matrix-js-sdk 41.8.0 → 41.9.0

package/lib/secret-storage.js

@@ -1,5 +1,3 @@
-import _slicedToArray from "@babel/runtime/helpers/slicedToArray";
-import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
 /*
 Copyright 2021-2023 The Matrix.org Foundation C.I.C.
 
@@ -27,7 +25,7 @@ import { secureRandomString } from "./randomstring.js";
 import { logger } from "./logger.js";
 import encryptAESSecretStorageItem from "./utils/encryptAESSecretStorageItem.js";
 import decryptAESSecretStorageItem from "./utils/decryptAESSecretStorageItem.js";
-export var SECRET_STORAGE_ALGORITHM_V1_AES = "m.secret_storage.v1.aes-hmac-sha2";
+export const SECRET_STORAGE_ALGORITHM_V1_AES = "m.secret_storage.v1.aes-hmac-sha2";
 
 /**
  * Common base interface for Secret Storage Keys.
@@ -124,14 +122,10 @@ export class ServerSideSecretStorageImpl {
    *
    * @returns The default key ID or null if no default key ID is set
    */
-  getDefaultKeyId() {
-    var _this = this;
-    return _asyncToGenerator(function* () {
-      var _defaultKey$key;
-      var defaultKey = yield _this.accountDataAdapter.getAccountDataFromServer("m.secret_storage.default_key");
-      if (!defaultKey) return null;
-      return (_defaultKey$key = defaultKey.key) !== null && _defaultKey$key !== void 0 ? _defaultKey$key : null;
-    })();
+  async getDefaultKeyId() {
+    const defaultKey = await this.accountDataAdapter.getAccountDataFromServer("m.secret_storage.default_key");
+    if (!defaultKey) return null;
+    return defaultKey.key ?? null;
   }
 
   /**
@@ -139,7 +133,7 @@ export class ServerSideSecretStorageImpl {
    */
   setDefaultKeyId(keyId) {
     return new Promise((resolve, reject) => {
-      var listener = ev => {
+      const listener = ev => {
         if (ev.getType() !== "m.secret_storage.default_key") {
           //  Different account data item
           return;
@@ -147,8 +141,8 @@ export class ServerSideSecretStorageImpl {
 
         // If keyId === null, the content should be an empty object.
         // Otherwise, the `key` in the content object should match keyId.
-        var content = ev.getContent();
-        var isSameKey = keyId === null ? Object.keys(content).length === 0 : content.key === keyId;
+        const content = ev.getContent();
+        const isSameKey = keyId === null ? Object.keys(content).length === 0 : content.key === keyId;
         if (isSameKey) {
           this.accountDataAdapter.removeListener(ClientEvent.AccountData, listener);
           resolve();
@@ -160,7 +154,7 @@ export class ServerSideSecretStorageImpl {
       // It doesn't specify how to delete the default key; we do it by setting the account data to an empty object.
       //
       // [1]: https://spec.matrix.org/v1.13/client-server-api/#key-storage
-      var newValue = keyId === null ? {} : {
+      const newValue = keyId === null ? {} : {
         key: keyId
       };
       this.accountDataAdapter.setAccountData("m.secret_storage.default_key", newValue).catch(e => {
@@ -183,39 +177,37 @@ export class ServerSideSecretStorageImpl {
    *     keyId: the ID of the key
    *     keyInfo: details about the key (iv, mac, passphrase)
    */
-  addKey(algorithm, opts, keyId) {
-    var _this2 = this;
-    return _asyncToGenerator(function* () {
-      if (algorithm !== SECRET_STORAGE_ALGORITHM_V1_AES) {
-        throw new Error("Unknown key algorithm ".concat(algorithm));
-      }
-      var keyInfo = {
-        algorithm
-      };
-      if (opts.name) {
-        keyInfo.name = opts.name;
-      }
-      if (opts.passphrase) {
-        keyInfo.passphrase = opts.passphrase;
-      }
-      var _yield$calculateKeyCh = yield calculateKeyCheck(opts.key),
-        iv = _yield$calculateKeyCh.iv,
-        mac = _yield$calculateKeyCh.mac;
-      keyInfo.iv = iv;
-      keyInfo.mac = mac;
-
-      // Create a unique key id. XXX: this is racey.
-      if (!keyId) {
-        do {
-          keyId = secureRandomString(32);
-        } while (yield _this2.accountDataAdapter.getAccountDataFromServer("m.secret_storage.key.".concat(keyId)));
-      }
-      yield _this2.accountDataAdapter.setAccountData("m.secret_storage.key.".concat(keyId), keyInfo);
-      return {
-        keyId,
-        keyInfo
-      };
-    })();
+  async addKey(algorithm, opts, keyId) {
+    if (algorithm !== SECRET_STORAGE_ALGORITHM_V1_AES) {
+      throw new Error(`Unknown key algorithm ${algorithm}`);
+    }
+    const keyInfo = {
+      algorithm
+    };
+    if (opts.name) {
+      keyInfo.name = opts.name;
+    }
+    if (opts.passphrase) {
+      keyInfo.passphrase = opts.passphrase;
+    }
+    const {
+      iv,
+      mac
+    } = await calculateKeyCheck(opts.key);
+    keyInfo.iv = iv;
+    keyInfo.mac = mac;
+
+    // Create a unique key id. XXX: this is racey.
+    if (!keyId) {
+      do {
+        keyId = secureRandomString(32);
+      } while (await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`));
+    }
+    await this.accountDataAdapter.setAccountData(`m.secret_storage.key.${keyId}`, keyInfo);
+    return {
+      keyId,
+      keyInfo
+    };
   }
 
   /**
@@ -227,18 +219,15 @@ export class ServerSideSecretStorageImpl {
    *     the form [keyId, keyInfo].  Otherwise, null is returned.
    *     XXX: why is this an array when addKey returns an object?
    */
-  getKey(keyId) {
-    var _this3 = this;
-    return _asyncToGenerator(function* () {
-      if (!keyId) {
-        keyId = yield _this3.getDefaultKeyId();
-      }
-      if (!keyId) {
-        return null;
-      }
-      var keyInfo = yield _this3.accountDataAdapter.getAccountDataFromServer("m.secret_storage.key.".concat(keyId));
-      return keyInfo ? [keyId, keyInfo] : null;
-    })();
+  async getKey(keyId) {
+    if (!keyId) {
+      keyId = await this.getDefaultKeyId();
+    }
+    if (!keyId) {
+      return null;
+    }
+    const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
+    return keyInfo ? [keyId, keyInfo] : null;
   }
 
   /**
@@ -248,12 +237,9 @@ export class ServerSideSecretStorageImpl {
    *     for. Defaults to the default key ID if not provided.
    * @returns Whether we have the key.
    */
-  hasKey(keyId) {
-    var _this4 = this;
-    return _asyncToGenerator(function* () {
-      var key = yield _this4.getKey(keyId);
-      return Boolean(key);
-    })();
+  async hasKey(keyId) {
+    const key = await this.getKey(keyId);
+    return Boolean(key);
   }
 
   /**
@@ -264,72 +250,66 @@ export class ServerSideSecretStorageImpl {
    *
    * @returns whether or not the key matches
    */
-  checkKey(key, info) {
-    return _asyncToGenerator(function* () {
-      if (info.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
-        if (info.mac) {
-          var _yield$calculateKeyCh2 = yield calculateKeyCheck(key, info.iv),
-            mac = _yield$calculateKeyCh2.mac;
-          return trimTrailingEquals(info.mac) === trimTrailingEquals(mac);
-        } else {
-          // if we have no information, we have to assume the key is right
-          return true;
-        }
+  async checkKey(key, info) {
+    if (info.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
+      if (info.mac) {
+        const {
+          mac
+        } = await calculateKeyCheck(key, info.iv);
+        return trimTrailingEquals(info.mac) === trimTrailingEquals(mac);
       } else {
-        throw new Error("Unknown algorithm");
+        // if we have no information, we have to assume the key is right
+        return true;
       }
-    })();
+    } else {
+      throw new Error("Unknown algorithm");
+    }
   }
 
   /**
    * Implementation of {@link ServerSideSecretStorage#store}.
    */
-  store(name, secret, keys) {
-    var _this5 = this;
-    return _asyncToGenerator(function* () {
-      if (secret === null) {
-        // remove secret
-        yield _this5.accountDataAdapter.setAccountData(name, {});
-        return;
-      }
-      var encrypted = {};
-      if (!keys) {
-        var defaultKeyId = yield _this5.getDefaultKeyId();
-        if (!defaultKeyId) {
-          throw new Error("No keys specified and no default key present");
-        }
-        keys = [defaultKeyId];
+  async store(name, secret, keys) {
+    if (secret === null) {
+      // remove secret
+      await this.accountDataAdapter.setAccountData(name, {});
+      return;
+    }
+    const encrypted = {};
+    if (!keys) {
+      const defaultKeyId = await this.getDefaultKeyId();
+      if (!defaultKeyId) {
+        throw new Error("No keys specified and no default key present");
       }
-      if (keys.length === 0) {
-        throw new Error("Zero keys given to encrypt with!");
+      keys = [defaultKeyId];
+    }
+    if (keys.length === 0) {
+      throw new Error("Zero keys given to encrypt with!");
+    }
+    for (const keyId of keys) {
+      // get key information from key storage
+      const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
+      if (!keyInfo) {
+        throw new Error("Unknown key: " + keyId);
       }
-      for (var _keyId of keys) {
-        // get key information from key storage
-        var _keyInfo = yield _this5.accountDataAdapter.getAccountDataFromServer("m.secret_storage.key.".concat(_keyId));
-        if (!_keyInfo) {
-          throw new Error("Unknown key: " + _keyId);
-        }
 
-        // encrypt secret, based on the algorithm
-        if (_keyInfo.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
-          var _keys = {
-            [_keyId]: _keyInfo
-          };
-          var _yield$_this5$getSecr = yield _this5.getSecretStorageKey(_keys, name),
-            _yield$_this5$getSecr2 = _slicedToArray(_yield$_this5$getSecr, 2),
-            encryption = _yield$_this5$getSecr2[1];
-          encrypted[_keyId] = yield encryption.encrypt(secret);
-        } else {
-          logger.warn("unknown algorithm for secret storage key " + _keyId + ": " + _keyInfo.algorithm);
-          // do nothing if we don't understand the encryption algorithm
-        }
+      // encrypt secret, based on the algorithm
+      if (keyInfo.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
+        const keys = {
+          [keyId]: keyInfo
+        };
+        const [, encryption] = await this.getSecretStorageKey(keys, name);
+        encrypted[keyId] = await encryption.encrypt(secret);
+      } else {
+        logger.warn("unknown algorithm for secret storage key " + keyId + ": " + keyInfo.algorithm);
+        // do nothing if we don't understand the encryption algorithm
       }
+    }
 
-      // save encrypted secret
-      yield _this5.accountDataAdapter.setAccountData(name, {
-        encrypted
-      });
-    })();
+    // save encrypted secret
+    await this.accountDataAdapter.setAccountData(name, {
+      encrypted
+    });
   }
 
   /**
@@ -343,42 +323,36 @@ export class ServerSideSecretStorageImpl {
    * @returns the decrypted contents of the secret, or "undefined" if `name` is not found in
    *    the user's account data.
    */
-  get(name) {
-    var _this6 = this;
-    return _asyncToGenerator(function* () {
-      var secretInfo = yield _this6.accountDataAdapter.getAccountDataFromServer(name);
-      if (!secretInfo) {
-        return;
-      }
-      if (!secretInfo.encrypted) {
-        throw new Error("Content is not encrypted!");
-      }
-
-      // get possible keys to decrypt
-      var keys = {};
-      for (var _keyId2 of Object.keys(secretInfo.encrypted)) {
-        // get key information from key storage
-        var _keyInfo2 = yield _this6.accountDataAdapter.getAccountDataFromServer("m.secret_storage.key.".concat(_keyId2));
-        var _encInfo = secretInfo.encrypted[_keyId2];
-        // only use keys we understand the encryption algorithm of
-        if ((_keyInfo2 === null || _keyInfo2 === void 0 ? void 0 : _keyInfo2.algorithm) === SECRET_STORAGE_ALGORITHM_V1_AES) {
-          if (_encInfo.iv && _encInfo.ciphertext && _encInfo.mac) {
-            keys[_keyId2] = _keyInfo2;
-          }
+  async get(name) {
+    const secretInfo = await this.accountDataAdapter.getAccountDataFromServer(name);
+    if (!secretInfo) {
+      return;
+    }
+    if (!secretInfo.encrypted) {
+      throw new Error("Content is not encrypted!");
+    }
+
+    // get possible keys to decrypt
+    const keys = {};
+    for (const keyId of Object.keys(secretInfo.encrypted)) {
+      // get key information from key storage
+      const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
+      const encInfo = secretInfo.encrypted[keyId];
+      // only use keys we understand the encryption algorithm of
+      if (keyInfo?.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
+        if (encInfo.iv && encInfo.ciphertext && encInfo.mac) {
+          keys[keyId] = keyInfo;
         }
       }
-      if (Object.keys(keys).length === 0) {
-        throw new Error("Could not decrypt ".concat(name, " because none of ") + "the keys it is encrypted with are for a supported algorithm");
-      }
-
-      // fetch private key from app
-      var _yield$_this6$getSecr = yield _this6.getSecretStorageKey(keys, name),
-        _yield$_this6$getSecr2 = _slicedToArray(_yield$_this6$getSecr, 2),
-        keyId = _yield$_this6$getSecr2[0],
-        decryption = _yield$_this6$getSecr2[1];
-      var encInfo = secretInfo.encrypted[keyId];
-      return decryption.decrypt(encInfo);
-    })();
+    }
+    if (Object.keys(keys).length === 0) {
+      throw new Error(`Could not decrypt ${name} because none of ` + `the keys it is encrypted with are for a supported algorithm`);
+    }
+
+    // fetch private key from app
+    const [keyId, decryption] = await this.getSecretStorageKey(keys, name);
+    const encInfo = secretInfo.encrypted[keyId];
+    return decryption.decrypt(encInfo);
   }
 
   /**
@@ -390,66 +364,58 @@ export class ServerSideSecretStorageImpl {
    *     with, or null if it is not present or not encrypted with a trusted
    *     key
    */
-  isStored(name) {
-    var _this7 = this;
-    return _asyncToGenerator(function* () {
-      // check if secret exists
-      var secretInfo = yield _this7.accountDataAdapter.getAccountDataFromServer(name);
-      if (!(secretInfo !== null && secretInfo !== void 0 && secretInfo.encrypted)) return null;
-      var ret = {};
-
-      // filter secret encryption keys with supported algorithm
-      for (var _keyId3 of Object.keys(secretInfo.encrypted)) {
-        // get key information from key storage
-        var _keyInfo3 = yield _this7.accountDataAdapter.getAccountDataFromServer("m.secret_storage.key.".concat(_keyId3));
-        if (!_keyInfo3) continue;
-        var encInfo = secretInfo.encrypted[_keyId3];
-
-        // only use keys we understand the encryption algorithm of
-        if (_keyInfo3.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
-          if (encInfo.iv && encInfo.ciphertext && encInfo.mac) {
-            ret[_keyId3] = _keyInfo3;
-          }
+  async isStored(name) {
+    // check if secret exists
+    const secretInfo = await this.accountDataAdapter.getAccountDataFromServer(name);
+    if (!secretInfo?.encrypted) return null;
+    const ret = {};
+
+    // filter secret encryption keys with supported algorithm
+    for (const keyId of Object.keys(secretInfo.encrypted)) {
+      // get key information from key storage
+      const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
+      if (!keyInfo) continue;
+      const encInfo = secretInfo.encrypted[keyId];
+
+      // only use keys we understand the encryption algorithm of
+      if (keyInfo.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
+        if (encInfo.iv && encInfo.ciphertext && encInfo.mac) {
+          ret[keyId] = keyInfo;
         }
       }
-      return Object.keys(ret).length ? ret : null;
-    })();
+    }
+    return Object.keys(ret).length ? ret : null;
   }
-  getSecretStorageKey(keys, name) {
-    var _this8 = this;
-    return _asyncToGenerator(function* () {
-      if (!_this8.callbacks.getSecretStorageKey) {
-        throw new Error("No getSecretStorageKey callback supplied");
-      }
-      var returned = yield _this8.callbacks.getSecretStorageKey({
-        keys
-      }, name);
-      if (!returned) {
-        throw new Error("getSecretStorageKey callback returned falsey");
-      }
-      if (returned.length < 2) {
-        throw new Error("getSecretStorageKey callback returned invalid data");
-      }
-      var _returned = _slicedToArray(returned, 2),
-        keyId = _returned[0],
-        privateKey = _returned[1];
-      if (!keys[keyId]) {
-        throw new Error("App returned unknown key from getSecretStorageKey!");
-      }
-      if (keys[keyId].algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
-        var decryption = {
-          encrypt: function encrypt(secret) {
-            return encryptAESSecretStorageItem(secret, privateKey, name);
-          },
-          decrypt: function decrypt(encInfo) {
-            return decryptAESSecretStorageItem(encInfo, privateKey, name);
-          }
-        };
-        return [keyId, decryption];
-      } else {
-        throw new Error("Unknown key type: " + keys[keyId].algorithm);
-      }
-    })();
+  async getSecretStorageKey(keys, name) {
+    if (!this.callbacks.getSecretStorageKey) {
+      throw new Error("No getSecretStorageKey callback supplied");
+    }
+    const returned = await this.callbacks.getSecretStorageKey({
+      keys
+    }, name);
+    if (!returned) {
+      throw new Error("getSecretStorageKey callback returned falsey");
+    }
+    if (returned.length < 2) {
+      throw new Error("getSecretStorageKey callback returned invalid data");
+    }
+    const [keyId, privateKey] = returned;
+    if (!keys[keyId]) {
+      throw new Error("App returned unknown key from getSecretStorageKey!");
+    }
+    if (keys[keyId].algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
+      const decryption = {
+        encrypt: function (secret) {
+          return encryptAESSecretStorageItem(secret, privateKey, name);
+        },
+        decrypt: function (encInfo) {
+          return decryptAESSecretStorageItem(encInfo, privateKey, name);
+        }
+      };
+      return [keyId, decryption];
+    } else {
+      throw new Error("Unknown key type: " + keys[keyId].algorithm);
+    }
   }
 }
 
@@ -464,7 +430,7 @@ export function trimTrailingEquals(input) {
   // Not sure I believe it, but it's easy enough to work around.
 
   // find the number of characters before the trailing =
-  var i = input.length;
+  let i = input.length;
   while (i >= 1 && input.charCodeAt(i - 1) == 0x3d) i--;
 
   // trim to the calculated length
@@ -476,7 +442,7 @@ export function trimTrailingEquals(input) {
 }
 
 // string of zeroes, for calculating the key check
-var ZERO_STR = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
+const ZERO_STR = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
 
 /**
  * Calculate the MAC for checking the key.