@unwanted/matrix-sdk-mini 34.12.0 → 36.0.0

package/src/models/poll.ts

@@ -48,9 +48,6 @@ const filterResponseRelations = (
     responseEvents: MatrixEvent[];
 } => {
     const responseEvents = relationEvents.filter((event) => {
-        if (event.isDecryptionFailure()) {
-            return;
-        }
         return (
             M_POLL_RESPONSE.matches(event.getType()) &&
             // From MSC3381:
@@ -172,8 +169,6 @@ export class Poll extends TypedEventEmitter<Exclude<PollEvent, PollEvent.New>, P
             },
         );
 
-        await Promise.all(allRelations.events.map((event) => this.matrixClient.decryptEventIfNeeded(event)));
-
         const responses =
             this.responses ||
             new Relations("m.reference", M_POLL_RESPONSE.name, this.matrixClient, [M_POLL_RESPONSE.altName!]);
@@ -235,7 +230,6 @@ export class Poll extends TypedEventEmitter<Exclude<PollEvent, PollEvent.New>, P
 
     private countUndecryptableEvents = (events: MatrixEvent[]): void => {
         const undecryptableEventIds = events
-            .filter((event) => event.isDecryptionFailure())
             .map((event) => event.getId()!);
 
         const previousCount = this.undecryptableRelationsCount;

package/src/models/relations-container.ts

@@ -98,18 +98,11 @@ export class RelationsContainer {
         if (!relation) return;
 
         const onEventDecrypted = (): void => {
-            if (event.isDecryptionFailure()) {
-                // This could for example happen if the encryption keys are not yet available.
-                // The event may still be decrypted later. Register the listener again.
-                event.once(MatrixEventEvent.Decrypted, onEventDecrypted);
-                return;
-            }
-
             this.aggregateChildEvent(event, timelineSet);
         };
 
         // If the event is currently encrypted, wait until it has been decrypted.
-        if (event.isBeingDecrypted() || event.shouldAttemptDecryption()) {
+        if (event.shouldAttemptDecryption()) {
             event.once(MatrixEventEvent.Decrypted, onEventDecrypted);
             return;
         }

package/src/models/relations.ts

@@ -52,7 +52,6 @@ export class Relations extends TypedEventEmitter<RelationsEvent, EventHandlerMap
     private sortedAnnotationsByKey: [string, Set<MatrixEvent>][] = [];
     private targetEvent: MatrixEvent | null = null;
     private creationEmitted = false;
-    private readonly client: MatrixClient;
 
     /**
      * @param relationType - The type of relation involved, such as "m.annotation", "m.reference", "m.replace", etc.
@@ -67,7 +66,6 @@ export class Relations extends TypedEventEmitter<RelationsEvent, EventHandlerMap
         public readonly altEventTypes?: string[],
     ) {
         super();
-        this.client = client instanceof Room ? client.client : client;
     }
 
     /**
@@ -323,12 +321,6 @@ export class Relations extends TypedEventEmitter<RelationsEvent, EventHandlerMap
             return event;
         }, null);
 
-        if (lastReplacement?.shouldAttemptDecryption() && this.client.isCryptoEnabled()) {
-            await lastReplacement.attemptDecryption(this.client.crypto!);
-        } else if (lastReplacement?.isBeingDecrypted()) {
-            await lastReplacement.getDecryptionPromise();
-        }
-
         return lastReplacement;
     }
 

package/src/models/room-member.ts

@@ -368,6 +368,11 @@ export class RoomMember extends TypedEventEmitter<RoomMemberEvent, RoomMemberEve
      * If false, any non-matrix content URLs will be ignored. Setting this option to
      * true will expose URLs that, if fetched, will leak information about the user
      * to anyone who they share a room with.
+     * @param useAuthentication - (optional) If true, the caller supports authenticated
+     * media and wants an authentication-required URL. Note that server support for
+     * authenticated media will not be checked - it is the caller's responsibility
+     * to do so before calling this function. Note also that useAuthentication
+     * implies allowRedirects. Defaults to false (unauthenticated endpoints).
      * @returns the avatar URL or null.
      */
     public getAvatarUrl(
@@ -377,13 +382,23 @@ export class RoomMember extends TypedEventEmitter<RoomMemberEvent, RoomMemberEve
         resizeMethod: string,
         allowDefault = true,
         allowDirectLinks: boolean,
+        useAuthentication: boolean = false,
     ): string | null {
         const rawUrl = this.getMxcAvatarUrl();
 
         if (!rawUrl && !allowDefault) {
             return null;
         }
-        const httpUrl = getHttpUriForMxc(baseUrl, rawUrl, width, height, resizeMethod, allowDirectLinks);
+        const httpUrl = getHttpUriForMxc(
+            baseUrl,
+            rawUrl,
+            width,
+            height,
+            resizeMethod,
+            allowDirectLinks,
+            undefined,
+            useAuthentication,
+        );
         if (httpUrl) {
             return httpUrl;
         }

package/src/models/room-state.ts

@@ -18,7 +18,7 @@ import { RoomMember } from "./room-member.ts";
 import { logger } from "../logger.ts";
 import { isNumber, removeHiddenChars } from "../utils.ts";
 import { EventType, UNSTABLE_MSC2716_MARKER } from "../@types/event.ts";
-import { IEvent, MatrixEvent, MatrixEventEvent } from "./event.ts";
+import { IEvent, MatrixEvent } from "./event.ts";
 import { MatrixClient } from "../client.ts";
 import { GuestAccess, HistoryVisibility, JoinRule } from "../@types/partials.ts";
 import { TypedEventEmitter } from "./typed-event-emitter.ts";
@@ -194,22 +194,11 @@ export class RoomState extends TypedEventEmitter<EmittedEvents, EventHandlerMap>
      * As the timeline might get reset while they are loading, this state needs to be inherited
      * and shared when the room state is cloned for the new timeline.
      * This should only be passed from clone.
-     * @param isStartTimelineState - Optional. This state is marked as a start state.
-     * This is used to skip state insertions that are
-     * in the wrong order. The order is determined by the `replaces_state` id.
-     *
-     * Example:
-     * A current state events `replaces_state` value is `1`.
-     * Trying to insert a state event with `event_id` `1` in its place would fail if isStartTimelineState = false.
-     *
-     * A current state events `event_id` is `2`.
-     * Trying to insert a state event where its `replaces_state` value is `2` would fail if isStartTimelineState = true.
      */
 
     public constructor(
         public readonly roomId: string,
         private oobMemberFlags = { status: OobStatus.NotStarted },
-        public readonly isStartTimelineState = false,
     ) {
         super();
         this.updateModifiedTime();
@@ -420,7 +409,7 @@ export class RoomState extends TypedEventEmitter<EmittedEvents, EventHandlerMap>
      * Fires {@link RoomStateEvent.Events}
      * Fires {@link RoomStateEvent.Marker}
      */
-    public setStateEvents(stateEvents: MatrixEvent[], options?: IMarkerFoundOptions): void {
+    public setStateEvents(stateEvents: MatrixEvent[], markerFoundOptions?: IMarkerFoundOptions): void {
         this.updateModifiedTime();
 
         // update the core event dict
@@ -432,22 +421,6 @@ export class RoomState extends TypedEventEmitter<EmittedEvents, EventHandlerMap>
             }
 
             const lastStateEvent = this.getStateEventMatching(event);
-
-            // Safety measure to not update the room (and emit the update) with older state.
-            // The sync loop really should not send old events but it does very regularly.
-            // Logging on return in those two conditions results in a large amount of logging. (on startup and when running element)
-            const lastReplaceId = lastStateEvent?.event.unsigned?.replaces_state;
-            const lastId = lastStateEvent?.event.event_id;
-            const newReplaceId = event.event.unsigned?.replaces_state;
-            const newId = event.event.event_id;
-            if (this.isStartTimelineState) {
-                // Add an event to the start of the timeline. Its replace id should not be the same as the one of the current/last start state event.
-                if (newReplaceId && lastId && newReplaceId === lastId) return;
-            } else {
-                // Add an event to the end of the timeline. It should not be the same as the one replaced by the current/last end state event.
-                if (lastReplaceId && newId && lastReplaceId === newId) return;
-            }
-
             this.setStateEvent(event);
             if (event.getType() === EventType.RoomMember) {
                 this.updateDisplayNameCache(event.getStateKey()!, event.getContent().displayname ?? "");
@@ -504,7 +477,7 @@ export class RoomState extends TypedEventEmitter<EmittedEvents, EventHandlerMap>
                 // assume all our sentinels are now out-of-date
                 this.sentinels = {};
             } else if (UNSTABLE_MSC2716_MARKER.matches(event.getType())) {
-                this.emit(RoomStateEvent.Marker, event, options);
+                this.emit(RoomStateEvent.Marker, event, markerFoundOptions);
             }
         });
 
@@ -544,15 +517,9 @@ export class RoomState extends TypedEventEmitter<EmittedEvents, EventHandlerMap>
             if (!M_BEACON.matches(event.getType()) && !event.isEncrypted()) return;
 
             try {
-                await matrixClient.decryptEventIfNeeded(event);
                 processBeaconRelation(relatedToEventId, event);
             } catch {
-                if (event.isDecryptionFailure()) {
-                    // add an event listener for once the event is decrypted.
-                    event.once(MatrixEventEvent.Decrypted, async () => {
-                        processBeaconRelation(relatedToEventId, event);
-                    });
-                }
+                //
             }
         }
     }

package/src/models/room.ts

@@ -494,7 +494,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 });
                 events.forEach(async (serializedEvent: Partial<IEvent>) => {
                     const event = mapper(serializedEvent);
-                    await client.decryptEventIfNeeded(event);
                     event.setStatus(EventStatus.NOT_SENT);
                     this.addPendingEvent(event, event.getTxnId()!);
                 });
@@ -533,52 +532,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         return null;
     }
 
-    /**
-     * Bulk decrypt critical events in a room
-     *
-     * Critical events represents the minimal set of events to decrypt
-     * for a typical UI to function properly
-     *
-     * - Last event of every room (to generate likely message preview)
-     * - All events up to the read receipt (to calculate an accurate notification count)
-     *
-     * @returns Signals when all events have been decrypted
-     */
-    public async decryptCriticalEvents(): Promise<void> {
-        if (!this.client.isCryptoEnabled()) return;
-
-        const readReceiptEventId = this.getEventReadUpTo(this.client.getUserId()!, true);
-        const events = this.getLiveTimeline().getEvents();
-        const readReceiptTimelineIndex = events.findIndex((matrixEvent) => {
-            return matrixEvent.event.event_id === readReceiptEventId;
-        });
-
-        const decryptionPromises = events
-            .slice(readReceiptTimelineIndex)
-            .reverse()
-            .map((event) => this.client.decryptEventIfNeeded(event));
-
-        await Promise.allSettled(decryptionPromises);
-    }
-
-    /**
-     * Bulk decrypt events in a room
-     *
-     * @returns Signals when all events have been decrypted
-     */
-    public async decryptAllEvents(): Promise<void> {
-        if (!this.client.isCryptoEnabled()) return;
-
-        const decryptionPromises = this.getUnfilteredTimelineSet()
-            .getLiveTimeline()
-            .getEvents()
-            .slice(0) // copy before reversing
-            .reverse()
-            .map((event) => this.client.decryptEventIfNeeded(event));
-
-        await Promise.allSettled(decryptionPromises);
-    }
-
     /**
      * Gets the creator of the room
      * @returns The creator of the room, or null if it could not be determined
@@ -1661,6 +1614,11 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * "crop" or "scale".
      * @param allowDefault - True to allow an identicon for this room if an
      * avatar URL wasn't explicitly set. Default: true. (Deprecated)
+     * @param useAuthentication - (optional) If true, the caller supports authenticated
+     * media and wants an authentication-required URL. Note that server support for
+     * authenticated media will not be checked - it is the caller's responsibility
+     * to do so before calling this function. Note also that useAuthentication
+     * implies allowRedirects. Defaults to false (unauthenticated endpoints).
      * @returns the avatar URL or null.
      */
     public getAvatarUrl(
@@ -1669,6 +1627,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         height: number,
         resizeMethod: ResizeMethod,
         allowDefault = true,
+        useAuthentication: boolean = false,
     ): string | null {
         const roomAvatarEvent = this.currentState.getStateEvents(EventType.RoomAvatar, "");
         if (!roomAvatarEvent && !allowDefault) {
@@ -1677,7 +1636,16 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
 
         const mainUrl = roomAvatarEvent ? roomAvatarEvent.getContent().url : null;
         if (mainUrl) {
-            return getHttpUriForMxc(baseUrl, mainUrl, width, height, resizeMethod);
+            return getHttpUriForMxc(
+                baseUrl,
+                mainUrl,
+                width,
+                height,
+                resizeMethod,
+                undefined,
+                undefined,
+                useAuthentication,
+            );
         }
 
         return null;
@@ -1739,10 +1707,11 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     public addEventsToTimeline(
         events: MatrixEvent[],
         toStartOfTimeline: boolean,
+        addToState: boolean,
         timeline: EventTimeline,
         paginationToken?: string,
     ): void {
-        timeline.getTimelineSet().addEventsToTimeline(events, toStartOfTimeline, timeline, paginationToken);
+        timeline.getTimelineSet().addEventsToTimeline(events, toStartOfTimeline, addToState, timeline, paginationToken);
     }
 
     /**
@@ -1907,7 +1876,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
             // see https://github.com/vector-im/vector-web/issues/2109
 
             unfilteredLiveTimeline.getEvents().forEach(function (event) {
-                timelineSet.addLiveEvent(event);
+                timelineSet.addLiveEvent(event, { addToState: false }); // Filtered timeline sets should not track state
             });
 
             // find the earliest unfiltered timeline
@@ -1994,6 +1963,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 if (filterType !== ThreadFilterType.My || currentUserParticipated) {
                     timelineSet.getLiveTimeline().addEvent(thread.rootEvent!, {
                         toStartOfTimeline: false,
+                        addToState: false,
                     });
                 }
             });
@@ -2062,12 +2032,12 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 return threadAMetadata.latest_event.origin_server_ts - threadBMetadata.latest_event.origin_server_ts;
             });
 
-            let latestMyThreadsRootEvent: MatrixEvent | undefined;
             const roomState = this.getLiveTimeline().getState(EventTimeline.FORWARDS);
             for (const rootEvent of threadRoots) {
                 const opts = {
                     duplicateStrategy: DuplicateStrategy.Ignore,
                     fromCache: false,
+                    addToState: false,
                     roomState,
                 };
                 this.threadsTimelineSets[0]?.addLiveEvent(rootEvent, opts);
@@ -2077,16 +2047,10 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 );
                 if (threadRelationship?.current_user_participated) {
                     this.threadsTimelineSets[1]?.addLiveEvent(rootEvent, opts);
-                    latestMyThreadsRootEvent = rootEvent;
                 }
             }
 
             this.processThreadRoots(threadRoots, true);
-
-            this.client.decryptEventIfNeeded(threadRoots[threadRoots.length - 1]);
-            if (latestMyThreadsRootEvent) {
-                this.client.decryptEventIfNeeded(latestMyThreadsRootEvent);
-            }
         }
 
         this.on(ThreadEvent.NewReply, this.onThreadReply);
@@ -2110,7 +2074,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                  * Try to decrypt the event. Promise resolution does not guarantee a successful decryption.
                  * Retry is handled in {@link processPollEvent}.
                  */
-                await this.client.decryptEventIfNeeded(event);
                 this.processPollEvent(event);
             } catch (err) {
                 logger.warn("Error processing poll event", event.getId(), err);
@@ -2129,13 +2092,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param event - Event that could be a poll event
      */
     private async processPollEvent(event: MatrixEvent): Promise<void> {
-        if (event.isDecryptionFailure()) {
-            event.once(MatrixEventEvent.Decrypted, (maybeDecryptedEvent: MatrixEvent) => {
-                this.processPollEvent(maybeDecryptedEvent);
-            });
-            return;
-        }
-
         if (M_POLL_START.matches(event.getType())) {
             try {
                 const poll = new Poll(event, this.client, this);
@@ -2190,6 +2146,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 duplicateStrategy: DuplicateStrategy.Replace,
                 fromCache: false,
                 roomState,
+                addToState: false,
             });
         }
     }
@@ -2381,9 +2338,13 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                     duplicateStrategy: DuplicateStrategy.Replace,
                     fromCache: false,
                     roomState: this.currentState,
+                    addToState: false,
                 });
             } else {
-                timelineSet.addEventToTimeline(thread.rootEvent, timelineSet.getLiveTimeline(), { toStartOfTimeline });
+                timelineSet.addEventToTimeline(thread.rootEvent, timelineSet.getLiveTimeline(), {
+                    toStartOfTimeline,
+                    addToState: false,
+                });
             }
         }
     };
@@ -2540,7 +2501,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * Fires {@link RoomEvent.Timeline}
      */
     private addLiveEvent(event: MatrixEvent, addLiveEventOptions: IAddLiveEventOptions): void {
-        const { duplicateStrategy, timelineWasEmpty, fromCache } = addLiveEventOptions;
+        const { duplicateStrategy, timelineWasEmpty, fromCache, addToState } = addLiveEventOptions;
 
         // add to our timeline sets
         for (const timelineSet of this.timelineSets) {
@@ -2548,6 +2509,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 duplicateStrategy,
                 fromCache,
                 timelineWasEmpty,
+                addToState,
             });
         }
 
@@ -2631,11 +2593,13 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                     if (timelineSet.getFilter()!.filterRoomTimeline([event]).length) {
                         timelineSet.addEventToTimeline(event, timelineSet.getLiveTimeline(), {
                             toStartOfTimeline: false,
+                            addToState: false, // We don't support localEcho of state events yet
                         });
                     }
                 } else {
                     timelineSet.addEventToTimeline(event, timelineSet.getLiveTimeline(), {
                         toStartOfTimeline: false,
+                        addToState: false, // We don't support localEcho of state events yet
                     });
                 }
             }
@@ -2886,8 +2850,8 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param addLiveEventOptions - addLiveEvent options
      * @throws If `duplicateStrategy` is not falsey, 'replace' or 'ignore'.
      */
-    public async addLiveEvents(events: MatrixEvent[], addLiveEventOptions?: IAddLiveEventOptions): Promise<void> {
-        const { duplicateStrategy, fromCache, timelineWasEmpty = false } = addLiveEventOptions ?? {};
+    public async addLiveEvents(events: MatrixEvent[], addLiveEventOptions: IAddLiveEventOptions): Promise<void> {
+        const { duplicateStrategy, fromCache, timelineWasEmpty = false, addToState } = addLiveEventOptions;
         if (duplicateStrategy && ["replace", "ignore"].indexOf(duplicateStrategy) === -1) {
             throw new Error("duplicateStrategy MUST be either 'replace' or 'ignore'");
         }
@@ -2902,6 +2866,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
             duplicateStrategy,
             fromCache,
             timelineWasEmpty,
+            addToState,
         };
 
         // List of extra events to check for being parents of any relations encountered

package/src/models/thread.ts

@@ -208,6 +208,7 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
 
     public static setServerSideSupport(status: FeatureSupport): void {
         Thread.hasServerSideSupport = status;
+        // XXX: This global latching behaviour is really unexpected and means that you can't undo when moving to a server without support
         if (status !== FeatureSupport.Stable) {
             FILTER_RELATED_BY_SENDERS.setPreferUnstable(true);
             FILTER_RELATED_BY_REL_TYPES.setPreferUnstable(true);
@@ -317,6 +318,7 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
                 toStartOfTimeline,
                 fromCache: false,
                 roomState: this.roomState,
+                addToState: false,
             });
         }
     }
@@ -343,7 +345,7 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
         if (this.findEventById(eventId)) {
             return;
         }
-        this.timelineSet.insertEventIntoTimeline(event, this.liveTimeline, this.roomState);
+        this.timelineSet.insertEventIntoTimeline(event, this.liveTimeline, this.roomState, false);
     }
 
     public addEvents(events: MatrixEvent[], toStartOfTimeline: boolean): void {
@@ -372,7 +374,6 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
         if (!Thread.hasServerSideSupport) {
             // When there's no server-side support, just add it to the end of the timeline.
             this.addEventToTimeline(event, toStartOfTimeline);
-            this.client.decryptEventIfNeeded(event);
         } else if (event.isRelation(RelationType.Annotation) || event.isRelation(RelationType.Replace)) {
             this.addRelatedThreadEvent(event, toStartOfTimeline);
             return;
@@ -618,7 +619,7 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
                     // if the thread has regular events, this will just load the last reply.
                     // if the thread is newly created, this will load the root event.
                     if (this.replyCount === 0 && this.rootEvent) {
-                        this.timelineSet.addEventsToTimeline([this.rootEvent], true, this.liveTimeline, null);
+                        this.timelineSet.addEventsToTimeline([this.rootEvent], true, false, this.liveTimeline, null);
                         this.liveTimeline.setPaginationToken(null, Direction.Backward);
                     } else {
                         this.initalEventFetchProm = this.client.paginateEventTimeline(this.liveTimeline, {

package/src/oidc/authorize.ts

@@ -17,13 +17,13 @@ limitations under the License.
 import { IdTokenClaims, Log, OidcClient, SigninResponse, SigninState, WebStorageStateStore } from "oidc-client-ts";
 
 import { logger } from "../logger.ts";
-import { randomString } from "../randomstring.ts";
+import { secureRandomString } from "../randomstring.ts";
 import { OidcError } from "./error.ts";
 import {
     BearerTokenResponse,
     UserState,
     validateBearerTokenResponse,
-    ValidatedIssuerMetadata,
+    ValidatedAuthMetadata,
     validateIdToken,
     validateStoredUserState,
 } from "./validate.ts";
@@ -52,7 +52,7 @@ export type AuthorizationParams = {
  * @returns scope
  */
 export const generateScope = (deviceId?: string): string => {
-    const safeDeviceId = deviceId ?? randomString(10);
+    const safeDeviceId = deviceId ?? secureRandomString(10);
     return `openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:${safeDeviceId}`;
 };
 
@@ -79,9 +79,9 @@ const generateCodeChallenge = async (codeVerifier: string): Promise<string> => {
 export const generateAuthorizationParams = ({ redirectUri }: { redirectUri: string }): AuthorizationParams => ({
     scope: generateScope(),
     redirectUri,
-    state: randomString(8),
-    nonce: randomString(8),
-    codeVerifier: randomString(64), // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters
+    state: secureRandomString(8),
+    nonce: secureRandomString(8),
+    codeVerifier: secureRandomString(64), // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters
 });
 
 /**
@@ -138,7 +138,7 @@ export const generateOidcAuthorizationUrl = async ({
     urlState,
 }: {
     clientId: string;
-    metadata: ValidatedIssuerMetadata;
+    metadata: ValidatedAuthMetadata;
     homeserverUrl: string;
     identityServerUrl?: string;
     redirectUri: string;

package/src/oidc/discovery.ts

@@ -16,7 +16,7 @@ limitations under the License.
 
 import { MetadataService, OidcClientSettingsStore } from "oidc-client-ts";
 
-import { isValidatedIssuerMetadata, validateOIDCIssuerWellKnown } from "./validate.ts";
+import { validateAuthMetadata } from "./validate.ts";
 import { Method, timeoutSignal } from "../http-api/index.ts";
 import { OidcClientConfig } from "./index.ts";
 
@@ -30,6 +30,7 @@ import { OidcClientConfig } from "./index.ts";
  * @param issuer - the OIDC issuer as returned by the /auth_issuer API
  * @returns validated authentication metadata and optionally signing keys
  * @throws when delegated auth config is invalid or unreachable
+ * @deprecated in favour of {@link MatrixClient#getAuthMetadata}
  */
 export const discoverAndValidateOIDCIssuerWellKnown = async (issuer: string): Promise<OidcClientConfig> => {
     const issuerOpenIdConfigUrl = new URL(".well-known/openid-configuration", issuer);
@@ -38,23 +39,28 @@ export const discoverAndValidateOIDCIssuerWellKnown = async (issuer: string): Pr
         signal: timeoutSignal(5000),
     });
     const issuerWellKnown = await issuerWellKnownResponse.json();
-    const validatedIssuerConfig = validateOIDCIssuerWellKnown(issuerWellKnown);
+    return validateAuthMetadataAndKeys(issuerWellKnown);
+};
+/**
+ * @experimental
+ * Validate the authentication metadata and fetch the signing keys from the jwks_uri in the metadata
+ * @param authMetadata - the authentication metadata to validate
+ * @returns validated authentication metadata and signing keys
+ */
+export const validateAuthMetadataAndKeys = async (authMetadata: unknown): Promise<OidcClientConfig> => {
+    const validatedIssuerConfig = validateAuthMetadata(authMetadata);
 
     // create a temporary settings store, so we can use metadata service for discovery
     const settings = new OidcClientSettingsStore({
-        authority: issuer,
+        authority: validatedIssuerConfig.issuer,
+        metadata: validatedIssuerConfig,
         redirect_uri: "", // Not known yet, this is here to make the type checker happy
         client_id: "", // Not known yet, this is here to make the type checker happy
     });
     const metadataService = new MetadataService(settings);
-    const metadata = await metadataService.getMetadata();
-    const signingKeys = (await metadataService.getSigningKeys()) ?? undefined;
-
-    isValidatedIssuerMetadata(metadata);
-
+    
     return {
         ...validatedIssuerConfig,
-        metadata,
-        signingKeys,
+        signingKeys: await metadataService.getSigningKeys(),
     };
 };

package/src/oidc/index.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import type { SigningKey } from "oidc-client-ts";
-import { ValidatedIssuerConfig, ValidatedIssuerMetadata } from "./validate.ts";
+import { ValidatedAuthMetadata } from "./validate.ts";
 
 export * from "./authorize.ts";
 export * from "./discovery.ts";
@@ -28,7 +28,6 @@ export * from "./validate.ts";
  * Validated config for native OIDC authentication, as returned by {@link discoverAndValidateOIDCIssuerWellKnown}.
  * Contains metadata and signing keys from the issuer's well-known (https://oidc-issuer.example.com/.well-known/openid-configuration).
  */
-export interface OidcClientConfig extends ValidatedIssuerConfig {
-    metadata: ValidatedIssuerMetadata;
-    signingKeys?: SigningKey[];
+export interface OidcClientConfig extends ValidatedAuthMetadata {
+    signingKeys: SigningKey[] | null;
 }

package/src/oidc/register.ts

@@ -65,12 +65,12 @@ export const registerOidcClient = async (
     delegatedAuthConfig: OidcClientConfig,
     clientMetadata: OidcRegistrationClientMetadata,
 ): Promise<string> => {
-    if (!delegatedAuthConfig.registrationEndpoint) {
+    if (!delegatedAuthConfig.registration_endpoint) {
         throw new Error(OidcError.DynamicRegistrationNotSupported);
     }
 
     const grantTypes: NonEmptyArray<string> = ["authorization_code", "refresh_token"];
-    if (grantTypes.some((scope) => !delegatedAuthConfig.metadata.grant_types_supported.includes(scope))) {
+    if (grantTypes.some((scope) => !delegatedAuthConfig.grant_types_supported.includes(scope))) {
         throw new Error(OidcError.DynamicRegistrationNotSupported);
     }
 
@@ -95,7 +95,7 @@ export const registerOidcClient = async (
     };
 
     try {
-        const response = await fetch(delegatedAuthConfig.registrationEndpoint, {
+        const response = await fetch(delegatedAuthConfig.registration_endpoint, {
             method: Method.Post,
             headers,
             body: JSON.stringify(metadata),

package/src/oidc/tokenRefresher.ts

@@ -77,11 +77,12 @@ export class OidcTokenRefresher {
             const scope = generateScope(deviceId);
 
             this.oidcClient = new OidcClient({
-                ...config.metadata,
+                metadata: config,
+                signingKeys: config.signingKeys ?? undefined,
                 client_id: clientId,
                 scope,
                 redirect_uri: redirectUri,
-                authority: config.metadata.issuer,
+                authority: config.issuer,
                 stateStore: new WebStorageStateStore({ prefix: "mx_oidc_", store: window.sessionStorage }),
             });
         } catch (error) {