@unwanted/matrix-sdk-mini 34.12.0 → 34.13.0

package/lib/crypto/CrossSigning.js

@@ -1,718 +0,0 @@
-import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
-import _defineProperty from "@babel/runtime/helpers/defineProperty";
-/*
-Copyright 2019 - 2021 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/**
- * Cross signing methods
- */
-
-import { pkSign, pkVerify } from "./olmlib.js";
-import { logger } from "../logger.js";
-import { IndexedDBCryptoStore } from "../crypto/store/indexeddb-crypto-store.js";
-import { DeviceVerificationStatus, UserVerificationStatus as UserTrustLevel } from "../crypto-api/index.js";
-import { decodeBase64, encodeBase64 } from "../base64.js";
-import encryptAESSecretStorageItem from "../utils/encryptAESSecretStorageItem.js";
-import decryptAESSecretStorageItem from "../utils/decryptAESSecretStorageItem.js";
-
-// backwards-compatibility re-exports
-export { UserTrustLevel };
-var KEY_REQUEST_TIMEOUT_MS = 1000 * 60;
-function publicKeyFromKeyInfo(keyInfo) {
-  // `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }
-  // We assume only a single key, and we want the bare form without type
-  // prefix, so we select the values.
-  return Object.values(keyInfo.keys)[0];
-}
-export class CrossSigningInfo {
-  /**
-   * Information about a user's cross-signing keys
-   *
-   * @param userId - the user that the information is about
-   * @param callbacks - Callbacks used to interact with the app
-   *     Requires getCrossSigningKey and saveCrossSigningKeys
-   * @param cacheCallbacks - Callbacks used to interact with the cache
-   */
-  constructor(userId) {
-    var callbacks = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-    var cacheCallbacks = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
-    this.userId = userId;
-    this.callbacks = callbacks;
-    this.cacheCallbacks = cacheCallbacks;
-    _defineProperty(this, "keys", {});
-    _defineProperty(this, "firstUse", true);
-    // This tracks whether we've ever verified this user with any identity.
-    // When you verify a user, any devices online at the time that receive
-    // the verifying signature via the homeserver will latch this to true
-    // and can use it in the future to detect cases where the user has
-    // become unverified later for any reason.
-    _defineProperty(this, "crossSigningVerifiedBefore", false);
-  }
-  static fromStorage(obj, userId) {
-    var res = new CrossSigningInfo(userId);
-    for (var prop in obj) {
-      if (obj.hasOwnProperty(prop)) {
-        // @ts-ignore - ts doesn't like this and nor should we
-        res[prop] = obj[prop];
-      }
-    }
-    return res;
-  }
-  toStorage() {
-    return {
-      keys: this.keys,
-      firstUse: this.firstUse,
-      crossSigningVerifiedBefore: this.crossSigningVerifiedBefore
-    };
-  }
-
-  /**
-   * Calls the app callback to ask for a private key
-   *
-   * @param type - The key type ("master", "self_signing", or "user_signing")
-   * @param expectedPubkey - The matching public key or undefined to use
-   *     the stored public key for the given key type.
-   * @returns An array with [ public key, Olm.PkSigning ]
-   */
-  getCrossSigningKey(type, expectedPubkey) {
-    var _this = this;
-    return _asyncToGenerator(function* () {
-      var shouldCache = ["master", "self_signing", "user_signing"].indexOf(type) >= 0;
-      if (!_this.callbacks.getCrossSigningKey) {
-        throw new Error("No getCrossSigningKey callback supplied");
-      }
-      if (expectedPubkey === undefined) {
-        expectedPubkey = _this.getId(type);
-      }
-      function validateKey(key) {
-        if (!key) return;
-        var signing = new globalThis.Olm.PkSigning();
-        var gotPubkey = signing.init_with_seed(key);
-        if (gotPubkey === expectedPubkey) {
-          return [gotPubkey, signing];
-        }
-        signing.free();
-      }
-      var privkey = null;
-      if (_this.cacheCallbacks.getCrossSigningKeyCache && shouldCache) {
-        privkey = yield _this.cacheCallbacks.getCrossSigningKeyCache(type, expectedPubkey);
-      }
-      var cacheresult = validateKey(privkey);
-      if (cacheresult) {
-        return cacheresult;
-      }
-      privkey = yield _this.callbacks.getCrossSigningKey(type, expectedPubkey);
-      var result = validateKey(privkey);
-      if (result) {
-        if (_this.cacheCallbacks.storeCrossSigningKeyCache && shouldCache) {
-          yield _this.cacheCallbacks.storeCrossSigningKeyCache(type, privkey);
-        }
-        return result;
-      }
-
-      /* No keysource even returned a key */
-      if (!privkey) {
-        throw new Error("getCrossSigningKey callback for " + type + " returned falsey");
-      }
-
-      /* We got some keys from the keysource, but none of them were valid */
-      throw new Error("Key type " + type + " from getCrossSigningKey callback did not match");
-    })();
-  }
-
-  /**
-   * Check whether the private keys exist in secret storage.
-   * XXX: This could be static, be we often seem to have an instance when we
-   * want to know this anyway...
-   *
-   * @param secretStorage - The secret store using account data
-   * @returns map of key name to key info the secret is encrypted
-   *     with, or null if it is not present or not encrypted with a trusted
-   *     key
-   */
-  isStoredInSecretStorage(secretStorage) {
-    return _asyncToGenerator(function* () {
-      // check what SSSS keys have encrypted the master key (if any)
-      var stored = (yield secretStorage.isStored("m.cross_signing.master")) || {};
-      // then check which of those SSSS keys have also encrypted the SSK and USK
-      function intersect(s) {
-        for (var k of Object.keys(stored)) {
-          if (!s[k]) {
-            delete stored[k];
-          }
-        }
-      }
-      for (var _type of ["self_signing", "user_signing"]) {
-        intersect((yield secretStorage.isStored("m.cross_signing.".concat(_type))) || {});
-      }
-      return Object.keys(stored).length ? stored : null;
-    })();
-  }
-
-  /**
-   * Store private keys in secret storage for use by other devices. This is
-   * typically called in conjunction with the creation of new cross-signing
-   * keys.
-   *
-   * @param keys - The keys to store
-   * @param secretStorage - The secret store using account data
-   */
-  static storeInSecretStorage(keys, secretStorage) {
-    return _asyncToGenerator(function* () {
-      for (var [_type2, privateKey] of keys) {
-        var encodedKey = encodeBase64(privateKey);
-        yield secretStorage.store("m.cross_signing.".concat(_type2), encodedKey);
-      }
-    })();
-  }
-
-  /**
-   * Get private keys from secret storage created by some other device. This
-   * also passes the private keys to the app-specific callback.
-   *
-   * @param type - The type of key to get.  One of "master",
-   * "self_signing", or "user_signing".
-   * @param secretStorage - The secret store using account data
-   * @returns The private key
-   */
-  static getFromSecretStorage(type, secretStorage) {
-    return _asyncToGenerator(function* () {
-      var encodedKey = yield secretStorage.get("m.cross_signing.".concat(type));
-      if (!encodedKey) {
-        return null;
-      }
-      return decodeBase64(encodedKey);
-    })();
-  }
-
-  /**
-   * Check whether the private keys exist in the local key cache.
-   *
-   * @param type - The type of key to get. One of "master",
-   * "self_signing", or "user_signing". Optional, will check all by default.
-   * @returns True if all keys are stored in the local cache.
-   */
-  isStoredInKeyCache(type) {
-    var _this2 = this;
-    return _asyncToGenerator(function* () {
-      var cacheCallbacks = _this2.cacheCallbacks;
-      if (!cacheCallbacks) return false;
-      var types = type ? [type] : ["master", "self_signing", "user_signing"];
-      for (var t of types) {
-        var _cacheCallbacks$getCr;
-        if (!(yield (_cacheCallbacks$getCr = cacheCallbacks.getCrossSigningKeyCache) === null || _cacheCallbacks$getCr === void 0 ? void 0 : _cacheCallbacks$getCr.call(cacheCallbacks, t))) {
-          return false;
-        }
-      }
-      return true;
-    })();
-  }
-
-  /**
-   * Get cross-signing private keys from the local cache.
-   *
-   * @returns A map from key type (string) to private key (Uint8Array)
-   */
-  getCrossSigningKeysFromCache() {
-    var _this3 = this;
-    return _asyncToGenerator(function* () {
-      var keys = new Map();
-      var cacheCallbacks = _this3.cacheCallbacks;
-      if (!cacheCallbacks) return keys;
-      for (var _type3 of ["master", "self_signing", "user_signing"]) {
-        var _cacheCallbacks$getCr2;
-        var privKey = yield (_cacheCallbacks$getCr2 = cacheCallbacks.getCrossSigningKeyCache) === null || _cacheCallbacks$getCr2 === void 0 ? void 0 : _cacheCallbacks$getCr2.call(cacheCallbacks, _type3);
-        if (!privKey) {
-          continue;
-        }
-        keys.set(_type3, privKey);
-      }
-      return keys;
-    })();
-  }
-
-  /**
-   * Get the ID used to identify the user. This can also be used to test for
-   * the existence of a given key type.
-   *
-   * @param type - The type of key to get the ID of.  One of "master",
-   * "self_signing", or "user_signing".  Defaults to "master".
-   *
-   * @returns the ID
-   */
-  getId() {
-    var type = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : "master";
-    if (!this.keys[type]) return null;
-    var keyInfo = this.keys[type];
-    return publicKeyFromKeyInfo(keyInfo);
-  }
-
-  /**
-   * Create new cross-signing keys for the given key types. The public keys
-   * will be held in this class, while the private keys are passed off to the
-   * `saveCrossSigningKeys` application callback.
-   *
-   * @param level - The key types to reset
-   */
-  resetKeys(level) {
-    var _this4 = this;
-    return _asyncToGenerator(function* () {
-      if (!_this4.callbacks.saveCrossSigningKeys) {
-        throw new Error("No saveCrossSigningKeys callback supplied");
-      }
-
-      // If we're resetting the master key, we reset all keys
-      if (level === undefined || level & CrossSigningLevel.MASTER || !_this4.keys.master) {
-        level = CrossSigningLevel.MASTER | CrossSigningLevel.USER_SIGNING | CrossSigningLevel.SELF_SIGNING;
-      } else if (level === 0) {
-        return;
-      }
-      var privateKeys = {};
-      var keys = {};
-      var masterSigning;
-      var masterPub;
-      try {
-        if (level & CrossSigningLevel.MASTER) {
-          masterSigning = new globalThis.Olm.PkSigning();
-          privateKeys.master = masterSigning.generate_seed();
-          masterPub = masterSigning.init_with_seed(privateKeys.master);
-          keys.master = {
-            user_id: _this4.userId,
-            usage: ["master"],
-            keys: {
-              ["ed25519:" + masterPub]: masterPub
-            }
-          };
-        } else {
-          [masterPub, masterSigning] = yield _this4.getCrossSigningKey("master");
-        }
-        if (level & CrossSigningLevel.SELF_SIGNING) {
-          var sskSigning = new globalThis.Olm.PkSigning();
-          try {
-            privateKeys.self_signing = sskSigning.generate_seed();
-            var sskPub = sskSigning.init_with_seed(privateKeys.self_signing);
-            keys.self_signing = {
-              user_id: _this4.userId,
-              usage: ["self_signing"],
-              keys: {
-                ["ed25519:" + sskPub]: sskPub
-              }
-            };
-            pkSign(keys.self_signing, masterSigning, _this4.userId, masterPub);
-          } finally {
-            sskSigning.free();
-          }
-        }
-        if (level & CrossSigningLevel.USER_SIGNING) {
-          var uskSigning = new globalThis.Olm.PkSigning();
-          try {
-            privateKeys.user_signing = uskSigning.generate_seed();
-            var uskPub = uskSigning.init_with_seed(privateKeys.user_signing);
-            keys.user_signing = {
-              user_id: _this4.userId,
-              usage: ["user_signing"],
-              keys: {
-                ["ed25519:" + uskPub]: uskPub
-              }
-            };
-            pkSign(keys.user_signing, masterSigning, _this4.userId, masterPub);
-          } finally {
-            uskSigning.free();
-          }
-        }
-        Object.assign(_this4.keys, keys);
-        _this4.callbacks.saveCrossSigningKeys(privateKeys);
-      } finally {
-        if (masterSigning) {
-          masterSigning.free();
-        }
-      }
-    })();
-  }
-
-  /**
-   * unsets the keys, used when another session has reset the keys, to disable cross-signing
-   */
-  clearKeys() {
-    this.keys = {};
-  }
-  setKeys(keys) {
-    var signingKeys = {};
-    if (keys.master) {
-      if (keys.master.user_id !== this.userId) {
-        var error = "Mismatched user ID " + keys.master.user_id + " in master key from " + this.userId;
-        logger.error(error);
-        throw new Error(error);
-      }
-      if (!this.keys.master) {
-        // this is the first key we've seen, so first-use is true
-        this.firstUse = true;
-      } else if (publicKeyFromKeyInfo(keys.master) !== this.getId()) {
-        // this is a different key, so first-use is false
-        this.firstUse = false;
-      } // otherwise, same key, so no change
-      signingKeys.master = keys.master;
-    } else if (this.keys.master) {
-      signingKeys.master = this.keys.master;
-    } else {
-      throw new Error("Tried to set cross-signing keys without a master key");
-    }
-    var masterKey = publicKeyFromKeyInfo(signingKeys.master);
-
-    // verify signatures
-    if (keys.user_signing) {
-      if (keys.user_signing.user_id !== this.userId) {
-        var _error = "Mismatched user ID " + keys.master.user_id + " in user_signing key from " + this.userId;
-        logger.error(_error);
-        throw new Error(_error);
-      }
-      try {
-        pkVerify(keys.user_signing, masterKey, this.userId);
-      } catch (e) {
-        logger.error("invalid signature on user-signing key");
-        // FIXME: what do we want to do here?
-        throw e;
-      }
-    }
-    if (keys.self_signing) {
-      if (keys.self_signing.user_id !== this.userId) {
-        var _error2 = "Mismatched user ID " + keys.master.user_id + " in self_signing key from " + this.userId;
-        logger.error(_error2);
-        throw new Error(_error2);
-      }
-      try {
-        pkVerify(keys.self_signing, masterKey, this.userId);
-      } catch (e) {
-        logger.error("invalid signature on self-signing key");
-        // FIXME: what do we want to do here?
-        throw e;
-      }
-    }
-
-    // if everything checks out, then save the keys
-    if (keys.master) {
-      this.keys.master = keys.master;
-      // if the master key is set, then the old self-signing and user-signing keys are obsolete
-      delete this.keys["self_signing"];
-      delete this.keys["user_signing"];
-    }
-    if (keys.self_signing) {
-      this.keys.self_signing = keys.self_signing;
-    }
-    if (keys.user_signing) {
-      this.keys.user_signing = keys.user_signing;
-    }
-  }
-  updateCrossSigningVerifiedBefore(isCrossSigningVerified) {
-    // It is critical that this value latches forward from false to true but
-    // never back to false to avoid a downgrade attack.
-    if (!this.crossSigningVerifiedBefore && isCrossSigningVerified) {
-      this.crossSigningVerifiedBefore = true;
-    }
-  }
-  signObject(data, type) {
-    var _this5 = this;
-    return _asyncToGenerator(function* () {
-      if (!_this5.keys[type]) {
-        throw new Error("Attempted to sign with " + type + " key but no such key present");
-      }
-      var [pubkey, signing] = yield _this5.getCrossSigningKey(type);
-      try {
-        pkSign(data, signing, _this5.userId, pubkey);
-        return data;
-      } finally {
-        signing.free();
-      }
-    })();
-  }
-  signUser(key) {
-    var _this6 = this;
-    return _asyncToGenerator(function* () {
-      if (!_this6.keys.user_signing) {
-        logger.info("No user signing key: not signing user");
-        return;
-      }
-      return _this6.signObject(key.keys.master, "user_signing");
-    })();
-  }
-  signDevice(userId, device) {
-    var _this7 = this;
-    return _asyncToGenerator(function* () {
-      if (userId !== _this7.userId) {
-        throw new Error("Trying to sign ".concat(userId, "'s device; can only sign our own device"));
-      }
-      if (!_this7.keys.self_signing) {
-        logger.info("No self signing key: not signing device");
-        return;
-      }
-      return _this7.signObject({
-        algorithms: device.algorithms,
-        keys: device.keys,
-        device_id: device.deviceId,
-        user_id: userId
-      }, "self_signing");
-    })();
-  }
-
-  /**
-   * Check whether a given user is trusted.
-   *
-   * @param userCrossSigning - Cross signing info for user
-   *
-   * @returns
-   */
-  checkUserTrust(userCrossSigning) {
-    // if we're checking our own key, then it's trusted if the master key
-    // and self-signing key match
-    if (this.userId === userCrossSigning.userId && this.getId() && this.getId() === userCrossSigning.getId() && this.getId("self_signing") && this.getId("self_signing") === userCrossSigning.getId("self_signing")) {
-      return new UserTrustLevel(true, true, this.firstUse);
-    }
-    if (!this.keys.user_signing) {
-      // If there's no user signing key, they can't possibly be verified.
-      // They may be TOFU trusted though.
-      return new UserTrustLevel(false, false, userCrossSigning.firstUse);
-    }
-    var userTrusted;
-    var userMaster = userCrossSigning.keys.master;
-    var uskId = this.getId("user_signing");
-    try {
-      pkVerify(userMaster, uskId, this.userId);
-      userTrusted = true;
-    } catch (_unused) {
-      userTrusted = false;
-    }
-    return new UserTrustLevel(userTrusted, userCrossSigning.crossSigningVerifiedBefore, userCrossSigning.firstUse);
-  }
-
-  /**
-   * Check whether a given device is trusted.
-   *
-   * @param userCrossSigning - Cross signing info for user
-   * @param device - The device to check
-   * @param localTrust - Whether the device is trusted locally
-   * @param trustCrossSignedDevices - Whether we trust cross signed devices
-   *
-   * @returns
-   */
-  checkDeviceTrust(userCrossSigning, device, localTrust, trustCrossSignedDevices) {
-    var userTrust = this.checkUserTrust(userCrossSigning);
-    var userSSK = userCrossSigning.keys.self_signing;
-    if (!userSSK) {
-      // if the user has no self-signing key then we cannot make any
-      // trust assertions about this device from cross-signing
-      return new DeviceTrustLevel(false, false, localTrust, trustCrossSignedDevices);
-    }
-    var deviceObj = deviceToObject(device, userCrossSigning.userId);
-    try {
-      // if we can verify the user's SSK from their master key...
-      pkVerify(userSSK, userCrossSigning.getId(), userCrossSigning.userId);
-      // ...and this device's key from their SSK...
-      pkVerify(deviceObj, publicKeyFromKeyInfo(userSSK), userCrossSigning.userId);
-      // ...then we trust this device as much as far as we trust the user
-      return DeviceTrustLevel.fromUserTrustLevel(userTrust, localTrust, trustCrossSignedDevices);
-    } catch (_unused2) {
-      return new DeviceTrustLevel(false, false, localTrust, trustCrossSignedDevices);
-    }
-  }
-
-  /**
-   * @returns Cache callbacks
-   */
-  getCacheCallbacks() {
-    return this.cacheCallbacks;
-  }
-}
-function deviceToObject(device, userId) {
-  return {
-    algorithms: device.algorithms,
-    keys: device.keys,
-    device_id: device.deviceId,
-    user_id: userId,
-    signatures: device.signatures
-  };
-}
-export var CrossSigningLevel = /*#__PURE__*/function (CrossSigningLevel) {
-  CrossSigningLevel[CrossSigningLevel["MASTER"] = 4] = "MASTER";
-  CrossSigningLevel[CrossSigningLevel["USER_SIGNING"] = 2] = "USER_SIGNING";
-  CrossSigningLevel[CrossSigningLevel["SELF_SIGNING"] = 1] = "SELF_SIGNING";
-  return CrossSigningLevel;
-}({});
-
-/**
- * Represents the ways in which we trust a device.
- *
- * @deprecated Use {@link DeviceVerificationStatus}.
- */
-export class DeviceTrustLevel extends DeviceVerificationStatus {
-  constructor(crossSigningVerified, tofu, localVerified, trustCrossSignedDevices) {
-    var signedByOwner = arguments.length > 4 && arguments[4] !== undefined ? arguments[4] : false;
-    super({
-      crossSigningVerified,
-      tofu,
-      localVerified,
-      trustCrossSignedDevices,
-      signedByOwner
-    });
-  }
-  static fromUserTrustLevel(userTrustLevel, localVerified, trustCrossSignedDevices) {
-    return new DeviceTrustLevel(userTrustLevel.isCrossSigningVerified(), userTrustLevel.isTofu(), localVerified, trustCrossSignedDevices, true);
-  }
-
-  /**
-   * @returns true if this device is verified via cross signing
-   */
-  isCrossSigningVerified() {
-    return this.crossSigningVerified;
-  }
-
-  /**
-   * @returns true if this device is verified locally
-   */
-  isLocallyVerified() {
-    return this.localVerified;
-  }
-
-  /**
-   * @returns true if this device is trusted from a user's key
-   * that is trusted on first use
-   */
-  isTofu() {
-    return this.tofu;
-  }
-}
-export function createCryptoStoreCacheCallbacks(store, olmDevice) {
-  return {
-    getCrossSigningKeyCache: function () {
-      var _getCrossSigningKeyCache = _asyncToGenerator(function* (type, _expectedPublicKey) {
-        var key = yield new Promise(resolve => {
-          store.doTxn("readonly", [IndexedDBCryptoStore.STORE_ACCOUNT], txn => {
-            store.getSecretStorePrivateKey(txn, resolve, type);
-          });
-        });
-        if (key && key.ciphertext) {
-          var pickleKey = Buffer.from(olmDevice.pickleKey);
-          var decrypted = yield decryptAESSecretStorageItem(key, pickleKey, type);
-          return decodeBase64(decrypted);
-        } else {
-          return key;
-        }
-      });
-      function getCrossSigningKeyCache(_x, _x2) {
-        return _getCrossSigningKeyCache.apply(this, arguments);
-      }
-      return getCrossSigningKeyCache;
-    }(),
-    storeCrossSigningKeyCache: function () {
-      var _storeCrossSigningKeyCache = _asyncToGenerator(function* (type, key) {
-        if (!(key instanceof Uint8Array)) {
-          throw new Error("storeCrossSigningKeyCache expects Uint8Array, got ".concat(key));
-        }
-        var pickleKey = Buffer.from(olmDevice.pickleKey);
-        var encryptedKey = yield encryptAESSecretStorageItem(encodeBase64(key), pickleKey, type);
-        return store.doTxn("readwrite", [IndexedDBCryptoStore.STORE_ACCOUNT], txn => {
-          store.storeSecretStorePrivateKey(txn, type, encryptedKey);
-        });
-      });
-      function storeCrossSigningKeyCache(_x3, _x4) {
-        return _storeCrossSigningKeyCache.apply(this, arguments);
-      }
-      return storeCrossSigningKeyCache;
-    }()
-  };
-}
-/**
- * Request cross-signing keys from another device during verification.
- *
- * @param baseApis - base Matrix API interface
- * @param userId - The user ID being verified
- * @param deviceId - The device ID being verified
- */
-export function requestKeysDuringVerification(_x5, _x6, _x7) {
-  return _requestKeysDuringVerification.apply(this, arguments);
-}
-function _requestKeysDuringVerification() {
-  _requestKeysDuringVerification = _asyncToGenerator(function* (baseApis, userId, deviceId) {
-    // If this is a self-verification, ask the other party for keys
-    if (baseApis.getUserId() !== userId) {
-      return;
-    }
-    logger.log("Cross-signing: Self-verification done; requesting keys");
-    // This happens asynchronously, and we're not concerned about waiting for
-    // it. We return here in order to test.
-    return new Promise((resolve, reject) => {
-      var client = baseApis;
-      var original = client.crypto.crossSigningInfo;
-
-      // We already have all of the infrastructure we need to validate and
-      // cache cross-signing keys, so instead of replicating that, here we set
-      // up callbacks that request them from the other device and call
-      // CrossSigningInfo.getCrossSigningKey() to validate/cache
-      var crossSigning = new CrossSigningInfo(original.userId, {
-        getCrossSigningKey: function () {
-          var _getCrossSigningKey = _asyncToGenerator(function* (type) {
-            logger.debug("Cross-signing: requesting secret", type, deviceId);
-            var {
-              promise
-            } = client.requestSecret("m.cross_signing.".concat(type), [deviceId]);
-            var result = yield promise;
-            var decoded = decodeBase64(result);
-            return Uint8Array.from(decoded);
-          });
-          function getCrossSigningKey(_x8) {
-            return _getCrossSigningKey.apply(this, arguments);
-          }
-          return getCrossSigningKey;
-        }()
-      }, original.getCacheCallbacks());
-      crossSigning.keys = original.keys;
-
-      // XXX: get all keys out if we get one key out
-      // https://github.com/vector-im/element-web/issues/12604
-      // then change here to reject on the timeout
-      // Requests can be ignored, so don't wait around forever
-      var timeout = new Promise(resolve => {
-        setTimeout(resolve, KEY_REQUEST_TIMEOUT_MS, new Error("Timeout"));
-      });
-
-      // also request and cache the key backup key
-      var backupKeyPromise = _asyncToGenerator(function* () {
-        var cachedKey = yield client.crypto.getSessionBackupPrivateKey();
-        if (!cachedKey) {
-          logger.info("No cached backup key found. Requesting...");
-          var secretReq = client.requestSecret("m.megolm_backup.v1", [deviceId]);
-          var base64Key = yield secretReq.promise;
-          logger.info("Got key backup key, decoding...");
-          var decodedKey = decodeBase64(base64Key);
-          logger.info("Decoded backup key, storing...");
-          yield client.crypto.storeSessionBackupPrivateKey(Uint8Array.from(decodedKey));
-          logger.info("Backup key stored. Starting backup restore...");
-          var backupInfo = yield client.getKeyBackupVersion();
-          // no need to await for this - just let it go in the bg
-          client.restoreKeyBackupWithCache(undefined, undefined, backupInfo).then(() => {
-            logger.info("Backup restored.");
-          });
-        }
-      })();
-
-      // We call getCrossSigningKey() for its side-effects
-      Promise.race([Promise.all([crossSigning.getCrossSigningKey("master"), crossSigning.getCrossSigningKey("self_signing"), crossSigning.getCrossSigningKey("user_signing"), backupKeyPromise]), timeout]).then(resolve, reject);
-    }).catch(e => {
-      logger.warn("Cross-signing: failure while requesting keys:", e);
-    });
-  });
-  return _requestKeysDuringVerification.apply(this, arguments);
-}
-//# sourceMappingURL=CrossSigning.js.map