matrix-js-sdk 34.2.0 → 34.3.0-rc.0

package/lib/oidc/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","names":["Log","OidcClient","SigninResponse","SigninState","WebStorageStateStore","logger","randomString","OidcError","validateBearerTokenResponse","validateIdToken","validateStoredUserState","generateScope","deviceId","safeDeviceId","concat","generateCodeChallenge","_ref","_asyncToGenerator","codeVerifier","globalThis","crypto","subtle","warn","utf8","TextEncoder","encode","digest","btoa","String","fromCharCode","Uint8Array","replace","_x","apply","arguments","generateAuthorizationParams","_ref2","redirectUri","scope","state","nonce","generateAuthorizationUrl","_ref4","authorizationUrl","clientId","_ref3","url","URL","searchParams","append","toString","_x2","_x3","_x4","generateOidcAuthorizationUrl","_ref6","_ref5","metadata","homeserverUrl","identityServerUrl","prompt","urlState","oidcClient","_objectSpread","client_id","redirect_uri","authority","issuer","response_mode","response_type","stateStore","prefix","store","window","sessionStorage","userState","request","createSigninRequest","url_state","_x5","normalizeBearerTokenResponseTokenType","response","id_token","expires_at","refresh_token","access_token","token_type","completeAuthorizationCodeGrant","_ref7","code","reconstructedUrl","location","origin","setLogger","stateString","get","Error","MissingOrInvalidStoredState","signInState","fromStorageString","client","signinResponse","processSigninResponse","href","settings","normalizedTokenResponse","oidcClientSettings","tokenResponse","idTokenClaims","profile","error","errorType","message","Object","values","includes","CodeExchangeFailed","_x6","_x7"],"sources":["../../src/oidc/authorize.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { IdTokenClaims, Log, OidcClient, SigninResponse, SigninState, WebStorageStateStore } from \"oidc-client-ts\";\n\nimport { logger } from \"../logger\";\nimport { randomString } from \"../randomstring\";\nimport { OidcError } from \"./error\";\nimport {\n    BearerTokenResponse,\n    UserState,\n    validateBearerTokenResponse,\n    ValidatedIssuerMetadata,\n    validateIdToken,\n    validateStoredUserState,\n} from \"./validate\";\n\n// reexport for backwards compatibility\nexport type { BearerTokenResponse };\n\n/**\n * Authorization parameters which are used in the authentication request of an OIDC auth code flow.\n *\n * See https://openid.net/specs/openid-connect-basic-1_0.html#RequestParameters.\n */\nexport type AuthorizationParams = {\n    state: string;\n    scope: string;\n    redirectUri: string;\n    codeVerifier: string;\n    nonce: string;\n};\n\n/**\n * @experimental\n * Generate the scope used in authorization request with OIDC OP\n * @returns scope\n */\nexport const generateScope = (deviceId?: string): string => {\n    const safeDeviceId = deviceId ?? randomString(10);\n    return `openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:${safeDeviceId}`;\n};\n\n// https://www.rfc-editor.org/rfc/rfc7636\nconst generateCodeChallenge = async (codeVerifier: string): Promise<string> => {\n    if (!globalThis.crypto.subtle) {\n        // @TODO(kerrya) should this be allowed? configurable?\n        logger.warn(\"A secure context is required to generate code challenge. Using plain text code challenge\");\n        return codeVerifier;\n    }\n    const utf8 = new TextEncoder().encode(codeVerifier);\n\n    const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", utf8);\n\n    return btoa(String.fromCharCode(...new Uint8Array(digest)))\n        .replace(/=/g, \"\")\n        .replace(/\\+/g, \"-\")\n        .replace(/\\//g, \"_\");\n};\n\n/**\n * Generate authorization params to pass to {@link generateAuthorizationUrl}.\n *\n * Used as part of an authorization code OIDC flow: see https://openid.net/specs/openid-connect-basic-1_0.html#CodeFlow.\n *\n * @param redirectUri - absolute url for OP to redirect to after authorization\n * @returns AuthorizationParams\n */\nexport const generateAuthorizationParams = ({ redirectUri }: { redirectUri: string }): AuthorizationParams => ({\n    scope: generateScope(),\n    redirectUri,\n    state: randomString(8),\n    nonce: randomString(8),\n    codeVerifier: randomString(64), // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters\n});\n\n/**\n * @deprecated use generateOidcAuthorizationUrl\n * Generate a URL to attempt authorization with the OP\n * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest\n * @param authorizationUrl - endpoint to attempt authorization with the OP\n * @param clientId - id of this client as registered with the OP\n * @param authorizationParams - params to be used in the url\n * @returns a Promise with the url as a string\n */\nexport const generateAuthorizationUrl = async (\n    authorizationUrl: string,\n    clientId: string,\n    { scope, redirectUri, state, nonce, codeVerifier }: AuthorizationParams,\n): Promise<string> => {\n    const url = new URL(authorizationUrl);\n    url.searchParams.append(\"response_mode\", \"query\");\n    url.searchParams.append(\"response_type\", \"code\");\n    url.searchParams.append(\"redirect_uri\", redirectUri);\n    url.searchParams.append(\"client_id\", clientId);\n    url.searchParams.append(\"state\", state);\n    url.searchParams.append(\"scope\", scope);\n    url.searchParams.append(\"nonce\", nonce);\n\n    url.searchParams.append(\"code_challenge_method\", \"S256\");\n    url.searchParams.append(\"code_challenge\", await generateCodeChallenge(codeVerifier));\n\n    return url.toString();\n};\n\n/**\n * @experimental\n * Generate a URL to attempt authorization with the OP\n * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest\n * @param metadata - validated metadata from OP discovery\n * @param clientId - this client's id as registered with the OP\n * @param homeserverUrl - used to establish the session on return from the OP\n * @param identityServerUrl - used to establish the session on return from the OP\n * @param nonce - state\n * @param prompt - indicates to the OP which flow the user should see - eg login or registration\n *          See https://openid.net/specs/openid-connect-prompt-create-1_0.html#name-prompt-parameter\n * @param urlState - value to append to the opaque state identifier to uniquely identify the callback\n * @returns a Promise with the url as a string\n */\nexport const generateOidcAuthorizationUrl = async ({\n    metadata,\n    redirectUri,\n    clientId,\n    homeserverUrl,\n    identityServerUrl,\n    nonce,\n    prompt,\n    urlState,\n}: {\n    clientId: string;\n    metadata: ValidatedIssuerMetadata;\n    homeserverUrl: string;\n    identityServerUrl?: string;\n    redirectUri: string;\n    nonce: string;\n    prompt?: string;\n    urlState?: string;\n}): Promise<string> => {\n    const scope = generateScope();\n    const oidcClient = new OidcClient({\n        ...metadata,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n        authority: metadata.issuer,\n        response_mode: \"query\",\n        response_type: \"code\",\n        scope,\n        stateStore: new WebStorageStateStore({ prefix: \"mx_oidc_\", store: window.sessionStorage }),\n    });\n    const userState: UserState = { homeserverUrl, nonce, identityServerUrl };\n    const request = await oidcClient.createSigninRequest({\n        state: userState,\n        nonce,\n        prompt,\n        url_state: urlState,\n    });\n\n    return request.url;\n};\n\n/**\n * Normalize token_type to use capital case to make consuming the token response easier\n * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: \"bearer\"\n * Later, when used in auth headers it is case sensitive and must be Bearer\n * See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4\n *\n * @param response - validated token response\n * @returns response with token_type set to 'Bearer'\n */\nconst normalizeBearerTokenResponseTokenType = (response: SigninResponse): BearerTokenResponse =>\n    ({\n        id_token: response.id_token,\n        scope: response.scope,\n        expires_at: response.expires_at,\n        refresh_token: response.refresh_token,\n        access_token: response.access_token,\n        token_type: \"Bearer\",\n    }) as BearerTokenResponse;\n\n/**\n * @experimental\n * Attempt to exchange authorization code for bearer token.\n *\n * Takes the authorization code returned by the OpenID Provider via the authorization URL, and makes a\n * request to the Token Endpoint, to obtain the access token, refresh token, etc.\n *\n * @param code - authorization code as returned by OP during authorization\n * @param storedAuthorizationParams - stored params from start of oidc login flow\n * @returns valid bearer token response\n * @throws An `Error` with `message` set to an entry in {@link OidcError},\n *      when the request fails, or the returned token response is invalid.\n */\nexport const completeAuthorizationCodeGrant = async (\n    code: string,\n    state: string,\n): Promise<{\n    oidcClientSettings: { clientId: string; issuer: string };\n    tokenResponse: BearerTokenResponse;\n    homeserverUrl: string;\n    idTokenClaims: IdTokenClaims;\n    identityServerUrl?: string;\n}> => {\n    /**\n     * Element Web strips and changes the url on starting the app\n     * Use the code and state from query params to rebuild a url\n     * so that oidc-client can parse it\n     */\n    const reconstructedUrl = new URL(window.location.origin);\n    reconstructedUrl.searchParams.append(\"code\", code);\n    reconstructedUrl.searchParams.append(\"state\", state);\n\n    // set oidc-client to use our logger\n    Log.setLogger(logger);\n    try {\n        const response = new SigninResponse(reconstructedUrl.searchParams);\n\n        const stateStore = new WebStorageStateStore({ prefix: \"mx_oidc_\", store: window.sessionStorage });\n\n        // retrieve the state we put in storage at the start of oidc auth flow\n        const stateString = await stateStore.get(response.state!);\n        if (!stateString) {\n            throw new Error(OidcError.MissingOrInvalidStoredState);\n        }\n\n        // hydrate the sign in state and create a client\n        // the stored sign in state includes oidc configuration we set at the start of the oidc login flow\n        const signInState = await SigninState.fromStorageString(stateString);\n        const client = new OidcClient({ ...signInState, stateStore });\n\n        // validate the code and state, and attempt to swap the code for tokens\n        const signinResponse = await client.processSigninResponse(reconstructedUrl.href);\n\n        // extra values we stored at the start of the login flow\n        // used to complete login in the client\n        const userState = signinResponse.userState;\n        validateStoredUserState(userState);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(signinResponse);\n        // throws when token is invalid\n        validateIdToken(signinResponse.id_token, client.settings.authority, client.settings.client_id, userState.nonce);\n        const normalizedTokenResponse = normalizeBearerTokenResponseTokenType(signinResponse);\n\n        return {\n            oidcClientSettings: {\n                clientId: client.settings.client_id,\n                issuer: client.settings.authority,\n            },\n            tokenResponse: normalizedTokenResponse,\n            homeserverUrl: userState.homeserverUrl,\n            identityServerUrl: userState.identityServerUrl,\n            idTokenClaims: signinResponse.profile,\n        };\n    } catch (error) {\n        logger.error(\"Oidc login failed\", error);\n        const errorType = (error as Error).message;\n\n        // rethrow errors that we recognise\n        if (Object.values(OidcError).includes(errorType as any)) {\n            throw error;\n        }\n        throw new Error(OidcError.CodeExchangeFailed);\n    }\n};\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAwBA,GAAG,EAAEC,UAAU,EAAEC,cAAc,EAAEC,WAAW,EAAEC,oBAAoB,QAAQ,gBAAgB;AAElH,SAASC,MAAM,QAAQ,WAAW;AAClC,SAASC,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,SAAS,QAAQ,SAAS;AACnC,SAGIC,2BAA2B,EAE3BC,eAAe,EACfC,uBAAuB,QACpB,YAAY;;AAEnB;;AAGA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMC,aAAa,GAAIC,QAAiB,IAAa;EACxD,IAAMC,YAAY,GAAGD,QAAQ,aAARA,QAAQ,cAARA,QAAQ,GAAIN,YAAY,CAAC,EAAE,CAAC;EACjD,wGAAAQ,MAAA,CAAwGD,YAAY;AACxH,CAAC;;AAED;AACA,IAAME,qBAAqB;EAAA,IAAAC,IAAA,GAAAC,iBAAA,CAAG,WAAOC,YAAoB,EAAsB;IAC3E,IAAI,CAACC,UAAU,CAACC,MAAM,CAACC,MAAM,EAAE;MAC3B;MACAhB,MAAM,CAACiB,IAAI,CAAC,0FAA0F,CAAC;MACvG,OAAOJ,YAAY;IACvB;IACA,IAAMK,IAAI,GAAG,IAAIC,WAAW,CAAC,CAAC,CAACC,MAAM,CAACP,YAAY,CAAC;IAEnD,IAAMQ,MAAM,SAASP,UAAU,CAACC,MAAM,CAACC,MAAM,CAACK,MAAM,CAAC,SAAS,EAAEH,IAAI,CAAC;IAErE,OAAOI,IAAI,CAACC,MAAM,CAACC,YAAY,CAAC,GAAG,IAAIC,UAAU,CAACJ,MAAM,CAAC,CAAC,CAAC,CACtDK,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CACjBA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CACnBA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;EAC5B,CAAC;EAAA,gBAdKhB,qBAAqBA,CAAAiB,EAAA;IAAA,OAAAhB,IAAA,CAAAiB,KAAA,OAAAC,SAAA;EAAA;AAAA,GAc1B;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMC,2BAA2B,GAAGC,KAAA;EAAA,IAAC;IAAEC;EAAqC,CAAC,GAAAD,KAAA;EAAA,OAA2B;IAC3GE,KAAK,EAAE3B,aAAa,CAAC,CAAC;IACtB0B,WAAW;IACXE,KAAK,EAAEjC,YAAY,CAAC,CAAC,CAAC;IACtBkC,KAAK,EAAElC,YAAY,CAAC,CAAC,CAAC;IACtBY,YAAY,EAAEZ,YAAY,CAAC,EAAE,CAAC,CAAE;EACpC,CAAC;AAAA,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMmC,wBAAwB;EAAA,IAAAC,KAAA,GAAAzB,iBAAA,CAAG,WACpC0B,gBAAwB,EACxBC,QAAgB,EAAAC,KAAA,EAEE;IAAA,IADlB;MAAEP,KAAK;MAAED,WAAW;MAAEE,KAAK;MAAEC,KAAK;MAAEtB;IAAkC,CAAC,GAAA2B,KAAA;IAEvE,IAAMC,GAAG,GAAG,IAAIC,GAAG,CAACJ,gBAAgB,CAAC;IACrCG,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC;IACjDH,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;IAChDH,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,cAAc,EAAEZ,WAAW,CAAC;IACpDS,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,WAAW,EAAEL,QAAQ,CAAC;IAC9CE,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEV,KAAK,CAAC;IACvCO,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEX,KAAK,CAAC;IACvCQ,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAET,KAAK,CAAC;IAEvCM,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACxDH,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,gBAAgB,QAAQlC,qBAAqB,CAACG,YAAY,CAAC,CAAC;IAEpF,OAAO4B,GAAG,CAACI,QAAQ,CAAC,CAAC;EACzB,CAAC;EAAA,gBAlBYT,wBAAwBA,CAAAU,GAAA,EAAAC,GAAA,EAAAC,GAAA;IAAA,OAAAX,KAAA,CAAAT,KAAA,OAAAC,SAAA;EAAA;AAAA,GAkBpC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMoB,4BAA4B;EAAA,IAAAC,KAAA,GAAAtC,iBAAA,CAAG,WAAAuC,KAAA,EAkBrB;IAAA,IAlB4B;MAC/CC,QAAQ;MACRpB,WAAW;MACXO,QAAQ;MACRc,aAAa;MACbC,iBAAiB;MACjBnB,KAAK;MACLoB,MAAM;MACNC;IAUJ,CAAC,GAAAL,KAAA;IACG,IAAMlB,KAAK,GAAG3B,aAAa,CAAC,CAAC;IAC7B,IAAMmD,UAAU,GAAG,IAAI7D,UAAU,CAAA8D,aAAA,CAAAA,aAAA,KAC1BN,QAAQ;MACXO,SAAS,EAAEpB,QAAQ;MACnBqB,YAAY,EAAE5B,WAAW;MACzB6B,SAAS,EAAET,QAAQ,CAACU,MAAM;MAC1BC,aAAa,EAAE,OAAO;MACtBC,aAAa,EAAE,MAAM;MACrB/B,KAAK;MACLgC,UAAU,EAAE,IAAIlE,oBAAoB,CAAC;QAAEmE,MAAM,EAAE,UAAU;QAAEC,KAAK,EAAEC,MAAM,CAACC;MAAe,CAAC;IAAC,EAC7F,CAAC;IACF,IAAMC,SAAoB,GAAG;MAAEjB,aAAa;MAAElB,KAAK;MAAEmB;IAAkB,CAAC;IACxE,IAAMiB,OAAO,SAASd,UAAU,CAACe,mBAAmB,CAAC;MACjDtC,KAAK,EAAEoC,SAAS;MAChBnC,KAAK;MACLoB,MAAM;MACNkB,SAAS,EAAEjB;IACf,CAAC,CAAC;IAEF,OAAOe,OAAO,CAAC9B,GAAG;EACtB,CAAC;EAAA,gBAvCYQ,4BAA4BA,CAAAyB,GAAA;IAAA,OAAAxB,KAAA,CAAAtB,KAAA,OAAAC,SAAA;EAAA;AAAA,GAuCxC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAM8C,qCAAqC,GAAIC,QAAwB,KAClE;EACGC,QAAQ,EAAED,QAAQ,CAACC,QAAQ;EAC3B5C,KAAK,EAAE2C,QAAQ,CAAC3C,KAAK;EACrB6C,UAAU,EAAEF,QAAQ,CAACE,UAAU;EAC/BC,aAAa,EAAEH,QAAQ,CAACG,aAAa;EACrCC,YAAY,EAAEJ,QAAQ,CAACI,YAAY;EACnCC,UAAU,EAAE;AAChB,CAAC,CAAwB;;AAE7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMC,8BAA8B;EAAA,IAAAC,KAAA,GAAAvE,iBAAA,CAAG,WAC1CwE,IAAY,EACZlD,KAAa,EAOX;IACF;AACJ;AACA;AACA;AACA;IACI,IAAMmD,gBAAgB,GAAG,IAAI3C,GAAG,CAAC0B,MAAM,CAACkB,QAAQ,CAACC,MAAM,CAAC;IACxDF,gBAAgB,CAAC1C,YAAY,CAACC,MAAM,CAAC,MAAM,EAAEwC,IAAI,CAAC;IAClDC,gBAAgB,CAAC1C,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEV,KAAK,CAAC;;IAEpD;IACAvC,GAAG,CAAC6F,SAAS,CAACxF,MAAM,CAAC;IACrB,IAAI;MACA,IAAM4E,QAAQ,GAAG,IAAI/E,cAAc,CAACwF,gBAAgB,CAAC1C,YAAY,CAAC;MAElE,IAAMsB,UAAU,GAAG,IAAIlE,oBAAoB,CAAC;QAAEmE,MAAM,EAAE,UAAU;QAAEC,KAAK,EAAEC,MAAM,CAACC;MAAe,CAAC,CAAC;;MAEjG;MACA,IAAMoB,WAAW,SAASxB,UAAU,CAACyB,GAAG,CAACd,QAAQ,CAAC1C,KAAM,CAAC;MACzD,IAAI,CAACuD,WAAW,EAAE;QACd,MAAM,IAAIE,KAAK,CAACzF,SAAS,CAAC0F,2BAA2B,CAAC;MAC1D;;MAEA;MACA;MACA,IAAMC,WAAW,SAAS/F,WAAW,CAACgG,iBAAiB,CAACL,WAAW,CAAC;MACpE,IAAMM,MAAM,GAAG,IAAInG,UAAU,CAAA8D,aAAA,CAAAA,aAAA,KAAMmC,WAAW;QAAE5B;MAAU,EAAE,CAAC;;MAE7D;MACA,IAAM+B,cAAc,SAASD,MAAM,CAACE,qBAAqB,CAACZ,gBAAgB,CAACa,IAAI,CAAC;;MAEhF;MACA;MACA,IAAM5B,SAAS,GAAG0B,cAAc,CAAC1B,SAAS;MAC1CjE,uBAAuB,CAACiE,SAAS,CAAC;;MAElC;MACAnE,2BAA2B,CAAC6F,cAAc,CAAC;MAC3C;MACA5F,eAAe,CAAC4F,cAAc,CAACnB,QAAQ,EAAEkB,MAAM,CAACI,QAAQ,CAACtC,SAAS,EAAEkC,MAAM,CAACI,QAAQ,CAACxC,SAAS,EAAEW,SAAS,CAACnC,KAAK,CAAC;MAC/G,IAAMiE,uBAAuB,GAAGzB,qCAAqC,CAACqB,cAAc,CAAC;MAErF,OAAO;QACHK,kBAAkB,EAAE;UAChB9D,QAAQ,EAAEwD,MAAM,CAACI,QAAQ,CAACxC,SAAS;UACnCG,MAAM,EAAEiC,MAAM,CAACI,QAAQ,CAACtC;QAC5B,CAAC;QACDyC,aAAa,EAAEF,uBAAuB;QACtC/C,aAAa,EAAEiB,SAAS,CAACjB,aAAa;QACtCC,iBAAiB,EAAEgB,SAAS,CAAChB,iBAAiB;QAC9CiD,aAAa,EAAEP,cAAc,CAACQ;MAClC,CAAC;IACL,CAAC,CAAC,OAAOC,KAAK,EAAE;MACZzG,MAAM,CAACyG,KAAK,CAAC,mBAAmB,EAAEA,KAAK,CAAC;MACxC,IAAMC,SAAS,GAAID,KAAK,CAAWE,OAAO;;MAE1C;MACA,IAAIC,MAAM,CAACC,MAAM,CAAC3G,SAAS,CAAC,CAAC4G,QAAQ,CAACJ,SAAgB,CAAC,EAAE;QACrD,MAAMD,KAAK;MACf;MACA,MAAM,IAAId,KAAK,CAACzF,SAAS,CAAC6G,kBAAkB,CAAC;IACjD;EACJ,CAAC;EAAA,gBAvEY7B,8BAA8BA,CAAA8B,GAAA,EAAAC,GAAA;IAAA,OAAA9B,KAAA,CAAAvD,KAAA,OAAAC,SAAA;EAAA;AAAA,GAuE1C","ignoreList":[]}
+{"version":3,"file":"authorize.js","names":["Log","OidcClient","SigninResponse","SigninState","WebStorageStateStore","logger","randomString","OidcError","validateBearerTokenResponse","validateIdToken","validateStoredUserState","sha256","encodeUnpaddedBase64Url","generateScope","deviceId","safeDeviceId","concat","generateCodeChallenge","_ref","_asyncToGenerator","codeVerifier","globalThis","crypto","subtle","warn","hashBuffer","_x","apply","arguments","generateAuthorizationParams","_ref2","redirectUri","scope","state","nonce","generateAuthorizationUrl","_ref4","authorizationUrl","clientId","_ref3","url","URL","searchParams","append","toString","_x2","_x3","_x4","generateOidcAuthorizationUrl","_ref6","_ref5","metadata","homeserverUrl","identityServerUrl","prompt","urlState","oidcClient","_objectSpread","client_id","redirect_uri","authority","issuer","response_mode","response_type","stateStore","prefix","store","window","sessionStorage","userState","request","createSigninRequest","url_state","_x5","normalizeBearerTokenResponseTokenType","response","id_token","expires_at","refresh_token","access_token","token_type","completeAuthorizationCodeGrant","_ref7","code","reconstructedUrl","location","origin","setLogger","stateString","get","Error","MissingOrInvalidStoredState","signInState","fromStorageString","client","signinResponse","processSigninResponse","href","settings","normalizedTokenResponse","oidcClientSettings","tokenResponse","idTokenClaims","profile","error","errorType","message","Object","values","includes","CodeExchangeFailed","_x6","_x7"],"sources":["../../src/oidc/authorize.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { IdTokenClaims, Log, OidcClient, SigninResponse, SigninState, WebStorageStateStore } from \"oidc-client-ts\";\n\nimport { logger } from \"../logger\";\nimport { randomString } from \"../randomstring\";\nimport { OidcError } from \"./error\";\nimport {\n    BearerTokenResponse,\n    UserState,\n    validateBearerTokenResponse,\n    ValidatedIssuerMetadata,\n    validateIdToken,\n    validateStoredUserState,\n} from \"./validate\";\nimport { sha256 } from \"../digest\";\nimport { encodeUnpaddedBase64Url } from \"../base64\";\n\n// reexport for backwards compatibility\nexport type { BearerTokenResponse };\n\n/**\n * Authorization parameters which are used in the authentication request of an OIDC auth code flow.\n *\n * See https://openid.net/specs/openid-connect-basic-1_0.html#RequestParameters.\n */\nexport type AuthorizationParams = {\n    state: string;\n    scope: string;\n    redirectUri: string;\n    codeVerifier: string;\n    nonce: string;\n};\n\n/**\n * @experimental\n * Generate the scope used in authorization request with OIDC OP\n * @returns scope\n */\nexport const generateScope = (deviceId?: string): string => {\n    const safeDeviceId = deviceId ?? randomString(10);\n    return `openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:${safeDeviceId}`;\n};\n\n// https://www.rfc-editor.org/rfc/rfc7636\nconst generateCodeChallenge = async (codeVerifier: string): Promise<string> => {\n    if (!globalThis.crypto.subtle) {\n        // @TODO(kerrya) should this be allowed? configurable?\n        logger.warn(\"A secure context is required to generate code challenge. Using plain text code challenge\");\n        return codeVerifier;\n    }\n\n    const hashBuffer = await sha256(codeVerifier);\n    return encodeUnpaddedBase64Url(hashBuffer);\n};\n\n/**\n * Generate authorization params to pass to {@link generateAuthorizationUrl}.\n *\n * Used as part of an authorization code OIDC flow: see https://openid.net/specs/openid-connect-basic-1_0.html#CodeFlow.\n *\n * @param redirectUri - absolute url for OP to redirect to after authorization\n * @returns AuthorizationParams\n */\nexport const generateAuthorizationParams = ({ redirectUri }: { redirectUri: string }): AuthorizationParams => ({\n    scope: generateScope(),\n    redirectUri,\n    state: randomString(8),\n    nonce: randomString(8),\n    codeVerifier: randomString(64), // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters\n});\n\n/**\n * @deprecated use generateOidcAuthorizationUrl\n * Generate a URL to attempt authorization with the OP\n * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest\n * @param authorizationUrl - endpoint to attempt authorization with the OP\n * @param clientId - id of this client as registered with the OP\n * @param authorizationParams - params to be used in the url\n * @returns a Promise with the url as a string\n */\nexport const generateAuthorizationUrl = async (\n    authorizationUrl: string,\n    clientId: string,\n    { scope, redirectUri, state, nonce, codeVerifier }: AuthorizationParams,\n): Promise<string> => {\n    const url = new URL(authorizationUrl);\n    url.searchParams.append(\"response_mode\", \"query\");\n    url.searchParams.append(\"response_type\", \"code\");\n    url.searchParams.append(\"redirect_uri\", redirectUri);\n    url.searchParams.append(\"client_id\", clientId);\n    url.searchParams.append(\"state\", state);\n    url.searchParams.append(\"scope\", scope);\n    url.searchParams.append(\"nonce\", nonce);\n\n    url.searchParams.append(\"code_challenge_method\", \"S256\");\n    url.searchParams.append(\"code_challenge\", await generateCodeChallenge(codeVerifier));\n\n    return url.toString();\n};\n\n/**\n * @experimental\n * Generate a URL to attempt authorization with the OP\n * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest\n * @param metadata - validated metadata from OP discovery\n * @param clientId - this client's id as registered with the OP\n * @param homeserverUrl - used to establish the session on return from the OP\n * @param identityServerUrl - used to establish the session on return from the OP\n * @param nonce - state\n * @param prompt - indicates to the OP which flow the user should see - eg login or registration\n *          See https://openid.net/specs/openid-connect-prompt-create-1_0.html#name-prompt-parameter\n * @param urlState - value to append to the opaque state identifier to uniquely identify the callback\n * @returns a Promise with the url as a string\n */\nexport const generateOidcAuthorizationUrl = async ({\n    metadata,\n    redirectUri,\n    clientId,\n    homeserverUrl,\n    identityServerUrl,\n    nonce,\n    prompt,\n    urlState,\n}: {\n    clientId: string;\n    metadata: ValidatedIssuerMetadata;\n    homeserverUrl: string;\n    identityServerUrl?: string;\n    redirectUri: string;\n    nonce: string;\n    prompt?: string;\n    urlState?: string;\n}): Promise<string> => {\n    const scope = generateScope();\n    const oidcClient = new OidcClient({\n        ...metadata,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n        authority: metadata.issuer,\n        response_mode: \"query\",\n        response_type: \"code\",\n        scope,\n        stateStore: new WebStorageStateStore({ prefix: \"mx_oidc_\", store: window.sessionStorage }),\n    });\n    const userState: UserState = { homeserverUrl, nonce, identityServerUrl };\n    const request = await oidcClient.createSigninRequest({\n        state: userState,\n        nonce,\n        prompt,\n        url_state: urlState,\n    });\n\n    return request.url;\n};\n\n/**\n * Normalize token_type to use capital case to make consuming the token response easier\n * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: \"bearer\"\n * Later, when used in auth headers it is case sensitive and must be Bearer\n * See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4\n *\n * @param response - validated token response\n * @returns response with token_type set to 'Bearer'\n */\nconst normalizeBearerTokenResponseTokenType = (response: SigninResponse): BearerTokenResponse =>\n    ({\n        id_token: response.id_token,\n        scope: response.scope,\n        expires_at: response.expires_at,\n        refresh_token: response.refresh_token,\n        access_token: response.access_token,\n        token_type: \"Bearer\",\n    }) as BearerTokenResponse;\n\n/**\n * @experimental\n * Attempt to exchange authorization code for bearer token.\n *\n * Takes the authorization code returned by the OpenID Provider via the authorization URL, and makes a\n * request to the Token Endpoint, to obtain the access token, refresh token, etc.\n *\n * @param code - authorization code as returned by OP during authorization\n * @param storedAuthorizationParams - stored params from start of oidc login flow\n * @returns valid bearer token response\n * @throws An `Error` with `message` set to an entry in {@link OidcError},\n *      when the request fails, or the returned token response is invalid.\n */\nexport const completeAuthorizationCodeGrant = async (\n    code: string,\n    state: string,\n): Promise<{\n    oidcClientSettings: { clientId: string; issuer: string };\n    tokenResponse: BearerTokenResponse;\n    homeserverUrl: string;\n    idTokenClaims: IdTokenClaims;\n    identityServerUrl?: string;\n}> => {\n    /**\n     * Element Web strips and changes the url on starting the app\n     * Use the code and state from query params to rebuild a url\n     * so that oidc-client can parse it\n     */\n    const reconstructedUrl = new URL(window.location.origin);\n    reconstructedUrl.searchParams.append(\"code\", code);\n    reconstructedUrl.searchParams.append(\"state\", state);\n\n    // set oidc-client to use our logger\n    Log.setLogger(logger);\n    try {\n        const response = new SigninResponse(reconstructedUrl.searchParams);\n\n        const stateStore = new WebStorageStateStore({ prefix: \"mx_oidc_\", store: window.sessionStorage });\n\n        // retrieve the state we put in storage at the start of oidc auth flow\n        const stateString = await stateStore.get(response.state!);\n        if (!stateString) {\n            throw new Error(OidcError.MissingOrInvalidStoredState);\n        }\n\n        // hydrate the sign in state and create a client\n        // the stored sign in state includes oidc configuration we set at the start of the oidc login flow\n        const signInState = await SigninState.fromStorageString(stateString);\n        const client = new OidcClient({ ...signInState, stateStore });\n\n        // validate the code and state, and attempt to swap the code for tokens\n        const signinResponse = await client.processSigninResponse(reconstructedUrl.href);\n\n        // extra values we stored at the start of the login flow\n        // used to complete login in the client\n        const userState = signinResponse.userState;\n        validateStoredUserState(userState);\n\n        // throws when response is invalid\n        validateBearerTokenResponse(signinResponse);\n        // throws when token is invalid\n        validateIdToken(signinResponse.id_token, client.settings.authority, client.settings.client_id, userState.nonce);\n        const normalizedTokenResponse = normalizeBearerTokenResponseTokenType(signinResponse);\n\n        return {\n            oidcClientSettings: {\n                clientId: client.settings.client_id,\n                issuer: client.settings.authority,\n            },\n            tokenResponse: normalizedTokenResponse,\n            homeserverUrl: userState.homeserverUrl,\n            identityServerUrl: userState.identityServerUrl,\n            idTokenClaims: signinResponse.profile,\n        };\n    } catch (error) {\n        logger.error(\"Oidc login failed\", error);\n        const errorType = (error as Error).message;\n\n        // rethrow errors that we recognise\n        if (Object.values(OidcError).includes(errorType as any)) {\n            throw error;\n        }\n        throw new Error(OidcError.CodeExchangeFailed);\n    }\n};\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAwBA,GAAG,EAAEC,UAAU,EAAEC,cAAc,EAAEC,WAAW,EAAEC,oBAAoB,QAAQ,gBAAgB;AAElH,SAASC,MAAM,QAAQ,WAAW;AAClC,SAASC,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,SAAS,QAAQ,SAAS;AACnC,SAGIC,2BAA2B,EAE3BC,eAAe,EACfC,uBAAuB,QACpB,YAAY;AACnB,SAASC,MAAM,QAAQ,WAAW;AAClC,SAASC,uBAAuB,QAAQ,WAAW;;AAEnD;;AAGA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMC,aAAa,GAAIC,QAAiB,IAAa;EACxD,IAAMC,YAAY,GAAGD,QAAQ,aAARA,QAAQ,cAARA,QAAQ,GAAIR,YAAY,CAAC,EAAE,CAAC;EACjD,wGAAAU,MAAA,CAAwGD,YAAY;AACxH,CAAC;;AAED;AACA,IAAME,qBAAqB;EAAA,IAAAC,IAAA,GAAAC,iBAAA,CAAG,WAAOC,YAAoB,EAAsB;IAC3E,IAAI,CAACC,UAAU,CAACC,MAAM,CAACC,MAAM,EAAE;MAC3B;MACAlB,MAAM,CAACmB,IAAI,CAAC,0FAA0F,CAAC;MACvG,OAAOJ,YAAY;IACvB;IAEA,IAAMK,UAAU,SAASd,MAAM,CAACS,YAAY,CAAC;IAC7C,OAAOR,uBAAuB,CAACa,UAAU,CAAC;EAC9C,CAAC;EAAA,gBATKR,qBAAqBA,CAAAS,EAAA;IAAA,OAAAR,IAAA,CAAAS,KAAA,OAAAC,SAAA;EAAA;AAAA,GAS1B;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMC,2BAA2B,GAAGC,KAAA;EAAA,IAAC;IAAEC;EAAqC,CAAC,GAAAD,KAAA;EAAA,OAA2B;IAC3GE,KAAK,EAAEnB,aAAa,CAAC,CAAC;IACtBkB,WAAW;IACXE,KAAK,EAAE3B,YAAY,CAAC,CAAC,CAAC;IACtB4B,KAAK,EAAE5B,YAAY,CAAC,CAAC,CAAC;IACtBc,YAAY,EAAEd,YAAY,CAAC,EAAE,CAAC,CAAE;EACpC,CAAC;AAAA,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAM6B,wBAAwB;EAAA,IAAAC,KAAA,GAAAjB,iBAAA,CAAG,WACpCkB,gBAAwB,EACxBC,QAAgB,EAAAC,KAAA,EAEE;IAAA,IADlB;MAAEP,KAAK;MAAED,WAAW;MAAEE,KAAK;MAAEC,KAAK;MAAEd;IAAkC,CAAC,GAAAmB,KAAA;IAEvE,IAAMC,GAAG,GAAG,IAAIC,GAAG,CAACJ,gBAAgB,CAAC;IACrCG,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC;IACjDH,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;IAChDH,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,cAAc,EAAEZ,WAAW,CAAC;IACpDS,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,WAAW,EAAEL,QAAQ,CAAC;IAC9CE,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEV,KAAK,CAAC;IACvCO,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEX,KAAK,CAAC;IACvCQ,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,OAAO,EAAET,KAAK,CAAC;IAEvCM,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACxDH,GAAG,CAACE,YAAY,CAACC,MAAM,CAAC,gBAAgB,QAAQ1B,qBAAqB,CAACG,YAAY,CAAC,CAAC;IAEpF,OAAOoB,GAAG,CAACI,QAAQ,CAAC,CAAC;EACzB,CAAC;EAAA,gBAlBYT,wBAAwBA,CAAAU,GAAA,EAAAC,GAAA,EAAAC,GAAA;IAAA,OAAAX,KAAA,CAAAT,KAAA,OAAAC,SAAA;EAAA;AAAA,GAkBpC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMoB,4BAA4B;EAAA,IAAAC,KAAA,GAAA9B,iBAAA,CAAG,WAAA+B,KAAA,EAkBrB;IAAA,IAlB4B;MAC/CC,QAAQ;MACRpB,WAAW;MACXO,QAAQ;MACRc,aAAa;MACbC,iBAAiB;MACjBnB,KAAK;MACLoB,MAAM;MACNC;IAUJ,CAAC,GAAAL,KAAA;IACG,IAAMlB,KAAK,GAAGnB,aAAa,CAAC,CAAC;IAC7B,IAAM2C,UAAU,GAAG,IAAIvD,UAAU,CAAAwD,aAAA,CAAAA,aAAA,KAC1BN,QAAQ;MACXO,SAAS,EAAEpB,QAAQ;MACnBqB,YAAY,EAAE5B,WAAW;MACzB6B,SAAS,EAAET,QAAQ,CAACU,MAAM;MAC1BC,aAAa,EAAE,OAAO;MACtBC,aAAa,EAAE,MAAM;MACrB/B,KAAK;MACLgC,UAAU,EAAE,IAAI5D,oBAAoB,CAAC;QAAE6D,MAAM,EAAE,UAAU;QAAEC,KAAK,EAAEC,MAAM,CAACC;MAAe,CAAC;IAAC,EAC7F,CAAC;IACF,IAAMC,SAAoB,GAAG;MAAEjB,aAAa;MAAElB,KAAK;MAAEmB;IAAkB,CAAC;IACxE,IAAMiB,OAAO,SAASd,UAAU,CAACe,mBAAmB,CAAC;MACjDtC,KAAK,EAAEoC,SAAS;MAChBnC,KAAK;MACLoB,MAAM;MACNkB,SAAS,EAAEjB;IACf,CAAC,CAAC;IAEF,OAAOe,OAAO,CAAC9B,GAAG;EACtB,CAAC;EAAA,gBAvCYQ,4BAA4BA,CAAAyB,GAAA;IAAA,OAAAxB,KAAA,CAAAtB,KAAA,OAAAC,SAAA;EAAA;AAAA,GAuCxC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAM8C,qCAAqC,GAAIC,QAAwB,KAClE;EACGC,QAAQ,EAAED,QAAQ,CAACC,QAAQ;EAC3B5C,KAAK,EAAE2C,QAAQ,CAAC3C,KAAK;EACrB6C,UAAU,EAAEF,QAAQ,CAACE,UAAU;EAC/BC,aAAa,EAAEH,QAAQ,CAACG,aAAa;EACrCC,YAAY,EAAEJ,QAAQ,CAACI,YAAY;EACnCC,UAAU,EAAE;AAChB,CAAC,CAAwB;;AAE7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMC,8BAA8B;EAAA,IAAAC,KAAA,GAAA/D,iBAAA,CAAG,WAC1CgE,IAAY,EACZlD,KAAa,EAOX;IACF;AACJ;AACA;AACA;AACA;IACI,IAAMmD,gBAAgB,GAAG,IAAI3C,GAAG,CAAC0B,MAAM,CAACkB,QAAQ,CAACC,MAAM,CAAC;IACxDF,gBAAgB,CAAC1C,YAAY,CAACC,MAAM,CAAC,MAAM,EAAEwC,IAAI,CAAC;IAClDC,gBAAgB,CAAC1C,YAAY,CAACC,MAAM,CAAC,OAAO,EAAEV,KAAK,CAAC;;IAEpD;IACAjC,GAAG,CAACuF,SAAS,CAAClF,MAAM,CAAC;IACrB,IAAI;MACA,IAAMsE,QAAQ,GAAG,IAAIzE,cAAc,CAACkF,gBAAgB,CAAC1C,YAAY,CAAC;MAElE,IAAMsB,UAAU,GAAG,IAAI5D,oBAAoB,CAAC;QAAE6D,MAAM,EAAE,UAAU;QAAEC,KAAK,EAAEC,MAAM,CAACC;MAAe,CAAC,CAAC;;MAEjG;MACA,IAAMoB,WAAW,SAASxB,UAAU,CAACyB,GAAG,CAACd,QAAQ,CAAC1C,KAAM,CAAC;MACzD,IAAI,CAACuD,WAAW,EAAE;QACd,MAAM,IAAIE,KAAK,CAACnF,SAAS,CAACoF,2BAA2B,CAAC;MAC1D;;MAEA;MACA;MACA,IAAMC,WAAW,SAASzF,WAAW,CAAC0F,iBAAiB,CAACL,WAAW,CAAC;MACpE,IAAMM,MAAM,GAAG,IAAI7F,UAAU,CAAAwD,aAAA,CAAAA,aAAA,KAAMmC,WAAW;QAAE5B;MAAU,EAAE,CAAC;;MAE7D;MACA,IAAM+B,cAAc,SAASD,MAAM,CAACE,qBAAqB,CAACZ,gBAAgB,CAACa,IAAI,CAAC;;MAEhF;MACA;MACA,IAAM5B,SAAS,GAAG0B,cAAc,CAAC1B,SAAS;MAC1C3D,uBAAuB,CAAC2D,SAAS,CAAC;;MAElC;MACA7D,2BAA2B,CAACuF,cAAc,CAAC;MAC3C;MACAtF,eAAe,CAACsF,cAAc,CAACnB,QAAQ,EAAEkB,MAAM,CAACI,QAAQ,CAACtC,SAAS,EAAEkC,MAAM,CAACI,QAAQ,CAACxC,SAAS,EAAEW,SAAS,CAACnC,KAAK,CAAC;MAC/G,IAAMiE,uBAAuB,GAAGzB,qCAAqC,CAACqB,cAAc,CAAC;MAErF,OAAO;QACHK,kBAAkB,EAAE;UAChB9D,QAAQ,EAAEwD,MAAM,CAACI,QAAQ,CAACxC,SAAS;UACnCG,MAAM,EAAEiC,MAAM,CAACI,QAAQ,CAACtC;QAC5B,CAAC;QACDyC,aAAa,EAAEF,uBAAuB;QACtC/C,aAAa,EAAEiB,SAAS,CAACjB,aAAa;QACtCC,iBAAiB,EAAEgB,SAAS,CAAChB,iBAAiB;QAC9CiD,aAAa,EAAEP,cAAc,CAACQ;MAClC,CAAC;IACL,CAAC,CAAC,OAAOC,KAAK,EAAE;MACZnG,MAAM,CAACmG,KAAK,CAAC,mBAAmB,EAAEA,KAAK,CAAC;MACxC,IAAMC,SAAS,GAAID,KAAK,CAAWE,OAAO;;MAE1C;MACA,IAAIC,MAAM,CAACC,MAAM,CAACrG,SAAS,CAAC,CAACsG,QAAQ,CAACJ,SAAgB,CAAC,EAAE;QACrD,MAAMD,KAAK;MACf;MACA,MAAM,IAAId,KAAK,CAACnF,SAAS,CAACuG,kBAAkB,CAAC;IACjD;EACJ,CAAC;EAAA,gBAvEY7B,8BAA8BA,CAAA8B,GAAA,EAAAC,GAAA;IAAA,OAAA9B,KAAA,CAAAvD,KAAA,OAAAC,SAAA;EAAA;AAAA,GAuE1C","ignoreList":[]}

package/lib/rust-crypto/RoomEncryptor.d.ts

@@ -1,4 +1,4 @@
-import { OlmMachine, HistoryVisibility as RustHistoryVisibility } from "@matrix-org/matrix-sdk-crypto-wasm";
+import { HistoryVisibility as RustHistoryVisibility, OlmMachine } from "@matrix-org/matrix-sdk-crypto-wasm";
 import { IContent, MatrixEvent } from "../models/event";
 import { Room } from "../models/room";
 import { KeyClaimManager } from "./KeyClaimManager";

package/lib/rust-crypto/RoomEncryptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoomEncryptor.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/RoomEncryptor.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGH,UAAU,EAGV,iBAAiB,IAAI,qBAAqB,EAE7C,MAAM,oCAAoC,CAAC;AAI5C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAIpE;;;;GAIG;AACH,qBAAa,aAAa;IAqBlB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,kBAAkB;IAxB9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,CAAS;IAE1C;;;;OAIG;IACH,OAAO,CAAC,wBAAwB,CAAoC;IAEpE;;;;;;OAMG;gBAEkB,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,sBAAsB,EAAE,uBAAuB,EAC/C,IAAI,EAAE,IAAI,EACnB,kBAAkB,EAAE,QAAQ;IAgBxC;;;;OAIG;IACI,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI;IAO5C;;;;OAIG;IACI,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAcjD;;;;;;;OAOG;IACU,oBAAoB,CAAC,gCAAgC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3F;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,EAAE,gCAAgC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBxG;;;;;;;;OAQG;YACW,uBAAuB;IAgGrC;;OAEG;IACU,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;YAOnC,iBAAiB;CAiBlC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,iBAAiB,GAAG,qBAAqB,CAW5F"}
+{"version":3,"file":"RoomEncryptor.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/RoomEncryptor.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIH,iBAAiB,IAAI,qBAAqB,EAC1C,UAAU,EAIb,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAIpE;;;;GAIG;AACH,qBAAa,aAAa;IAqBlB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,kBAAkB;IAxB9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,+EAA+E;IAC/E,OAAO,CAAC,yBAAyB,CAAS;IAE1C;;;;OAIG;IACH,OAAO,CAAC,wBAAwB,CAAoC;IAEpE;;;;;;OAMG;gBAEkB,UAAU,EAAE,UAAU,EACtB,eAAe,EAAE,eAAe,EAChC,sBAAsB,EAAE,uBAAuB,EAC/C,IAAI,EAAE,IAAI,EACnB,kBAAkB,EAAE,QAAQ;IAgBxC;;;;OAIG;IACI,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI;IAO5C;;;;OAIG;IACI,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;IAcjD;;;;;;;OAOG;IACU,oBAAoB,CAAC,gCAAgC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3F;;;;;;;;OAQG;IACI,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,EAAE,gCAAgC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBxG;;;;;;;;OAQG;YACW,uBAAuB;IAmGrC;;OAEG;IACU,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;YAOnC,iBAAiB;CAiBlC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,iBAAiB,GAAG,qBAAqB,CAW5F"}

package/lib/rust-crypto/RoomEncryptor.js

@@ -16,8 +16,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { EncryptionAlgorithm, EncryptionSettings, RoomId, UserId, HistoryVisibility as RustHistoryVisibility } from "@matrix-org/matrix-sdk-crypto-wasm";
 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+import { CollectStrategy, EncryptionAlgorithm, EncryptionSettings, HistoryVisibility as RustHistoryVisibility, RoomId, UserId } from "@matrix-org/matrix-sdk-crypto-wasm";
 import { EventType } from "../@types/event";
 import { logger, LogSpan } from "../logger";
 import { HistoryVisibility } from "../@types/partials";
@@ -224,7 +224,11 @@ export class RoomEncryptor {
 
       // When this.room.getBlacklistUnverifiedDevices() === null, the global settings should be used
       // See Room#getBlacklistUnverifiedDevices
-      rustEncryptionSettings.onlyAllowTrustedDevices = (_this3$room$getBlackl = _this3.room.getBlacklistUnverifiedDevices()) !== null && _this3$room$getBlackl !== void 0 ? _this3$room$getBlackl : globalBlacklistUnverifiedDevices;
+      if ((_this3$room$getBlackl = _this3.room.getBlacklistUnverifiedDevices()) !== null && _this3$room$getBlackl !== void 0 ? _this3$room$getBlackl : globalBlacklistUnverifiedDevices) {
+        rustEncryptionSettings.sharingStrategy = CollectStrategy.DeviceBasedStrategyOnlyTrustedDevices;
+      } else {
+        rustEncryptionSettings.sharingStrategy = CollectStrategy.DeviceBasedStrategyAllDevices;
+      }
       yield logDuration(_this3.prefixedLogger, "shareRoomKey", /*#__PURE__*/_asyncToGenerator(function* () {
         var shareMessages = yield _this3.olmMachine.shareRoomKey(new RoomId(_this3.room.roomId),
         // safe to pass without cloning, as it's not reused here (before or after)

package/lib/rust-crypto/RoomEncryptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"RoomEncryptor.js","names":["EncryptionAlgorithm","EncryptionSettings","RoomId","UserId","HistoryVisibility","RustHistoryVisibility","RustSdkCryptoJs","EventType","logger","LogSpan","logDuration","KnownMembership","RoomEncryptor","constructor","olmMachine","keyClaimManager","outgoingRequestManager","room","encryptionSettings","_defineProperty","Promise","resolve","prefixedLogger","getChild","concat","roomId","members","getJoinedMembers","updateTrackedUsers","map","u","userId","catch","e","error","onCryptoEvent","config","JSON","stringify","Error","onRoomMembership","member","membership","Join","Invite","shouldEncryptForInvitedMembers","prepareForEncryption","globalBlacklistUnverifiedDevices","_this","_asyncToGenerator","encryptEvent","event","_event$getTxnId","_this2","getTxnId","prom","currentEncryptionPromise","then","ensureEncryptionSession","encryptEventInner","_this3","_this3$room$getBlackl","algorithm","debug","getEncryptionTargetMembers","lazyLoadedMembersResolved","doProcessOutgoingRequests","userList","ensureSessionsForUsers","rustEncryptionSettings","historyVisibility","toRustHistoryVisibility","getHistoryVisibility","MegolmV1AesSha2","rotation_period_ms","rotationPeriod","BigInt","rotation_period_msgs","rotationPeriodMessages","onlyAllowTrustedDevices","getBlacklistUnverifiedDevices","shareMessages","shareRoomKey","m","outgoingRequestProcessor","makeOutgoingRequest","forceDiscardSession","_this4","r","invalidateGroupSession","info","_this5","encryptedContent","encryptRoomEvent","getType","getContent","makeEncrypted","RoomMessageEncrypted","parse","identityKeys","curve25519","toBase64","ed25519","visibility","Invited","Joined","Shared","WorldReadable"],"sources":["../../src/rust-crypto/RoomEncryptor.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport {\n    EncryptionAlgorithm,\n    EncryptionSettings,\n    OlmMachine,\n    RoomId,\n    UserId,\n    HistoryVisibility as RustHistoryVisibility,\n    ToDeviceRequest,\n} from \"@matrix-org/matrix-sdk-crypto-wasm\";\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { EventType } from \"../@types/event\";\nimport { IContent, MatrixEvent } from \"../models/event\";\nimport { Room } from \"../models/room\";\nimport { Logger, logger, LogSpan } from \"../logger\";\nimport { KeyClaimManager } from \"./KeyClaimManager\";\nimport { RoomMember } from \"../models/room-member\";\nimport { HistoryVisibility } from \"../@types/partials\";\nimport { OutgoingRequestsManager } from \"./OutgoingRequestsManager\";\nimport { logDuration } from \"../utils\";\nimport { KnownMembership } from \"../@types/membership\";\n\n/**\n * RoomEncryptor: responsible for encrypting messages to a given room\n *\n * @internal\n */\nexport class RoomEncryptor {\n    private readonly prefixedLogger: Logger;\n\n    /** whether the room members have been loaded and tracked for the first time */\n    private lazyLoadedMembersResolved = false;\n\n    /**\n     * Ensures that there is only one encryption operation at a time for that room.\n     *\n     * An encryption operation is either a {@link prepareForEncryption} or an {@link encryptEvent} call.\n     */\n    private currentEncryptionPromise: Promise<void> = Promise.resolve();\n\n    /**\n     * @param olmMachine - The rust-sdk's OlmMachine\n     * @param keyClaimManager - Our KeyClaimManager, which manages the queue of one-time-key claim requests\n     * @param outgoingRequestManager - The OutgoingRequestManager, which manages the queue of outgoing requests.\n     * @param room - The room we want to encrypt for\n     * @param encryptionSettings - body of the m.room.encryption event currently in force in this room\n     */\n    public constructor(\n        private readonly olmMachine: OlmMachine,\n        private readonly keyClaimManager: KeyClaimManager,\n        private readonly outgoingRequestManager: OutgoingRequestsManager,\n        private readonly room: Room,\n        private encryptionSettings: IContent,\n    ) {\n        this.prefixedLogger = logger.getChild(`[${room.roomId} encryption]`);\n\n        // start tracking devices for any users already known to be in this room.\n        // Do not load members here, would defeat lazy loading.\n        const members = room.getJoinedMembers();\n\n        // At this point just mark the known members as tracked, it might not be the full list of members\n        // because of lazy loading. This is fine, because we will get a member list update when sending a message for\n        // the first time, see `RoomEncryptor#ensureEncryptionSession`\n        this.olmMachine\n            .updateTrackedUsers(members.map((u) => new RustSdkCryptoJs.UserId(u.userId)))\n            .catch((e) => this.prefixedLogger.error(\"Error initializing tracked users\", e));\n    }\n\n    /**\n     * Handle a new `m.room.encryption` event in this room\n     *\n     * @param config - The content of the encryption event\n     */\n    public onCryptoEvent(config: IContent): void {\n        if (JSON.stringify(this.encryptionSettings) != JSON.stringify(config)) {\n            // This should currently be unreachable, since the Rust SDK will reject any attempts to change config.\n            throw new Error(\"Cannot reconfigure an active RoomEncryptor\");\n        }\n    }\n\n    /**\n     * Handle a new `m.room.member` event in this room\n     *\n     * @param member - new membership state\n     */\n    public onRoomMembership(member: RoomMember): void {\n        if (\n            member.membership == KnownMembership.Join ||\n            (member.membership == KnownMembership.Invite && this.room.shouldEncryptForInvitedMembers())\n        ) {\n            // make sure we are tracking the deviceList for this user\n            this.olmMachine.updateTrackedUsers([new UserId(member.userId)]).catch((e) => {\n                this.prefixedLogger.error(\"Unable to update tracked users\", e);\n            });\n        }\n\n        // TODO: handle leaves (including our own)\n    }\n\n    /**\n     * Prepare to encrypt events in this room.\n     *\n     * This ensures that we have a megolm session ready to use and that we have shared its key with all the devices\n     * in the room.\n     *\n     * @param globalBlacklistUnverifiedDevices - When `true`, it will not send encrypted messages to unverified devices\n     */\n    public async prepareForEncryption(globalBlacklistUnverifiedDevices: boolean): Promise<void> {\n        // We consider a prepareForEncryption as an encryption promise as it will potentially share keys\n        // even if it doesn't send an event.\n        // Usually this is called when the user starts typing, so we want to make sure we have keys ready when the\n        // message is finally sent.\n        // If `encryptEvent` is invoked before `prepareForEncryption` has completed, the `encryptEvent` call will wait for\n        // `prepareForEncryption` to complete before executing.\n        // The part where `encryptEvent` shares the room key will then usually be a no-op as it was already performed by `prepareForEncryption`.\n        await this.encryptEvent(null, globalBlacklistUnverifiedDevices);\n    }\n\n    /**\n     * Encrypt an event for this room, or prepare for encryption.\n     *\n     * This will ensure that we have a megolm session for this room, share it with the devices in the room, and\n     * then, if an event is provided, encrypt it using the session.\n     *\n     * @param event - Event to be encrypted, or null if only preparing for encryption (in which case we will pre-share the room key).\n     * @param globalBlacklistUnverifiedDevices - When `true`, it will not send encrypted messages to unverified devices\n     */\n    public encryptEvent(event: MatrixEvent | null, globalBlacklistUnverifiedDevices: boolean): Promise<void> {\n        const logger = new LogSpan(this.prefixedLogger, event ? event.getTxnId() ?? \"\" : \"prepareForEncryption\");\n        // Ensure order of encryption to avoid message ordering issues, as the scheduler only ensures\n        // events order after they have been encrypted.\n        const prom = this.currentEncryptionPromise\n            .catch(() => {\n                // Any errors in the previous call will have been reported already, so there is nothing to do here.\n                // we just throw away the error and start anew.\n            })\n            .then(async () => {\n                await logDuration(logger, \"ensureEncryptionSession\", async () => {\n                    await this.ensureEncryptionSession(logger, globalBlacklistUnverifiedDevices);\n                });\n                if (event) {\n                    await logDuration(logger, \"encryptEventInner\", async () => {\n                        await this.encryptEventInner(logger, event);\n                    });\n                }\n            });\n\n        this.currentEncryptionPromise = prom;\n        return prom;\n    }\n\n    /**\n     * Prepare to encrypt events in this room.\n     *\n     * This ensures that we have a megolm session ready to use and that we have shared its key with all the devices\n     * in the room.\n     *\n     * @param logger - a place to write diagnostics to\n     * @param globalBlacklistUnverifiedDevices - When `true`, it will not send encrypted messages to unverified devices\n     */\n    private async ensureEncryptionSession(logger: LogSpan, globalBlacklistUnverifiedDevices: boolean): Promise<void> {\n        if (this.encryptionSettings.algorithm !== \"m.megolm.v1.aes-sha2\") {\n            throw new Error(\n                `Cannot encrypt in ${this.room.roomId} for unsupported algorithm '${this.encryptionSettings.algorithm}'`,\n            );\n        }\n        logger.debug(\"Starting encryption\");\n\n        const members = await this.room.getEncryptionTargetMembers();\n\n        // If this is the first time we are sending a message to the room, we may not yet have seen all the members\n        // (so the Crypto SDK might not have a device list for them). So, if this is the first time we are encrypting\n        // for this room, give the SDK the full list of members, to be on the safe side.\n        //\n        // This could end up being racy (if two calls to ensureEncryptionSession happen at the same time), but that's\n        // not a particular problem, since `OlmMachine.updateTrackedUsers` just adds any users that weren't already tracked.\n        if (!this.lazyLoadedMembersResolved) {\n            await logDuration(this.prefixedLogger, \"loadMembersIfNeeded: updateTrackedUsers\", async () => {\n                await this.olmMachine.updateTrackedUsers(members.map((u) => new RustSdkCryptoJs.UserId(u.userId)));\n            });\n            logger.debug(`Updated tracked users`);\n            this.lazyLoadedMembersResolved = true;\n\n            // Query keys in case we don't have them for newly tracked members.\n            // It's important after loading members for the first time, as likely most of them won't be\n            // known yet and will be unable to decrypt messages despite being in the room for long.\n            // This must be done before ensuring sessions. If not the devices of these users are not\n            // known yet and will not get the room key.\n            // We don't have API to only get the keys queries related to this member list, so we just\n            // process the pending requests from the olmMachine. (usually these are processed\n            // at the end of the sync, but we can't wait for that).\n            // XXX future improvement process only KeysQueryRequests for the users that have never been queried.\n            logger.debug(`Processing outgoing requests`);\n\n            await logDuration(this.prefixedLogger, \"doProcessOutgoingRequests\", async () => {\n                await this.outgoingRequestManager.doProcessOutgoingRequests();\n            });\n        } else {\n            // If members are already loaded it's less critical to await on key queries.\n            // We might still want to trigger a processOutgoingRequests here.\n            // The call to `ensureSessionsForUsers` below will wait a bit on in-flight key queries we are\n            // interested in. If a sync handling happens in the meantime, and some new members are added to the room\n            // or have new devices it would give us a chance to query them before sending.\n            // It's less critical due to the racy nature of this process.\n            logger.debug(`Processing outgoing requests in background`);\n            this.outgoingRequestManager.doProcessOutgoingRequests();\n        }\n\n        logger.debug(\n            `Encrypting for users (shouldEncryptForInvitedMembers: ${this.room.shouldEncryptForInvitedMembers()}):`,\n            members.map((u) => `${u.userId} (${u.membership})`),\n        );\n\n        const userList = members.map((u) => new UserId(u.userId));\n\n        await logDuration(this.prefixedLogger, \"ensureSessionsForUsers\", async () => {\n            await this.keyClaimManager.ensureSessionsForUsers(logger, userList);\n        });\n\n        const rustEncryptionSettings = new EncryptionSettings();\n        rustEncryptionSettings.historyVisibility = toRustHistoryVisibility(this.room.getHistoryVisibility());\n\n        // We only support megolm\n        rustEncryptionSettings.algorithm = EncryptionAlgorithm.MegolmV1AesSha2;\n\n        // We need to convert the rotation period from milliseconds to microseconds\n        // See https://spec.matrix.org/v1.8/client-server-api/#mroomencryption and\n        // https://matrix-org.github.io/matrix-rust-sdk-crypto-wasm/classes/EncryptionSettings.html#rotationPeriod\n        if (typeof this.encryptionSettings.rotation_period_ms === \"number\") {\n            rustEncryptionSettings.rotationPeriod = BigInt(this.encryptionSettings.rotation_period_ms * 1000);\n        }\n\n        if (typeof this.encryptionSettings.rotation_period_msgs === \"number\") {\n            rustEncryptionSettings.rotationPeriodMessages = BigInt(this.encryptionSettings.rotation_period_msgs);\n        }\n\n        // When this.room.getBlacklistUnverifiedDevices() === null, the global settings should be used\n        // See Room#getBlacklistUnverifiedDevices\n        rustEncryptionSettings.onlyAllowTrustedDevices =\n            this.room.getBlacklistUnverifiedDevices() ?? globalBlacklistUnverifiedDevices;\n\n        await logDuration(this.prefixedLogger, \"shareRoomKey\", async () => {\n            const shareMessages: ToDeviceRequest[] = await this.olmMachine.shareRoomKey(\n                new RoomId(this.room.roomId),\n                // safe to pass without cloning, as it's not reused here (before or after)\n                userList,\n                rustEncryptionSettings,\n            );\n            if (shareMessages) {\n                for (const m of shareMessages) {\n                    await this.outgoingRequestManager.outgoingRequestProcessor.makeOutgoingRequest(m);\n                }\n            }\n        });\n    }\n\n    /**\n     * Discard any existing group session for this room\n     */\n    public async forceDiscardSession(): Promise<void> {\n        const r = await this.olmMachine.invalidateGroupSession(new RoomId(this.room.roomId));\n        if (r) {\n            this.prefixedLogger.info(\"Discarded existing group session\");\n        }\n    }\n\n    private async encryptEventInner(logger: LogSpan, event: MatrixEvent): Promise<void> {\n        logger.debug(\"Encrypting actual message content\");\n        const encryptedContent = await this.olmMachine.encryptRoomEvent(\n            new RoomId(this.room.roomId),\n            event.getType(),\n            JSON.stringify(event.getContent()),\n        );\n\n        event.makeEncrypted(\n            EventType.RoomMessageEncrypted,\n            JSON.parse(encryptedContent),\n            this.olmMachine.identityKeys.curve25519.toBase64(),\n            this.olmMachine.identityKeys.ed25519.toBase64(),\n        );\n\n        logger.debug(\"Encrypted event successfully\");\n    }\n}\n\n/**\n * Convert a HistoryVisibility to a RustHistoryVisibility\n * @param visibility - HistoryVisibility enum\n * @returns a RustHistoryVisibility enum\n */\nexport function toRustHistoryVisibility(visibility: HistoryVisibility): RustHistoryVisibility {\n    switch (visibility) {\n        case HistoryVisibility.Invited:\n            return RustHistoryVisibility.Invited;\n        case HistoryVisibility.Joined:\n            return RustHistoryVisibility.Joined;\n        case HistoryVisibility.Shared:\n            return RustHistoryVisibility.Shared;\n        case HistoryVisibility.WorldReadable:\n            return RustHistoryVisibility.WorldReadable;\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SACIA,mBAAmB,EACnBC,kBAAkB,EAElBC,MAAM,EACNC,MAAM,EACNC,iBAAiB,IAAIC,qBAAqB,QAEvC,oCAAoC;AAC3C,OAAO,KAAKC,eAAe,MAAM,oCAAoC;AAErE,SAASC,SAAS,QAAQ,iBAAiB;AAG3C,SAAiBC,MAAM,EAAEC,OAAO,QAAQ,WAAW;AAGnD,SAASL,iBAAiB,QAAQ,oBAAoB;AAEtD,SAASM,WAAW,QAAQ,UAAU;AACtC,SAASC,eAAe,QAAQ,sBAAsB;;AAEtD;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,aAAa,CAAC;EAavB;AACJ;AACA;AACA;AACA;AACA;AACA;EACWC,WAAWA,CACGC,UAAsB,EACtBC,eAAgC,EAChCC,sBAA+C,EAC/CC,IAAU,EACnBC,kBAA4B,EACtC;IAAA,KALmBJ,UAAsB,GAAtBA,UAAsB;IAAA,KACtBC,eAAgC,GAAhCA,eAAgC;IAAA,KAChCC,sBAA+C,GAA/CA,sBAA+C;IAAA,KAC/CC,IAAU,GAAVA,IAAU;IAAA,KACnBC,kBAA4B,GAA5BA,kBAA4B;IAAAC,eAAA;IAtBxC;IAAAA,eAAA,oCACoC,KAAK;IAEzC;AACJ;AACA;AACA;AACA;IAJIA,eAAA,mCAKkDC,OAAO,CAACC,OAAO,CAAC,CAAC;IAgB/D,IAAI,CAACC,cAAc,GAAGd,MAAM,CAACe,QAAQ,KAAAC,MAAA,CAAKP,IAAI,CAACQ,MAAM,iBAAc,CAAC;;IAEpE;IACA;IACA,IAAMC,OAAO,GAAGT,IAAI,CAACU,gBAAgB,CAAC,CAAC;;IAEvC;IACA;IACA;IACA,IAAI,CAACb,UAAU,CACVc,kBAAkB,CAACF,OAAO,CAACG,GAAG,CAAEC,CAAC,IAAK,IAAIxB,eAAe,CAACH,MAAM,CAAC2B,CAAC,CAACC,MAAM,CAAC,CAAC,CAAC,CAC5EC,KAAK,CAAEC,CAAC,IAAK,IAAI,CAACX,cAAc,CAACY,KAAK,CAAC,kCAAkC,EAAED,CAAC,CAAC,CAAC;EACvF;;EAEA;AACJ;AACA;AACA;AACA;EACWE,aAAaA,CAACC,MAAgB,EAAQ;IACzC,IAAIC,IAAI,CAACC,SAAS,CAAC,IAAI,CAACpB,kBAAkB,CAAC,IAAImB,IAAI,CAACC,SAAS,CAACF,MAAM,CAAC,EAAE;MACnE;MACA,MAAM,IAAIG,KAAK,CAAC,4CAA4C,CAAC;IACjE;EACJ;;EAEA;AACJ;AACA;AACA;AACA;EACWC,gBAAgBA,CAACC,MAAkB,EAAQ;IAC9C,IACIA,MAAM,CAACC,UAAU,IAAI/B,eAAe,CAACgC,IAAI,IACxCF,MAAM,CAACC,UAAU,IAAI/B,eAAe,CAACiC,MAAM,IAAI,IAAI,CAAC3B,IAAI,CAAC4B,8BAA8B,CAAC,CAAE,EAC7F;MACE;MACA,IAAI,CAAC/B,UAAU,CAACc,kBAAkB,CAAC,CAAC,IAAIzB,MAAM,CAACsC,MAAM,CAACV,MAAM,CAAC,CAAC,CAAC,CAACC,KAAK,CAAEC,CAAC,IAAK;QACzE,IAAI,CAACX,cAAc,CAACY,KAAK,CAAC,gCAAgC,EAAED,CAAC,CAAC;MAClE,CAAC,CAAC;IACN;;IAEA;EACJ;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACiBa,oBAAoBA,CAACC,gCAAyC,EAAiB;IAAA,IAAAC,KAAA;IAAA,OAAAC,iBAAA;MACxF;MACA;MACA;MACA;MACA;MACA;MACA;MACA,MAAMD,KAAI,CAACE,YAAY,CAAC,IAAI,EAAEH,gCAAgC,CAAC;IAAC;EACpE;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACWG,YAAYA,CAACC,KAAyB,EAAEJ,gCAAyC,EAAiB;IAAA,IAAAK,eAAA;MAAAC,MAAA;IACrG,IAAM7C,MAAM,GAAG,IAAIC,OAAO,CAAC,IAAI,CAACa,cAAc,EAAE6B,KAAK,IAAAC,eAAA,GAAGD,KAAK,CAACG,QAAQ,CAAC,CAAC,cAAAF,eAAA,cAAAA,eAAA,GAAI,EAAE,GAAG,sBAAsB,CAAC;IACxG;IACA;IACA,IAAMG,IAAI,GAAG,IAAI,CAACC,wBAAwB,CACrCxB,KAAK,CAAC,MAAM;MACT;MACA;IAAA,CACH,CAAC,CACDyB,IAAI,eAAAR,iBAAA,CAAC,aAAY;MACd,MAAMvC,WAAW,CAACF,MAAM,EAAE,yBAAyB,eAAAyC,iBAAA,CAAE,aAAY;QAC7D,MAAMI,MAAI,CAACK,uBAAuB,CAAClD,MAAM,EAAEuC,gCAAgC,CAAC;MAChF,CAAC,EAAC;MACF,IAAII,KAAK,EAAE;QACP,MAAMzC,WAAW,CAACF,MAAM,EAAE,mBAAmB,eAAAyC,iBAAA,CAAE,aAAY;UACvD,MAAMI,MAAI,CAACM,iBAAiB,CAACnD,MAAM,EAAE2C,KAAK,CAAC;QAC/C,CAAC,EAAC;MACN;IACJ,CAAC,EAAC;IAEN,IAAI,CAACK,wBAAwB,GAAGD,IAAI;IACpC,OAAOA,IAAI;EACf;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACkBG,uBAAuBA,CAAClD,MAAe,EAAEuC,gCAAyC,EAAiB;IAAA,IAAAa,MAAA;IAAA,OAAAX,iBAAA;MAAA,IAAAY,qBAAA;MAC7G,IAAID,MAAI,CAAC1C,kBAAkB,CAAC4C,SAAS,KAAK,sBAAsB,EAAE;QAC9D,MAAM,IAAIvB,KAAK,sBAAAf,MAAA,CACUoC,MAAI,CAAC3C,IAAI,CAACQ,MAAM,kCAAAD,MAAA,CAA+BoC,MAAI,CAAC1C,kBAAkB,CAAC4C,SAAS,MACzG,CAAC;MACL;MACAtD,MAAM,CAACuD,KAAK,CAAC,qBAAqB,CAAC;MAEnC,IAAMrC,OAAO,SAASkC,MAAI,CAAC3C,IAAI,CAAC+C,0BAA0B,CAAC,CAAC;;MAE5D;MACA;MACA;MACA;MACA;MACA;MACA,IAAI,CAACJ,MAAI,CAACK,yBAAyB,EAAE;QACjC,MAAMvD,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,yCAAyC,eAAA2B,iBAAA,CAAE,aAAY;UAC1F,MAAMW,MAAI,CAAC9C,UAAU,CAACc,kBAAkB,CAACF,OAAO,CAACG,GAAG,CAAEC,CAAC,IAAK,IAAIxB,eAAe,CAACH,MAAM,CAAC2B,CAAC,CAACC,MAAM,CAAC,CAAC,CAAC;QACtG,CAAC,EAAC;QACFvB,MAAM,CAACuD,KAAK,wBAAwB,CAAC;QACrCH,MAAI,CAACK,yBAAyB,GAAG,IAAI;;QAErC;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACAzD,MAAM,CAACuD,KAAK,+BAA+B,CAAC;QAE5C,MAAMrD,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,2BAA2B,eAAA2B,iBAAA,CAAE,aAAY;UAC5E,MAAMW,MAAI,CAAC5C,sBAAsB,CAACkD,yBAAyB,CAAC,CAAC;QACjE,CAAC,EAAC;MACN,CAAC,MAAM;QACH;QACA;QACA;QACA;QACA;QACA;QACA1D,MAAM,CAACuD,KAAK,6CAA6C,CAAC;QAC1DH,MAAI,CAAC5C,sBAAsB,CAACkD,yBAAyB,CAAC,CAAC;MAC3D;MAEA1D,MAAM,CAACuD,KAAK,0DAAAvC,MAAA,CACiDoC,MAAI,CAAC3C,IAAI,CAAC4B,8BAA8B,CAAC,CAAC,SACnGnB,OAAO,CAACG,GAAG,CAAEC,CAAC,OAAAN,MAAA,CAAQM,CAAC,CAACC,MAAM,QAAAP,MAAA,CAAKM,CAAC,CAACY,UAAU,MAAG,CACtD,CAAC;MAED,IAAMyB,QAAQ,GAAGzC,OAAO,CAACG,GAAG,CAAEC,CAAC,IAAK,IAAI3B,MAAM,CAAC2B,CAAC,CAACC,MAAM,CAAC,CAAC;MAEzD,MAAMrB,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,wBAAwB,eAAA2B,iBAAA,CAAE,aAAY;QACzE,MAAMW,MAAI,CAAC7C,eAAe,CAACqD,sBAAsB,CAAC5D,MAAM,EAAE2D,QAAQ,CAAC;MACvE,CAAC,EAAC;MAEF,IAAME,sBAAsB,GAAG,IAAIpE,kBAAkB,CAAC,CAAC;MACvDoE,sBAAsB,CAACC,iBAAiB,GAAGC,uBAAuB,CAACX,MAAI,CAAC3C,IAAI,CAACuD,oBAAoB,CAAC,CAAC,CAAC;;MAEpG;MACAH,sBAAsB,CAACP,SAAS,GAAG9D,mBAAmB,CAACyE,eAAe;;MAEtE;MACA;MACA;MACA,IAAI,OAAOb,MAAI,CAAC1C,kBAAkB,CAACwD,kBAAkB,KAAK,QAAQ,EAAE;QAChEL,sBAAsB,CAACM,cAAc,GAAGC,MAAM,CAAChB,MAAI,CAAC1C,kBAAkB,CAACwD,kBAAkB,GAAG,IAAI,CAAC;MACrG;MAEA,IAAI,OAAOd,MAAI,CAAC1C,kBAAkB,CAAC2D,oBAAoB,KAAK,QAAQ,EAAE;QAClER,sBAAsB,CAACS,sBAAsB,GAAGF,MAAM,CAAChB,MAAI,CAAC1C,kBAAkB,CAAC2D,oBAAoB,CAAC;MACxG;;MAEA;MACA;MACAR,sBAAsB,CAACU,uBAAuB,IAAAlB,qBAAA,GAC1CD,MAAI,CAAC3C,IAAI,CAAC+D,6BAA6B,CAAC,CAAC,cAAAnB,qBAAA,cAAAA,qBAAA,GAAId,gCAAgC;MAEjF,MAAMrC,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,cAAc,eAAA2B,iBAAA,CAAE,aAAY;QAC/D,IAAMgC,aAAgC,SAASrB,MAAI,CAAC9C,UAAU,CAACoE,YAAY,CACvE,IAAIhF,MAAM,CAAC0D,MAAI,CAAC3C,IAAI,CAACQ,MAAM,CAAC;QAC5B;QACA0C,QAAQ,EACRE,sBACJ,CAAC;QACD,IAAIY,aAAa,EAAE;UACf,KAAK,IAAME,CAAC,IAAIF,aAAa,EAAE;YAC3B,MAAMrB,MAAI,CAAC5C,sBAAsB,CAACoE,wBAAwB,CAACC,mBAAmB,CAACF,CAAC,CAAC;UACrF;QACJ;MACJ,CAAC,EAAC;IAAC;EACP;;EAEA;AACJ;AACA;EACiBG,mBAAmBA,CAAA,EAAkB;IAAA,IAAAC,MAAA;IAAA,OAAAtC,iBAAA;MAC9C,IAAMuC,CAAC,SAASD,MAAI,CAACzE,UAAU,CAAC2E,sBAAsB,CAAC,IAAIvF,MAAM,CAACqF,MAAI,CAACtE,IAAI,CAACQ,MAAM,CAAC,CAAC;MACpF,IAAI+D,CAAC,EAAE;QACHD,MAAI,CAACjE,cAAc,CAACoE,IAAI,CAAC,kCAAkC,CAAC;MAChE;IAAC;EACL;EAEc/B,iBAAiBA,CAACnD,MAAe,EAAE2C,KAAkB,EAAiB;IAAA,IAAAwC,MAAA;IAAA,OAAA1C,iBAAA;MAChFzC,MAAM,CAACuD,KAAK,CAAC,mCAAmC,CAAC;MACjD,IAAM6B,gBAAgB,SAASD,MAAI,CAAC7E,UAAU,CAAC+E,gBAAgB,CAC3D,IAAI3F,MAAM,CAACyF,MAAI,CAAC1E,IAAI,CAACQ,MAAM,CAAC,EAC5B0B,KAAK,CAAC2C,OAAO,CAAC,CAAC,EACfzD,IAAI,CAACC,SAAS,CAACa,KAAK,CAAC4C,UAAU,CAAC,CAAC,CACrC,CAAC;MAED5C,KAAK,CAAC6C,aAAa,CACfzF,SAAS,CAAC0F,oBAAoB,EAC9B5D,IAAI,CAAC6D,KAAK,CAACN,gBAAgB,CAAC,EAC5BD,MAAI,CAAC7E,UAAU,CAACqF,YAAY,CAACC,UAAU,CAACC,QAAQ,CAAC,CAAC,EAClDV,MAAI,CAAC7E,UAAU,CAACqF,YAAY,CAACG,OAAO,CAACD,QAAQ,CAAC,CAClD,CAAC;MAED7F,MAAM,CAACuD,KAAK,CAAC,8BAA8B,CAAC;IAAC;EACjD;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASQ,uBAAuBA,CAACgC,UAA6B,EAAyB;EAC1F,QAAQA,UAAU;IACd,KAAKnG,iBAAiB,CAACoG,OAAO;MAC1B,OAAOnG,qBAAqB,CAACmG,OAAO;IACxC,KAAKpG,iBAAiB,CAACqG,MAAM;MACzB,OAAOpG,qBAAqB,CAACoG,MAAM;IACvC,KAAKrG,iBAAiB,CAACsG,MAAM;MACzB,OAAOrG,qBAAqB,CAACqG,MAAM;IACvC,KAAKtG,iBAAiB,CAACuG,aAAa;MAChC,OAAOtG,qBAAqB,CAACsG,aAAa;EAClD;AACJ","ignoreList":[]}
+{"version":3,"file":"RoomEncryptor.js","names":["RustSdkCryptoJs","CollectStrategy","EncryptionAlgorithm","EncryptionSettings","HistoryVisibility","RustHistoryVisibility","RoomId","UserId","EventType","logger","LogSpan","logDuration","KnownMembership","RoomEncryptor","constructor","olmMachine","keyClaimManager","outgoingRequestManager","room","encryptionSettings","_defineProperty","Promise","resolve","prefixedLogger","getChild","concat","roomId","members","getJoinedMembers","updateTrackedUsers","map","u","userId","catch","e","error","onCryptoEvent","config","JSON","stringify","Error","onRoomMembership","member","membership","Join","Invite","shouldEncryptForInvitedMembers","prepareForEncryption","globalBlacklistUnverifiedDevices","_this","_asyncToGenerator","encryptEvent","event","_event$getTxnId","_this2","getTxnId","prom","currentEncryptionPromise","then","ensureEncryptionSession","encryptEventInner","_this3","_this3$room$getBlackl","algorithm","debug","getEncryptionTargetMembers","lazyLoadedMembersResolved","doProcessOutgoingRequests","userList","ensureSessionsForUsers","rustEncryptionSettings","historyVisibility","toRustHistoryVisibility","getHistoryVisibility","MegolmV1AesSha2","rotation_period_ms","rotationPeriod","BigInt","rotation_period_msgs","rotationPeriodMessages","getBlacklistUnverifiedDevices","sharingStrategy","DeviceBasedStrategyOnlyTrustedDevices","DeviceBasedStrategyAllDevices","shareMessages","shareRoomKey","m","outgoingRequestProcessor","makeOutgoingRequest","forceDiscardSession","_this4","r","invalidateGroupSession","info","_this5","encryptedContent","encryptRoomEvent","getType","getContent","makeEncrypted","RoomMessageEncrypted","parse","identityKeys","curve25519","toBase64","ed25519","visibility","Invited","Joined","Shared","WorldReadable"],"sources":["../../src/rust-crypto/RoomEncryptor.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\nimport {\n    CollectStrategy,\n    EncryptionAlgorithm,\n    EncryptionSettings,\n    HistoryVisibility as RustHistoryVisibility,\n    OlmMachine,\n    RoomId,\n    ToDeviceRequest,\n    UserId,\n} from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { EventType } from \"../@types/event\";\nimport { IContent, MatrixEvent } from \"../models/event\";\nimport { Room } from \"../models/room\";\nimport { Logger, logger, LogSpan } from \"../logger\";\nimport { KeyClaimManager } from \"./KeyClaimManager\";\nimport { RoomMember } from \"../models/room-member\";\nimport { HistoryVisibility } from \"../@types/partials\";\nimport { OutgoingRequestsManager } from \"./OutgoingRequestsManager\";\nimport { logDuration } from \"../utils\";\nimport { KnownMembership } from \"../@types/membership\";\n\n/**\n * RoomEncryptor: responsible for encrypting messages to a given room\n *\n * @internal\n */\nexport class RoomEncryptor {\n    private readonly prefixedLogger: Logger;\n\n    /** whether the room members have been loaded and tracked for the first time */\n    private lazyLoadedMembersResolved = false;\n\n    /**\n     * Ensures that there is only one encryption operation at a time for that room.\n     *\n     * An encryption operation is either a {@link prepareForEncryption} or an {@link encryptEvent} call.\n     */\n    private currentEncryptionPromise: Promise<void> = Promise.resolve();\n\n    /**\n     * @param olmMachine - The rust-sdk's OlmMachine\n     * @param keyClaimManager - Our KeyClaimManager, which manages the queue of one-time-key claim requests\n     * @param outgoingRequestManager - The OutgoingRequestManager, which manages the queue of outgoing requests.\n     * @param room - The room we want to encrypt for\n     * @param encryptionSettings - body of the m.room.encryption event currently in force in this room\n     */\n    public constructor(\n        private readonly olmMachine: OlmMachine,\n        private readonly keyClaimManager: KeyClaimManager,\n        private readonly outgoingRequestManager: OutgoingRequestsManager,\n        private readonly room: Room,\n        private encryptionSettings: IContent,\n    ) {\n        this.prefixedLogger = logger.getChild(`[${room.roomId} encryption]`);\n\n        // start tracking devices for any users already known to be in this room.\n        // Do not load members here, would defeat lazy loading.\n        const members = room.getJoinedMembers();\n\n        // At this point just mark the known members as tracked, it might not be the full list of members\n        // because of lazy loading. This is fine, because we will get a member list update when sending a message for\n        // the first time, see `RoomEncryptor#ensureEncryptionSession`\n        this.olmMachine\n            .updateTrackedUsers(members.map((u) => new RustSdkCryptoJs.UserId(u.userId)))\n            .catch((e) => this.prefixedLogger.error(\"Error initializing tracked users\", e));\n    }\n\n    /**\n     * Handle a new `m.room.encryption` event in this room\n     *\n     * @param config - The content of the encryption event\n     */\n    public onCryptoEvent(config: IContent): void {\n        if (JSON.stringify(this.encryptionSettings) != JSON.stringify(config)) {\n            // This should currently be unreachable, since the Rust SDK will reject any attempts to change config.\n            throw new Error(\"Cannot reconfigure an active RoomEncryptor\");\n        }\n    }\n\n    /**\n     * Handle a new `m.room.member` event in this room\n     *\n     * @param member - new membership state\n     */\n    public onRoomMembership(member: RoomMember): void {\n        if (\n            member.membership == KnownMembership.Join ||\n            (member.membership == KnownMembership.Invite && this.room.shouldEncryptForInvitedMembers())\n        ) {\n            // make sure we are tracking the deviceList for this user\n            this.olmMachine.updateTrackedUsers([new UserId(member.userId)]).catch((e) => {\n                this.prefixedLogger.error(\"Unable to update tracked users\", e);\n            });\n        }\n\n        // TODO: handle leaves (including our own)\n    }\n\n    /**\n     * Prepare to encrypt events in this room.\n     *\n     * This ensures that we have a megolm session ready to use and that we have shared its key with all the devices\n     * in the room.\n     *\n     * @param globalBlacklistUnverifiedDevices - When `true`, it will not send encrypted messages to unverified devices\n     */\n    public async prepareForEncryption(globalBlacklistUnverifiedDevices: boolean): Promise<void> {\n        // We consider a prepareForEncryption as an encryption promise as it will potentially share keys\n        // even if it doesn't send an event.\n        // Usually this is called when the user starts typing, so we want to make sure we have keys ready when the\n        // message is finally sent.\n        // If `encryptEvent` is invoked before `prepareForEncryption` has completed, the `encryptEvent` call will wait for\n        // `prepareForEncryption` to complete before executing.\n        // The part where `encryptEvent` shares the room key will then usually be a no-op as it was already performed by `prepareForEncryption`.\n        await this.encryptEvent(null, globalBlacklistUnverifiedDevices);\n    }\n\n    /**\n     * Encrypt an event for this room, or prepare for encryption.\n     *\n     * This will ensure that we have a megolm session for this room, share it with the devices in the room, and\n     * then, if an event is provided, encrypt it using the session.\n     *\n     * @param event - Event to be encrypted, or null if only preparing for encryption (in which case we will pre-share the room key).\n     * @param globalBlacklistUnverifiedDevices - When `true`, it will not send encrypted messages to unverified devices\n     */\n    public encryptEvent(event: MatrixEvent | null, globalBlacklistUnverifiedDevices: boolean): Promise<void> {\n        const logger = new LogSpan(this.prefixedLogger, event ? (event.getTxnId() ?? \"\") : \"prepareForEncryption\");\n        // Ensure order of encryption to avoid message ordering issues, as the scheduler only ensures\n        // events order after they have been encrypted.\n        const prom = this.currentEncryptionPromise\n            .catch(() => {\n                // Any errors in the previous call will have been reported already, so there is nothing to do here.\n                // we just throw away the error and start anew.\n            })\n            .then(async () => {\n                await logDuration(logger, \"ensureEncryptionSession\", async () => {\n                    await this.ensureEncryptionSession(logger, globalBlacklistUnverifiedDevices);\n                });\n                if (event) {\n                    await logDuration(logger, \"encryptEventInner\", async () => {\n                        await this.encryptEventInner(logger, event);\n                    });\n                }\n            });\n\n        this.currentEncryptionPromise = prom;\n        return prom;\n    }\n\n    /**\n     * Prepare to encrypt events in this room.\n     *\n     * This ensures that we have a megolm session ready to use and that we have shared its key with all the devices\n     * in the room.\n     *\n     * @param logger - a place to write diagnostics to\n     * @param globalBlacklistUnverifiedDevices - When `true`, it will not send encrypted messages to unverified devices\n     */\n    private async ensureEncryptionSession(logger: LogSpan, globalBlacklistUnverifiedDevices: boolean): Promise<void> {\n        if (this.encryptionSettings.algorithm !== \"m.megolm.v1.aes-sha2\") {\n            throw new Error(\n                `Cannot encrypt in ${this.room.roomId} for unsupported algorithm '${this.encryptionSettings.algorithm}'`,\n            );\n        }\n        logger.debug(\"Starting encryption\");\n\n        const members = await this.room.getEncryptionTargetMembers();\n\n        // If this is the first time we are sending a message to the room, we may not yet have seen all the members\n        // (so the Crypto SDK might not have a device list for them). So, if this is the first time we are encrypting\n        // for this room, give the SDK the full list of members, to be on the safe side.\n        //\n        // This could end up being racy (if two calls to ensureEncryptionSession happen at the same time), but that's\n        // not a particular problem, since `OlmMachine.updateTrackedUsers` just adds any users that weren't already tracked.\n        if (!this.lazyLoadedMembersResolved) {\n            await logDuration(this.prefixedLogger, \"loadMembersIfNeeded: updateTrackedUsers\", async () => {\n                await this.olmMachine.updateTrackedUsers(members.map((u) => new RustSdkCryptoJs.UserId(u.userId)));\n            });\n            logger.debug(`Updated tracked users`);\n            this.lazyLoadedMembersResolved = true;\n\n            // Query keys in case we don't have them for newly tracked members.\n            // It's important after loading members for the first time, as likely most of them won't be\n            // known yet and will be unable to decrypt messages despite being in the room for long.\n            // This must be done before ensuring sessions. If not the devices of these users are not\n            // known yet and will not get the room key.\n            // We don't have API to only get the keys queries related to this member list, so we just\n            // process the pending requests from the olmMachine. (usually these are processed\n            // at the end of the sync, but we can't wait for that).\n            // XXX future improvement process only KeysQueryRequests for the users that have never been queried.\n            logger.debug(`Processing outgoing requests`);\n\n            await logDuration(this.prefixedLogger, \"doProcessOutgoingRequests\", async () => {\n                await this.outgoingRequestManager.doProcessOutgoingRequests();\n            });\n        } else {\n            // If members are already loaded it's less critical to await on key queries.\n            // We might still want to trigger a processOutgoingRequests here.\n            // The call to `ensureSessionsForUsers` below will wait a bit on in-flight key queries we are\n            // interested in. If a sync handling happens in the meantime, and some new members are added to the room\n            // or have new devices it would give us a chance to query them before sending.\n            // It's less critical due to the racy nature of this process.\n            logger.debug(`Processing outgoing requests in background`);\n            this.outgoingRequestManager.doProcessOutgoingRequests();\n        }\n\n        logger.debug(\n            `Encrypting for users (shouldEncryptForInvitedMembers: ${this.room.shouldEncryptForInvitedMembers()}):`,\n            members.map((u) => `${u.userId} (${u.membership})`),\n        );\n\n        const userList = members.map((u) => new UserId(u.userId));\n\n        await logDuration(this.prefixedLogger, \"ensureSessionsForUsers\", async () => {\n            await this.keyClaimManager.ensureSessionsForUsers(logger, userList);\n        });\n\n        const rustEncryptionSettings = new EncryptionSettings();\n        rustEncryptionSettings.historyVisibility = toRustHistoryVisibility(this.room.getHistoryVisibility());\n\n        // We only support megolm\n        rustEncryptionSettings.algorithm = EncryptionAlgorithm.MegolmV1AesSha2;\n\n        // We need to convert the rotation period from milliseconds to microseconds\n        // See https://spec.matrix.org/v1.8/client-server-api/#mroomencryption and\n        // https://matrix-org.github.io/matrix-rust-sdk-crypto-wasm/classes/EncryptionSettings.html#rotationPeriod\n        if (typeof this.encryptionSettings.rotation_period_ms === \"number\") {\n            rustEncryptionSettings.rotationPeriod = BigInt(this.encryptionSettings.rotation_period_ms * 1000);\n        }\n\n        if (typeof this.encryptionSettings.rotation_period_msgs === \"number\") {\n            rustEncryptionSettings.rotationPeriodMessages = BigInt(this.encryptionSettings.rotation_period_msgs);\n        }\n\n        // When this.room.getBlacklistUnverifiedDevices() === null, the global settings should be used\n        // See Room#getBlacklistUnverifiedDevices\n        if (this.room.getBlacklistUnverifiedDevices() ?? globalBlacklistUnverifiedDevices) {\n            rustEncryptionSettings.sharingStrategy = CollectStrategy.DeviceBasedStrategyOnlyTrustedDevices;\n        } else {\n            rustEncryptionSettings.sharingStrategy = CollectStrategy.DeviceBasedStrategyAllDevices;\n        }\n\n        await logDuration(this.prefixedLogger, \"shareRoomKey\", async () => {\n            const shareMessages: ToDeviceRequest[] = await this.olmMachine.shareRoomKey(\n                new RoomId(this.room.roomId),\n                // safe to pass without cloning, as it's not reused here (before or after)\n                userList,\n                rustEncryptionSettings,\n            );\n            if (shareMessages) {\n                for (const m of shareMessages) {\n                    await this.outgoingRequestManager.outgoingRequestProcessor.makeOutgoingRequest(m);\n                }\n            }\n        });\n    }\n\n    /**\n     * Discard any existing group session for this room\n     */\n    public async forceDiscardSession(): Promise<void> {\n        const r = await this.olmMachine.invalidateGroupSession(new RoomId(this.room.roomId));\n        if (r) {\n            this.prefixedLogger.info(\"Discarded existing group session\");\n        }\n    }\n\n    private async encryptEventInner(logger: LogSpan, event: MatrixEvent): Promise<void> {\n        logger.debug(\"Encrypting actual message content\");\n        const encryptedContent = await this.olmMachine.encryptRoomEvent(\n            new RoomId(this.room.roomId),\n            event.getType(),\n            JSON.stringify(event.getContent()),\n        );\n\n        event.makeEncrypted(\n            EventType.RoomMessageEncrypted,\n            JSON.parse(encryptedContent),\n            this.olmMachine.identityKeys.curve25519.toBase64(),\n            this.olmMachine.identityKeys.ed25519.toBase64(),\n        );\n\n        logger.debug(\"Encrypted event successfully\");\n    }\n}\n\n/**\n * Convert a HistoryVisibility to a RustHistoryVisibility\n * @param visibility - HistoryVisibility enum\n * @returns a RustHistoryVisibility enum\n */\nexport function toRustHistoryVisibility(visibility: HistoryVisibility): RustHistoryVisibility {\n    switch (visibility) {\n        case HistoryVisibility.Invited:\n            return RustHistoryVisibility.Invited;\n        case HistoryVisibility.Joined:\n            return RustHistoryVisibility.Joined;\n        case HistoryVisibility.Shared:\n            return RustHistoryVisibility.Shared;\n        case HistoryVisibility.WorldReadable:\n            return RustHistoryVisibility.WorldReadable;\n    }\n}\n"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,KAAKA,eAAe,MAAM,oCAAoC;AACrE,SACIC,eAAe,EACfC,mBAAmB,EACnBC,kBAAkB,EAClBC,iBAAiB,IAAIC,qBAAqB,EAE1CC,MAAM,EAENC,MAAM,QACH,oCAAoC;AAE3C,SAASC,SAAS,QAAQ,iBAAiB;AAG3C,SAAiBC,MAAM,EAAEC,OAAO,QAAQ,WAAW;AAGnD,SAASN,iBAAiB,QAAQ,oBAAoB;AAEtD,SAASO,WAAW,QAAQ,UAAU;AACtC,SAASC,eAAe,QAAQ,sBAAsB;;AAEtD;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,aAAa,CAAC;EAavB;AACJ;AACA;AACA;AACA;AACA;AACA;EACWC,WAAWA,CACGC,UAAsB,EACtBC,eAAgC,EAChCC,sBAA+C,EAC/CC,IAAU,EACnBC,kBAA4B,EACtC;IAAA,KALmBJ,UAAsB,GAAtBA,UAAsB;IAAA,KACtBC,eAAgC,GAAhCA,eAAgC;IAAA,KAChCC,sBAA+C,GAA/CA,sBAA+C;IAAA,KAC/CC,IAAU,GAAVA,IAAU;IAAA,KACnBC,kBAA4B,GAA5BA,kBAA4B;IAAAC,eAAA;IAtBxC;IAAAA,eAAA,oCACoC,KAAK;IAEzC;AACJ;AACA;AACA;AACA;IAJIA,eAAA,mCAKkDC,OAAO,CAACC,OAAO,CAAC,CAAC;IAgB/D,IAAI,CAACC,cAAc,GAAGd,MAAM,CAACe,QAAQ,KAAAC,MAAA,CAAKP,IAAI,CAACQ,MAAM,iBAAc,CAAC;;IAEpE;IACA;IACA,IAAMC,OAAO,GAAGT,IAAI,CAACU,gBAAgB,CAAC,CAAC;;IAEvC;IACA;IACA;IACA,IAAI,CAACb,UAAU,CACVc,kBAAkB,CAACF,OAAO,CAACG,GAAG,CAAEC,CAAC,IAAK,IAAI/B,eAAe,CAACO,MAAM,CAACwB,CAAC,CAACC,MAAM,CAAC,CAAC,CAAC,CAC5EC,KAAK,CAAEC,CAAC,IAAK,IAAI,CAACX,cAAc,CAACY,KAAK,CAAC,kCAAkC,EAAED,CAAC,CAAC,CAAC;EACvF;;EAEA;AACJ;AACA;AACA;AACA;EACWE,aAAaA,CAACC,MAAgB,EAAQ;IACzC,IAAIC,IAAI,CAACC,SAAS,CAAC,IAAI,CAACpB,kBAAkB,CAAC,IAAImB,IAAI,CAACC,SAAS,CAACF,MAAM,CAAC,EAAE;MACnE;MACA,MAAM,IAAIG,KAAK,CAAC,4CAA4C,CAAC;IACjE;EACJ;;EAEA;AACJ;AACA;AACA;AACA;EACWC,gBAAgBA,CAACC,MAAkB,EAAQ;IAC9C,IACIA,MAAM,CAACC,UAAU,IAAI/B,eAAe,CAACgC,IAAI,IACxCF,MAAM,CAACC,UAAU,IAAI/B,eAAe,CAACiC,MAAM,IAAI,IAAI,CAAC3B,IAAI,CAAC4B,8BAA8B,CAAC,CAAE,EAC7F;MACE;MACA,IAAI,CAAC/B,UAAU,CAACc,kBAAkB,CAAC,CAAC,IAAItB,MAAM,CAACmC,MAAM,CAACV,MAAM,CAAC,CAAC,CAAC,CAACC,KAAK,CAAEC,CAAC,IAAK;QACzE,IAAI,CAACX,cAAc,CAACY,KAAK,CAAC,gCAAgC,EAAED,CAAC,CAAC;MAClE,CAAC,CAAC;IACN;;IAEA;EACJ;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACiBa,oBAAoBA,CAACC,gCAAyC,EAAiB;IAAA,IAAAC,KAAA;IAAA,OAAAC,iBAAA;MACxF;MACA;MACA;MACA;MACA;MACA;MACA;MACA,MAAMD,KAAI,CAACE,YAAY,CAAC,IAAI,EAAEH,gCAAgC,CAAC;IAAC;EACpE;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACWG,YAAYA,CAACC,KAAyB,EAAEJ,gCAAyC,EAAiB;IAAA,IAAAK,eAAA;MAAAC,MAAA;IACrG,IAAM7C,MAAM,GAAG,IAAIC,OAAO,CAAC,IAAI,CAACa,cAAc,EAAE6B,KAAK,IAAAC,eAAA,GAAID,KAAK,CAACG,QAAQ,CAAC,CAAC,cAAAF,eAAA,cAAAA,eAAA,GAAI,EAAE,GAAI,sBAAsB,CAAC;IAC1G;IACA;IACA,IAAMG,IAAI,GAAG,IAAI,CAACC,wBAAwB,CACrCxB,KAAK,CAAC,MAAM;MACT;MACA;IAAA,CACH,CAAC,CACDyB,IAAI,eAAAR,iBAAA,CAAC,aAAY;MACd,MAAMvC,WAAW,CAACF,MAAM,EAAE,yBAAyB,eAAAyC,iBAAA,CAAE,aAAY;QAC7D,MAAMI,MAAI,CAACK,uBAAuB,CAAClD,MAAM,EAAEuC,gCAAgC,CAAC;MAChF,CAAC,EAAC;MACF,IAAII,KAAK,EAAE;QACP,MAAMzC,WAAW,CAACF,MAAM,EAAE,mBAAmB,eAAAyC,iBAAA,CAAE,aAAY;UACvD,MAAMI,MAAI,CAACM,iBAAiB,CAACnD,MAAM,EAAE2C,KAAK,CAAC;QAC/C,CAAC,EAAC;MACN;IACJ,CAAC,EAAC;IAEN,IAAI,CAACK,wBAAwB,GAAGD,IAAI;IACpC,OAAOA,IAAI;EACf;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACkBG,uBAAuBA,CAAClD,MAAe,EAAEuC,gCAAyC,EAAiB;IAAA,IAAAa,MAAA;IAAA,OAAAX,iBAAA;MAAA,IAAAY,qBAAA;MAC7G,IAAID,MAAI,CAAC1C,kBAAkB,CAAC4C,SAAS,KAAK,sBAAsB,EAAE;QAC9D,MAAM,IAAIvB,KAAK,sBAAAf,MAAA,CACUoC,MAAI,CAAC3C,IAAI,CAACQ,MAAM,kCAAAD,MAAA,CAA+BoC,MAAI,CAAC1C,kBAAkB,CAAC4C,SAAS,MACzG,CAAC;MACL;MACAtD,MAAM,CAACuD,KAAK,CAAC,qBAAqB,CAAC;MAEnC,IAAMrC,OAAO,SAASkC,MAAI,CAAC3C,IAAI,CAAC+C,0BAA0B,CAAC,CAAC;;MAE5D;MACA;MACA;MACA;MACA;MACA;MACA,IAAI,CAACJ,MAAI,CAACK,yBAAyB,EAAE;QACjC,MAAMvD,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,yCAAyC,eAAA2B,iBAAA,CAAE,aAAY;UAC1F,MAAMW,MAAI,CAAC9C,UAAU,CAACc,kBAAkB,CAACF,OAAO,CAACG,GAAG,CAAEC,CAAC,IAAK,IAAI/B,eAAe,CAACO,MAAM,CAACwB,CAAC,CAACC,MAAM,CAAC,CAAC,CAAC;QACtG,CAAC,EAAC;QACFvB,MAAM,CAACuD,KAAK,wBAAwB,CAAC;QACrCH,MAAI,CAACK,yBAAyB,GAAG,IAAI;;QAErC;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACAzD,MAAM,CAACuD,KAAK,+BAA+B,CAAC;QAE5C,MAAMrD,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,2BAA2B,eAAA2B,iBAAA,CAAE,aAAY;UAC5E,MAAMW,MAAI,CAAC5C,sBAAsB,CAACkD,yBAAyB,CAAC,CAAC;QACjE,CAAC,EAAC;MACN,CAAC,MAAM;QACH;QACA;QACA;QACA;QACA;QACA;QACA1D,MAAM,CAACuD,KAAK,6CAA6C,CAAC;QAC1DH,MAAI,CAAC5C,sBAAsB,CAACkD,yBAAyB,CAAC,CAAC;MAC3D;MAEA1D,MAAM,CAACuD,KAAK,0DAAAvC,MAAA,CACiDoC,MAAI,CAAC3C,IAAI,CAAC4B,8BAA8B,CAAC,CAAC,SACnGnB,OAAO,CAACG,GAAG,CAAEC,CAAC,OAAAN,MAAA,CAAQM,CAAC,CAACC,MAAM,QAAAP,MAAA,CAAKM,CAAC,CAACY,UAAU,MAAG,CACtD,CAAC;MAED,IAAMyB,QAAQ,GAAGzC,OAAO,CAACG,GAAG,CAAEC,CAAC,IAAK,IAAIxB,MAAM,CAACwB,CAAC,CAACC,MAAM,CAAC,CAAC;MAEzD,MAAMrB,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,wBAAwB,eAAA2B,iBAAA,CAAE,aAAY;QACzE,MAAMW,MAAI,CAAC7C,eAAe,CAACqD,sBAAsB,CAAC5D,MAAM,EAAE2D,QAAQ,CAAC;MACvE,CAAC,EAAC;MAEF,IAAME,sBAAsB,GAAG,IAAInE,kBAAkB,CAAC,CAAC;MACvDmE,sBAAsB,CAACC,iBAAiB,GAAGC,uBAAuB,CAACX,MAAI,CAAC3C,IAAI,CAACuD,oBAAoB,CAAC,CAAC,CAAC;;MAEpG;MACAH,sBAAsB,CAACP,SAAS,GAAG7D,mBAAmB,CAACwE,eAAe;;MAEtE;MACA;MACA;MACA,IAAI,OAAOb,MAAI,CAAC1C,kBAAkB,CAACwD,kBAAkB,KAAK,QAAQ,EAAE;QAChEL,sBAAsB,CAACM,cAAc,GAAGC,MAAM,CAAChB,MAAI,CAAC1C,kBAAkB,CAACwD,kBAAkB,GAAG,IAAI,CAAC;MACrG;MAEA,IAAI,OAAOd,MAAI,CAAC1C,kBAAkB,CAAC2D,oBAAoB,KAAK,QAAQ,EAAE;QAClER,sBAAsB,CAACS,sBAAsB,GAAGF,MAAM,CAAChB,MAAI,CAAC1C,kBAAkB,CAAC2D,oBAAoB,CAAC;MACxG;;MAEA;MACA;MACA,KAAAhB,qBAAA,GAAID,MAAI,CAAC3C,IAAI,CAAC8D,6BAA6B,CAAC,CAAC,cAAAlB,qBAAA,cAAAA,qBAAA,GAAId,gCAAgC,EAAE;QAC/EsB,sBAAsB,CAACW,eAAe,GAAGhF,eAAe,CAACiF,qCAAqC;MAClG,CAAC,MAAM;QACHZ,sBAAsB,CAACW,eAAe,GAAGhF,eAAe,CAACkF,6BAA6B;MAC1F;MAEA,MAAMxE,WAAW,CAACkD,MAAI,CAACtC,cAAc,EAAE,cAAc,eAAA2B,iBAAA,CAAE,aAAY;QAC/D,IAAMkC,aAAgC,SAASvB,MAAI,CAAC9C,UAAU,CAACsE,YAAY,CACvE,IAAI/E,MAAM,CAACuD,MAAI,CAAC3C,IAAI,CAACQ,MAAM,CAAC;QAC5B;QACA0C,QAAQ,EACRE,sBACJ,CAAC;QACD,IAAIc,aAAa,EAAE;UACf,KAAK,IAAME,CAAC,IAAIF,aAAa,EAAE;YAC3B,MAAMvB,MAAI,CAAC5C,sBAAsB,CAACsE,wBAAwB,CAACC,mBAAmB,CAACF,CAAC,CAAC;UACrF;QACJ;MACJ,CAAC,EAAC;IAAC;EACP;;EAEA;AACJ;AACA;EACiBG,mBAAmBA,CAAA,EAAkB;IAAA,IAAAC,MAAA;IAAA,OAAAxC,iBAAA;MAC9C,IAAMyC,CAAC,SAASD,MAAI,CAAC3E,UAAU,CAAC6E,sBAAsB,CAAC,IAAItF,MAAM,CAACoF,MAAI,CAACxE,IAAI,CAACQ,MAAM,CAAC,CAAC;MACpF,IAAIiE,CAAC,EAAE;QACHD,MAAI,CAACnE,cAAc,CAACsE,IAAI,CAAC,kCAAkC,CAAC;MAChE;IAAC;EACL;EAEcjC,iBAAiBA,CAACnD,MAAe,EAAE2C,KAAkB,EAAiB;IAAA,IAAA0C,MAAA;IAAA,OAAA5C,iBAAA;MAChFzC,MAAM,CAACuD,KAAK,CAAC,mCAAmC,CAAC;MACjD,IAAM+B,gBAAgB,SAASD,MAAI,CAAC/E,UAAU,CAACiF,gBAAgB,CAC3D,IAAI1F,MAAM,CAACwF,MAAI,CAAC5E,IAAI,CAACQ,MAAM,CAAC,EAC5B0B,KAAK,CAAC6C,OAAO,CAAC,CAAC,EACf3D,IAAI,CAACC,SAAS,CAACa,KAAK,CAAC8C,UAAU,CAAC,CAAC,CACrC,CAAC;MAED9C,KAAK,CAAC+C,aAAa,CACf3F,SAAS,CAAC4F,oBAAoB,EAC9B9D,IAAI,CAAC+D,KAAK,CAACN,gBAAgB,CAAC,EAC5BD,MAAI,CAAC/E,UAAU,CAACuF,YAAY,CAACC,UAAU,CAACC,QAAQ,CAAC,CAAC,EAClDV,MAAI,CAAC/E,UAAU,CAACuF,YAAY,CAACG,OAAO,CAACD,QAAQ,CAAC,CAClD,CAAC;MAED/F,MAAM,CAACuD,KAAK,CAAC,8BAA8B,CAAC;IAAC;EACjD;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASQ,uBAAuBA,CAACkC,UAA6B,EAAyB;EAC1F,QAAQA,UAAU;IACd,KAAKtG,iBAAiB,CAACuG,OAAO;MAC1B,OAAOtG,qBAAqB,CAACsG,OAAO;IACxC,KAAKvG,iBAAiB,CAACwG,MAAM;MACzB,OAAOvG,qBAAqB,CAACuG,MAAM;IACvC,KAAKxG,iBAAiB,CAACyG,MAAM;MACzB,OAAOxG,qBAAqB,CAACwG,MAAM;IACvC,KAAKzG,iBAAiB,CAAC0G,aAAa;MAChC,OAAOzG,qBAAqB,CAACyG,aAAa;EAClD;AACJ","ignoreList":[]}

package/lib/rust-crypto/index.js

@@ -91,6 +91,7 @@ function _initOlmMachine() {
     olmMachine.roomKeyRequestsEnabled = false;
     var rustCrypto = new RustCrypto(logger, olmMachine, http, userId, deviceId, secretStorage, cryptoCallbacks);
     yield olmMachine.registerRoomKeyUpdatedCallback(sessions => rustCrypto.onRoomKeysUpdated(sessions));
+    yield olmMachine.registerRoomKeysWithheldCallback(withheld => rustCrypto.onRoomKeysWithheld(withheld));
     yield olmMachine.registerUserIdentityUpdatedCallback(userId => rustCrypto.onUserIdentityUpdated(userId));
     yield olmMachine.registerDevicesUpdatedCallback(userIds => rustCrypto.onDevicesUpdated(userIds));
 

package/lib/rust-crypto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["RustSdkCryptoJs","StoreHandle","RustCrypto","MigrationState","migrateFromLegacyCrypto","migrateLegacyLocalTrustIfNeeded","migrateRoomSettingsFromLegacyCrypto","initRustCrypto","_x","_initRustCrypto","apply","arguments","_asyncToGenerator","args","logger","debug","initAsync","Tracing","LoggerLevel","Debug","turnOn","storeHandle","storePrefix","storeKey","openWithKey","open","storePassphrase","legacyCryptoStore","_objectSpread","legacyStore","rustCrypto","initOlmMachine","http","userId","deviceId","secretStorage","cryptoCallbacks","free","_x2","_x3","_x4","_x5","_x6","_x7","_x8","_x9","_initOlmMachine","olmMachine","OlmMachine","initFromStore","UserId","DeviceId","roomKeyRequestsEnabled","registerRoomKeyUpdatedCallback","sessions","onRoomKeysUpdated","registerUserIdentityUpdatedCallback","onUserIdentityUpdated","registerDevicesUpdatedCallback","userIds","onDevicesUpdated","checkSecrets","registerReceiveSecretCallback","name","_value","outgoingRequests","containsData","migrationState","getMigrationState","INITIAL_OWN_KEY_QUERY_DONE","initialKeyQueryDone","userHasCrossSigningKeys","e","error","setMigrationState"],"sources":["../../src/rust-crypto/index.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\nimport { StoreHandle } from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { RustCrypto } from \"./rust-crypto\";\nimport { IHttpOpts, MatrixHttpApi } from \"../http-api\";\nimport { ServerSideSecretStorage } from \"../secret-storage\";\nimport { ICryptoCallbacks } from \"../crypto\";\nimport { Logger } from \"../logger\";\nimport { CryptoStore, MigrationState } from \"../crypto/store/base\";\nimport {\n    migrateFromLegacyCrypto,\n    migrateLegacyLocalTrustIfNeeded,\n    migrateRoomSettingsFromLegacyCrypto,\n} from \"./libolm_migration\";\n\n/**\n * Create a new `RustCrypto` implementation\n *\n * @param args - Parameter object\n * @internal\n */\nexport async function initRustCrypto(args: {\n    /** A `Logger` instance that will be used for debug output. */\n    logger: Logger;\n\n    /**\n     * Low-level HTTP interface: used to make outgoing requests required by the rust SDK.\n     * We expect it to set the access token, etc.\n     */\n    http: MatrixHttpApi<IHttpOpts & { onlyData: true }>;\n\n    /** The local user's User ID. */\n    userId: string;\n\n    /** The local user's Device ID. */\n    deviceId: string;\n\n    /** Interface to server-side secret storage. */\n    secretStorage: ServerSideSecretStorage;\n\n    /** Crypto callbacks provided by the application. */\n    cryptoCallbacks: ICryptoCallbacks;\n\n    /**\n     * The prefix to use on the indexeddbs created by rust-crypto.\n     * If `null`, a memory store will be used.\n     */\n    storePrefix: string | null;\n\n    /**\n     * A passphrase to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null, or `storeKey` is set.  If neither this nor `storeKey` is set\n     * (and `storePrefix` is not null), the indexeddb will be unencrypted.\n     */\n    storePassphrase?: string;\n\n    /**\n     * A key to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null. Otherwise, if it is set, it must be a 32-byte cryptographic key, which\n     * will be used to encrypt the indexeddb. See also `storePassphrase`.\n     */\n    storeKey?: Uint8Array;\n\n    /** If defined, we will check if any data needs migrating from this store to the rust store. */\n    legacyCryptoStore?: CryptoStore;\n\n    /** The pickle key for `legacyCryptoStore` */\n    legacyPickleKey?: string;\n\n    /**\n     * A callback which will receive progress updates on migration from `legacyCryptoStore`.\n     *\n     * Called with (-1, -1) to mark the end of migration.\n     */\n    legacyMigrationProgressListener?: (progress: number, total: number) => void;\n}): Promise<RustCrypto> {\n    const { logger } = args;\n\n    // initialise the rust matrix-sdk-crypto-wasm, if it hasn't already been done\n    logger.debug(\"Initialising Rust crypto-sdk WASM artifact\");\n    await RustSdkCryptoJs.initAsync();\n\n    // enable tracing in the rust-sdk\n    new RustSdkCryptoJs.Tracing(RustSdkCryptoJs.LoggerLevel.Debug).turnOn();\n\n    logger.debug(\"Opening Rust CryptoStore\");\n    let storeHandle;\n    if (args.storePrefix) {\n        if (args.storeKey) {\n            storeHandle = await StoreHandle.openWithKey(args.storePrefix, args.storeKey);\n        } else {\n            storeHandle = await StoreHandle.open(args.storePrefix, args.storePassphrase);\n        }\n    } else {\n        storeHandle = await StoreHandle.open();\n    }\n\n    if (args.legacyCryptoStore) {\n        // We have a legacy crypto store, which we may need to migrate from.\n        await migrateFromLegacyCrypto({\n            legacyStore: args.legacyCryptoStore,\n            storeHandle,\n            ...args,\n        });\n    }\n\n    const rustCrypto = await initOlmMachine(\n        logger,\n        args.http,\n        args.userId,\n        args.deviceId,\n        args.secretStorage,\n        args.cryptoCallbacks,\n        storeHandle,\n        args.legacyCryptoStore,\n    );\n\n    storeHandle.free();\n\n    logger.debug(\"Completed rust crypto-sdk setup\");\n    return rustCrypto;\n}\n\nasync function initOlmMachine(\n    logger: Logger,\n    http: MatrixHttpApi<IHttpOpts & { onlyData: true }>,\n    userId: string,\n    deviceId: string,\n    secretStorage: ServerSideSecretStorage,\n    cryptoCallbacks: ICryptoCallbacks,\n    storeHandle: StoreHandle,\n    legacyCryptoStore?: CryptoStore,\n): Promise<RustCrypto> {\n    logger.debug(\"Init OlmMachine\");\n\n    const olmMachine = await RustSdkCryptoJs.OlmMachine.initFromStore(\n        new RustSdkCryptoJs.UserId(userId),\n        new RustSdkCryptoJs.DeviceId(deviceId),\n        storeHandle,\n    );\n\n    // A final migration step, now that we have an OlmMachine.\n    if (legacyCryptoStore) {\n        await migrateRoomSettingsFromLegacyCrypto({\n            logger,\n            legacyStore: legacyCryptoStore,\n            olmMachine,\n        });\n    }\n\n    // Disable room key requests, per https://github.com/vector-im/element-web/issues/26524.\n    olmMachine.roomKeyRequestsEnabled = false;\n\n    const rustCrypto = new RustCrypto(logger, olmMachine, http, userId, deviceId, secretStorage, cryptoCallbacks);\n\n    await olmMachine.registerRoomKeyUpdatedCallback((sessions: RustSdkCryptoJs.RoomKeyInfo[]) =>\n        rustCrypto.onRoomKeysUpdated(sessions),\n    );\n    await olmMachine.registerUserIdentityUpdatedCallback((userId: RustSdkCryptoJs.UserId) =>\n        rustCrypto.onUserIdentityUpdated(userId),\n    );\n    await olmMachine.registerDevicesUpdatedCallback((userIds: string[]) => rustCrypto.onDevicesUpdated(userIds));\n\n    // Check if there are any key backup secrets pending processing. There may be multiple secrets to process if several devices have gossiped them.\n    // The `registerReceiveSecretCallback` function will only be triggered for new secrets. If the client is restarted before processing them, the secrets will need to be manually handled.\n    rustCrypto.checkSecrets(\"m.megolm_backup.v1\");\n\n    // Register a callback to be notified when a new secret is received, as for now only the key backup secret is supported (the cross signing secrets are handled automatically by the OlmMachine)\n    await olmMachine.registerReceiveSecretCallback((name: string, _value: string) =>\n        // Instead of directly checking the secret value, we poll the inbox to get all values for that secret type.\n        // Once we have all the values, we can safely clear the secret inbox.\n        rustCrypto.checkSecrets(name),\n    );\n\n    // Tell the OlmMachine to think about its outgoing requests before we hand control back to the application.\n    //\n    // This is primarily a fudge to get it to correctly populate the `users_for_key_query` list, so that future\n    // calls to getIdentity (etc) block until the key queries are performed.\n    //\n    // Note that we don't actually need to *make* any requests here; it is sufficient to tell the Rust side to think\n    // about them.\n    //\n    // XXX: find a less hacky way to do this.\n    await olmMachine.outgoingRequests();\n\n    if (legacyCryptoStore && (await legacyCryptoStore.containsData())) {\n        const migrationState = await legacyCryptoStore.getMigrationState();\n        if (migrationState < MigrationState.INITIAL_OWN_KEY_QUERY_DONE) {\n            logger.debug(`Performing initial key query after migration`);\n            // We need to do an initial keys query so that the rust stack can properly update trust of\n            // the user device and identity from the migrated private keys.\n            // If not done, there is a short period where the own device/identity trust will be undefined after migration.\n            let initialKeyQueryDone = false;\n            while (!initialKeyQueryDone) {\n                try {\n                    await rustCrypto.userHasCrossSigningKeys(userId);\n                    initialKeyQueryDone = true;\n                } catch (e) {\n                    // If the initial key query fails, we retry until it succeeds.\n                    logger.error(\"Failed to check for cross-signing keys after migration, retrying\", e);\n                }\n            }\n\n            // If the private master cross-signing key was not cached in the legacy store, the rust session\n            // will not be able to establish the trust of the user identity.\n            // That means that after migration the session could revert to unverified.\n            // In order to avoid asking the users to re-verify their sessions, we need to migrate the legacy local trust\n            // (if the legacy session was already verified) to the new session.\n            await migrateLegacyLocalTrustIfNeeded({ legacyCryptoStore, rustCrypto, logger });\n\n            await legacyCryptoStore.setMigrationState(MigrationState.INITIAL_OWN_KEY_QUERY_DONE);\n        }\n    }\n\n    return rustCrypto;\n}\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,KAAKA,eAAe,MAAM,oCAAoC;AACrE,SAASC,WAAW,QAAQ,oCAAoC;AAEhE,SAASC,UAAU,QAAQ,eAAe;AAK1C,SAAsBC,cAAc,QAAQ,sBAAsB;AAClE,SACIC,uBAAuB,EACvBC,+BAA+B,EAC/BC,mCAAmC,QAChC,oBAAoB;;AAE3B;AACA;AACA;AACA;AACA;AACA;AACA,gBAAsBC,cAAcA,CAAAC,EAAA;EAAA,OAAAC,eAAA,CAAAC,KAAA,OAAAC,SAAA;AAAA;AAsGnC,SAAAF,gBAAA;EAAAA,eAAA,GAAAG,iBAAA,CAtGM,WAA8BC,IAwDpC,EAAuB;IACpB,IAAM;MAAEC;IAAO,CAAC,GAAGD,IAAI;;IAEvB;IACAC,MAAM,CAACC,KAAK,CAAC,4CAA4C,CAAC;IAC1D,MAAMf,eAAe,CAACgB,SAAS,CAAC,CAAC;;IAEjC;IACA,IAAIhB,eAAe,CAACiB,OAAO,CAACjB,eAAe,CAACkB,WAAW,CAACC,KAAK,CAAC,CAACC,MAAM,CAAC,CAAC;IAEvEN,MAAM,CAACC,KAAK,CAAC,0BAA0B,CAAC;IACxC,IAAIM,WAAW;IACf,IAAIR,IAAI,CAACS,WAAW,EAAE;MAClB,IAAIT,IAAI,CAACU,QAAQ,EAAE;QACfF,WAAW,SAASpB,WAAW,CAACuB,WAAW,CAACX,IAAI,CAACS,WAAW,EAAET,IAAI,CAACU,QAAQ,CAAC;MAChF,CAAC,MAAM;QACHF,WAAW,SAASpB,WAAW,CAACwB,IAAI,CAACZ,IAAI,CAACS,WAAW,EAAET,IAAI,CAACa,eAAe,CAAC;MAChF;IACJ,CAAC,MAAM;MACHL,WAAW,SAASpB,WAAW,CAACwB,IAAI,CAAC,CAAC;IAC1C;IAEA,IAAIZ,IAAI,CAACc,iBAAiB,EAAE;MACxB;MACA,MAAMvB,uBAAuB,CAAAwB,aAAA;QACzBC,WAAW,EAAEhB,IAAI,CAACc,iBAAiB;QACnCN;MAAW,GACRR,IAAI,CACV,CAAC;IACN;IAEA,IAAMiB,UAAU,SAASC,cAAc,CACnCjB,MAAM,EACND,IAAI,CAACmB,IAAI,EACTnB,IAAI,CAACoB,MAAM,EACXpB,IAAI,CAACqB,QAAQ,EACbrB,IAAI,CAACsB,aAAa,EAClBtB,IAAI,CAACuB,eAAe,EACpBf,WAAW,EACXR,IAAI,CAACc,iBACT,CAAC;IAEDN,WAAW,CAACgB,IAAI,CAAC,CAAC;IAElBvB,MAAM,CAACC,KAAK,CAAC,iCAAiC,CAAC;IAC/C,OAAOe,UAAU;EACrB,CAAC;EAAA,OAAArB,eAAA,CAAAC,KAAA,OAAAC,SAAA;AAAA;AAAA,SAEcoB,cAAcA,CAAAO,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA;EAAA,OAAAC,eAAA,CAAApC,KAAA,OAAAC,SAAA;AAAA;AAAA,SAAAmC,gBAAA;EAAAA,eAAA,GAAAlC,iBAAA,CAA7B,WACIE,MAAc,EACdkB,IAAmD,EACnDC,MAAc,EACdC,QAAgB,EAChBC,aAAsC,EACtCC,eAAiC,EACjCf,WAAwB,EACxBM,iBAA+B,EACZ;IACnBb,MAAM,CAACC,KAAK,CAAC,iBAAiB,CAAC;IAE/B,IAAMgC,UAAU,SAAS/C,eAAe,CAACgD,UAAU,CAACC,aAAa,CAC7D,IAAIjD,eAAe,CAACkD,MAAM,CAACjB,MAAM,CAAC,EAClC,IAAIjC,eAAe,CAACmD,QAAQ,CAACjB,QAAQ,CAAC,EACtCb,WACJ,CAAC;;IAED;IACA,IAAIM,iBAAiB,EAAE;MACnB,MAAMrB,mCAAmC,CAAC;QACtCQ,MAAM;QACNe,WAAW,EAAEF,iBAAiB;QAC9BoB;MACJ,CAAC,CAAC;IACN;;IAEA;IACAA,UAAU,CAACK,sBAAsB,GAAG,KAAK;IAEzC,IAAMtB,UAAU,GAAG,IAAI5B,UAAU,CAACY,MAAM,EAAEiC,UAAU,EAAEf,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAEC,aAAa,EAAEC,eAAe,CAAC;IAE7G,MAAMW,UAAU,CAACM,8BAA8B,CAAEC,QAAuC,IACpFxB,UAAU,CAACyB,iBAAiB,CAACD,QAAQ,CACzC,CAAC;IACD,MAAMP,UAAU,CAACS,mCAAmC,CAAEvB,MAA8B,IAChFH,UAAU,CAAC2B,qBAAqB,CAACxB,MAAM,CAC3C,CAAC;IACD,MAAMc,UAAU,CAACW,8BAA8B,CAAEC,OAAiB,IAAK7B,UAAU,CAAC8B,gBAAgB,CAACD,OAAO,CAAC,CAAC;;IAE5G;IACA;IACA7B,UAAU,CAAC+B,YAAY,CAAC,oBAAoB,CAAC;;IAE7C;IACA,MAAMd,UAAU,CAACe,6BAA6B,CAAC,CAACC,IAAY,EAAEC,MAAc;IACxE;IACA;IACAlC,UAAU,CAAC+B,YAAY,CAACE,IAAI,CAChC,CAAC;;IAED;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAMhB,UAAU,CAACkB,gBAAgB,CAAC,CAAC;IAEnC,IAAItC,iBAAiB,WAAWA,iBAAiB,CAACuC,YAAY,CAAC,CAAC,CAAC,EAAE;MAC/D,IAAMC,cAAc,SAASxC,iBAAiB,CAACyC,iBAAiB,CAAC,CAAC;MAClE,IAAID,cAAc,GAAGhE,cAAc,CAACkE,0BAA0B,EAAE;QAC5DvD,MAAM,CAACC,KAAK,+CAA+C,CAAC;QAC5D;QACA;QACA;QACA,IAAIuD,mBAAmB,GAAG,KAAK;QAC/B,OAAO,CAACA,mBAAmB,EAAE;UACzB,IAAI;YACA,MAAMxC,UAAU,CAACyC,uBAAuB,CAACtC,MAAM,CAAC;YAChDqC,mBAAmB,GAAG,IAAI;UAC9B,CAAC,CAAC,OAAOE,CAAC,EAAE;YACR;YACA1D,MAAM,CAAC2D,KAAK,CAAC,kEAAkE,EAAED,CAAC,CAAC;UACvF;QACJ;;QAEA;QACA;QACA;QACA;QACA;QACA,MAAMnE,+BAA+B,CAAC;UAAEsB,iBAAiB;UAAEG,UAAU;UAAEhB;QAAO,CAAC,CAAC;QAEhF,MAAMa,iBAAiB,CAAC+C,iBAAiB,CAACvE,cAAc,CAACkE,0BAA0B,CAAC;MACxF;IACJ;IAEA,OAAOvC,UAAU;EACrB,CAAC;EAAA,OAAAgB,eAAA,CAAApC,KAAA,OAAAC,SAAA;AAAA","ignoreList":[]}
+{"version":3,"file":"index.js","names":["RustSdkCryptoJs","StoreHandle","RustCrypto","MigrationState","migrateFromLegacyCrypto","migrateLegacyLocalTrustIfNeeded","migrateRoomSettingsFromLegacyCrypto","initRustCrypto","_x","_initRustCrypto","apply","arguments","_asyncToGenerator","args","logger","debug","initAsync","Tracing","LoggerLevel","Debug","turnOn","storeHandle","storePrefix","storeKey","openWithKey","open","storePassphrase","legacyCryptoStore","_objectSpread","legacyStore","rustCrypto","initOlmMachine","http","userId","deviceId","secretStorage","cryptoCallbacks","free","_x2","_x3","_x4","_x5","_x6","_x7","_x8","_x9","_initOlmMachine","olmMachine","OlmMachine","initFromStore","UserId","DeviceId","roomKeyRequestsEnabled","registerRoomKeyUpdatedCallback","sessions","onRoomKeysUpdated","registerRoomKeysWithheldCallback","withheld","onRoomKeysWithheld","registerUserIdentityUpdatedCallback","onUserIdentityUpdated","registerDevicesUpdatedCallback","userIds","onDevicesUpdated","checkSecrets","registerReceiveSecretCallback","name","_value","outgoingRequests","containsData","migrationState","getMigrationState","INITIAL_OWN_KEY_QUERY_DONE","initialKeyQueryDone","userHasCrossSigningKeys","e","error","setMigrationState"],"sources":["../../src/rust-crypto/index.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport * as RustSdkCryptoJs from \"@matrix-org/matrix-sdk-crypto-wasm\";\nimport { StoreHandle } from \"@matrix-org/matrix-sdk-crypto-wasm\";\n\nimport { RustCrypto } from \"./rust-crypto\";\nimport { IHttpOpts, MatrixHttpApi } from \"../http-api\";\nimport { ServerSideSecretStorage } from \"../secret-storage\";\nimport { ICryptoCallbacks } from \"../crypto\";\nimport { Logger } from \"../logger\";\nimport { CryptoStore, MigrationState } from \"../crypto/store/base\";\nimport {\n    migrateFromLegacyCrypto,\n    migrateLegacyLocalTrustIfNeeded,\n    migrateRoomSettingsFromLegacyCrypto,\n} from \"./libolm_migration\";\n\n/**\n * Create a new `RustCrypto` implementation\n *\n * @param args - Parameter object\n * @internal\n */\nexport async function initRustCrypto(args: {\n    /** A `Logger` instance that will be used for debug output. */\n    logger: Logger;\n\n    /**\n     * Low-level HTTP interface: used to make outgoing requests required by the rust SDK.\n     * We expect it to set the access token, etc.\n     */\n    http: MatrixHttpApi<IHttpOpts & { onlyData: true }>;\n\n    /** The local user's User ID. */\n    userId: string;\n\n    /** The local user's Device ID. */\n    deviceId: string;\n\n    /** Interface to server-side secret storage. */\n    secretStorage: ServerSideSecretStorage;\n\n    /** Crypto callbacks provided by the application. */\n    cryptoCallbacks: ICryptoCallbacks;\n\n    /**\n     * The prefix to use on the indexeddbs created by rust-crypto.\n     * If `null`, a memory store will be used.\n     */\n    storePrefix: string | null;\n\n    /**\n     * A passphrase to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null, or `storeKey` is set.  If neither this nor `storeKey` is set\n     * (and `storePrefix` is not null), the indexeddb will be unencrypted.\n     */\n    storePassphrase?: string;\n\n    /**\n     * A key to use to encrypt the indexeddb created by rust-crypto.\n     *\n     * Ignored if `storePrefix` is null. Otherwise, if it is set, it must be a 32-byte cryptographic key, which\n     * will be used to encrypt the indexeddb. See also `storePassphrase`.\n     */\n    storeKey?: Uint8Array;\n\n    /** If defined, we will check if any data needs migrating from this store to the rust store. */\n    legacyCryptoStore?: CryptoStore;\n\n    /** The pickle key for `legacyCryptoStore` */\n    legacyPickleKey?: string;\n\n    /**\n     * A callback which will receive progress updates on migration from `legacyCryptoStore`.\n     *\n     * Called with (-1, -1) to mark the end of migration.\n     */\n    legacyMigrationProgressListener?: (progress: number, total: number) => void;\n}): Promise<RustCrypto> {\n    const { logger } = args;\n\n    // initialise the rust matrix-sdk-crypto-wasm, if it hasn't already been done\n    logger.debug(\"Initialising Rust crypto-sdk WASM artifact\");\n    await RustSdkCryptoJs.initAsync();\n\n    // enable tracing in the rust-sdk\n    new RustSdkCryptoJs.Tracing(RustSdkCryptoJs.LoggerLevel.Debug).turnOn();\n\n    logger.debug(\"Opening Rust CryptoStore\");\n    let storeHandle;\n    if (args.storePrefix) {\n        if (args.storeKey) {\n            storeHandle = await StoreHandle.openWithKey(args.storePrefix, args.storeKey);\n        } else {\n            storeHandle = await StoreHandle.open(args.storePrefix, args.storePassphrase);\n        }\n    } else {\n        storeHandle = await StoreHandle.open();\n    }\n\n    if (args.legacyCryptoStore) {\n        // We have a legacy crypto store, which we may need to migrate from.\n        await migrateFromLegacyCrypto({\n            legacyStore: args.legacyCryptoStore,\n            storeHandle,\n            ...args,\n        });\n    }\n\n    const rustCrypto = await initOlmMachine(\n        logger,\n        args.http,\n        args.userId,\n        args.deviceId,\n        args.secretStorage,\n        args.cryptoCallbacks,\n        storeHandle,\n        args.legacyCryptoStore,\n    );\n\n    storeHandle.free();\n\n    logger.debug(\"Completed rust crypto-sdk setup\");\n    return rustCrypto;\n}\n\nasync function initOlmMachine(\n    logger: Logger,\n    http: MatrixHttpApi<IHttpOpts & { onlyData: true }>,\n    userId: string,\n    deviceId: string,\n    secretStorage: ServerSideSecretStorage,\n    cryptoCallbacks: ICryptoCallbacks,\n    storeHandle: StoreHandle,\n    legacyCryptoStore?: CryptoStore,\n): Promise<RustCrypto> {\n    logger.debug(\"Init OlmMachine\");\n\n    const olmMachine = await RustSdkCryptoJs.OlmMachine.initFromStore(\n        new RustSdkCryptoJs.UserId(userId),\n        new RustSdkCryptoJs.DeviceId(deviceId),\n        storeHandle,\n    );\n\n    // A final migration step, now that we have an OlmMachine.\n    if (legacyCryptoStore) {\n        await migrateRoomSettingsFromLegacyCrypto({\n            logger,\n            legacyStore: legacyCryptoStore,\n            olmMachine,\n        });\n    }\n\n    // Disable room key requests, per https://github.com/vector-im/element-web/issues/26524.\n    olmMachine.roomKeyRequestsEnabled = false;\n\n    const rustCrypto = new RustCrypto(logger, olmMachine, http, userId, deviceId, secretStorage, cryptoCallbacks);\n\n    await olmMachine.registerRoomKeyUpdatedCallback((sessions: RustSdkCryptoJs.RoomKeyInfo[]) =>\n        rustCrypto.onRoomKeysUpdated(sessions),\n    );\n    await olmMachine.registerRoomKeysWithheldCallback((withheld: RustSdkCryptoJs.RoomKeyWithheldInfo[]) =>\n        rustCrypto.onRoomKeysWithheld(withheld),\n    );\n    await olmMachine.registerUserIdentityUpdatedCallback((userId: RustSdkCryptoJs.UserId) =>\n        rustCrypto.onUserIdentityUpdated(userId),\n    );\n    await olmMachine.registerDevicesUpdatedCallback((userIds: string[]) => rustCrypto.onDevicesUpdated(userIds));\n\n    // Check if there are any key backup secrets pending processing. There may be multiple secrets to process if several devices have gossiped them.\n    // The `registerReceiveSecretCallback` function will only be triggered for new secrets. If the client is restarted before processing them, the secrets will need to be manually handled.\n    rustCrypto.checkSecrets(\"m.megolm_backup.v1\");\n\n    // Register a callback to be notified when a new secret is received, as for now only the key backup secret is supported (the cross signing secrets are handled automatically by the OlmMachine)\n    await olmMachine.registerReceiveSecretCallback((name: string, _value: string) =>\n        // Instead of directly checking the secret value, we poll the inbox to get all values for that secret type.\n        // Once we have all the values, we can safely clear the secret inbox.\n        rustCrypto.checkSecrets(name),\n    );\n\n    // Tell the OlmMachine to think about its outgoing requests before we hand control back to the application.\n    //\n    // This is primarily a fudge to get it to correctly populate the `users_for_key_query` list, so that future\n    // calls to getIdentity (etc) block until the key queries are performed.\n    //\n    // Note that we don't actually need to *make* any requests here; it is sufficient to tell the Rust side to think\n    // about them.\n    //\n    // XXX: find a less hacky way to do this.\n    await olmMachine.outgoingRequests();\n\n    if (legacyCryptoStore && (await legacyCryptoStore.containsData())) {\n        const migrationState = await legacyCryptoStore.getMigrationState();\n        if (migrationState < MigrationState.INITIAL_OWN_KEY_QUERY_DONE) {\n            logger.debug(`Performing initial key query after migration`);\n            // We need to do an initial keys query so that the rust stack can properly update trust of\n            // the user device and identity from the migrated private keys.\n            // If not done, there is a short period where the own device/identity trust will be undefined after migration.\n            let initialKeyQueryDone = false;\n            while (!initialKeyQueryDone) {\n                try {\n                    await rustCrypto.userHasCrossSigningKeys(userId);\n                    initialKeyQueryDone = true;\n                } catch (e) {\n                    // If the initial key query fails, we retry until it succeeds.\n                    logger.error(\"Failed to check for cross-signing keys after migration, retrying\", e);\n                }\n            }\n\n            // If the private master cross-signing key was not cached in the legacy store, the rust session\n            // will not be able to establish the trust of the user identity.\n            // That means that after migration the session could revert to unverified.\n            // In order to avoid asking the users to re-verify their sessions, we need to migrate the legacy local trust\n            // (if the legacy session was already verified) to the new session.\n            await migrateLegacyLocalTrustIfNeeded({ legacyCryptoStore, rustCrypto, logger });\n\n            await legacyCryptoStore.setMigrationState(MigrationState.INITIAL_OWN_KEY_QUERY_DONE);\n        }\n    }\n\n    return rustCrypto;\n}\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,KAAKA,eAAe,MAAM,oCAAoC;AACrE,SAASC,WAAW,QAAQ,oCAAoC;AAEhE,SAASC,UAAU,QAAQ,eAAe;AAK1C,SAAsBC,cAAc,QAAQ,sBAAsB;AAClE,SACIC,uBAAuB,EACvBC,+BAA+B,EAC/BC,mCAAmC,QAChC,oBAAoB;;AAE3B;AACA;AACA;AACA;AACA;AACA;AACA,gBAAsBC,cAAcA,CAAAC,EAAA;EAAA,OAAAC,eAAA,CAAAC,KAAA,OAAAC,SAAA;AAAA;AAsGnC,SAAAF,gBAAA;EAAAA,eAAA,GAAAG,iBAAA,CAtGM,WAA8BC,IAwDpC,EAAuB;IACpB,IAAM;MAAEC;IAAO,CAAC,GAAGD,IAAI;;IAEvB;IACAC,MAAM,CAACC,KAAK,CAAC,4CAA4C,CAAC;IAC1D,MAAMf,eAAe,CAACgB,SAAS,CAAC,CAAC;;IAEjC;IACA,IAAIhB,eAAe,CAACiB,OAAO,CAACjB,eAAe,CAACkB,WAAW,CAACC,KAAK,CAAC,CAACC,MAAM,CAAC,CAAC;IAEvEN,MAAM,CAACC,KAAK,CAAC,0BAA0B,CAAC;IACxC,IAAIM,WAAW;IACf,IAAIR,IAAI,CAACS,WAAW,EAAE;MAClB,IAAIT,IAAI,CAACU,QAAQ,EAAE;QACfF,WAAW,SAASpB,WAAW,CAACuB,WAAW,CAACX,IAAI,CAACS,WAAW,EAAET,IAAI,CAACU,QAAQ,CAAC;MAChF,CAAC,MAAM;QACHF,WAAW,SAASpB,WAAW,CAACwB,IAAI,CAACZ,IAAI,CAACS,WAAW,EAAET,IAAI,CAACa,eAAe,CAAC;MAChF;IACJ,CAAC,MAAM;MACHL,WAAW,SAASpB,WAAW,CAACwB,IAAI,CAAC,CAAC;IAC1C;IAEA,IAAIZ,IAAI,CAACc,iBAAiB,EAAE;MACxB;MACA,MAAMvB,uBAAuB,CAAAwB,aAAA;QACzBC,WAAW,EAAEhB,IAAI,CAACc,iBAAiB;QACnCN;MAAW,GACRR,IAAI,CACV,CAAC;IACN;IAEA,IAAMiB,UAAU,SAASC,cAAc,CACnCjB,MAAM,EACND,IAAI,CAACmB,IAAI,EACTnB,IAAI,CAACoB,MAAM,EACXpB,IAAI,CAACqB,QAAQ,EACbrB,IAAI,CAACsB,aAAa,EAClBtB,IAAI,CAACuB,eAAe,EACpBf,WAAW,EACXR,IAAI,CAACc,iBACT,CAAC;IAEDN,WAAW,CAACgB,IAAI,CAAC,CAAC;IAElBvB,MAAM,CAACC,KAAK,CAAC,iCAAiC,CAAC;IAC/C,OAAOe,UAAU;EACrB,CAAC;EAAA,OAAArB,eAAA,CAAAC,KAAA,OAAAC,SAAA;AAAA;AAAA,SAEcoB,cAAcA,CAAAO,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA;EAAA,OAAAC,eAAA,CAAApC,KAAA,OAAAC,SAAA;AAAA;AAAA,SAAAmC,gBAAA;EAAAA,eAAA,GAAAlC,iBAAA,CAA7B,WACIE,MAAc,EACdkB,IAAmD,EACnDC,MAAc,EACdC,QAAgB,EAChBC,aAAsC,EACtCC,eAAiC,EACjCf,WAAwB,EACxBM,iBAA+B,EACZ;IACnBb,MAAM,CAACC,KAAK,CAAC,iBAAiB,CAAC;IAE/B,IAAMgC,UAAU,SAAS/C,eAAe,CAACgD,UAAU,CAACC,aAAa,CAC7D,IAAIjD,eAAe,CAACkD,MAAM,CAACjB,MAAM,CAAC,EAClC,IAAIjC,eAAe,CAACmD,QAAQ,CAACjB,QAAQ,CAAC,EACtCb,WACJ,CAAC;;IAED;IACA,IAAIM,iBAAiB,EAAE;MACnB,MAAMrB,mCAAmC,CAAC;QACtCQ,MAAM;QACNe,WAAW,EAAEF,iBAAiB;QAC9BoB;MACJ,CAAC,CAAC;IACN;;IAEA;IACAA,UAAU,CAACK,sBAAsB,GAAG,KAAK;IAEzC,IAAMtB,UAAU,GAAG,IAAI5B,UAAU,CAACY,MAAM,EAAEiC,UAAU,EAAEf,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAEC,aAAa,EAAEC,eAAe,CAAC;IAE7G,MAAMW,UAAU,CAACM,8BAA8B,CAAEC,QAAuC,IACpFxB,UAAU,CAACyB,iBAAiB,CAACD,QAAQ,CACzC,CAAC;IACD,MAAMP,UAAU,CAACS,gCAAgC,CAAEC,QAA+C,IAC9F3B,UAAU,CAAC4B,kBAAkB,CAACD,QAAQ,CAC1C,CAAC;IACD,MAAMV,UAAU,CAACY,mCAAmC,CAAE1B,MAA8B,IAChFH,UAAU,CAAC8B,qBAAqB,CAAC3B,MAAM,CAC3C,CAAC;IACD,MAAMc,UAAU,CAACc,8BAA8B,CAAEC,OAAiB,IAAKhC,UAAU,CAACiC,gBAAgB,CAACD,OAAO,CAAC,CAAC;;IAE5G;IACA;IACAhC,UAAU,CAACkC,YAAY,CAAC,oBAAoB,CAAC;;IAE7C;IACA,MAAMjB,UAAU,CAACkB,6BAA6B,CAAC,CAACC,IAAY,EAAEC,MAAc;IACxE;IACA;IACArC,UAAU,CAACkC,YAAY,CAACE,IAAI,CAChC,CAAC;;IAED;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAMnB,UAAU,CAACqB,gBAAgB,CAAC,CAAC;IAEnC,IAAIzC,iBAAiB,WAAWA,iBAAiB,CAAC0C,YAAY,CAAC,CAAC,CAAC,EAAE;MAC/D,IAAMC,cAAc,SAAS3C,iBAAiB,CAAC4C,iBAAiB,CAAC,CAAC;MAClE,IAAID,cAAc,GAAGnE,cAAc,CAACqE,0BAA0B,EAAE;QAC5D1D,MAAM,CAACC,KAAK,+CAA+C,CAAC;QAC5D;QACA;QACA;QACA,IAAI0D,mBAAmB,GAAG,KAAK;QAC/B,OAAO,CAACA,mBAAmB,EAAE;UACzB,IAAI;YACA,MAAM3C,UAAU,CAAC4C,uBAAuB,CAACzC,MAAM,CAAC;YAChDwC,mBAAmB,GAAG,IAAI;UAC9B,CAAC,CAAC,OAAOE,CAAC,EAAE;YACR;YACA7D,MAAM,CAAC8D,KAAK,CAAC,kEAAkE,EAAED,CAAC,CAAC;UACvF;QACJ;;QAEA;QACA;QACA;QACA;QACA;QACA,MAAMtE,+BAA+B,CAAC;UAAEsB,iBAAiB;UAAEG,UAAU;UAAEhB;QAAO,CAAC,CAAC;QAEhF,MAAMa,iBAAiB,CAACkD,iBAAiB,CAAC1E,cAAc,CAACqE,0BAA0B,CAAC;MACxF;IACJ;IAEA,OAAO1C,UAAU;EACrB,CAAC;EAAA,OAAAgB,eAAA,CAAApC,KAAA,OAAAC,SAAA;AAAA","ignoreList":[]}

package/lib/rust-crypto/rust-crypto.d.ts

@@ -444,6 +444,15 @@ export declare class RustCrypto extends TypedEventEmitter<RustCryptoEvents, Rust
      */
     onRoomKeysUpdated(keys: RustSdkCryptoJs.RoomKeyInfo[]): Promise<void>;
     private onRoomKeyUpdated;
+    /**
+     * Callback for `OlmMachine.registerRoomKeyWithheldCallback`.
+     *
+     * Called by the rust sdk whenever we are told that a key has been withheld. We see if we had any events that
+     * failed to decrypt for the given session, and update their status if so.
+     *
+     * @param withheld - Details of the withheld sessions.
+     */
+    onRoomKeysWithheld(withheld: RustSdkCryptoJs.RoomKeyWithheldInfo[]): Promise<void>;
     /**
      * Callback for `OlmMachine.registerUserIdentityUpdatedCallback`
      *

package/lib/rust-crypto/rust-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust-crypto.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/rust-crypto.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,eAAe,MAAM,oCAAoC,CAAC;AAEtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEnF,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,WAAW,EAAoB,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAmB,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAAU,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAU,MAAM,aAAa,CAAC;AAK/D,OAAO,EACH,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EAEf,kBAAkB,EAClB,SAAS,EACT,eAAe,EAGf,wBAAwB,EACxB,mBAAmB,EAGnB,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACtB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAU,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAmC,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAO7F,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAqB,MAAM,UAAU,CAAC;AAuB/F;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,iBAAiB,CAAC,gBAAgB,EAAE,kBAAkB,CAAE,YAAW,aAAa;IAoBxG,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAKvB,8CAA8C;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAzCpC,OAAO,CAAC,wBAAwB,CAAQ;IAExC,2CAA2C;IAC3C,OAAO,CAAC,OAAO,CAAS;IAExB,0CAA0C;IAC1C,OAAO,CAAC,cAAc,CAAqC;IAE3D,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,wBAAwB,CAA2B;IAC3D,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,uBAAuB,CAA0B;IACzD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAgC;IAC3E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkE;gBAGvE,MAAM,EAAE,MAAM;IAE/B,4DAA4D;IAC3C,UAAU,EAAE,eAAe,CAAC,UAAU;IAEvD;;;;OAIG;IACc,IAAI,EAAE,aAAa,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAEpE,gCAAgC;IACf,MAAM,EAAE,MAAM;IAE/B,kCAAkC;IAClC,SAAS,EAAE,MAAM;IAEjB,8CAA8C;IAC7B,aAAa,EAAE,uBAAuB;IAEvD,mDAAmD;IAClC,eAAe,EAAE,eAAe;IAyCrD;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAa5B,IAAW,2BAA2B,CAAC,EAAE,EAAE,OAAO,EAEjD;IAED,IAAW,2BAA2B,IAAI,OAAO,CAGhD;IAEM,IAAI,IAAI,IAAI;IAoBN,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5D,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAa9E;;;;OAIG;IACI,sBAAsB,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB;IAgBtE;;;;;OAKG;IACI,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB;IAI7D;;;;;;;;OAQG;IACI,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAKzD;;;;;;;;OAQG;IACU,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvD;;OAEG;IACU,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAoBhH;;OAEG;IACU,sBAAsB,CAC/B,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUT,gCAAgC,UAAS;IAEhD;;OAEG;IACI,UAAU,IAAI,MAAM;IAK3B;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxE;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKhD,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAQlC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,cAAc,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAK/C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIvC,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpF,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF;;OAEG;IACU,uBAAuB,CAAC,MAAM,SAAc,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CtG;;;;;;;;OAQG;IACU,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;IAkC/F;;;OAGG;YACW,cAAc;IAgC5B;;;OAGG;YACW,kBAAkB;IAShC;;OAEG;IACI,0BAA0B,IAAI,OAAO;IAI5C;;OAEG;IACI,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAMrD;;;;OAIG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBhG;;;;OAIG;IACU,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7D;;OAEG;IACU,2BAA2B,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAmB3C;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAWvF;;OAEG;IACU,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC;IAcpD;;OAEG;IACU,oBAAoB,CAAC,IAAI,GAAE,eAAwC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmDzG;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlF;;OAEG;IACU,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;IAiBrD;;OAEG;IACU,sBAAsB,CAAC,EAChC,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,GACpB,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD/C;;;;;;;OAOG;YACW,kCAAkC;IAgBhD;;;;OAIG;YACW,sBAAsB;IAYpC;;OAEG;IACU,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA0BjE;;OAEG;IACU,+BAA+B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA0BnG;;OAEG;IACU,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAI/F;;;;;;;;OAQG;IACI,yCAAyC,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAiBvF;;;;;;;;;;OAUG;IACI,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAoB5G;;OAEG;IACU,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmChG;;;;;;;;;;OAUG;YACW,8BAA8B;IAgB5C;;OAEG;IACH,OAAO,CAAC,6BAA6B,CAAsC;IAE3E;;;;OAIG;IACI,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI;IAK3E;;;;;;;;OAQG;IACU,0BAA0B,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAyBvE;;;;;;;;;;;OAWG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA0BtG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMrE;;;;;;;OAOG;IACU,4BAA4B,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa3F;;;;OAIG;IACU,6BAA6B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIpE;;;;OAIG;IACU,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAI9E;;;;OAIG;IACU,uBAAuB,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAItE;;OAEG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5C;;;;;;;OAOG;YACW,UAAU;IAoBxB;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC;IAIvD;;OAEG;IACU,gBAAgB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE;;OAEG;IACU,mBAAmB,CAC5B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GACtE,OAAO,CAAC,IAAI,CAAC;IAKhB;;OAEG;IACU,mBAAmB,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAa7F;;;;;;;OAOG;YACW,kBAAkB;IAwBhC;;;;OAIG;IACU,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAkB5F;;;;OAIG;IACU,gBAAgB,CACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;OAIG;IACU,kBAAkB,CAAC,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzE;;;;OAIG;IACU,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCzE;;;;;OAKG;IACI,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI;IAQ5D;;;;;;OAMG;IACH,OAAO,CAAC,gCAAgC;IA+BxC;;;;;OAKG;IACI,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IAS7F;;;;;;;OAOG;IACU,iBAAiB,CAAC,IAAI,EAAE,eAAe,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlF,OAAO,CAAC,gBAAgB;IA0BxB;;;;;;;OAOG;IACU,qBAAqB,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;;OASG;IACU,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/D;;;;;;;;;;;OAWG;YACW,oBAAoB;IAYlC;;;;;;OAMG;IACU,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IActD;;;;;OAKG;IACU,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCnE;;;;OAIG;YACW,sBAAsB;IAoCpC;;;;;OAKG;IACU,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,eAAe,GAAG,SAAS,CAAC;CAGtF;AAoRD,KAAK,gBAAgB,GACf,WAAW,CAAC,2BAA2B,GACvC,WAAW,CAAC,sBAAsB,GAClC,WAAW,CAAC,WAAW,GACvB,WAAW,CAAC,iBAAiB,GAC7B,WAAW,CAAC,cAAc,GAC1B,sBAAsB,CAAC;AAE7B,KAAK,kBAAkB,GAAG;IACtB;;OAEG;IACH,CAAC,WAAW,CAAC,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAElF;;OAEG;IACH,CAAC,WAAW,CAAC,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAEvG,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACtE;;;;;;;;;;;OAWG;IACH,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;IAC9C;;;;;OAKG;IACH,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;IAClF;;;;;OAKG;IACH,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;CAClF,GAAG,wBAAwB,CAAC"}
+{"version":3,"file":"rust-crypto.d.ts","sourceRoot":"","sources":["../../src/rust-crypto/rust-crypto.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,eAAe,MAAM,oCAAoC,CAAC;AAEtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEnF,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,WAAW,EAAoB,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAmB,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACtH,OAAO,EAAU,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAU,MAAM,aAAa,CAAC;AAK/D,OAAO,EACH,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,eAAe,EAEf,kBAAkB,EAClB,SAAS,EACT,eAAe,EAGf,wBAAwB,EACxB,mBAAmB,EAGnB,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACtB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAU,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAmC,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAO7F,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAqB,MAAM,UAAU,CAAC;AAuB/F;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,iBAAiB,CAAC,gBAAgB,EAAE,kBAAkB,CAAE,YAAW,aAAa;IAoBxG,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,gCAAgC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAKvB,8CAA8C;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAzCpC,OAAO,CAAC,wBAAwB,CAAQ;IAExC,2CAA2C;IAC3C,OAAO,CAAC,OAAO,CAAS;IAExB,0CAA0C;IAC1C,OAAO,CAAC,cAAc,CAAqC;IAE3D,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,wBAAwB,CAA2B;IAC3D,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,uBAAuB,CAA0B;IACzD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAgC;IAC3E,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA0B;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkE;gBAGvE,MAAM,EAAE,MAAM;IAE/B,4DAA4D;IAC3C,UAAU,EAAE,eAAe,CAAC,UAAU;IAEvD;;;;OAIG;IACc,IAAI,EAAE,aAAa,CAAC,SAAS,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAEpE,gCAAgC;IACf,MAAM,EAAE,MAAM;IAE/B,kCAAkC;IAClC,SAAS,EAAE,MAAM;IAEjB,8CAA8C;IAC7B,aAAa,EAAE,uBAAuB;IAEvD,mDAAmD;IAClC,eAAe,EAAE,eAAe;IAyCrD;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAa5B,IAAW,2BAA2B,CAAC,EAAE,EAAE,OAAO,EAEjD;IAED,IAAW,2BAA2B,IAAI,OAAO,CAGhD;IAEM,IAAI,IAAI,IAAI;IAoBN,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5D,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAa9E;;;;OAIG;IACI,sBAAsB,CAAC,KAAK,EAAE,WAAW,GAAG,mBAAmB;IAgBtE;;;;;OAKG;IACI,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB;IAI7D;;;;;;;;OAQG;IACI,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAKzD;;;;;;;;OAQG;IACU,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvD;;OAEG;IACU,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAoBhH;;OAEG;IACU,sBAAsB,CAC/B,IAAI,EAAE,kBAAkB,EAAE,EAC1B,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUT,gCAAgC,UAAS;IAEhD;;OAEG;IACI,UAAU,IAAI,MAAM;IAK3B;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxE;;OAEG;IACU,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC;IAKhD,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAQlC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,cAAc,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAK/C,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIvC,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpF,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF;;OAEG;IACU,uBAAuB,CAAC,MAAM,SAAc,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CtG;;;;;;;;OAQG;IACU,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;IAkC/F;;;OAGG;YACW,cAAc;IAgC5B;;;OAGG;YACW,kBAAkB;IAShC;;OAEG;IACI,0BAA0B,IAAI,OAAO;IAI5C;;OAEG;IACI,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAMrD;;;;OAIG;IACU,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBhG;;;;OAIG;IACU,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB7D;;OAEG;IACU,2BAA2B,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAmB3C;;OAEG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAWvF;;OAEG;IACU,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC;IAcpD;;OAEG;IACU,oBAAoB,CAAC,IAAI,GAAE,eAAwC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmDzG;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlF;;OAEG;IACU,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC;IAiBrD;;OAEG;IACU,sBAAsB,CAAC,EAChC,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,GACpB,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD/C;;;;;;;OAOG;YACW,kCAAkC;IAgBhD;;;;OAIG;YACW,sBAAsB;IAYpC;;OAEG;IACU,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA0BjE;;OAEG;IACU,+BAA+B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA0BnG;;OAEG;IACU,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAI/F;;;;;;;;OAQG;IACI,yCAAyC,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAiBvF;;;;;;;;;;OAUG;IACI,mCAAmC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAoB5G;;OAEG;IACU,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmChG;;;;;;;;;;OAUG;YACW,8BAA8B;IAgB5C;;OAEG;IACH,OAAO,CAAC,6BAA6B,CAAsC;IAE3E;;;;OAIG;IACI,+BAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI;IAK3E;;;;;;;;OAQG;IACU,0BAA0B,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAyBvE;;;;;;;;;;;OAWG;IACU,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA0BtG;;;;;;OAMG;IACU,0BAA0B,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAMrE;;;;;;;OAOG;IACU,4BAA4B,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa3F;;;;OAIG;IACU,6BAA6B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIpE;;;;OAIG;IACU,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAI9E;;;;OAIG;IACU,uBAAuB,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAItE;;OAEG;IACU,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;OAEG;IACU,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5C;;;;;;;OAOG;YACW,UAAU;IAoBxB;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC;IAIvD;;OAEG;IACU,gBAAgB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAOpE;;OAEG;IACU,mBAAmB,CAC5B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GACtE,OAAO,CAAC,IAAI,CAAC;IAKhB;;OAEG;IACU,mBAAmB,IAAI,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAa7F;;;;;;;OAOG;YACW,kBAAkB;IAwBhC;;;;OAIG;IACU,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAkB5F;;;;OAIG;IACU,gBAAgB,CACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;OAIG;IACU,kBAAkB,CAAC,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzE;;;;OAIG;IACU,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCzE;;;;;OAKG;IACI,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI;IAQ5D;;;;;;OAMG;IACH,OAAO,CAAC,gCAAgC;IA+BxC;;;;;OAKG;IACI,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IAS7F;;;;;;;OAOG;IACU,iBAAiB,CAAC,IAAI,EAAE,eAAe,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlF,OAAO,CAAC,gBAAgB;IA0BxB;;;;;;;OAOG;IACU,kBAAkB,CAAC,QAAQ,EAAE,eAAe,CAAC,mBAAmB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB/F;;;;;;;OAOG;IACU,qBAAqB,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;;OASG;IACU,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/D;;;;;;;;;;;OAWG;YACW,oBAAoB;IAYlC;;;;;;OAMG;IACU,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IActD;;;;;OAKG;IACU,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCnE;;;;OAIG;YACW,sBAAsB;IAoCpC;;;;;OAKG;IACU,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,eAAe,GAAG,SAAS,CAAC;CAGtF;AAgRD,KAAK,gBAAgB,GACf,WAAW,CAAC,2BAA2B,GACvC,WAAW,CAAC,sBAAsB,GAClC,WAAW,CAAC,WAAW,GACvB,WAAW,CAAC,iBAAiB,GAC7B,WAAW,CAAC,cAAc,GAC1B,sBAAsB,CAAC;AAE7B,KAAK,kBAAkB,GAAG;IACtB;;OAEG;IACH,CAAC,WAAW,CAAC,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAElF;;OAEG;IACH,CAAC,WAAW,CAAC,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAEvG,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACtE;;;;;;;;;;;OAWG;IACH,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC;IAC9C;;;;;OAKG;IACH,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;IAClF;;;;;OAKG;IACH,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,KAAK,IAAI,CAAC;CAClF,GAAG,wBAAwB,CAAC"}