@unwanted/matrix-sdk-mini 34.12.0 → 34.13.0

package/src/rendezvous/transports/MSC4108RendezvousSession.ts

@@ -1,270 +0,0 @@
-/*
-Copyright 2024 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { logger } from "../../logger.ts";
-import { sleep } from "../../utils.ts";
-import { ClientRendezvousFailureReason, MSC4108FailureReason, RendezvousFailureListener } from "../index.ts";
-import { MatrixClient, Method } from "../../matrix.ts";
-import { ClientPrefix } from "../../http-api/index.ts";
-
-/**
- * Prototype of the unstable [MSC4108](https://github.com/matrix-org/matrix-spec-proposals/pull/4108)
- * insecure rendezvous session protocol.
- * @experimental Note that this is UNSTABLE and may have breaking changes without notice.
- */
-export class MSC4108RendezvousSession {
-    public url?: string;
-    private readonly client?: MatrixClient;
-    private readonly fallbackRzServer?: string;
-    private readonly fetchFn?: typeof globalThis.fetch;
-    private readonly onFailure?: RendezvousFailureListener;
-    private etag?: string;
-    private expiresAt?: Date;
-    private expiresTimer?: ReturnType<typeof setTimeout>;
-    private _cancelled = false;
-    private _ready = false;
-
-    public constructor({
-        onFailure,
-        url,
-        fetchFn,
-    }: {
-        fetchFn?: typeof globalThis.fetch;
-        onFailure?: RendezvousFailureListener;
-        url: string;
-    });
-    public constructor({
-        onFailure,
-        client,
-        fallbackRzServer,
-        fetchFn,
-    }: {
-        fetchFn?: typeof globalThis.fetch;
-        onFailure?: RendezvousFailureListener;
-        client?: MatrixClient;
-        fallbackRzServer?: string;
-    });
-    public constructor({
-        fetchFn,
-        onFailure,
-        url,
-        client,
-        fallbackRzServer,
-    }: {
-        fetchFn?: typeof globalThis.fetch;
-        onFailure?: RendezvousFailureListener;
-        url?: string;
-        client?: MatrixClient;
-        fallbackRzServer?: string;
-    }) {
-        this.fetchFn = fetchFn;
-        this.onFailure = onFailure;
-        this.client = client;
-        this.fallbackRzServer = fallbackRzServer;
-        this.url = url;
-    }
-
-    /**
-     * Returns whether the channel is ready to be used.
-     */
-    public get ready(): boolean {
-        return this._ready;
-    }
-
-    /**
-     * Returns whether the channel has been cancelled.
-     */
-    public get cancelled(): boolean {
-        return this._cancelled;
-    }
-
-    private fetch(resource: URL | string, options?: RequestInit): ReturnType<typeof globalThis.fetch> {
-        if (this.fetchFn) {
-            return this.fetchFn(resource, options);
-        }
-        return globalThis.fetch(resource, options);
-    }
-
-    private async getPostEndpoint(): Promise<string | undefined> {
-        if (this.client) {
-            try {
-                if (await this.client.doesServerSupportUnstableFeature("org.matrix.msc4108")) {
-                    return this.client.http
-                        .getUrl("/org.matrix.msc4108/rendezvous", undefined, ClientPrefix.Unstable)
-                        .toString();
-                }
-            } catch (err) {
-                logger.warn("Failed to get unstable features", err);
-            }
-        }
-
-        return this.fallbackRzServer;
-    }
-
-    /**
-     * Sends data via the rendezvous channel.
-     * @param data the payload to send
-     */
-    public async send(data: string): Promise<void> {
-        if (this._cancelled) {
-            return;
-        }
-        const method = this.url ? Method.Put : Method.Post;
-        const uri = this.url ?? (await this.getPostEndpoint());
-
-        if (!uri) {
-            throw new Error("Invalid rendezvous URI");
-        }
-
-        const headers: Record<string, string> = { "content-type": "text/plain" };
-
-        // if we didn't create the rendezvous channel, we need to fetch the first etag if needed
-        if (!this.etag && this.url) {
-            await this.receive();
-        }
-
-        if (this.etag) {
-            headers["if-match"] = this.etag;
-        }
-
-        logger.info(`=> ${method} ${uri} with ${data} if-match: ${this.etag}`);
-
-        const res = await this.fetch(uri, { method, headers, body: data, redirect: "follow" });
-        if (res.status === 404) {
-            return this.cancel(ClientRendezvousFailureReason.Unknown);
-        }
-        this.etag = res.headers.get("etag") ?? undefined;
-
-        logger.info(`Received etag: ${this.etag}`);
-
-        if (method === Method.Post) {
-            const expires = res.headers.get("expires");
-            if (expires) {
-                if (this.expiresTimer) {
-                    clearTimeout(this.expiresTimer);
-                    this.expiresTimer = undefined;
-                }
-                this.expiresAt = new Date(expires);
-                this.expiresTimer = setTimeout(() => {
-                    this.expiresTimer = undefined;
-                    this.cancel(ClientRendezvousFailureReason.Expired);
-                }, this.expiresAt.getTime() - Date.now());
-            }
-            // MSC4108: we expect a JSON response with a rendezvous URL
-            const json = await res.json();
-            if (typeof json.url !== "string") {
-                throw new Error("No rendezvous URL given");
-            }
-            this.url = json.url;
-            this._ready = true;
-        }
-    }
-
-    /**
-     * Receives data from the rendezvous channel.
-     * @return the returned promise won't resolve until new data is acquired or the channel is closed either by the server or the other party.
-     */
-    public async receive(): Promise<string | undefined> {
-        if (!this.url) {
-            throw new Error("Rendezvous not set up");
-        }
-        // eslint-disable-next-line no-constant-condition
-        while (true) {
-            if (this._cancelled) {
-                return undefined;
-            }
-
-            const headers: Record<string, string> = {};
-            if (this.etag) {
-                headers["if-none-match"] = this.etag;
-            }
-
-            logger.info(`=> GET ${this.url} if-none-match: ${this.etag}`);
-            const poll = await this.fetch(this.url, { method: Method.Get, headers });
-
-            if (poll.status === 404) {
-                await this.cancel(ClientRendezvousFailureReason.Unknown);
-                return undefined;
-            }
-
-            // rely on server expiring the channel rather than checking ourselves
-
-            const etag = poll.headers.get("etag") ?? undefined;
-            if (poll.headers.get("content-type") !== "text/plain") {
-                this.etag = etag;
-            } else if (poll.status === 200) {
-                if (!etag) {
-                    // Some browsers & extensions block the ETag header for anti-tracking purposes
-                    // We try and detect this so the client can give the user a somewhat helpful message
-                    await this.cancel(ClientRendezvousFailureReason.ETagMissing);
-                    return undefined;
-                }
-
-                this.etag = etag;
-                const text = await poll.text();
-                logger.info(`Received: ${text} with etag ${this.etag}`);
-                return text;
-            }
-            await sleep(1000);
-        }
-    }
-
-    /**
-     * Cancels the rendezvous channel.
-     * If the reason is user_declined or user_cancelled then the channel will also be closed.
-     * @param reason the reason to cancel with
-     */
-    public async cancel(reason: MSC4108FailureReason | ClientRendezvousFailureReason): Promise<void> {
-        if (this._cancelled) return;
-        if (this.expiresTimer) {
-            clearTimeout(this.expiresTimer);
-            this.expiresTimer = undefined;
-        }
-
-        if (
-            reason === ClientRendezvousFailureReason.Unknown &&
-            this.expiresAt &&
-            this.expiresAt.getTime() < Date.now()
-        ) {
-            reason = ClientRendezvousFailureReason.Expired;
-        }
-
-        this._cancelled = true;
-        this._ready = false;
-        this.onFailure?.(reason);
-
-        if (reason === ClientRendezvousFailureReason.UserDeclined || reason === MSC4108FailureReason.UserCancelled) {
-            await this.close();
-        }
-    }
-
-    /**
-     * Closes the rendezvous channel.
-     */
-    public async close(): Promise<void> {
-        if (this.expiresTimer) {
-            clearTimeout(this.expiresTimer);
-            this.expiresTimer = undefined;
-        }
-
-        if (!this.url) return;
-        try {
-            await this.fetch(this.url, { method: Method.Delete });
-        } catch (e) {
-            logger.warn(e);
-        }
-    }
-}

package/src/rendezvous/transports/index.ts

@@ -1,17 +0,0 @@
-/*
-Copyright 2022 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-export * from "./MSC4108RendezvousSession.ts";

package/src/rust-crypto/CrossSigningIdentity.ts

@@ -1,183 +0,0 @@
-/*
-Copyright 2023 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { OlmMachine, CrossSigningStatus, CrossSigningBootstrapRequests } from "@matrix-org/matrix-sdk-crypto-wasm";
-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
-
-import { BootstrapCrossSigningOpts } from "../crypto-api/index.ts";
-import { logger } from "../logger.ts";
-import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor.ts";
-import { UIAuthCallback } from "../interactive-auth.ts";
-import { ServerSideSecretStorage } from "../secret-storage.ts";
-
-/** Manages the cross-signing keys for our own user.
- *
- * @internal
- */
-export class CrossSigningIdentity {
-    public constructor(
-        private readonly olmMachine: OlmMachine,
-        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,
-        private readonly secretStorage: ServerSideSecretStorage,
-    ) {}
-
-    /**
-     * Initialise our cross-signing keys by creating new keys if they do not exist, and uploading to the server
-     */
-    public async bootstrapCrossSigning(opts: BootstrapCrossSigningOpts): Promise<void> {
-        if (opts.setupNewCrossSigning) {
-            await this.resetCrossSigning(opts.authUploadDeviceSigningKeys);
-            return;
-        }
-
-        const olmDeviceStatus: CrossSigningStatus = await this.olmMachine.crossSigningStatus();
-
-        // Try to fetch cross signing keys from the secret storage
-        const masterKeyFromSecretStorage = await this.secretStorage.get("m.cross_signing.master");
-        const selfSigningKeyFromSecretStorage = await this.secretStorage.get("m.cross_signing.self_signing");
-        const userSigningKeyFromSecretStorage = await this.secretStorage.get("m.cross_signing.user_signing");
-        const privateKeysInSecretStorage = Boolean(
-            masterKeyFromSecretStorage && selfSigningKeyFromSecretStorage && userSigningKeyFromSecretStorage,
-        );
-
-        const olmDeviceHasKeys =
-            olmDeviceStatus.hasMaster && olmDeviceStatus.hasUserSigning && olmDeviceStatus.hasSelfSigning;
-
-        // Log all relevant state for easier parsing of debug logs.
-        logger.log("bootstrapCrossSigning: starting", {
-            setupNewCrossSigning: opts.setupNewCrossSigning,
-            olmDeviceHasMaster: olmDeviceStatus.hasMaster,
-            olmDeviceHasUserSigning: olmDeviceStatus.hasUserSigning,
-            olmDeviceHasSelfSigning: olmDeviceStatus.hasSelfSigning,
-            privateKeysInSecretStorage,
-        });
-
-        if (olmDeviceHasKeys) {
-            if (!(await this.secretStorage.hasKey())) {
-                logger.warn(
-                    "bootstrapCrossSigning: Olm device has private keys, but secret storage is not yet set up; doing nothing for now.",
-                );
-                // the keys should get uploaded to 4S once that is set up.
-            } else if (!privateKeysInSecretStorage) {
-                // the device has the keys but they are not in 4S, so update it
-                logger.log("bootstrapCrossSigning: Olm device has private keys: exporting to secret storage");
-                await this.exportCrossSigningKeysToStorage();
-            } else {
-                logger.log(
-                    "bootstrapCrossSigning: Olm device has private keys and they are saved in secret storage; doing nothing",
-                );
-            }
-        } /* (!olmDeviceHasKeys) */ else {
-            if (privateKeysInSecretStorage) {
-                // they are in 4S, so import from there
-                logger.log(
-                    "bootstrapCrossSigning: Cross-signing private keys not found locally, but they are available " +
-                        "in secret storage, reading storage and caching locally",
-                );
-                await this.olmMachine.importCrossSigningKeys(
-                    masterKeyFromSecretStorage,
-                    selfSigningKeyFromSecretStorage,
-                    userSigningKeyFromSecretStorage,
-                );
-
-                // Get the current device
-                const device: RustSdkCryptoJs.Device = await this.olmMachine.getDevice(
-                    this.olmMachine.userId,
-                    this.olmMachine.deviceId,
-                );
-                try {
-                    // Sign the device with our cross-signing key and upload the signature
-                    const request: RustSdkCryptoJs.SignatureUploadRequest = await device.verify();
-                    await this.outgoingRequestProcessor.makeOutgoingRequest(request);
-                } finally {
-                    device.free();
-                }
-            } else {
-                logger.log(
-                    "bootstrapCrossSigning: Cross-signing private keys not found locally or in secret storage, creating new keys",
-                );
-                await this.resetCrossSigning(opts.authUploadDeviceSigningKeys);
-            }
-        }
-
-        // TODO: we might previously have bootstrapped cross-signing but not completed uploading the keys to the
-        //   server -- in which case we should call OlmDevice.bootstrap_cross_signing. How do we know?
-        logger.log("bootstrapCrossSigning: complete");
-    }
-
-    /** Reset our cross-signing keys
-     *
-     * This method will:
-     *   * Tell the OlmMachine to create new keys
-     *   * Upload the new public keys and the device signature to the server
-     *   * Upload the private keys to SSSS, if it is set up
-     */
-    private async resetCrossSigning(authUploadDeviceSigningKeys?: UIAuthCallback<void>): Promise<void> {
-        // XXX: We must find a way to make this atomic, currently if the user does not remember his account password
-        // or 4S passphrase/key the process will fail in a bad state, with keys rotated but not uploaded or saved in 4S.
-        const outgoingRequests: CrossSigningBootstrapRequests = await this.olmMachine.bootstrapCrossSigning(true);
-
-        // If 4S is configured we need to update it.
-        if (!(await this.secretStorage.hasKey())) {
-            logger.warn(
-                "resetCrossSigning: Secret storage is not yet set up; not exporting keys to secret storage yet.",
-            );
-            // the keys should get uploaded to 4S once that is set up.
-        } else {
-            // Update 4S before uploading cross-signing keys, to stay consistent with legacy that asks
-            // 4S passphrase before asking for account password.
-            // Ultimately should be made atomic and resistant to forgotten password/passphrase.
-            logger.log("resetCrossSigning: exporting private keys to secret storage");
-            await this.exportCrossSigningKeysToStorage();
-        }
-
-        logger.log("resetCrossSigning: publishing public keys to server");
-        for (const req of [
-            outgoingRequests.uploadKeysRequest,
-            outgoingRequests.uploadSigningKeysRequest,
-            outgoingRequests.uploadSignaturesRequest,
-        ]) {
-            if (req) {
-                await this.outgoingRequestProcessor.makeOutgoingRequest(req, authUploadDeviceSigningKeys);
-            }
-        }
-    }
-
-    /**
-     * Extract the cross-signing keys from the olm machine and save them to secret storage, if it is configured
-     *
-     * (If secret storage is *not* configured, we assume that the export will happen when it is set up)
-     */
-    private async exportCrossSigningKeysToStorage(): Promise<void> {
-        const exported: RustSdkCryptoJs.CrossSigningKeyExport | null = await this.olmMachine.exportCrossSigningKeys();
-        /* istanbul ignore else (this function is only called when we know the olm machine has keys) */
-        if (exported?.masterKey) {
-            await this.secretStorage.store("m.cross_signing.master", exported.masterKey);
-        } else {
-            logger.error(`Cannot export MSK to secret storage, private key unknown`);
-        }
-        if (exported?.self_signing_key) {
-            await this.secretStorage.store("m.cross_signing.self_signing", exported.self_signing_key);
-        } else {
-            logger.error(`Cannot export SSK to secret storage, private key unknown`);
-        }
-        if (exported?.userSigningKey) {
-            await this.secretStorage.store("m.cross_signing.user_signing", exported.userSigningKey);
-        } else {
-            logger.error(`Cannot export USK to secret storage, private key unknown`);
-        }
-    }
-}