matrix-js-sdk 42.0.0 → 42.1.0

package/src/matrixrtc/MatrixRTCSession.ts

@@ -35,6 +35,7 @@ import type {
     RTCCallIntent,
     Transport,
     SlotDescription,
+    RtcSlotEventContent,
 } from "./types.ts";
 import {
     MembershipManagerEvent,
@@ -309,6 +310,25 @@ export class MatrixRTCSession extends TypedEventEmitter<
         return computeSlotId(this.slotDescription);
     }
 
+    /**
+     * Reads the current slot state event's content for this session.
+     *
+     * @returns The slot event's content, or `undefined` if no slot event exists for this session.
+     */
+    public getRtcSlot(): RtcSlotEventContent | undefined {
+        return getSlotEventContent(this.roomSubset, this.slotDescription);
+    }
+
+    /**
+     * Whether this session's slot is closed.
+     *
+     * @returns `true` if the slot is closed, `false` if the slot is open or `undefined`
+     * if no slot exists.
+     */
+    public isSlotClosed(): boolean | undefined {
+        return isSlotClosed(this.roomSubset, this.slotDescription);
+    }
+
     /**
      * Returns all the call memberships for a room that match the provided `sessionDescription`,
      * oldest first.
@@ -325,7 +345,7 @@ export class MatrixRTCSession extends TypedEventEmitter<
         const logger = rootLogger.getChild(
             `[MatrixRTCSession ${room.roomId} ${slotDescription.application}#${slotDescription.id}]`,
         );
-        const callMemberEvents = collectMembersEvents(room, options, logger);
+        const callMemberEvents = collectMembersEvents(room, slotDescription, options, logger);
 
         const callMemberships = await computeBackendIdentityAndVerifyMemberEvents(
             room,
@@ -424,6 +444,7 @@ export class MatrixRTCSession extends TypedEventEmitter<
         );
 
         this.roomSubset.on(RoomStateEvent.Members, this.onRoomMemberUpdate);
+        this.roomSubset.on(RoomStateEvent.Events, this.onRoomStateEvent);
         this.roomSubset.on(RoomStickyEventsEvent.Update, this.onStickyEventUpdate);
 
         this.initialMembershipCalculated = this.ensureRecalculateSessionMembers();
@@ -448,6 +469,7 @@ export class MatrixRTCSession extends TypedEventEmitter<
         }
 
         this.roomSubset.off(RoomStateEvent.Members, this.onRoomMemberUpdate);
+        this.roomSubset.off(RoomStateEvent.Events, this.onRoomStateEvent);
         this.roomSubset.off(RoomStickyEventsEvent.Update, this.onStickyEventUpdate);
     }
 
@@ -714,6 +736,15 @@ export class MatrixRTCSession extends TypedEventEmitter<
         void this.ensureRecalculateSessionMembers();
     };
 
+    /**
+     * Call this when a room state event has been updated.
+     */
+    private readonly onRoomStateEvent = (event: MatrixEvent): void => {
+        if (event.getType() !== EventType.RTCSlot) return;
+        if (event.getStateKey() !== computeSlotId(this.slotDescription)) return;
+        void this.ensureRecalculateSessionMembers();
+    };
+
     /**
      * Call this when a sticky event update has occured.
      */
@@ -735,7 +766,6 @@ export class MatrixRTCSession extends TypedEventEmitter<
      * Call this when something changed that may impacts the current MatrixRTC members in this session.
      */
     // We allow this name schema since this function should only be used for testing purposes.
-    // eslint-disable-next-line @typescript-eslint/naming-convention
     public _onRTCSessionMemberUpdate = async (): Promise<void> => {
         await this.recalculateSessionMembers();
     };
@@ -899,17 +929,54 @@ function isValidMembership(
     return true;
 }
 
+/**
+ * Reads the slot state event's content for the given slot description.
+ *
+ * @returns The slot event's content, or `undefined` if no slot event exists for the given description.
+ */
+function getSlotEventContent(
+    room: Pick<Room, "getLiveTimeline">,
+    slotDescription: SlotDescription,
+): RtcSlotEventContent | undefined {
+    const slotId = computeSlotId(slotDescription);
+    const slotEvent = room
+        .getLiveTimeline()
+        .getState(EventTimeline.FORWARDS)
+        ?.getStateEvents(EventType.RTCSlot, slotId);
+    if (!slotEvent) return undefined;
+
+    return slotEvent.getContent<RtcSlotEventContent>();
+}
+
+/**
+ * Whether the given slot is closed.
+ *
+ * @returns `true` if the slot is closed, `false` if the slot is open or `undefined`
+ * if no slot exists.
+ */
+function isSlotClosed(room: Pick<Room, "getLiveTimeline">, slotDescription: SlotDescription): boolean | undefined {
+    const content = getSlotEventContent(room, slotDescription) as Partial<RtcSlotEventContent> | undefined;
+    if (content === undefined) return undefined;
+
+    return (
+        content.status !== "open" ||
+        typeof content.application !== "object" ||
+        content.application?.type !== slotDescription.application
+    );
+}
+
 /**
  * Collects the raw member events from room state and sticky store.
  */
 function collectMembersEvents(
     room: Pick<Room, "getLiveTimeline" | "roomId" | "_unstable_getStickyEvents">,
+    slotDescription: SlotDescription,
     options: SessionMembershipsForSlotOpts,
     logger: Logger,
 ): MatrixEvent[] {
     const { listenForStickyEvents, listenForMemberStateEvents } = options;
     let callMemberEvents: MatrixEvent[] = [];
-    if (listenForStickyEvents) {
+    if (listenForStickyEvents && !isSlotClosed(room, slotDescription)) {
         // prefill with sticky events
         callMemberEvents = [...room._unstable_getStickyEvents()].filter((e) => e.getType() === EventType.RTCMembership);
     }

package/src/matrixrtc/MatrixRTCSessionManager.ts

@@ -22,7 +22,7 @@ import { RoomStateEvent } from "../models/room-state.ts";
 import { type MatrixEvent } from "../models/event.ts";
 import { MatrixRTCSession } from "./MatrixRTCSession.ts";
 import { EventType } from "../@types/event.ts";
-import { type SlotDescription } from "./types.ts";
+import { type RtcSlotEventContent, type SlotDescription } from "./types.ts";
 import { computeSlotId } from "./utils.ts";
 
 export enum MatrixRTCSessionManagerEvents {
@@ -98,6 +98,25 @@ export class MatrixRTCSessionManager extends TypedEventEmitter<MatrixRTCSessionM
         return this.roomSessions.get(room.roomId)!;
     }
 
+    /**
+     * Reads the current slot state event's content for the given room's session.
+     *
+     * @returns The slot event's content, or `undefined` if no slot event exists for the session.
+     */
+    public getRtcSlot(room: Room): RtcSlotEventContent | undefined {
+        return this.getRoomSession(room).getRtcSlot();
+    }
+
+    /**
+     * Whether the given room's slot is closed.
+     *
+     * @returns `true` if the slot is closed, `false` if the slot is open or `undefined`
+     * if no slot exists.
+     */
+    public isSlotClosed(room: Room): boolean | undefined {
+        return this.getRoomSession(room).isSlotClosed();
+    }
+
     /**
      * Gets the main MatrixRTC session for a room, returning an empty session
      * if no members are currently participating
@@ -129,7 +148,7 @@ export class MatrixRTCSessionManager extends TypedEventEmitter<MatrixRTCSessionM
     };
 
     private readonly onRoomState = (event: MatrixEvent): void => {
-        if (event.getType() !== EventType.GroupCallMemberPrefix) {
+        if (event.getType() !== EventType.GroupCallMemberPrefix && event.getType() !== EventType.RTCSlot) {
             return;
         }
         const room = this.client.getRoom(event.getRoomId());

package/src/matrixrtc/MembershipManager.ts

@@ -1111,11 +1111,14 @@ export class StickyEventMembershipManager extends MembershipManager {
                 ...(this.callIntent ? { "m.call.intent": this.callIntent } : {}),
             },
             slot_id: computeSlotId(this.slotDescription),
-            // Make sure we do not add the alias to the transport.
-            // It is not needed in matrix2.0. The additional session information will be used to find the right alias on the sfu.
-            rtc_transports: livekitTransport
-                ? [{ type: livekitTransport.type, livekit_service_url: livekitTransport.livekit_service_url }]
-                : [],
+            transports: {
+                // Make sure we do not add the alias to the transport.
+                // It is not needed in matrix2.0. The additional session information will be used to find the right alias on the sfu.
+                published: livekitTransport
+                    ? [{ type: livekitTransport.type, livekit_service_url: livekitTransport.livekit_service_url }]
+                    : [],
+                can_subscribe: ["livekit"],
+            },
             member: { device_id: this.deviceId, user_id: this.userId, id: this.memberId },
             versions: [],
             ...relationObject,

package/src/matrixrtc/index.ts

@@ -20,5 +20,5 @@ export * from "./MatrixRTCSession.ts";
 export * from "./MatrixRTCSessionManager.ts";
 export type * from "./types.ts";
 export { type SessionMembershipData, type RtcMembershipData } from "./membershipData/index.ts";
-export { Status, parseCallNotificationContent, isMyMembership } from "./types.ts";
+export { Status, parseCallNotificationContent, isMyMembership, RTC_SLOT_ENCRYPTION_PER_MEMBER } from "./types.ts";
 export { MembershipManagerEvent } from "./IMembershipManager.ts";

package/src/matrixrtc/membershipData/rtc.ts

@@ -17,7 +17,7 @@ limitations under the License.
 import { MXID_PATTERN } from "../../models/room-member.ts";
 import type { IContent } from "../../models/event.ts";
 import type { RelationType } from "../../types.ts";
-import { type RtcSlotEventContent, type Transport } from "../types.ts";
+import { type RtcSlotApplicationContent, type Transport } from "../types.ts";
 import { MatrixRTCMembershipParseError } from "./common.ts";
 import { sha256 } from "../../digest.ts";
 import { encodeUnpaddedBase64 } from "../../base64.ts";
@@ -37,8 +37,11 @@ export interface RtcMembershipData {
         event_id: string;
         rel_type: RelationType.Reference;
     };
-    "application": RtcSlotEventContent["application"];
-    "rtc_transports": Transport[];
+    "application": RtcSlotApplicationContent;
+    "transports": {
+        published: Transport[];
+        can_subscribe: string[];
+    };
     "versions": string[];
     "msc4354_sticky_key"?: string;
     "sticky_key"?: string;
@@ -97,17 +100,25 @@ export const checkRtcMembershipData = (data: IContent, sender: string): data is
             if (data.application.type.includes("#")) errors.push(prefix + 'application.type must not include "#"');
         }
     }
-    if (data.rtc_transports === undefined || !Array.isArray(data.rtc_transports)) {
-        errors.push(prefix + "rtc_transports must be an array");
+    if (typeof data.transports !== "object" || data.transports === null || !Array.isArray(data.transports.published)) {
+        errors.push(prefix + "transports.published must be an array");
     } else {
         // validate that each transport has at least a string 'type'
-        for (const t of data.rtc_transports) {
+        for (const t of data.transports.published) {
             if (typeof t !== "object" || t === null || typeof (t as any).type !== "string") {
-                errors.push(prefix + "rtc_transports entries must be objects with a string type");
+                errors.push(prefix + "transports.published entries must be objects with a string type");
                 break;
             }
         }
     }
+    if (
+        typeof data.transports !== "object" ||
+        data.transports === null ||
+        !Array.isArray(data.transports.can_subscribe) ||
+        !data.transports.can_subscribe.every((t: unknown) => typeof t === "string")
+    ) {
+        errors.push(prefix + "transports.can_subscribe must be an array of strings");
+    }
     if (data.versions === undefined || !Array.isArray(data.versions)) {
         errors.push(prefix + "versions must be an array");
     } else if (!data.versions.every((v) => typeof v === "string")) {

package/src/matrixrtc/types.ts

@@ -201,15 +201,32 @@ export interface Transport {
 }
 
 /**
- * Event content for a `m.rtc.slot` state event.
+ * Event content for `org.matrix.msc4143.rtc.slot` state events.
  */
 export interface RtcSlotEventContent<T extends string = string> {
-    application: {
-        type: T;
-        // other application specific keys
-        [key: string]: unknown;
-    };
-    slot_id: string;
+    status: "open" | "closed";
+    application?: RtcSlotApplicationContent<T>;
+    encryption?: RtcSlotEncryptionContent;
+}
+
+/**
+ * Content of the `application` object within `org.matrix.msc4143.rtc.slot` events.
+ */
+export interface RtcSlotApplicationContent<T extends string = string> {
+    type: T;
+    // Other application specific keys.
+    [key: string]: unknown;
+}
+
+export const RTC_SLOT_ENCRYPTION_PER_MEMBER = "org.matrix.msc4143.per_member";
+
+/**
+ * Content of the `encryption` object within `org.matrix.msc4143.rtc.slot` events.
+ */
+export interface RtcSlotEncryptionContent {
+    type: typeof RTC_SLOT_ENCRYPTION_PER_MEMBER;
+    // Other encryption-mechanism specific keys.
+    [key: string]: unknown;
 }
 
 /**

package/src/models/event.ts

@@ -50,7 +50,6 @@ import { type EmptyObject } from "../@types/common.ts";
 
 export { EventStatus } from "./event-status.ts";
 
-/* eslint-disable camelcase */
 export interface IContent {
     [key: string]: any;
     "msgtype"?: MsgType | string;
@@ -165,7 +164,6 @@ export interface IClearEvent {
     content: Omit<IContent, "membership" | "avatar_url" | "displayname" | "m.relates_to">;
     unsigned?: IUnsigned;
 }
-/* eslint-enable camelcase */
 
 interface IKeyRequestRecipient {
     userId: string;
@@ -938,7 +936,6 @@ export class MatrixEvent extends TypedEventEmitter<MatrixEventEmittedEvents, Mat
         // `decryptionPromise`).
         await Promise.resolve();
 
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             this.retryDecryption = false;
 

package/src/models/room-state.ts

@@ -62,11 +62,8 @@ export interface IPowerLevelsContent {
     users?: Record<string, number>;
     events?: Record<string, number>;
     notifications?: Partial<Record<"room", number>>;
-    // eslint-disable-next-line camelcase
     users_default?: number;
-    // eslint-disable-next-line camelcase
     events_default?: number;
-    // eslint-disable-next-line camelcase
     state_default?: number;
     ban?: number;
     invite?: number;

package/src/models/room.ts

@@ -640,7 +640,9 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         let capabilities: Capabilities = {};
         try {
             capabilities = await this.client.getCapabilities();
-        } catch {}
+        } catch {
+            // Ignore errors - we'll just use the default safe room version
+        }
         let versionCap = capabilities["m.room_versions"];
         if (!versionCap) {
             versionCap = {
@@ -2276,7 +2278,9 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 event.once(MatrixEventEvent.BeforeRedaction, (redactedEvent: MatrixEvent) => {
                     this.polls.delete(redactedEvent.getId()!);
                 });
-            } catch {}
+            } catch {
+                // Do nothing
+            }
             // poll creation can fail for malformed poll start events
             return;
         }
@@ -3444,7 +3448,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     /**
      * Get an iterator of currently active sticky events.
      */
-    // eslint-disable-next-line
     public _unstable_getStickyEvents(): ReturnType<RoomStickyEventsStore["getStickyEvents"]> {
         return this.stickyEvents.getStickyEvents();
     }
@@ -3456,7 +3459,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param stickyKey The sticky key used by the event.
      * @returns A matching active sticky event, or undefined.
      */
-    // eslint-disable-next-line
     public _unstable_getKeyedStickyEvent(
         sender: string,
         type: string,
@@ -3471,7 +3473,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param sender The sender of the sticky event.
      * @returns An array of matching sticky events.
      */
-    // eslint-disable-next-line
     public _unstable_getUnkeyedStickyEvent(
         sender: string,
         type: string,
@@ -3485,7 +3486,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param events A set of new sticky events.
      * @internal
      */
-    // eslint-disable-next-line
     public _unstable_addStickyEvents(events: MatrixEvent[]): ReturnType<RoomStickyEventsStore["addStickyEvents"]> {
         // ALWAYS filter out any events that are past retention
         events = events.filter((e) => this.retention?.shouldEventBeRetained(e) ?? true);

package/src/models/thread.ts

@@ -914,8 +914,8 @@ export const FILTER_RELATED_BY_REL_TYPES = new ServerControlledNamespacedValue(
 export const THREAD_RELATION_TYPE = new ServerControlledNamespacedValue("m.thread", "io.element.thread");
 
 export enum ThreadFilterType {
-    "My",
-    "All",
+    My,
+    All,
 }
 
 export function threadFilterTypeToFilter(type: ThreadFilterType | null): "all" | "participated" {

package/src/realtime-callbacks.ts

@@ -140,7 +140,6 @@ function runCallbacks(): void {
 
     // get the list of things to call
     const callbacksToRun: Callback[] = [];
-    // eslint-disable-next-line
     while (true) {
         const first = callbackList[0];
         if (!first || first.runAt > timestamp) {

package/src/rendezvous/transports/MSC4108RendezvousSession.ts

@@ -181,7 +181,6 @@ export class MSC4108RendezvousSession {
         if (!this.url) {
             throw new Error("Rendezvous not set up");
         }
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             if (this._cancelled) {
                 return undefined;

package/src/rust-crypto/OutgoingRequestProcessor.ts

@@ -190,7 +190,6 @@ export class OutgoingRequestProcessor {
     ): Promise<string> {
         let currentRetryCount = 0;
 
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             try {
                 return await this.rawJsonRequest(method, path, queryParams, body);

package/src/rust-crypto/backup.ts

@@ -27,6 +27,7 @@ import {
     type KeyBackupRestoreOpts,
     type KeyBackupRestoreResult,
     type KeyBackupRoomSessions,
+    type NewKeyBackupInfo,
 } from "../crypto-api/keybackup.ts";
 import { type Logger } from "../logger.ts";
 import { ClientPrefix, type IHttpOpts, MatrixError, type MatrixHttpApi, Method } from "../http-api/index.ts";
@@ -325,11 +326,6 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
             return null;
         }
         this.checkedForBackup = true;
-
-        if (backupInfo && !backupInfo.version) {
-            this.logger.warn("active backup lacks a useful 'version'; ignoring it");
-            backupInfo = undefined;
-        }
         this.serverBackupInfo = backupInfo;
 
         const activeVersion = await this.getActiveBackupVersion();
@@ -356,34 +352,51 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
                 this.logger.debug("Key backup present on server but not trusted: not enabling key backup");
             }
         } else {
-            if (activeVersion === null) {
-                this.logger.debug(`Found usable key backup v${backupInfo.version}: enabling key backups`);
-                await this.enableKeyBackup(backupInfo);
-            } else if (activeVersion !== backupInfo.version) {
-                this.logger.debug(
-                    `On backup version ${activeVersion} but found version ${backupInfo.version}: switching.`,
-                );
-                // This will remove any pending backup request, remove the backup key and reset the backup state of each room key we have.
-                await this.disableKeyBackup();
-                // Enabling will now trigger re-upload of all the keys
-                await this.enableKeyBackup(backupInfo);
-            } else {
-                this.logger.debug(`Backup version ${backupInfo.version} still current`);
-            }
+            await this.enableOrSwitchKeyBackup(backupInfo, activeVersion);
         }
         return { backupInfo, trustInfo };
     }
 
+    /**
+     * Enable key backup upload for the given backup version, if it is not already.
+     *
+     * If backup is currently enabled for a different version, disables it first.
+     *
+     * Also emits one or more {@link CryptoEvent.KeyBackupStatus} events if the backup status changes.
+     *
+     * @param backupInfo - the desired backup version (and the encryption key).
+     * @param activeVersion - the current active backup version (or `null`, if none).
+     */
+    private async enableOrSwitchKeyBackup(backupInfo: KeyBackupInfo, activeVersion: string | null): Promise<void> {
+        if (activeVersion === null) {
+            this.logger.debug(`Found usable key backup v${backupInfo.version}: enabling key backups`);
+            await this.enableKeyBackup(backupInfo);
+        } else if (activeVersion !== backupInfo.version) {
+            this.logger.debug(`On backup version ${activeVersion} but found version ${backupInfo.version}: switching.`);
+            // This will remove any pending backup request, remove the backup upload key from the OlmMachine and reset
+            // the backup state of each room key we have.
+            await this.disableKeyBackup();
+            // Enabling will now trigger re-upload of all the keys
+            await this.enableKeyBackup(backupInfo);
+        } else {
+            this.logger.debug(`Backup version ${backupInfo.version} still current`);
+        }
+    }
+
+    /**
+     * Helper for {@link enableOrSwitchKeyBackup}.
+     *
+     * Enables key backup upload for the given backup version. Also emits
+     * a {@link CryptoEvent.KeyBackupStatus} event.
+     */
     private async enableKeyBackup(backupInfo: KeyBackupInfo): Promise<void> {
         // we know for certain it must be a Curve25519 key, because we have verified it and only Curve25519
         // keys can be verified.
-        //
-        // we also checked it has a valid `version`.
         await this.olmMachine.enableBackupV1(
             (backupInfo.auth_data as Curve25519AuthData).public_key,
-            backupInfo.version!,
+            backupInfo.version,
         );
-        this.activeBackupVersion = backupInfo.version!;
+        this.activeBackupVersion = backupInfo.version;
 
         this.emit(CryptoEvent.KeyBackupStatus, true);
 
@@ -560,16 +573,24 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
     }
 
     /**
-     * Creates a new key backup by generating a new random private key.
+     * Creates a new key backup by generating a new random private key, and then enable key backup upload and download
+     * using the new backup version.
      *
      * If there is an existing backup server side it will be deleted and replaced
      * by the new one.
      *
+     * Saves the decryption key in the Rust SDK's CryptoStore.
+     *
      * @param signObject - Method that should sign the backup with existing device and
      * existing identity.
      * @returns a KeyBackupCreationInfo - All information related to the backup.
      */
     public async setupKeyBackup(signObject: (authData: AuthData) => Promise<void>): Promise<KeyBackupCreationInfo> {
+        // Wait for any active call to `checkKeyBackupAndEnable` to complete, to avoid racing with it
+        if (this.keyBackupCheckInProgress) {
+            await this.keyBackupCheckInProgress;
+        }
+
         // Clean up any existing backup
         await this.deleteAllKeyBackupVersions();
 
@@ -580,19 +601,36 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
 
         await signObject(authData);
 
+        const backupData: NewKeyBackupInfo = {
+            algorithm: pubKey.algorithm,
+            auth_data: authData,
+        };
+
         const res = await this.http.authedRequest<{ version: string }>(
             Method.Post,
             "/room_keys/version",
             undefined,
-            {
-                algorithm: pubKey.algorithm,
-                auth_data: authData,
-            },
+            backupData,
             {
                 prefix: ClientPrefix.V3,
             },
         );
 
+        // This backup was just created and signed locally, so use the creation response to make up a full
+        // `KeyBackupInfo` struct representing the new backup, instead of doing another discovery/trust check.
+        const backupInfo: KeyBackupInfo = {
+            algorithm: pubKey.algorithm,
+            auth_data: authData,
+            version: res.version,
+            count: 0,
+            etag: "", // we never actually use the etag, so we can just make up a value
+        };
+
+        // saveBackupDecryptionKey emits KeyBackupDecryptionKeyCached. Cache and
+        // enable the created backup first so listeners observe the new version.
+        this.serverBackupInfo = backupInfo;
+        this.checkedForBackup = true;
+        await this.enableOrSwitchKeyBackup(backupInfo, await this.getActiveBackupVersion());
         await this.saveBackupDecryptionKey(randomKey, res.version);
 
         return {

package/src/rust-crypto/device-converter.ts

@@ -111,6 +111,7 @@ export function downloadDeviceToJsDevice(device: QueryDevice): Device {
 
     const signatures = new Map<string, Map<string, string>>();
     if (device.signatures) {
+        // oxlint-disable-next-line guard-for-in
         for (const userId in device.signatures) {
             signatures.set(userId, new Map(Object.entries(device.signatures[userId])));
         }

package/src/rust-crypto/index.ts

@@ -96,6 +96,14 @@ export async function initRustCrypto(args: {
      * Whether to enable support for encrypting state events.
      */
     enableEncryptedStateEvents?: boolean;
+
+    /**
+     * Optional PEM-formatted string that provides CA certificates. These will
+     * be used to check X.509 signatures on user identities. Any user identity
+     * that has a valid signature according to the supplied CAs will be
+     * considered verified, without any manual verification taking place.
+     */
+    caCertsPem?: string;
 }): Promise<RustCrypto> {
     const { logger } = args;
 
@@ -134,6 +142,7 @@ export async function initRustCrypto(args: {
         storeHandle,
         args.legacyCryptoStore,
         args.enableEncryptedStateEvents,
+        args.caCertsPem,
     );
 
     storeHandle.free();
@@ -152,6 +161,7 @@ async function initOlmMachine(
     storeHandle: StoreHandle,
     legacyCryptoStore?: CryptoStore,
     enableEncryptedStateEvents?: boolean,
+    caCertsPem?: string,
 ): Promise<RustCrypto> {
     logger.debug("Init OlmMachine");
 
@@ -160,6 +170,7 @@ async function initOlmMachine(
         new RustSdkCryptoJs.DeviceId(deviceId),
         storeHandle,
         logger,
+        caCertsPem,
     );
 
     // A final migration step, now that we have an OlmMachine.

package/src/rust-crypto/libolm_migration.ts

@@ -251,7 +251,6 @@ async function migrateOlmSessions(
     storeHandle: RustSdkCryptoJs.StoreHandle,
     onBatchDone: (batchSize: number) => void,
 ): Promise<void> {
-    // eslint-disable-next-line no-constant-condition
     while (true) {
         const batch = await legacyStore.getEndToEndSessionsBatch();
         if (batch === null) return;
@@ -279,7 +278,6 @@ async function migrateMegolmSessions(
     storeHandle: RustSdkCryptoJs.StoreHandle,
     onBatchDone: (batchSize: number) => void,
 ): Promise<void> {
-    // eslint-disable-next-line no-constant-condition
     while (true) {
         const batch = await legacyStore.getEndToEndInboundGroupSessionsBatch();
         if (batch === null) return;

package/src/rust-crypto/rust-crypto.ts

@@ -1407,9 +1407,6 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, CryptoEventH
         if (await this.secretStorageHasAESKey()) {
             await this.secretStorage.store("m.megolm_backup.v1", backupInfo.decryptionKey.toBase64());
         }
-
-        // we can check and start async
-        void this.checkKeyBackupAndEnable();
     }
 
     /**