matrix-js-sdk 43.0.0 → 44.0.0

package/src/models/room.ts

@@ -2253,7 +2253,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     /**
      * Processes poll events:
      * If the event has a decryption failure, it will listen for decryption and tries again.
-     * If it is a poll start event (`m.poll.start`),
+     * If it is a poll start event (`m.poll.start`) for a poll not yet known to the room,
      * it creates and stores a Poll model and emits a PollEvent.New event.
      * If the event is related to a poll, it will add it to the poll.
      * Noop for other cases.
@@ -2269,6 +2269,10 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         }
 
         if (M_POLL_START.matches(event.getType())) {
+            // Check that we don't already have the poll as events can arrive more than once
+            // in some situations. If we add the poll twice, it will break the existing poll model.
+            if (this.polls.has(event.getId()!)) return;
+
             try {
                 const poll = new Poll(event, this.client, this);
                 this.polls.set(event.getId()!, poll);
@@ -3132,7 +3136,9 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 threadId = "",
             } = this.eventShouldLiveIn(event, neighbouringEvents, threadRoots);
 
-            if (!shouldLiveInThread && !shouldLiveInRoom && event.isRelation()) {
+            // Cached relations are aggregated below and attach when their parent is later hydrated.
+            // Avoid blocking offline startup on a parent fetch.
+            if (!fromCache && !shouldLiveInThread && !shouldLiveInRoom && event.isRelation()) {
                 try {
                     const parentEvent = new MatrixEvent(
                         await this.client.fetchRoomEvent(this.roomId, event.relationEventId!),

package/src/models/thread.ts

@@ -68,6 +68,28 @@ export function determineFeatureSupport(stable: boolean, unstable: boolean): Fea
     }
 }
 
+/**
+ * Cap on how many threads fetch their initial events at the same time. Each fetch is a (recursive) `/relations`
+ * request, and opening a thread list creates every thread in the room at once; without a cap a room with dozens
+ * of threads fires dozens of concurrent heavy requests, which can starve everything else the homeserver worker is doing.
+ */
+const MAX_CONCURRENT_INITIAL_FETCHES = 3;
+let runningInitialFetches = 0;
+const waitingInitialFetches: (() => void)[] = [];
+
+async function withInitialFetchSlot<T>(fn: () => Promise<T>): Promise<T> {
+    if (runningInitialFetches >= MAX_CONCURRENT_INITIAL_FETCHES) {
+        await new Promise<void>((resolve) => waitingInitialFetches.push(resolve));
+    }
+    runningInitialFetches++;
+    try {
+        return await fn();
+    } finally {
+        runningInitialFetches--;
+        waitingInitialFetches.shift()?.();
+    }
+}
+
 export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerMap> {
     public static hasServerSideSupport = FeatureSupport.None;
     public static hasServerSideListSupport = FeatureSupport.None;
@@ -679,9 +701,9 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
                         this.timelineSet.addEventsToTimeline([this.rootEvent], true, false, this.liveTimeline, null);
                         this.liveTimeline.setPaginationToken(null, Direction.Backward);
                     } else {
-                        this.initalEventFetchProm = this.client.paginateEventTimeline(this.liveTimeline, {
-                            backwards: true,
-                        });
+                        this.initalEventFetchProm = withInitialFetchSlot(() =>
+                            this.client.paginateEventTimeline(this.liveTimeline, { backwards: true }),
+                        );
                         await this.initalEventFetchProm;
                     }
                     // We have now fetched the initial events, so set the flag. We need to do this before

package/src/rendezvous/MSC4108SignInWithQR.ts

@@ -36,7 +36,7 @@ import {
     type ValidatedAuthMetadata,
     waitForDeviceAuthorization,
 } from "../oauth/index.ts";
-import { type CryptoApi } from "../crypto-api/index.ts";
+import { type SignInWithQRSecrets, type SignInWithQRFlow } from "./SignInWithQRFlow.ts";
 
 /**
  * Enum representing the payload types transmissible over [MSC4108](https://github.com/matrix-org/matrix-spec-proposals/pull/4108)
@@ -106,7 +106,7 @@ interface AcceptedPayload extends MSC4108Payload {
     type: PayloadType.ProtocolAccepted;
 }
 
-interface SecretsPayload extends MSC4108Payload, Awaited<ReturnType<NonNullable<CryptoApi["exportSecretsBundle"]>>> {
+interface SecretsPayload extends MSC4108Payload, SignInWithQRSecrets {
     type: PayloadType.Secrets;
 }
 
@@ -115,7 +115,7 @@ interface SecretsPayload extends MSC4108Payload, Awaited<ReturnType<NonNullable<
  * sign in with QR + OAuth2 flow.
  * @experimental Note that this is UNSTABLE and may have breaking changes without notice.
  */
-export class MSC4108SignInWithQR {
+export class MSC4108SignInWithQR implements SignInWithQRFlow {
     private readonly ourIntent: QrCodeIntent;
     private _code?: Uint8Array;
     private expectingNewDeviceId?: string;

package/src/rendezvous/SignInWithQRFlow.ts

@@ -0,0 +1,117 @@
+/*
+Copyright 2026 Element Creations Ltd.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import {
+    type ClientRendezvousFailureReason,
+    type MSC4108FailureReason,
+    type RendezvousFailureListener,
+} from "./RendezvousFailureReason.ts";
+import { type DeviceAccessTokenResponse, type ValidatedAuthMetadata } from "../oauth/index.ts";
+import type { SecretsBundleJson } from "../@types/matrix-sdk-crypto-wasm.d.ts";
+
+/**
+ * The secrets bundle shared from the existing device to the new device.
+ * @experimental Note that this is UNSTABLE and may have breaking changes without notice.
+ */
+export type { SecretsBundleJson as SignInWithQRSecrets } from "../@types/matrix-sdk-crypto-wasm.d.ts";
+
+/**
+ * Common interface for the sign in with QR + OAuth2 flows, e.g. the 2024 and 2025 versions of
+ * [MSC4108](https://github.com/matrix-org/matrix-spec-proposals/pull/4108).
+ * @experimental Note that this is UNSTABLE and may have breaking changes without notice.
+ */
+export interface SignInWithQRFlow {
+    /**
+     * Callback for when the rendezvous fails.
+     */
+    onFailure?: RendezvousFailureListener;
+
+    /**
+     * Returns the check code for the secure channel or undefined if not generated yet.
+     */
+    readonly checkCode: string | undefined;
+
+    /**
+     * Returns the code representing the rendezvous suitable for rendering in a QR code or undefined if not generated yet.
+     */
+    readonly code: Uint8Array | undefined;
+
+    /**
+     * Returns true if the device is the already logged in device reciprocating a new login on the other side of the channel.
+     */
+    readonly isExistingDevice: boolean;
+
+    /**
+     * Returns true if the device is the new device logging in being reciprocated by the device on the other side of the channel.
+     */
+    readonly isNewDevice: boolean;
+
+    /**
+     * Generate the code including doing partial set up of the channel where required.
+     */
+    generateCode(): Promise<void>;
+
+    /**
+     * The first step in the OAuth2 QR login process.
+     * To be called after the QR code has been rendered or scanned.
+     * The scanning device has to discover the homeserver details, if they scanned the code then they already have it.
+     * If the new device is the one rendering the QR code then it has to wait be sent the homeserver details via the rendezvous channel.
+     *
+     * Depending on the version of the flow, the homeserver is identified either by `serverName` or `baseUrl`.
+     */
+    negotiateProtocols(): Promise<{ serverName?: string; baseUrl?: string }>;
+
+    /**
+     * The second & third step in the OAuth2 QR login process.
+     * To be called after `negotiateProtocols` for the existing device.
+     * To be called after OAuth2 negotiation for the new device.
+     *
+     * @param input - Required for the new device to start the device authorization grant, not required for the existing device reciprocating the login
+     */
+    deviceAuthorizationGrant(input?: { metadata: ValidatedAuthMetadata; clientId: string; deviceId: string }): Promise<{
+        verificationUri?: string;
+        userCode?: string;
+    }>;
+
+    /**
+     * The fourth step in the OAuth2 QR login process.
+     * The reciprocating device must perform step 5 for this method to resolve.
+     * To be called after {@link deviceAuthorizationGrant} only on the new device.
+     */
+    completeLoginOnNewDevice(input: { clientId: string }): Promise<DeviceAccessTokenResponse | undefined>;
+
+    /**
+     * The fifth (and final) step in the OAuth2 QR login process.
+     * To be called after the new device has completed authentication.
+     */
+    shareSecrets(): Promise<{ secrets?: SecretsBundleJson }>;
+
+    /**
+     * Decline the login on the existing device.
+     */
+    declineLoginOnExistingDevice(): Promise<void>;
+
+    /**
+     * Cancels the rendezvous session.
+     * @param reason the reason for the cancellation
+     */
+    cancel(reason: MSC4108FailureReason | ClientRendezvousFailureReason): Promise<void>;
+
+    /**
+     * Closes the rendezvous session.
+     */
+    close(): Promise<void>;
+}

package/src/rendezvous/index.ts

@@ -23,6 +23,7 @@ import { RendezvousIntent } from "./RendezvousIntent.ts";
 import { logger } from "../logger.ts";
 
 export * from "./MSC4108SignInWithQR.ts";
+export type * from "./SignInWithQRFlow.ts";
 export type * from "./RendezvousChannel.ts";
 export type * from "./RendezvousCode.ts";
 export * from "./RendezvousError.ts";

package/src/rust-crypto/index.ts

@@ -286,7 +286,11 @@ async function initOlmMachine(
             logger.info(
                 `Checking for pending key bundle for recently-joined room ${roomId} (joined ${new Date(pendingDetails.inviteAcceptedAtMillis).toISOString()})`,
             );
-            await rustCrypto.maybeAcceptKeyBundle(roomId, pendingDetails.inviterId.toString());
+            // Launch `maybeAcceptKeyBundle` without awaiting it so it cannot block crypto initialisation.
+            // Failed or interrupted key queries/downloads leave the pending marker for a later startup to retry.
+            rustCrypto.maybeAcceptKeyBundle(roomId, pendingDetails.inviterId.toString()).catch((err) => {
+                logger.error("Error attempting to download a pending room key bundle", err);
+            });
         } else {
             logger.info(
                 `Clearing pending-key-bundle flag for room ${roomId} (too old: joined ${new Date(pendingDetails.inviteAcceptedAtMillis).toISOString()})`,