livekit-client 2.11.3 → 2.12.0

package/dist/livekit-client.e2ee.worker.mjs

@@ -482,8 +482,7 @@ const KEY_PROVIDER_DEFAULTS = {
   ratchetSalt: SALT,
   ratchetWindowSize: 8,
   failureTolerance: DECRYPTION_FAILURE_TOLERANCE,
-  keyringSize: 16,
-  allowKeyExtraction: false
+  keyringSize: 16
 };
 const MAX_SIF_COUNT = 100;
 const MAX_SIF_DURATION = 2000;
@@ -550,11 +549,16 @@ class CryptorError extends LivekitError {
 var KeyProviderEvent;
 (function (KeyProviderEvent) {
   KeyProviderEvent["SetKey"] = "setKey";
+  /** Event for requesting to ratchet the key used to encrypt the stream */
   KeyProviderEvent["RatchetRequest"] = "ratchetRequest";
+  /** Emitted when a key is ratcheted. Could be after auto-ratcheting on decryption failure or
+   *  following a `RatchetRequest`, will contain the ratcheted key material */
   KeyProviderEvent["KeyRatcheted"] = "keyRatcheted";
 })(KeyProviderEvent || (KeyProviderEvent = {}));
 var KeyHandlerEvent;
 (function (KeyHandlerEvent) {
+  /** Emitted when a key has been ratcheted. Is emitted when any key has been ratcheted
+   * i.e. when the FrameCryptor tried to ratchet when decryption is failing  */
   KeyHandlerEvent["KeyRatcheted"] = "keyRatcheted";
 })(KeyHandlerEvent || (KeyHandlerEvent = {}));
 var EncryptionEvent;
@@ -963,10 +967,9 @@ function importKey(keyBytes_1) {
       name: ENCRYPTION_ALGORITHM
     };
     let usage = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : 'encrypt';
-    let extractable = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : false;
     return function* () {
       // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey
-      return crypto.subtle.importKey('raw', keyBytes, algorithm, extractable, usage === 'derive' ? ['deriveBits', 'deriveKey'] : ['encrypt', 'decrypt']);
+      return crypto.subtle.importKey('raw', keyBytes, algorithm, false, usage === 'derive' ? ['deriveBits', 'deriveKey'] : ['encrypt', 'decrypt']);
     }();
   });
 }
@@ -1418,11 +1421,12 @@ class FrameCryptor extends BaseFrameCryptor {
             if (ratchetOpts.ratchetCount < _this.keyProviderOptions.ratchetWindowSize) {
               workerLogger.debug("ratcheting key attempt ".concat(ratchetOpts.ratchetCount, " of ").concat(_this.keyProviderOptions.ratchetWindowSize, ", for kind ").concat(encodedFrame instanceof RTCEncodedAudioFrame ? 'audio' : 'video'));
               let ratchetedKeySet;
+              let ratchetResult;
               if ((initialMaterial !== null && initialMaterial !== void 0 ? initialMaterial : keySet) === _this.keys.getKeySet(keyIndex)) {
                 // only ratchet if the currently set key is still the same as the one used to decrypt this frame
                 // if not, it might be that a different frame has already ratcheted and we try with that one first
-                const newMaterial = yield _this.keys.ratchetKey(keyIndex, false);
-                ratchetedKeySet = yield deriveKeys(newMaterial, _this.keyProviderOptions.ratchetSalt);
+                ratchetResult = yield _this.keys.ratchetKey(keyIndex, false);
+                ratchetedKeySet = yield deriveKeys(ratchetResult.cryptoKey, _this.keyProviderOptions.ratchetSalt);
               }
               const frame = yield _this.decryptFrame(encodedFrame, keyIndex, initialMaterial || keySet, {
                 ratchetCount: ratchetOpts.ratchetCount + 1,
@@ -1432,7 +1436,7 @@ class FrameCryptor extends BaseFrameCryptor {
                 // before updating the keys, make sure that the keySet used for this frame is still the same as the currently set key
                 // if it's not, a new key might have been set already, which we don't want to override
                 if ((initialMaterial !== null && initialMaterial !== void 0 ? initialMaterial : keySet) === _this.keys.getKeySet(keyIndex)) {
-                  _this.keys.setKeySet(ratchetedKeySet, keyIndex, true);
+                  _this.keys.setKeySet(ratchetedKeySet, keyIndex, ratchetResult);
                   // decryption was successful, set the new key index to reflect the ratcheted key set
                   _this.keys.setCurrentKeyIndex(keyIndex);
                 }
@@ -1720,12 +1724,10 @@ class ParticipantKeyHandler extends eventsExports.EventEmitter {
    * returns the ratcheted material
    * if `setKey` is true (default), it will also set the ratcheted key directly on the crypto key ring
    * @param keyIndex
-   * @param setKey set the new key. Will emit KeyHandlerEvent.KeyRatcheted after key generation (default: true)
-   * @param extractable allow key extraction (get the key in plaintext) on the ratcheted new key (default: false)
+   * @param setKey
    */
   ratchetKey(keyIndex) {
     let setKey = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : true;
-    let extractable = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
     const currentKeyIndex = keyIndex !== null && keyIndex !== void 0 ? keyIndex : this.getCurrentKeyIndex();
     const existingPromise = this.ratchetPromiseMap.get(currentKeyIndex);
     if (typeof existingPromise !== 'undefined') {
@@ -1738,12 +1740,17 @@ class ParticipantKeyHandler extends eventsExports.EventEmitter {
           throw new TypeError("Cannot ratchet key without a valid keyset of participant ".concat(this.participantIdentity));
         }
         const currentMaterial = keySet.material;
-        const newMaterial = yield importKey(yield ratchet(currentMaterial, this.keyProviderOptions.ratchetSalt), currentMaterial.algorithm.name, 'derive', extractable);
+        const chainKey = yield ratchet(currentMaterial, this.keyProviderOptions.ratchetSalt);
+        const newMaterial = yield importKey(chainKey, currentMaterial.algorithm.name, 'derive');
+        const ratchetResult = {
+          chainKey,
+          cryptoKey: newMaterial
+        };
         if (setKey) {
-          yield this.setKeyFromMaterial(newMaterial, currentKeyIndex, true);
-          this.emit(KeyHandlerEvent.KeyRatcheted, newMaterial, this.participantIdentity, currentKeyIndex);
+          // Set the new key and emit a ratchet event with the ratcheted chain key
+          yield this.setKeyFromMaterial(newMaterial, currentKeyIndex, ratchetResult);
         }
-        resolve(newMaterial);
+        resolve(ratchetResult);
       } catch (e) {
         reject(e);
       } finally {
@@ -1778,7 +1785,7 @@ class ParticipantKeyHandler extends eventsExports.EventEmitter {
   setKeyFromMaterial(material_1, keyIndex_1) {
     return __awaiter(this, arguments, void 0, function (material, keyIndex) {
       var _this2 = this;
-      let emitRatchetEvent = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+      let ratchetedResult = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : null;
       return function* () {
         const keySet = yield deriveKeys(material, _this2.keyProviderOptions.ratchetSalt);
         const newIndex = keyIndex >= 0 ? keyIndex % _this2.cryptoKeyRing.length : _this2.currentKeyIndex;
@@ -1787,16 +1794,16 @@ class ParticipantKeyHandler extends eventsExports.EventEmitter {
           algorithm: material.algorithm,
           ratchetSalt: _this2.keyProviderOptions.ratchetSalt
         });
-        _this2.setKeySet(keySet, newIndex, emitRatchetEvent);
+        _this2.setKeySet(keySet, newIndex, ratchetedResult);
         if (newIndex >= 0) _this2.currentKeyIndex = newIndex;
       }();
     });
   }
   setKeySet(keySet, keyIndex) {
-    let emitRatchetEvent = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+    let ratchetedResult = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : null;
     this.cryptoKeyRing[keyIndex % this.cryptoKeyRing.length] = keySet;
-    if (emitRatchetEvent) {
-      this.emit(KeyHandlerEvent.KeyRatcheted, keySet.material, this.participantIdentity, keyIndex);
+    if (ratchetedResult) {
+      this.emit(KeyHandlerEvent.KeyRatcheted, ratchetedResult, this.participantIdentity, keyIndex);
     }
   }
   setCurrentKeyIndex(index) {
@@ -1901,11 +1908,11 @@ function handleRatchetRequest(data) {
   return __awaiter(this, void 0, void 0, function* () {
     if (useSharedKey) {
       const keyHandler = getSharedKeyHandler();
-      yield keyHandler.ratchetKey(data.keyIndex, true, data.extractable);
+      yield keyHandler.ratchetKey(data.keyIndex);
       keyHandler.resetKeyStatus();
     } else if (data.participantIdentity) {
       const keyHandler = getParticipantKeyHandler(data.participantIdentity);
-      yield keyHandler.ratchetKey(data.keyIndex, true, data.extractable);
+      yield keyHandler.ratchetKey(data.keyIndex);
       keyHandler.resetKeyStatus();
     } else {
       workerLogger.error('no participant Id was provided for ratchet request and shared key usage is disabled');
@@ -2009,13 +2016,13 @@ function setupCryptorErrorEvents(cryptor) {
     postMessage(msg);
   });
 }
-function emitRatchetedKeys(material, participantIdentity, keyIndex) {
+function emitRatchetedKeys(ratchetResult, participantIdentity, keyIndex) {
   const msg = {
     kind: "ratchetKey",
     data: {
       participantIdentity,
       keyIndex,
-      material
+      ratchetResult
     }
   };
   postMessage(msg);