whalibmob 5.14.2 → 5.14.3

package/lib/Client.js

@@ -2449,50 +2449,9 @@ class WhalibmobClient extends EventEmitter {
       : fromStr;
     const recipientPhone = targetJid.split('@')[0].split(':')[0].split('.')[0];
 
-    // The retry names the device under one address family, but a contact holds
-    // a session under each: a Signal address is (user, device) with the server
-    // stripped, and the LID user and the phone user are different strings, so
-    // one session is not reachable under the other's name. Purging only the
-    // family the receipt happened to arrive in left the other one in place —
-    // the resend picked it straight back up and produced the same ciphertext
-    // the device had just said it could not read, so the message stayed
-    // undecryptable until something else rebuilt the session.
-    //
-    // This is what made a reply sent after a companion-device exchange stick on
-    // "Waiting for this message" on the primary: the receipt came in one family,
-    // the stale session sat in the other, and every resend re-used it.
-    const recipientUsers = new Set([recipientPhone]);
-    const mappedPn  = this._lidToPn && this._lidToPn.get(recipientPhone);
-    const mappedLid = this._pnToLid && this._pnToLid.get(recipientPhone);
-    if (mappedPn)  recipientUsers.add(mappedPn);
-    if (mappedLid) recipientUsers.add(mappedLid);
-
     _whaDbg('[DBG] RETRY_RECV msgId=' + msgId + ' from=' + fromStr +
-      ' users=[' + [...recipientUsers].join(',') + '] — clearing session + resending\n');
-
-    // Delete all Signal sessions for the recipient's devices so next send creates fresh pkmsg
-    const sigStore = this._signal && this._signal.store;
-    if (sigStore && sigStore._sessions) {
-      const sessions = sigStore._sessions;
-      Object.keys(sessions).forEach(addr => {
-        // Match on the user segment rather than a bare prefix: "4071.0" must
-        // not be cleared by a retry for "407".
-        const user = addr.slice(0, addr.lastIndexOf('.'));
-        if (recipientUsers.has(user)) {
-          _whaDbg('[DBG] RETRY deleting session for ' + addr);
-          delete sessions[addr];
-        }
-      });
-    }
-
-    // Clear device manager cache so we re-fetch devices on next send. LID device
-    // lists are filed under a "lid:" key, so clearing the bare user only ever
-    // dropped the phone-side list.
-    if (this._devMgr) {
-      const cacheKeys = [];
-      for (const u of recipientUsers) cacheKeys.push(u, 'lid:' + u);
-      this._devMgr.clearCache(cacheKeys);
-    }
+      ' — clearing session + resending\n');
+    this._purgeContactSessions(recipientPhone, 'RETRY');
 
     // Re-send the message — will create fresh pre-key (pkmsg) sessions.
     // A group resend must go back through the group path: it needs a fresh
@@ -2740,6 +2699,59 @@ class WhalibmobClient extends EventEmitter {
     this._retryPending.delete(msgId);
   }
 
+  // Drop every Signal session and cached device list a contact owns, so the
+  // next send to them has to fetch a prekey bundle and open a fresh session.
+  //
+  // A contact holds a session under each address family: a Signal address is
+  // (user, device) with the server stripped, and the LID user and the phone
+  // user are different strings, so one session is not reachable under the
+  // other's name. Clearing only the family whose name happened to be at hand
+  // leaves the other in place, and the next send picks it straight back up —
+  // which is how a message stayed undecryptable on a device that had already
+  // said it could not read it.
+  //
+  // Device lists are filed the same way, LID ones under a "lid:" key, so both
+  // spellings of both users have to go.
+  //
+  // Returns the set of users it resolved, for callers that want to log it.
+  _purgeContactSessions(user, tag) {
+    const label = tag || 'PURGE';
+    const users = new Set([String(user)]);
+    const mappedPn  = this._lidToPn && this._lidToPn.get(user);
+    const mappedLid = this._pnToLid && this._pnToLid.get(user);
+    if (mappedPn)  users.add(mappedPn);
+    if (mappedLid) users.add(mappedLid);
+
+    const sigStore = this._signal && this._signal.store;
+    if (sigStore && sigStore._sessions) {
+      const sessions = sigStore._sessions;
+      for (const addr of Object.keys(sessions)) {
+        // Match on the address's user segment rather than a bare string
+        // prefix: a purge for "407" must not take "4071.0" with it.
+        const addrUser = addr.slice(0, addr.lastIndexOf('.'));
+        if (users.has(addrUser)) {
+          _whaDbg('[DBG] ' + label + ' deleting session for ' + addr);
+          // Through the store rather than off the object it hands back: a bare
+          // `delete` leaves the file alone and the store unmarked, so nothing
+          // is written on the way out and a restart loads every purged session
+          // straight back — the one case the purge exists to prevent. Not
+          // awaited on purpose; the method's body is synchronous, so the
+          // delete and the save have both happened by the time it returns.
+          sigStore.deleteSession(addr);
+        }
+      }
+    }
+
+    if (this._devMgr) {
+      const cacheKeys = [];
+      for (const u of users) cacheKeys.push(u, 'lid:' + u);
+      this._devMgr.clearCache(cacheKeys);
+    }
+
+    _whaDbg('[DBG] ' + label + ' purged users=[' + [...users].join(',') + ']');
+    return users;
+  }
+
   // Hold a sent message's plaintext so a retry receipt naming it can be
   // answered. Both send paths file their entry here so the bound lives in one
   // place instead of being repeated as a literal at each call site.
@@ -2972,23 +2984,16 @@ class WhalibmobClient extends EventEmitter {
     }
 
     if (type === 'identity') {
-      // Server push: a contact re-registered WhatsApp (new identity key / new phone).
-      // Their old Signal sessions are no longer valid — clear them and the device
-      // cache so the next send builds a fresh pkmsg session from scratch.
+      // Server push: a contact re-registered WhatsApp (new identity key / new
+      // phone). Every session we hold with them is anchored in an identity key
+      // that no longer exists, so all of them have to go — under both the
+      // number and the LID, or the next send reaches for the survivor and the
+      // contact receives ciphertext nothing on their side can open. A retry
+      // receipt cannot rescue that: the session is not stale, it is dead.
       const fromJid   = String(attrs.from || '');
       const fromPhone = fromJid.split('@')[0].split(':')[0];
-      if (fromPhone && this._devMgr) {
-        this._devMgr._dcDel([fromPhone]);
-        _whaDbg('[DBG] NOTIF_IDENTITY flushed device cache for re-registered ' + fromPhone);
-      }
-      if (fromPhone && this._signal && this._signal.store && this._signal.store._sessions) {
-        const sessions = this._signal.store._sessions;
-        let cleared = 0;
-        for (const addr of Object.keys(sessions)) {
-          if (addr.startsWith(fromPhone + '.')) { delete sessions[addr]; cleared++; }
-        }
-        _whaDbg('[DBG] NOTIF_IDENTITY cleared ' + cleared + ' Signal sessions for ' + fromPhone);
-      }
+      if (fromPhone) this._purgeContactSessions(fromPhone, 'NOTIF_IDENTITY');
+      this.emit('identity_change', { jid: fromJid, user: fromPhone });
     }
 
     // Ack the notification

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.14.2",
+  "version": "5.14.3",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API and web ",
   "author": "Kunboruto20",
   "main": "index.js",