n                logger.log(\"bootstrapCrossSigning: Olm device has private keys: exporting to secret storage\");\n                await this.exportCrossSigningKeysToStorage();\n            } else {\n                logger.log(\n                    \"bootstrapCrossSigning: Olm device has private keys and they are saved in secret storage; doing nothing\",\n                );\n            }\n        } /* (!olmDeviceHasKeys) */ else {\n            if (privateKeysInSecretStorage) {\n                // they are in 4S, so import from there\n                logger.log(\n                    \"bootstrapCrossSigning: Cross-signing private keys not found locally, but they are available \" +\n                        \"in secret storage, reading storage and caching locally\",\n                );\n                await this.olmMachine.importCrossSigningKeys(\n                    masterKeyFromSecretStorage,\n                    selfSigningKeyFromSecretStorage,\n                    userSigningKeyFromSecretStorage,\n                );\n\n                // Get the current device\n                const device: RustSdkCryptoJs.Device = await this.olmMachine.getDevice(\n                    this.olmMachine.userId,\n                    this.olmMachine.deviceId,\n                );\n                try {\n                    // Sign the device with our cross-signing key and upload the signature\n                    const request: RustSdkCryptoJs.SignatureUploadRequest = await device.verify();\n                    await this.outgoingRequestProcessor.makeOutgoingRequest(request);\n                } finally {\n                    device.free();\n                }\n            } else {\n                logger.log(\n                    \"bootstrapCrossSigning: Cross-signing private keys not found locally or in secret storage, creating new keys\",\n                );\n                await this.resetCrossSigning(opts.authUploadDeviceSigningKeys);\n            }\n        }\n\n        // TODO: we might previously have bootstrapped cross-signing but not completed uploading the keys to the\n        //   server -- in which case we should call OlmDevice.bootstrap_cross_signing. How do we know?\n        logger.log(\"bootstrapCrossSigning: complete\");\n    }\n\n    /** Reset our cross-signing keys\n     *\n     * This method will:\n     *   * Tell the OlmMachine to create new keys\n     *   * Upload the new public keys and the device signature to the server\n     *   * Upload the private keys to SSSS, if it is set up\n     */\n    private async resetCrossSigning(authUploadDeviceSigningKeys?: UIAuthCallback<void>): Promise<void> {\n        // XXX: We must find a way to make this atomic, currently if the user does not remember his account password\n        // or 4S passphrase/key the process will fail in a bad state, with keys rotated but not uploaded or saved in 4S.\n        const outgoingRequests: CrossSigningBootstrapRequests = await this.olmMachine.bootstrapCrossSigning(true);\n\n        // If 4S is configured we need to update it.\n        if (!(await this.secretStorage.hasKey())) {\n            logger.warn(\n                \"resetCrossSigning: Secret storage is not yet set up; not exporting keys to secret storage yet.\",\n            );\n            // the keys should get uploaded to 4S once that is set up.\n        } else {\n            // Update 4S before uploading cross-signing keys, to stay consistent with legacy that asks\n            // 4S passphrase before asking for account password.\n            // Ultimately should be made atomic and resistant to forgotten password/passphrase.\n            logger.log(\"resetCrossSigning: exporting private keys to secret storage\");\n            await this.exportCrossSigningKeysToStorage();\n        }\n\n        logger.log(\"resetCrossSigning: publishing public keys to server\");\n        for (const req of [\n            outgoingRequests.uploadKeysRequest,\n            outgoingRequests.uploadSigningKeysRequest,\n            outgoingRequests.uploadSignaturesRequest,\n        ]) {\n            if (req) {\n                await this.outgoingRequestProcessor.makeOutgoingRequest(req, authUploadDeviceSigningKeys);\n            }\n        }\n    }\n\n    /**\n     * Extract the cross-signing keys from the olm machine and save them to secret storage, if it is configured\n     *\n     * (If secret storage is *not* configured, we assume that the export will happen when it is set up)\n     */\n    private async exportCrossSigningKeysToStorage(): Promise<void> {\n        const exported: RustSdkCryptoJs.CrossSigningKeyExport | null = await this.olmMachine.exportCrossSigningKeys();\n        /* istanbul ignore else (this function is only called when we know the olm machine has keys) */\n        if (exported?.masterKey) {\n            await this.secretStorage.store(\"m.cross_signing.master\", exported.masterKey);\n        } else {\n            logger.error(`Cannot export MSK to secret storage, private key unknown`);\n        }\n        if (exported?.self_signing_key) {\n            await this.secretStorage.store(\"m.cross_signing.self_signing\", exported.self_signing_key);\n        } else {\n            logger.error(`Cannot export SSK to secret storage, private key unknown`);\n        }\n        if (exported?.userSigningKey) {\n            await this.secretStorage.store(\"m.cross_signing.user_signing\", exported.userSigningKey);\n        } else {\n            logger.error(`Cannot export USK to secret storage, private key unknown`);\n        }\n    }\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA,SAASA,MAAM,QAAQ,cAAc;AAKrC;AACA;AACA;AACA;AACA,OAAO,MAAMC,oBAAoB,CAAC;EACvBC,WAAWA,CACGC,UAAsB,EACtBC,wBAAkD,EAClDC,aAAsC,EACzD;IAAA,KAHmBF,UAAsB,GAAtBA,UAAsB;IAAA,KACtBC,wBAAkD,GAAlDA,wBAAkD;IAAA,KAClDC,aAAsC,GAAtCA,aAAsC;EACxD;;EAEH;AACJ;AACA;EACiBC,qBAAqBA,CAACC,IAA+B,EAAiB;IAAA,IAAAC,KAAA;IAAA,OAAAC,iBAAA;MAC/E,IAAIF,IAAI,CAACG,oBAAoB,EAAE;QAC3B,MAAMF,KAAI,CAACG,iBAAiB,CAACJ,IAAI,CAACK,2BAA2B,CAAC;QAC9D;MACJ;MAEA,IAAMC,eAAmC,SAASL,KAAI,CAACL,UAAU,CAACW,kBAAkB,CAAC,CAAC;;MAEtF;MACA,IAAMC,0BAA0B,SAASP,KAAI,CAACH,aAAa,CAACW,GAAG,CAAC,wBAAwB,CAAC;MACzF,IAAMC,+BAA+B,SAAST,KAAI,CAACH,aAAa,CAACW,GAAG,CAAC,8BAA8B,CAAC;MACpG,IAAME,+BAA+B,SAASV,KAAI,CAACH,aAAa,CAACW,GAAG,CAAC,8BAA8B,CAAC;MACpG,IAAMG,0BAA0B,GAAGC,OAAO,CACtCL,0BAA0B,IAAIE,+BAA+B,IAAIC,+BACrE,CAAC;MAED,IAAMG,gBAAgB,GAClBR,eAAe,CAACS,SAAS,IAAIT,eAAe,CAACU,cAAc,IAAIV,eAAe,CAACW,cAAc;;MAEjG;MACAxB,MAAM,CAACyB,GAAG,CAAC,iCAAiC,EAAE;QAC1Cf,oBAAoB,EAAEH,IAAI,CAACG,oBAAoB;QAC/CgB,kBAAkB,EAAEb,eAAe,CAACS,SAAS;QAC7CK,uBAAuB,EAAEd,eAAe,CAACU,cAAc;QACvDK,uBAAuB,EAAEf,eAAe,CAACW,cAAc;QACvDL;MACJ,CAAC,CAAC;MAEF,IAAIE,gBAAgB,EAAE;QAClB,IAAI,QAAQb,KAAI,CAACH,aAAa,CAACwB,MAAM,CAAC,CAAC,CAAC,EAAE;UACtC7B,MAAM,CAAC8B,IAAI,CACP,kHACJ,CAAC;UACD;QACJ,CAAC,MAAM,IAAI,CAACX,0BAA0B,EAAE;UACpC;UACAnB,MAAM,CAACyB,GAAG,CAAC,iFAAiF,CAAC;UAC7F,MAAMjB,KAAI,CAACuB,+BAA+B,CAAC,CAAC;QAChD,CAAC,MAAM;UACH/B,MAAM,CAACyB,GAAG,CACN,wGACJ,CAAC;QACL;MACJ,CAAC,CAAC,8BAA+B;QAC7B,IAAIN,0BAA0B,EAAE;UAC5B;UACAnB,MAAM,CAACyB,GAAG,CACN,8FAA8F,GAC1F,wDACR,CAAC;UACD,MAAMjB,KAAI,CAACL,UAAU,CAAC6B,sBAAsB,CACxCjB,0BAA0B,EAC1BE,+BAA+B,EAC/BC,+BACJ,CAAC;;UAED;UACA,IAAMe,MAA8B,SAASzB,KAAI,CAACL,UAAU,CAAC+B,SAAS,CAClE1B,KAAI,CAACL,UAAU,CAACgC,MAAM,EACtB3B,KAAI,CAACL,UAAU,CAACiC,QACpB,CAAC;UACD,IAAI;YACA;YACA,IAAMC,OAA+C,SAASJ,MAAM,CAACK,MAAM,CAAC,CAAC;YAC7E,MAAM9B,KAAI,CAACJ,wBAAwB,CAACmC,mBAAmB,CAACF,OAAO,CAAC;UACpE,CAAC,SAAS;YACNJ,MAAM,CAACO,IAAI,CAAC,CAAC;UACjB;QACJ,CAAC,MAAM;UACHxC,MAAM,CAACyB,GAAG,CACN,6GACJ,CAAC;UACD,MAAMjB,KAAI,CAACG,iBAAiB,CAACJ,IAAI,CAACK,2BAA2B,CAAC;QAClE;MACJ;;MAEA;MACA;MACAZ,MAAM,CAACyB,GAAG,CAAC,iCAAiC,CAAC;IAAC;EAClD;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;EACkBd,iBAAiBA,CAACC,2BAAkD,EAAiB;IAAA,IAAA6B,MAAA;IAAA,OAAAhC,iBAAA;MAC/F;MACA;MACA,IAAMiC,gBAA+C,SAASD,MAAI,CAACtC,UAAU,CAACG,qBAAqB,CAAC,IAAI,CAAC;;MAEzG;MACA,IAAI,QAAQmC,MAAI,CAACpC,aAAa,CAACwB,MAAM,CAAC,CAAC,CAAC,EAAE;QACtC7B,MAAM,CAAC8B,IAAI,CACP,gGACJ,CAAC;QACD;MACJ,CAAC,MAAM;QACH;QACA;QACA;QACA9B,MAAM,CAACyB,GAAG,CAAC,6DAA6D,CAAC;QACzE,MAAMgB,MAAI,CAACV,+BAA+B,CAAC,CAAC;MAChD;MAEA/B,MAAM,CAACyB,GAAG,CAAC,qDAAqD,CAAC;MACjE,KAAK,IAAMkB,GAAG,IAAI,CACdD,gBAAgB,CAACE,iBAAiB,EAClCF,gBAAgB,CAACG,wBAAwB,EACzCH,gBAAgB,CAACI,uBAAuB,CAC3C,EAAE;QACC,IAAIH,GAAG,EAAE;UACL,MAAMF,MAAI,CAACrC,wBAAwB,CAACmC,mBAAmB,CAACI,GAAG,EAAE/B,2BAA2B,CAAC;QAC7F;MACJ;IAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;EACkBmB,+BAA+BA,CAAA,EAAkB;IAAA,IAAAgB,MAAA;IAAA,OAAAtC,iBAAA;MAC3D,IAAMuC,QAAsD,SAASD,MAAI,CAAC5C,UAAU,CAAC8C,sBAAsB,CAAC,CAAC;MAC7G;MACA,IAAID,QAAQ,aAARA,QAAQ,eAARA,QAAQ,CAAEE,SAAS,EAAE;QACrB,MAAMH,MAAI,CAAC1C,aAAa,CAAC8C,KAAK,CAAC,wBAAwB,EAAEH,QAAQ,CAACE,SAAS,CAAC;MAChF,CAAC,MAAM;QACHlD,MAAM,CAACoD,KAAK,2DAA2D,CAAC;MAC5E;MACA,IAAIJ,QAAQ,aAARA,QAAQ,eAARA,QAAQ,CAAEK,gBAAgB,EAAE;QAC5B,MAAMN,MAAI,CAAC1C,aAAa,CAAC8C,KAAK,CAAC,8BAA8B,EAAEH,QAAQ,CAACK,gBAAgB,CAAC;MAC7F,CAAC,MAAM;QACHrD,MAAM,CAACoD,KAAK,2DAA2D,CAAC;MAC5E;MACA,IAAIJ,QAAQ,aAARA,QAAQ,eAARA,QAAQ,CAAEM,cAAc,EAAE;QAC1B,MAAMP,MAAI,CAAC1C,aAAa,CAAC8C,KAAK,CAAC,8BAA8B,EAAEH,QAAQ,CAACM,cAAc,CAAC;MAC3F,CAAC,MAAM;QACHtD,MAAM,CAACoD,KAAK,2DAA2D,CAAC;MAC5E;IAAC;EACL;AACJ","ignoreList":[]}

package/lib/rust-crypto/DehydratedDeviceManager.d.ts

@@ -0,0 +1,98 @@
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor.ts";
+import { IHttpOpts, MatrixHttpApi } from "../http-api/index.ts";
+import { ServerSideSecretStorage } from "../secret-storage.ts";
+import { Logger } from "../logger.ts";
+/**
+ * The unstable URL prefix for dehydrated device endpoints
+ */
+export declare const UnstablePrefix = "/_matrix/client/unstable/org.matrix.msc3814.v1";
+/**
+ * Manages dehydrated devices
+ *
+ * We have one of these per `RustCrypto`.  It's responsible for
+ *
+ * * determining server support for dehydrated devices
+ * * creating new dehydrated devices when requested, including periodically
+ *   replacing the dehydrated device with a new one
+ * * rehydrating a device when requested, and when present
+ *
+ * @internal
+ */
+export declare class DehydratedDeviceManager {
+    private readonly logger;
+    private readonly olmMachine;
+    private readonly http;
+    private readonly outgoingRequestProcessor;
+    private readonly secretStorage;
+    /** the secret key used for dehydrating and rehydrating */
+    private key?;
+    /** the ID of the interval for periodically replacing the dehydrated device */
+    private intervalId?;
+    constructor(logger: Logger, olmMachine: RustSdkCryptoJs.OlmMachine, http: MatrixHttpApi<IHttpOpts & {
+        onlyData: true;
+    }>, outgoingRequestProcessor: OutgoingRequestProcessor, secretStorage: ServerSideSecretStorage);
+    /**
+     * Return whether the server supports dehydrated devices.
+     */
+    isSupported(): Promise<boolean>;
+    /**
+     * Start using device dehydration.
+     *
+     * - Rehydrates a dehydrated device, if one is available.
+     * - Creates a new dehydration key, if necessary, and stores it in Secret
+     *   Storage.
+     *   - If `createNewKey` is set to true, always creates a new key.
+     *   - If a dehydration key is not available, creates a new one.
+     * - Creates a new dehydrated device, and schedules periodically creating
+     *   new dehydrated devices.
+     *
+     * @param createNewKey - whether to force creation of a new dehydration key.
+     *   This can be used, for example, if Secret Storage is being reset.
+     */
+    start(createNewKey?: boolean): Promise<void>;
+    /**
+     * Return whether the dehydration key is stored in Secret Storage.
+     */
+    isKeyStored(): Promise<boolean>;
+    /**
+     * Reset the dehydration key.
+     *
+     * Creates a new key and stores it in secret storage.
+     */
+    resetKey(): Promise<void>;
+    /**
+     * Get and cache the encryption key from secret storage.
+     *
+     * If `create` is `true`, creates a new key if no existing key is present.
+     *
+     * @returns the key, if available, or `null` if no key is available
+     */
+    private getKey;
+    /**
+     * Rehydrate the dehydrated device stored on the server.
+     *
+     * Checks if there is a dehydrated device on the server.  If so, rehydrates
+     * the device and processes the to-device events.
+     *
+     * Returns whether or not a dehydrated device was found.
+     */
+    rehydrateDeviceIfAvailable(): Promise<boolean>;
+    /**
+     * Creates and uploads a new dehydrated device.
+     *
+     * Creates and stores a new key in secret storage if none is available.
+     */
+    createAndUploadDehydratedDevice(): Promise<void>;
+    /**
+     * Schedule periodic creation of dehydrated devices.
+     */
+    scheduleDeviceDehydration(): Promise<void>;
+    /**
+     * Stop the dehydrated device manager.
+     *
+     * Cancels any scheduled dehydration tasks.
+     */
+    stop(): void;
+}
+//# sourceMappingURL=DehydratedDeviceManager.d.ts.map

package/lib/rust-crypto/DehydratedDeviceManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DehydratedDeviceManager.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/DehydratedDeviceManager.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,eAAe,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAe,aAAa,EAAU,MAAM,sBAAsB,CAAC;AAErF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAmBtC;;GAEG;AACH,eAAO,MAAM,cAAc,mDAAmD,CAAC;AAW/E;;;;;;;;;;;GAWG;AACH,qBAAa,uBAAuB;IAO5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAVlC,0DAA0D;IAC1D,OAAO,CAAC,GAAG,CAAC,CAAa;IACzB,8EAA8E;IAC9E,OAAO,CAAC,UAAU,CAAC,CAAiC;gBAG/B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,eAAe,CAAC,UAAU,EACtC,IAAI,EAAE,aAAa,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,EACnD,wBAAwB,EAAE,wBAAwB,EAClD,aAAa,EAAE,uBAAuB;IAG3D;;OAEG;IACU,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IA2B5C;;;;;;;;;;;;;OAaG;IACU,KAAK,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAezD;;OAEG;IACU,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAI5C;;;;OAIG;IACU,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtC;;;;;;OAMG;YACW,MAAM;IAepB;;;;;;;OAOG;IACU,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC;IAwE3D;;;;OAIG;IACU,+BAA+B,IAAI,OAAO,CAAC,IAAI,CAAC;IAW7D;;OAEG;IACU,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYvD;;;;OAIG;IACI,IAAI,IAAI,IAAI;CAMtB"}

package/lib/rust-crypto/DehydratedDeviceManager.js

@@ -0,0 +1,285 @@
+import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
+import _defineProperty from "@babel/runtime/helpers/defineProperty";
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+import { encodeUri } from "../utils.js";
+import { Method } from "../http-api/index.js";
+import { decodeBase64, encodeUnpaddedBase64 } from "../base64.js";
+
+/**
+ * The response body of `GET /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device`.
+ */
+
+/**
+ * The response body of `POST /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device/events`.
+ */
+
+/**
+ * The unstable URL prefix for dehydrated device endpoints
+ */
+export var UnstablePrefix = "/_matrix/client/unstable/org.matrix.msc3814.v1";
+/**
+ * The name used for the dehydration key in Secret Storage
+ */
+var SECRET_STORAGE_NAME = "org.matrix.msc3814";
+
+/**
+ * The interval between creating dehydrated devices. (one week)
+ */
+var DEHYDRATION_INTERVAL = 7 * 24 * 60 * 60 * 1000;
+
+/**
+ * Manages dehydrated devices
+ *
+ * We have one of these per `RustCrypto`.  It's responsible for
+ *
+ * * determining server support for dehydrated devices
+ * * creating new dehydrated devices when requested, including periodically
+ *   replacing the dehydrated device with a new one
+ * * rehydrating a device when requested, and when present
+ *
+ * @internal
+ */
+export class DehydratedDeviceManager {
+  constructor(logger, olmMachine, http, outgoingRequestProcessor, secretStorage) {
+    this.logger = logger;
+    this.olmMachine = olmMachine;
+    this.http = http;
+    this.outgoingRequestProcessor = outgoingRequestProcessor;
+    this.secretStorage = secretStorage;
+    /** the secret key used for dehydrating and rehydrating */
+    _defineProperty(this, "key", void 0);
+    /** the ID of the interval for periodically replacing the dehydrated device */
+    _defineProperty(this, "intervalId", void 0);
+  }
+
+  /**
+   * Return whether the server supports dehydrated devices.
+   */
+  isSupported() {
+    var _this = this;
+    return _asyncToGenerator(function* () {
+      // call the endpoint to get a dehydrated device.  If it returns an
+      // M_UNRECOGNIZED error, then dehydration is unsupported.  If it returns
+      // a successful response, or an M_NOT_FOUND, then dehydration is supported.
+      // Any other exceptions are passed through.
+      try {
+        yield _this.http.authedRequest(Method.Get, "/dehydrated_device", undefined, undefined, {
+          prefix: UnstablePrefix
+        });
+      } catch (error) {
+        var err = error;
+        if (err.errcode === "M_UNRECOGNIZED") {
+          return false;
+        } else if (err.errcode === "M_NOT_FOUND") {
+          return true;
+        }
+        throw error;
+      }
+      return true;
+    })();
+  }
+
+  /**
+   * Start using device dehydration.
+   *
+   * - Rehydrates a dehydrated device, if one is available.
+   * - Creates a new dehydration key, if necessary, and stores it in Secret
+   *   Storage.
+   *   - If `createNewKey` is set to true, always creates a new key.
+   *   - If a dehydration key is not available, creates a new one.
+   * - Creates a new dehydrated device, and schedules periodically creating
+   *   new dehydrated devices.
+   *
+   * @param createNewKey - whether to force creation of a new dehydration key.
+   *   This can be used, for example, if Secret Storage is being reset.
+   */
+  start(createNewKey) {
+    var _this2 = this;
+    return _asyncToGenerator(function* () {
+      _this2.stop();
+      try {
+        yield _this2.rehydrateDeviceIfAvailable();
+      } catch (e) {
+        // If rehydration fails, there isn't much we can do about it.  Log
+        // the error, and create a new device.
+        _this2.logger.info("dehydration: Error rehydrating device:", e);
+      }
+      if (createNewKey) {
+        yield _this2.resetKey();
+      }
+      yield _this2.scheduleDeviceDehydration();
+    })();
+  }
+
+  /**
+   * Return whether the dehydration key is stored in Secret Storage.
+   */
+  isKeyStored() {
+    var _this3 = this;
+    return _asyncToGenerator(function* () {
+      return Boolean(yield _this3.secretStorage.isStored(SECRET_STORAGE_NAME));
+    })();
+  }
+
+  /**
+   * Reset the dehydration key.
+   *
+   * Creates a new key and stores it in secret storage.
+   */
+  resetKey() {
+    var _this4 = this;
+    return _asyncToGenerator(function* () {
+      var key = new Uint8Array(32);
+      globalThis.crypto.getRandomValues(key);
+      yield _this4.secretStorage.store(SECRET_STORAGE_NAME, encodeUnpaddedBase64(key));
+      _this4.key = key;
+    })();
+  }
+
+  /**
+   * Get and cache the encryption key from secret storage.
+   *
+   * If `create` is `true`, creates a new key if no existing key is present.
+   *
+   * @returns the key, if available, or `null` if no key is available
+   */
+  getKey(create) {
+    var _this5 = this;
+    return _asyncToGenerator(function* () {
+      if (_this5.key === undefined) {
+        var keyB64 = yield _this5.secretStorage.get(SECRET_STORAGE_NAME);
+        if (keyB64 === undefined) {
+          if (!create) {
+            return null;
+          }
+          yield _this5.resetKey();
+        } else {
+          _this5.key = decodeBase64(keyB64);
+        }
+      }
+      return _this5.key;
+    })();
+  }
+
+  /**
+   * Rehydrate the dehydrated device stored on the server.
+   *
+   * Checks if there is a dehydrated device on the server.  If so, rehydrates
+   * the device and processes the to-device events.
+   *
+   * Returns whether or not a dehydrated device was found.
+   */
+  rehydrateDeviceIfAvailable() {
+    var _this6 = this;
+    return _asyncToGenerator(function* () {
+      var key = yield _this6.getKey(false);
+      if (!key) {
+        return false;
+      }
+      var dehydratedDeviceResp;
+      try {
+        dehydratedDeviceResp = yield _this6.http.authedRequest(Method.Get, "/dehydrated_device", undefined, undefined, {
+          prefix: UnstablePrefix
+        });
+      } catch (error) {
+        var err = error;
+        // We ignore M_NOT_FOUND (there is no dehydrated device, so nothing
+        // us to do) and M_UNRECOGNIZED (the server does not understand the
+        // endpoint).  We pass through any other errors.
+        if (err.errcode === "M_NOT_FOUND" || err.errcode === "M_UNRECOGNIZED") {
+          _this6.logger.info("dehydration: No dehydrated device");
+          return false;
+        }
+        throw err;
+      }
+      _this6.logger.info("dehydration: dehydrated device found");
+      var rehydratedDevice = yield _this6.olmMachine.dehydratedDevices().rehydrate(key, new RustSdkCryptoJs.DeviceId(dehydratedDeviceResp.device_id), JSON.stringify(dehydratedDeviceResp.device_data));
+      _this6.logger.info("dehydration: device rehydrated");
+      var nextBatch = undefined;
+      var toDeviceCount = 0;
+      var roomKeyCount = 0;
+      var path = encodeUri("/dehydrated_device/$device_id/events", {
+        $device_id: dehydratedDeviceResp.device_id
+      });
+      // eslint-disable-next-line no-constant-condition
+      while (true) {
+        var eventResp = yield _this6.http.authedRequest(Method.Post, path, undefined, nextBatch ? {
+          next_batch: nextBatch
+        } : {}, {
+          prefix: UnstablePrefix
+        });
+        if (eventResp.events.length === 0) {
+          break;
+        }
+        toDeviceCount += eventResp.events.length;
+        nextBatch = eventResp.next_batch;
+        var roomKeyInfos = yield rehydratedDevice.receiveEvents(JSON.stringify(eventResp.events));
+        roomKeyCount += roomKeyInfos.length;
+      }
+      _this6.logger.info("dehydration: received ".concat(roomKeyCount, " room keys from ").concat(toDeviceCount, " to-device events"));
+      return true;
+    })();
+  }
+
+  /**
+   * Creates and uploads a new dehydrated device.
+   *
+   * Creates and stores a new key in secret storage if none is available.
+   */
+  createAndUploadDehydratedDevice() {
+    var _this7 = this;
+    return _asyncToGenerator(function* () {
+      var key = yield _this7.getKey(true);
+      var dehydratedDevice = yield _this7.olmMachine.dehydratedDevices().create();
+      var request = yield dehydratedDevice.keysForUpload("Dehydrated device", key);
+      yield _this7.outgoingRequestProcessor.makeOutgoingRequest(request);
+      _this7.logger.info("dehydration: uploaded device");
+    })();
+  }
+
+  /**
+   * Schedule periodic creation of dehydrated devices.
+   */
+  scheduleDeviceDehydration() {
+    var _this8 = this;
+    return _asyncToGenerator(function* () {
+      // cancel any previously-scheduled tasks
+      _this8.stop();
+      yield _this8.createAndUploadDehydratedDevice();
+      _this8.intervalId = setInterval(() => {
+        _this8.createAndUploadDehydratedDevice().catch(error => {
+          _this8.logger.error("Error creating dehydrated device:", error);
+        });
+      }, DEHYDRATION_INTERVAL);
+    })();
+  }
+
+  /**
+   * Stop the dehydrated device manager.
+   *
+   * Cancels any scheduled dehydration tasks.
+   */
+  stop() {
+    if (this.intervalId) {
+      clearInterval(this.intervalId);
+      this.intervalId = undefined;
+    }
+  }
+}
+//# sourceMappingURL=DehydratedDeviceManager.js.map

package/lib/rust-crypto/DehydratedDeviceManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DehydratedDeviceManager.js","names":["RustSdkCryptoJs","encodeUri","Method","decodeBase64","encodeUnpaddedBase64","UnstablePrefix","SECRET_STORAGE_NAME","DEHYDRATION_INTERVAL","DehydratedDeviceManager","constructor","logger","olmMachine","http","outgoingRequestProcessor","secretStorage","_defineProperty","isSupported","_this","_asyncToGenerator","authedRequest","Get","undefined","prefix","error","err","errcode","start","createNewKey","_this2","stop","rehydrateDeviceIfAvailable","e","info","resetKey","scheduleDeviceDehydration","isKeyStored","_this3","Boolean","isStored","_this4","key","Uint8Array","globalThis","crypto","getRandomValues","store","getKey","create","_this5","keyB64","get","_this6","dehydratedDeviceResp","rehydratedDevice","dehydratedDevices","rehydrate","DeviceId","device_id","JSON","stringify","device_data","nextBatch","toDeviceCount","roomKeyCount","path","$device_id","eventResp","Post","next_batch","events","length","roomKeyInfos","receiveEvents","concat","createAndUploadDehydratedDevice","_this7","dehydratedDevice","request","keysForUpload","makeOutgoingRequest","_this8","intervalId","setInterval","catch","clearInterval"],"sources":["../../src/rust-crypto/DehydratedDeviceManager.ts"],"sourcesContent":["/*\nCopyright 2024 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { OutgoingRequestProcessor } from \"./OutgoingRequestProcessor.ts\";\nimport { encodeUri } from \"../utils.ts\";\nimport { IHttpOpts, MatrixError, MatrixHttpApi, Method } from \"../http-api/index.ts\";\nimport { IToDeviceEvent } from \"../sync-accumulator.ts\";\nimport { ServerSideSecretStorage } from \"../secret-storage.ts\";\nimport { decodeBase64, encodeUnpaddedBase64 } from \"../base64.ts\";\nimport { Logger } from \"../logger.ts\";\n\n/**\n * The response body of `GET /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device`.\n */\ninterface DehydratedDeviceResp {\n    device_id: string;\n    device_data: {\n        algorithm: string;\n    };\n}\n/**\n * The response body of `POST /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device/events`.\n */\ninterface DehydratedDeviceEventsResp {\n    events: IToDeviceEvent[];\n    next_batch: string;\n}\n\n/**\n * The unstable URL prefix for dehydrated device endpoints\n */\nexport const UnstablePrefix = \"/_matrix/client/unstable/org.matrix.msc3814.v1\";\n/**\n * The name used for the dehydration key in Secret Storage\n */\nconst SECRET_STORAGE_NAME = \"org.matrix.msc3814\";\n\n/**\n * The interval between creating dehydrated devices. (one week)\n */\nconst DEHYDRATION_INTERVAL = 7 * 24 * 60 * 60 * 1000;\n\n/**\n * Manages dehydrated devices\n *\n * We have one of these per `RustCrypto`.  It's responsible for\n *\n * * determining server support for dehydrated devices\n * * creating new dehydrated devices when requested, including periodically\n *   replacing the dehydrated device with a new one\n * * rehydrating a device when requested, and when present\n *\n * @internal\n */\nexport class DehydratedDeviceManager {\n    /** the secret key used for dehydrating and rehydrating */\n    private key?: Uint8Array;\n    /** the ID of the interval for periodically replacing the dehydrated device */\n    private intervalId?: ReturnType<typeof setInterval>;\n\n    public constructor(\n        private readonly logger: Logger,\n        private readonly olmMachine: RustSdkCryptoJs.OlmMachine,\n        private readonly http: MatrixHttpApi<IHttpOpts & { onlyData: true }>,\n        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,\n        private readonly secretStorage: ServerSideSecretStorage,\n    ) {}\n\n    /**\n     * Return whether the server supports dehydrated devices.\n     */\n    public async isSupported(): Promise<boolean> {\n        // call the endpoint to get a dehydrated device.  If it returns an\n        // M_UNRECOGNIZED error, then dehydration is unsupported.  If it returns\n        // a successful response, or an M_NOT_FOUND, then dehydration is supported.\n        // Any other exceptions are passed through.\n        try {\n            await this.http.authedRequest<DehydratedDeviceResp>(\n                Method.Get,\n                \"/dehydrated_device\",\n                undefined,\n                undefined,\n                {\n                    prefix: UnstablePrefix,\n                },\n            );\n        } catch (error) {\n            const err = error as MatrixError;\n            if (err.errcode === \"M_UNRECOGNIZED\") {\n                return false;\n            } else if (err.errcode === \"M_NOT_FOUND\") {\n                return true;\n            }\n            throw error;\n        }\n        return true;\n    }\n\n    /**\n     * Start using device dehydration.\n     *\n     * - Rehydrates a dehydrated device, if one is available.\n     * - Creates a new dehydration key, if necessary, and stores it in Secret\n     *   Storage.\n     *   - If `createNewKey` is set to true, always creates a new key.\n     *   - If a dehydration key is not available, creates a new one.\n     * - Creates a new dehydrated device, and schedules periodically creating\n     *   new dehydrated devices.\n     *\n     * @param createNewKey - whether to force creation of a new dehydration key.\n     *   This can be used, for example, if Secret Storage is being reset.\n     */\n    public async start(createNewKey?: boolean): Promise<void> {\n        this.stop();\n        try {\n            await this.rehydrateDeviceIfAvailable();\n        } catch (e) {\n            // If rehydration fails, there isn't much we can do about it.  Log\n            // the error, and create a new device.\n            this.logger.info(\"dehydration: Error rehydrating device:\", e);\n        }\n        if (createNewKey) {\n            await this.resetKey();\n        }\n        await this.scheduleDeviceDehydration();\n    }\n\n    /**\n     * Return whether the dehydration key is stored in Secret Storage.\n     */\n    public async isKeyStored(): Promise<boolean> {\n        return Boolean(await this.secretStorage.isStored(SECRET_STORAGE_NAME));\n    }\n\n    /**\n     * Reset the dehydration key.\n     *\n     * Creates a new key and stores it in secret storage.\n     */\n    public async resetKey(): Promise<void> {\n        const key = new Uint8Array(32);\n        globalThis.crypto.getRandomValues(key);\n        await this.secretStorage.store(SECRET_STORAGE_NAME, encodeUnpaddedBase64(key));\n        this.key = key;\n    }\n\n    /**\n     * Get and cache the encryption key from secret storage.\n     *\n     * If `create` is `true`, creates a new key if no existing key is present.\n     *\n     * @returns the key, if available, or `null` if no key is available\n     */\n    private async getKey(create: boolean): Promise<Uint8Array | null> {\n        if (this.key === undefined) {\n            const keyB64 = await this.secretStorage.get(SECRET_STORAGE_NAME);\n            if (keyB64 === undefined) {\n                if (!create) {\n                    return null;\n                }\n                await this.resetKey();\n            } else {\n                this.key = decodeBase64(keyB64);\n            }\n        }\n        return this.key!;\n    }\n\n    /**\n     * Rehydrate the dehydrated device stored on the server.\n     *\n     * Checks if there is a dehydrated device on the server.  If so, rehydrates\n     * the device and processes the to-device events.\n     *\n     * Returns whether or not a dehydrated device was found.\n     */\n    public async rehydrateDeviceIfAvailable(): Promise<boolean> {\n        const key = await this.getKey(false);\n        if (!key) {\n            return false;\n        }\n\n        let dehydratedDeviceResp;\n        try {\n            dehydratedDeviceResp = await this.http.authedRequest<DehydratedDeviceResp>(\n                Method.Get,\n                \"/dehydrated_device\",\n                undefined,\n                undefined,\n                {\n                    prefix: UnstablePrefix,\n                },\n            );\n        } catch (error) {\n            const err = error as MatrixError;\n            // We ignore M_NOT_FOUND (there is no dehydrated device, so nothing\n            // us to do) and M_UNRECOGNIZED (the server does not understand the\n            // endpoint).  We pass through any other errors.\n            if (err.errcode === \"M_NOT_FOUND\" || err.errcode === \"M_UNRECOGNIZED\") {\n                this.logger.info(\"dehydration: No dehydrated device\");\n                return false;\n            }\n            throw err;\n        }\n\n        this.logger.info(\"dehydration: dehydrated device found\");\n\n        const rehydratedDevice = await this.olmMachine\n            .dehydratedDevices()\n            .rehydrate(\n                key,\n                new RustSdkCryptoJs.DeviceId(dehydratedDeviceResp.device_id),\n                JSON.stringify(dehydratedDeviceResp.device_data),\n            );\n\n        this.logger.info(\"dehydration: device rehydrated\");\n\n        let nextBatch: string | undefined = undefined;\n        let toDeviceCount = 0;\n        let roomKeyCount = 0;\n        const path = encodeUri(\"/dehydrated_device/$device_id/events\", {\n            $device_id: dehydratedDeviceResp.device_id,\n        });\n        // eslint-disable-next-line no-constant-condition\n        while (true) {\n            const eventResp: DehydratedDeviceEventsResp = await this.http.authedRequest<DehydratedDeviceEventsResp>(\n                Method.Post,\n                path,\n                undefined,\n                nextBatch ? { next_batch: nextBatch } : {},\n                {\n                    prefix: UnstablePrefix,\n                },\n            );\n\n            if (eventResp.events.length === 0) {\n                break;\n            }\n            toDeviceCount += eventResp.events.length;\n            nextBatch = eventResp.next_batch;\n            const roomKeyInfos = await rehydratedDevice.receiveEvents(JSON.stringify(eventResp.events));\n            roomKeyCount += roomKeyInfos.length;\n        }\n        this.logger.info(`dehydration: received ${roomKeyCount} room keys from ${toDeviceCount} to-device events`);\n\n        return true;\n    }\n\n    /**\n     * Creates and uploads a new dehydrated device.\n     *\n     * Creates and stores a new key in secret storage if none is available.\n     */\n    public async createAndUploadDehydratedDevice(): Promise<void> {\n        const key = (await this.getKey(true))!;\n\n        const dehydratedDevice = await this.olmMachine.dehydratedDevices().create();\n        const request = await dehydratedDevice.keysForUpload(\"Dehydrated device\", key);\n\n        await this.outgoingRequestProcessor.makeOutgoingRequest(request);\n\n        this.logger.info(\"dehydration: uploaded device\");\n    }\n\n    /**\n     * Schedule periodic creation of dehydrated devices.\n     */\n    public async scheduleDeviceDehydration(): Promise<void> {\n        // cancel any previously-scheduled tasks\n        this.stop();\n\n        await this.createAndUploadDehydratedDevice();\n        this.intervalId = setInterval(() => {\n            this.createAndUploadDehydratedDevice().catch((error) => {\n                this.logger.error(\"Error creating dehydrated device:\", error);\n            });\n        }, DEHYDRATION_INTERVAL);\n    }\n\n    /**\n     * Stop the dehydrated device manager.\n     *\n     * Cancels any scheduled dehydration tasks.\n     */\n    public stop(): void {\n        if (this.intervalId) {\n            clearInterval(this.intervalId);\n            this.intervalId = undefined;\n        }\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,KAAKA,eAAe,MAAM,oCAAoC;AAGrE,SAASC,SAAS,QAAQ,aAAa;AACvC,SAAgDC,MAAM,QAAQ,sBAAsB;AAGpF,SAASC,YAAY,EAAEC,oBAAoB,QAAQ,cAAc;;AAGjE;AACA;AACA;;AAOA;AACA;AACA;;AAMA;AACA;AACA;AACA,OAAO,IAAMC,cAAc,GAAG,gDAAgD;AAC9E;AACA;AACA;AACA,IAAMC,mBAAmB,GAAG,oBAAoB;;AAEhD;AACA;AACA;AACA,IAAMC,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;;AAEpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,uBAAuB,CAAC;EAM1BC,WAAWA,CACGC,MAAc,EACdC,UAAsC,EACtCC,IAAmD,EACnDC,wBAAkD,EAClDC,aAAsC,EACzD;IAAA,KALmBJ,MAAc,GAAdA,MAAc;IAAA,KACdC,UAAsC,GAAtCA,UAAsC;IAAA,KACtCC,IAAmD,GAAnDA,IAAmD;IAAA,KACnDC,wBAAkD,GAAlDA,wBAAkD;IAAA,KAClDC,aAAsC,GAAtCA,aAAsC;IAV3D;IAAAC,eAAA;IAEA;IAAAA,eAAA;EASG;;EAEH;AACJ;AACA;EACiBC,WAAWA,CAAA,EAAqB;IAAA,IAAAC,KAAA;IAAA,OAAAC,iBAAA;MACzC;MACA;MACA;MACA;MACA,IAAI;QACA,MAAMD,KAAI,CAACL,IAAI,CAACO,aAAa,CACzBjB,MAAM,CAACkB,GAAG,EACV,oBAAoB,EACpBC,SAAS,EACTA,SAAS,EACT;UACIC,MAAM,EAAEjB;QACZ,CACJ,CAAC;MACL,CAAC,CAAC,OAAOkB,KAAK,EAAE;QACZ,IAAMC,GAAG,GAAGD,KAAoB;QAChC,IAAIC,GAAG,CAACC,OAAO,KAAK,gBAAgB,EAAE;UAClC,OAAO,KAAK;QAChB,CAAC,MAAM,IAAID,GAAG,CAACC,OAAO,KAAK,aAAa,EAAE;UACtC,OAAO,IAAI;QACf;QACA,MAAMF,KAAK;MACf;MACA,OAAO,IAAI;IAAC;EAChB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACiBG,KAAKA,CAACC,YAAsB,EAAiB;IAAA,IAAAC,MAAA;IAAA,OAAAV,iBAAA;MACtDU,MAAI,CAACC,IAAI,CAAC,CAAC;MACX,IAAI;QACA,MAAMD,MAAI,CAACE,0BAA0B,CAAC,CAAC;MAC3C,CAAC,CAAC,OAAOC,CAAC,EAAE;QACR;QACA;QACAH,MAAI,CAAClB,MAAM,CAACsB,IAAI,CAAC,wCAAwC,EAAED,CAAC,CAAC;MACjE;MACA,IAAIJ,YAAY,EAAE;QACd,MAAMC,MAAI,CAACK,QAAQ,CAAC,CAAC;MACzB;MACA,MAAML,MAAI,CAACM,yBAAyB,CAAC,CAAC;IAAC;EAC3C;;EAEA;AACJ;AACA;EACiBC,WAAWA,CAAA,EAAqB;IAAA,IAAAC,MAAA;IAAA,OAAAlB,iBAAA;MACzC,OAAOmB,OAAO,OAAOD,MAAI,CAACtB,aAAa,CAACwB,QAAQ,CAAChC,mBAAmB,CAAC,CAAC;IAAC;EAC3E;;EAEA;AACJ;AACA;AACA;AACA;EACiB2B,QAAQA,CAAA,EAAkB;IAAA,IAAAM,MAAA;IAAA,OAAArB,iBAAA;MACnC,IAAMsB,GAAG,GAAG,IAAIC,UAAU,CAAC,EAAE,CAAC;MAC9BC,UAAU,CAACC,MAAM,CAACC,eAAe,CAACJ,GAAG,CAAC;MACtC,MAAMD,MAAI,CAACzB,aAAa,CAAC+B,KAAK,CAACvC,mBAAmB,EAAEF,oBAAoB,CAACoC,GAAG,CAAC,CAAC;MAC9ED,MAAI,CAACC,GAAG,GAAGA,GAAG;IAAC;EACnB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;EACkBM,MAAMA,CAACC,MAAe,EAA8B;IAAA,IAAAC,MAAA;IAAA,OAAA9B,iBAAA;MAC9D,IAAI8B,MAAI,CAACR,GAAG,KAAKnB,SAAS,EAAE;QACxB,IAAM4B,MAAM,SAASD,MAAI,CAAClC,aAAa,CAACoC,GAAG,CAAC5C,mBAAmB,CAAC;QAChE,IAAI2C,MAAM,KAAK5B,SAAS,EAAE;UACtB,IAAI,CAAC0B,MAAM,EAAE;YACT,OAAO,IAAI;UACf;UACA,MAAMC,MAAI,CAACf,QAAQ,CAAC,CAAC;QACzB,CAAC,MAAM;UACHe,MAAI,CAACR,GAAG,GAAGrC,YAAY,CAAC8C,MAAM,CAAC;QACnC;MACJ;MACA,OAAOD,MAAI,CAACR,GAAG;IAAE;EACrB;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACiBV,0BAA0BA,CAAA,EAAqB;IAAA,IAAAqB,MAAA;IAAA,OAAAjC,iBAAA;MACxD,IAAMsB,GAAG,SAASW,MAAI,CAACL,MAAM,CAAC,KAAK,CAAC;MACpC,IAAI,CAACN,GAAG,EAAE;QACN,OAAO,KAAK;MAChB;MAEA,IAAIY,oBAAoB;MACxB,IAAI;QACAA,oBAAoB,SAASD,MAAI,CAACvC,IAAI,CAACO,aAAa,CAChDjB,MAAM,CAACkB,GAAG,EACV,oBAAoB,EACpBC,SAAS,EACTA,SAAS,EACT;UACIC,MAAM,EAAEjB;QACZ,CACJ,CAAC;MACL,CAAC,CAAC,OAAOkB,KAAK,EAAE;QACZ,IAAMC,GAAG,GAAGD,KAAoB;QAChC;QACA;QACA;QACA,IAAIC,GAAG,CAACC,OAAO,KAAK,aAAa,IAAID,GAAG,CAACC,OAAO,KAAK,gBAAgB,EAAE;UACnE0B,MAAI,CAACzC,MAAM,CAACsB,IAAI,CAAC,mCAAmC,CAAC;UACrD,OAAO,KAAK;QAChB;QACA,MAAMR,GAAG;MACb;MAEA2B,MAAI,CAACzC,MAAM,CAACsB,IAAI,CAAC,sCAAsC,CAAC;MAExD,IAAMqB,gBAAgB,SAASF,MAAI,CAACxC,UAAU,CACzC2C,iBAAiB,CAAC,CAAC,CACnBC,SAAS,CACNf,GAAG,EACH,IAAIxC,eAAe,CAACwD,QAAQ,CAACJ,oBAAoB,CAACK,SAAS,CAAC,EAC5DC,IAAI,CAACC,SAAS,CAACP,oBAAoB,CAACQ,WAAW,CACnD,CAAC;MAELT,MAAI,CAACzC,MAAM,CAACsB,IAAI,CAAC,gCAAgC,CAAC;MAElD,IAAI6B,SAA6B,GAAGxC,SAAS;MAC7C,IAAIyC,aAAa,GAAG,CAAC;MACrB,IAAIC,YAAY,GAAG,CAAC;MACpB,IAAMC,IAAI,GAAG/D,SAAS,CAAC,sCAAsC,EAAE;QAC3DgE,UAAU,EAAEb,oBAAoB,CAACK;MACrC,CAAC,CAAC;MACF;MACA,OAAO,IAAI,EAAE;QACT,IAAMS,SAAqC,SAASf,MAAI,CAACvC,IAAI,CAACO,aAAa,CACvEjB,MAAM,CAACiE,IAAI,EACXH,IAAI,EACJ3C,SAAS,EACTwC,SAAS,GAAG;UAAEO,UAAU,EAAEP;QAAU,CAAC,GAAG,CAAC,CAAC,EAC1C;UACIvC,MAAM,EAAEjB;QACZ,CACJ,CAAC;QAED,IAAI6D,SAAS,CAACG,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;UAC/B;QACJ;QACAR,aAAa,IAAII,SAAS,CAACG,MAAM,CAACC,MAAM;QACxCT,SAAS,GAAGK,SAAS,CAACE,UAAU;QAChC,IAAMG,YAAY,SAASlB,gBAAgB,CAACmB,aAAa,CAACd,IAAI,CAACC,SAAS,CAACO,SAAS,CAACG,MAAM,CAAC,CAAC;QAC3FN,YAAY,IAAIQ,YAAY,CAACD,MAAM;MACvC;MACAnB,MAAI,CAACzC,MAAM,CAACsB,IAAI,0BAAAyC,MAAA,CAA0BV,YAAY,sBAAAU,MAAA,CAAmBX,aAAa,sBAAmB,CAAC;MAE1G,OAAO,IAAI;IAAC;EAChB;;EAEA;AACJ;AACA;AACA;AACA;EACiBY,+BAA+BA,CAAA,EAAkB;IAAA,IAAAC,MAAA;IAAA,OAAAzD,iBAAA;MAC1D,IAAMsB,GAAG,SAAUmC,MAAI,CAAC7B,MAAM,CAAC,IAAI,CAAG;MAEtC,IAAM8B,gBAAgB,SAASD,MAAI,CAAChE,UAAU,CAAC2C,iBAAiB,CAAC,CAAC,CAACP,MAAM,CAAC,CAAC;MAC3E,IAAM8B,OAAO,SAASD,gBAAgB,CAACE,aAAa,CAAC,mBAAmB,EAAEtC,GAAG,CAAC;MAE9E,MAAMmC,MAAI,CAAC9D,wBAAwB,CAACkE,mBAAmB,CAACF,OAAO,CAAC;MAEhEF,MAAI,CAACjE,MAAM,CAACsB,IAAI,CAAC,8BAA8B,CAAC;IAAC;EACrD;;EAEA;AACJ;AACA;EACiBE,yBAAyBA,CAAA,EAAkB;IAAA,IAAA8C,MAAA;IAAA,OAAA9D,iBAAA;MACpD;MACA8D,MAAI,CAACnD,IAAI,CAAC,CAAC;MAEX,MAAMmD,MAAI,CAACN,+BAA+B,CAAC,CAAC;MAC5CM,MAAI,CAACC,UAAU,GAAGC,WAAW,CAAC,MAAM;QAChCF,MAAI,CAACN,+BAA+B,CAAC,CAAC,CAACS,KAAK,CAAE5D,KAAK,IAAK;UACpDyD,MAAI,CAACtE,MAAM,CAACa,KAAK,CAAC,mCAAmC,EAAEA,KAAK,CAAC;QACjE,CAAC,CAAC;MACN,CAAC,EAAEhB,oBAAoB,CAAC;IAAC;EAC7B;;EAEA;AACJ;AACA;AACA;AACA;EACWsB,IAAIA,CAAA,EAAS;IAChB,IAAI,IAAI,CAACoD,UAAU,EAAE;MACjBG,aAAa,CAAC,IAAI,CAACH,UAAU,CAAC;MAC9B,IAAI,CAACA,UAAU,GAAG5D,SAAS;IAC/B;EACJ;AACJ","ignoreList":[]}

package/lib/rust-crypto/KeyClaimManager.d.ts

@@ -0,0 +1,33 @@
+import { OlmMachine, UserId } from "@matrix-org/matrix-sdk-crypto-wasm";
+import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor.ts";
+import { LogSpan } from "../logger.ts";
+/**
+ * KeyClaimManager: linearises calls to OlmMachine.getMissingSessions to avoid races
+ *
+ * We have one of these per `RustCrypto` (and hence per `MatrixClient`).
+ *
+ * @internal
+ */
+export declare class KeyClaimManager {
+    private readonly olmMachine;
+    private readonly outgoingRequestProcessor;
+    private currentClaimPromise;
+    private stopped;
+    constructor(olmMachine: OlmMachine, outgoingRequestProcessor: OutgoingRequestProcessor);
+    /**
+     * Tell the KeyClaimManager to immediately stop processing requests.
+     *
+     * Any further calls, and any still in the queue, will fail with an error.
+     */
+    stop(): void;
+    /**
+     * Given a list of users, attempt to ensure that we have Olm Sessions active with each of their devices
+     *
+     * If we don't have an active olm session, we will claim a one-time key and start one.
+     * @param logger - logger to use
+     * @param userList - list of userIDs to claim
+     */
+    ensureSessionsForUsers(logger: LogSpan, userList: Array<UserId>): Promise<void>;
+    private ensureSessionsForUsersInner;
+}
+//# sourceMappingURL=KeyClaimManager.d.ts.map

package/lib/rust-crypto/KeyClaimManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyClaimManager.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/KeyClaimManager.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,qBAAa,eAAe;IAKpB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IAL7C,OAAO,CAAC,mBAAmB,CAAgB;IAC3C,OAAO,CAAC,OAAO,CAAS;gBAGH,UAAU,EAAE,UAAU,EACtB,wBAAwB,EAAE,wBAAwB;IAKvE;;;;OAIG;IACI,IAAI,IAAI,IAAI;IAInB;;;;;;OAMG;IACI,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YAcxE,2BAA2B;CAgB5C"}