Page MenuHomePhabricator
Differential D12298

[terraform] mariadb on aws
ClosedPublic
Actions

Authored by will on Jun 3 2024, 8:13 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Mar 11, 3:38 PM
Unknown Object (File)
Tue, Mar 11, 2:42 AM
Unknown Object (File)
Feb 26 2025, 8:41 AM
Unknown Object (File)
Feb 26 2025, 6:24 AM
Unknown Object (File)
Feb 26 2025, 6:24 AM
Unknown Object (File)
Feb 26 2025, 6:24 AM
Unknown Object (File)
Feb 25 2025, 1:22 PM
Unknown Object (File)
Feb 24 2025, 3:07 PM
View All 94 Files
Subscribers
ashoat
tomek

Details

Reviewers
bartek
varun
Commits
rCOMM34aeee96902c: [terraform] mariadb on aws
Summary

Sets up a mariadb instance within a vpc.

Depends on D12297

Test Plan

terraform apply. Still testing uploading local keyserver data to the mariadb instance. Will not land until properly tested

Diff Detail

Repository
rCOMM Comm
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
services/
terraform/
self-host/
44 lines
10 lines

Diff 40996

View Options

services/terraform/self-host/aws_db.tf

// @flow // @flow
import olm from '@commapp/olm'; import olm from '@commapp/olm';
import type { EncryptResult } from '@commapp/olm'; import type { EncryptResult } from '@commapp/olm';
import invariant from 'invariant'; import invariant from 'invariant';
import localforage from 'localforage'; import localforage from 'localforage';
import uuid from 'uuid'; import uuid from 'uuid';
import { import {
olmEncryptedMessageTypes, olmEncryptedMessageTypes,
type NotificationsOlmDataType, type NotificationsOlmDataType,
type PickledOLMAccount, type PickledOLMAccount,
} from 'lib/types/crypto-types.js'; } from 'lib/types/crypto-types.js';
import type { import type {
PlainTextWebNotification, PlainTextWebNotification,
EncryptedWebNotification, EncryptedWebNotification,
SenderDeviceDescriptor,
} from 'lib/types/notif-types.js'; } from 'lib/types/notif-types.js';
import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js'; import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';
import { getMessageForException } from 'lib/utils/errors.js'; import { getMessageForException } from 'lib/utils/errors.js';
import { promiseAll } from 'lib/utils/promises.js'; import { promiseAll } from 'lib/utils/promises.js';
import { assertWithValidator } from 'lib/utils/validation-utils.js'; import { assertWithValidator } from 'lib/utils/validation-utils.js';
import { import {
fetchAuthMetadata,
getNotifsInboundKeysForDeviceID,
} from './services-client.js';
import {
type EncryptedData, type EncryptedData,
decryptData, decryptData,
encryptData, encryptData,
importJWKKey, importJWKKey,
exportKeyToJWK, exportKeyToJWK,
generateCryptoKey, generateCryptoKey,
encryptedAESDataValidator, encryptedAESDataValidator,
extendedCryptoKeyValidator, extendedCryptoKeyValidator,
▲ Show 20 Lines • Show All 55 Lines • ▼ Show 20 Linesasync function deserializeEncryptedData<T>(
encryptedData: EncryptedData, encryptedData: EncryptedData,
encryptionKey: CryptoKey, encryptionKey: CryptoKey,
): Promise<T> { ): Promise<T> {
const serializedData = await decryptData(encryptedData, encryptionKey); const serializedData = await decryptData(encryptedData, encryptionKey);
const data: T = JSON.parse(new TextDecoder().decode(serializedData)); const data: T = JSON.parse(new TextDecoder().decode(serializedData));
return data; return data;
} }
async function deserializeEncryptedDataOptional<T>(
encryptedData: ?EncryptedData,
encryptionKey: ?CryptoKey,
): Promise<?T> {
if (!encryptedData || !encryptionKey) {
return undefined;
}
return deserializeEncryptedData<T>(encryptedData, encryptionKey);
}
async function serializeUnencryptedData<T>( async function serializeUnencryptedData<T>(
data: T, data: T,
encryptionKey: CryptoKey, encryptionKey: CryptoKey,
): Promise<EncryptedData> { ): Promise<EncryptedData> {
const dataAsString = JSON.stringify(data); const dataAsString = JSON.stringify(data);
invariant( invariant(
dataAsString, dataAsString,
'Attempt to serialize null or undefined is forbidden', 'Attempt to serialize null or undefined is forbidden',
); );
return await encryptData( return await encryptData(
new TextEncoder().encode(dataAsString), new TextEncoder().encode(dataAsString),
encryptionKey, encryptionKey,
); );
} }
async function validateCryptoKey( async function validateCryptoKey(
cryptoKey: CryptoKey | SubtleCrypto$JsonWebKey, cryptoKey: CryptoKey | SubtleCrypto$JsonWebKey,
): Promise<CryptoKey> { ): Promise<CryptoKey> {
if (!isDesktopSafari) { if (!isDesktopSafari) {
return ((cryptoKey: any): CryptoKey); return ((cryptoKey: any): CryptoKey);
} }
return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey)); return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));
} }
async function validateCryptoKeyOptional(
cryptoKey: ?CryptoKey | ?SubtleCrypto$JsonWebKey,
): Promise<?CryptoKey> {
if (!cryptoKey) {
return undefined;
}
return validateCryptoKey(cryptoKey);
}
async function getCryptoKeyPersistentForm( async function getCryptoKeyPersistentForm(
cryptoKey: CryptoKey, cryptoKey: CryptoKey,
): Promise<CryptoKey | SubtleCrypto$JsonWebKey> { ): Promise<CryptoKey | SubtleCrypto$JsonWebKey> {
if (!isDesktopSafari) { if (!isDesktopSafari) {
return cryptoKey; return cryptoKey;
} }
// Safari doesn't support structured clone algorithm in service // Safari doesn't support structured clone algorithm in service
// worker context so we have to store CryptoKey as JSON // worker context so we have to store CryptoKey as JSON
return await exportKeyToJWK(cryptoKey); return await exportKeyToJWK(cryptoKey);
} }
async function getNotifsAccountWithOlmData(
senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{
+encryptedOlmData: ?EncryptedData,
+encryptionKey: ?CryptoKey,
+olmDataKey: string,
+encryptionKeyDBLabel: string,
+encryptedOlmAccount: ?EncryptedData,
+accountEncryptionKey: ?CryptoKey,
+synchronizationValue: ?string,
}> {
let olmDataKey;
let olmDataEncryptionKeyDBLabel;
const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
if (keyserverID) {
const olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);
const { olmDataKey: fetchedOlmDataKey, encryptionKeyDBKey } = olmDBKeys;
olmDataKey = fetchedOlmDataKey;
olmDataEncryptionKeyDBLabel = encryptionKeyDBKey;
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
olmDataKey = getOlmDataKeyForDeviceID(senderDeviceID);
olmDataEncryptionKeyDBLabel =
getOlmEncryptionKeyDBLabelForDeviceID(senderDeviceID);
}
const queryResult = await localforage.getMultipleItems<{
notificationAccount: ?EncryptedData,
notificationAccountEncryptionKey: ?CryptoKey,
synchronizationValue: ?number,
[string]: ?EncryptedData | ?CryptoKey | ?SubtleCrypto$JsonWebKey,
}>(
[
INDEXED_DB_NOTIFS_ACCOUNT_KEY,
INDEXED_DB_NOTIFS_ACCOUNT_ENCRYPTION_KEY_DB_LABEL,
olmDataEncryptionKeyDBLabel,
olmDataKey,
],
INDEXED_DB_NOTIFS_SYNC_KEY,
);
const {
values: {
notificationAccount,
notificationAccountEncryptionKey,
[olmDataKey]: maybeEncryptedOlmData,
[olmDataEncryptionKeyDBLabel]: maybeOlmDataEncryptionKey,
},
synchronizationValue,
} = queryResult;
if (!notificationAccount || !notificationAccountEncryptionKey) {
throw new Error(
'Attempt to decrypt notification but olm account not initialized.',
);
}
const encryptedOlmData: ?EncryptedData = maybeEncryptedOlmData
? assertWithValidator(maybeEncryptedOlmData, encryptedAESDataValidator)
: undefined;
const olmDataEncryptionKey: ?CryptoKey | ?SubtleCrypto$JsonWebKey =
maybeOlmDataEncryptionKey
? assertWithValidator(
maybeOlmDataEncryptionKey,
extendedCryptoKeyValidator,
)
: undefined;
const [encryptionKey, accountEncryptionKey] = await Promise.all([
validateCryptoKeyOptional(olmDataEncryptionKey),
validateCryptoKey(notificationAccountEncryptionKey),
]);
return {
encryptedOlmData,
encryptionKey,
encryptionKeyDBLabel: olmDataEncryptionKeyDBLabel,
encryptedOlmAccount: notificationAccount,
olmDataKey,
accountEncryptionKey,
synchronizationValue,
};
}
async function persistNotifsAccountWithOlmData(input: { async function persistNotifsAccountWithOlmData(input: {
+olmDataKey?: string, +olmDataKey?: string,
+olmEncryptionKeyDBLabel?: string, +olmEncryptionKeyDBLabel?: string,
+olmData?: ?NotificationsOlmDataType, +olmData?: ?NotificationsOlmDataType,
+encryptionKey?: ?CryptoKey, +encryptionKey?: ?CryptoKey,
+accountEncryptionKey?: ?CryptoKey, +accountEncryptionKey?: ?CryptoKey,
+accountWithPicklingKey?: PickledOLMAccount, +accountWithPicklingKey?: PickledOLMAccount,
+synchronizationValue: ?string, +synchronizationValue: ?string,
▲ Show 20 Lines • Show All 79 Lines • ▼ Show 20 Lines try {
// likely shared worker persisted its own data // likely shared worker persisted its own data
console.log(e); console.log(e);
} }
} }
async function decryptWebNotification( async function decryptWebNotification(
encryptedNotification: EncryptedWebNotification, encryptedNotification: EncryptedWebNotification,
): Promise<PlainTextWebNotification | WebNotifDecryptionError> { ): Promise<PlainTextWebNotification | WebNotifDecryptionError> {
const { id, keyserverID, encryptedPayload } = encryptedNotification; const {
invariant(keyserverID, 'KeyserverID must be present to decrypt a notif'); id,
encryptedPayload,
type: messageType,
...rest
} = encryptedNotification;
const senderDeviceDescriptor: SenderDeviceDescriptor = rest;
const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>( const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(
WEB_NOTIFS_SERVICE_UTILS_KEY, WEB_NOTIFS_SERVICE_UTILS_KEY,
); );
if (!utilsData) { if (!utilsData) {
return { id, error: 'Necessary data not found in IndexedDB' }; return { id, error: 'Necessary data not found in IndexedDB' };
} }
const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData); const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);
let olmDBKeys; let notifsAccountWithOlmData;
try { try {
olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID); notifsAccountWithOlmData = await getNotifsAccountWithOlmData(
senderDeviceDescriptor,
);
} catch (e) { } catch (e) {
return { return {
id, id,
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
const { olmDataKey, encryptionKeyDBKey } = olmDBKeys;
const [encryptedOlmData, encryptionKey] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),
retrieveEncryptionKey(encryptionKeyDBKey),
]);
if (!encryptionKey || !encryptedOlmData) { const {
return { encryptionKey,
id, encryptedOlmData,
error: 'Received encrypted notification but olm session was not created', olmDataKey,
displayErrorMessage: staffCanSee, encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
}; accountEncryptionKey,
} encryptedOlmAccount,
synchronizationValue,
} = notifsAccountWithOlmData;
try { try {
await olm.init({ locateFile: () => olmWasmPath }); const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
deserializeEncryptedDataOptional<NotificationsOlmDataType>(
const decryptedNotification = await commonDecrypt<PlainTextWebNotification>(
encryptedOlmData, encryptedOlmData,
olmDataKey,
encryptionKey, encryptionKey,
),
deserializeEncryptedDataOptional<PickledOLMAccount>(
encryptedOlmAccount,
accountEncryptionKey,
),
olm.init({ locateFile: () => olmWasmPath }),
]);
let decryptedNotification;
let updatedOlmData;
let updatedNotifsAccount;
const { senderDeviceID, keyserverID } = senderDeviceDescriptor;
if (keyserverID) {
invariant(
notificationsOlmData && encryptionKey,
'Received encrypted notification but keyserver olm session was not created',
);
const {
decryptedNotification: resultDecryptedNotification,
updatedOlmData: resultUpdatedOlmData,
} = await commonDecrypt<PlainTextWebNotification>(
notificationsOlmData,
encryptedPayload, encryptedPayload,
); );
decryptedNotification = resultDecryptedNotification;
updatedOlmData = resultUpdatedOlmData;
const { unreadCount } = decryptedNotification; const { unreadCount } = decryptedNotification;
invariant(keyserverID, 'Keyserver ID must be set to update badge counts'); invariant(keyserverID, 'Keyserver ID must be set to update badge counts');
await updateNotifsUnreadCountStorage({ await Promise.all([
persistNotifsAccountWithOlmData({
olmDataKey,
olmData: updatedOlmData,
olmEncryptionKeyDBLabel,
encryptionKey,
forceWrite: false,
synchronizationValue,
}),
updateNotifsUnreadCountStorage({
[keyserverID]: unreadCount, [keyserverID]: unreadCount,
}),
]);
return { id, ...decryptedNotification };
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
invariant(
accountWithPicklingKey,
'Received encrypted notification but notifs olm account not created',
);
const {
decryptedNotification: resultDecryptedNotification,
updatedOlmData: resultUpdatedOlmData,
updatedNotifsAccount: resultUpdatedNotifsAccount,
} = await commonPeerDecrypt<PlainTextWebNotification>(
senderDeviceID,
notificationsOlmData,
accountWithPicklingKey,
messageType,
encryptedPayload,
);
decryptedNotification = resultDecryptedNotification;
updatedOlmData = resultUpdatedOlmData;
updatedNotifsAccount = resultUpdatedNotifsAccount;
await persistNotifsAccountWithOlmData({
accountWithPicklingKey: updatedNotifsAccount,
accountEncryptionKey,
encryptionKey,
olmData: updatedOlmData,
olmDataKey,
olmEncryptionKeyDBLabel,
synchronizationValue,
forceWrite: false,
}); });
return { id, ...decryptedNotification }; return { id, ...decryptedNotification };
}
} catch (e) { } catch (e) {
return { return {
id, id,
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
} }
async function decryptDesktopNotification( async function decryptDesktopNotification(
encryptedPayload: string, encryptedPayload: string,
messageType: string,
staffCanSee: boolean, staffCanSee: boolean,
keyserverID?: string, senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{ +[string]: mixed }> { ): Promise<{ +[string]: mixed }> {
let encryptedOlmData, encryptionKey, olmDataKey; const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
try {
const { olmDataKey: olmDataKeyValue, encryptionKeyDBKey } =
await getNotifsOlmSessionDBKeys(keyserverID);
olmDataKey = olmDataKeyValue; let notifsAccountWithOlmData;
try {
[encryptedOlmData, encryptionKey] = await Promise.all([ [notifsAccountWithOlmData] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey), getNotifsAccountWithOlmData(senderDeviceDescriptor),
retrieveEncryptionKey(encryptionKeyDBKey),
initOlm(), initOlm(),
]); ]);
} catch (e) { } catch (e) {
return { return {
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
if (!encryptionKey || !encryptedOlmData) { const {
return { encryptionKey,
error: 'Received encrypted notification but olm session was not created', encryptedOlmData,
displayErrorMessage: staffCanSee, olmDataKey,
}; encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
} accountEncryptionKey,
encryptedOlmAccount,
synchronizationValue,
} = notifsAccountWithOlmData;
let decryptedNotification;
try { try {
decryptedNotification = await commonDecrypt<{ +[string]: mixed }>( const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
deserializeEncryptedDataOptional<NotificationsOlmDataType>(
encryptedOlmData, encryptedOlmData,
olmDataKey,
encryptionKey, encryptionKey,
encryptedPayload, ),
deserializeEncryptedDataOptional<PickledOLMAccount>(
encryptedOlmAccount,
accountEncryptionKey,
),
]);
if (keyserverID) {
invariant(
notificationsOlmData && encryptionKey,
'Received encrypted notification but keyserver olm session was not created',
); );
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}
if (!keyserverID) { const { decryptedNotification, updatedOlmData } = await commonDecrypt<{
return decryptedNotification; +[string]: mixed,
} }>(notificationsOlmData, encryptedPayload);
const updatedOlmDataPersistencePromise = persistNotifsAccountWithOlmData({
olmDataKey,
olmData: updatedOlmData,
olmEncryptionKeyDBLabel,
encryptionKey,
forceWrite: false,
synchronizationValue,
});
// iOS notifications require that unread count is set under // iOS notifications require that unread count is set under
// `badge` key. Since MacOS notifications are created by the // `badge` key. Since MacOS notifications are created by the
// same function the unread count is also set under `badge` key // same function the unread count is also set under `badge` key
const { badge } = decryptedNotification; const { badge } = decryptedNotification;
if (typeof badge === 'number') { if (typeof badge === 'number') {
await updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }); await Promise.all([
updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }),
updatedOlmDataPersistencePromise,
]);
return decryptedNotification; return decryptedNotification;
} }
const { unreadCount } = decryptedNotification; const { unreadCount } = decryptedNotification;
if (typeof unreadCount === 'number') { if (typeof unreadCount === 'number') {
await updateNotifsUnreadCountStorage({ await Promise.all([
updateNotifsUnreadCountStorage({
[(keyserverID: string)]: unreadCount, [(keyserverID: string)]: unreadCount,
}); }),
updatedOlmDataPersistencePromise,
]);
} }
return decryptedNotification;
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
invariant(
accountWithPicklingKey,
'Received encrypted notification but notifs olm account not created',
);
const { decryptedNotification, updatedOlmData, updatedNotifsAccount } =
await commonPeerDecrypt<{
+[string]: mixed,
}>(
senderDeviceID,
notificationsOlmData,
accountWithPicklingKey,
messageType,
encryptedPayload,
);
await persistNotifsAccountWithOlmData({
accountWithPicklingKey: updatedNotifsAccount,
accountEncryptionKey,
encryptionKey,
olmData: updatedOlmData,
olmDataKey,
olmEncryptionKeyDBLabel,
synchronizationValue,
forceWrite: false,
});
return decryptedNotification; return decryptedNotification;
} }
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}
}
async function commonDecrypt<T>( async function commonDecrypt<T>(
encryptedOlmData: EncryptedData, notificationsOlmData: NotificationsOlmDataType,
olmDataKey: string,
encryptionKey: CryptoKey,
encryptedPayload: string, encryptedPayload: string,
): Promise<T> { ): Promise<{
const serializedOlmData = await decryptData(encryptedOlmData, encryptionKey); +decryptedNotification: T,
+updatedOlmData: NotificationsOlmDataType,
}> {
const { const {
mainSession, mainSession,
picklingKey, picklingKey,
pendingSessionUpdate, pendingSessionUpdate,
updateCreationTimestamp, updateCreationTimestamp,
}: NotificationsOlmDataType = JSON.parse( } = notificationsOlmData;
new TextDecoder().decode(serializedOlmData),
);
let updatedOlmData: NotificationsOlmDataType; let updatedOlmData: NotificationsOlmDataType;
let decryptedNotification: T; let decryptedNotification: T;
const shouldUpdateMainSession = const shouldUpdateMainSession =
Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME; Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;
const decryptionWithPendingSessionResult = decryptWithPendingSession<T>( const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(
Show All 26 Lines if (decryptionWithPendingSessionResult.decryptedNotification) {
updatedOlmData = { updatedOlmData = {
mainSession: mainSession, mainSession: mainSession,
pendingSessionUpdate, pendingSessionUpdate,
updateCreationTimestamp: newUpdateCreationTimestamp, updateCreationTimestamp: newUpdateCreationTimestamp,
picklingKey, picklingKey,
}; };
} }
const updatedEncryptedSession = await encryptData( return { decryptedNotification, updatedOlmData };
new TextEncoder().encode(JSON.stringify(updatedOlmData)), }
encryptionKey,
async function commonPeerDecrypt<T>(
senderDeviceID: string,
notificationsOlmData: ?NotificationsOlmDataType,
notificationAccount: PickledOLMAccount,
messageType: string,
encryptedPayload: string,
): Promise<{
+decryptedNotification: T,
+updatedOlmData?: NotificationsOlmDataType,
+updatedNotifsAccount?: PickledOLMAccount,
}> {
if (
messageType !== olmEncryptedMessageTypes.PREKEY.toString() &&
messageType !== olmEncryptedMessageTypes.TEXT.toString()
) {
throw new Error(
`Received message of invalid type from device: ${senderDeviceID}`,
); );
}
await localforage.setItem(olmDataKey, updatedEncryptedSession); let isSenderChainEmpty = true;
let hasReceivedMessage = false;
const sessionExists = !!notificationsOlmData;
return decryptedNotification; if (notificationsOlmData) {
const session = new olm.Session();
session.unpickle(
notificationsOlmData.picklingKey,
notificationsOlmData.pendingSessionUpdate,
);
isSenderChainEmpty = session.is_sender_chain_empty();
hasReceivedMessage = session.has_received_message();
}
// regular message
const isRegularMessage =
!!notificationsOlmData &&
messageType === olmEncryptedMessageTypes.TEXT.toString();
const isRegularPrekeyMessage =
!!notificationsOlmData &&
messageType === olmEncryptedMessageTypes.PREKEY.toString() &&
isSenderChainEmpty &&
hasReceivedMessage;
if (!!notificationsOlmData && (isRegularMessage || isRegularPrekeyMessage)) {
return await commonDecrypt<T>(notificationsOlmData, encryptedPayload);
}
// At this point we either face race condition or session reset attempt or
// session initialization attempt. For each of this scenario new inbound
// session must be created in order to decrypt message
const authMetadata = await fetchAuthMetadata();
const notifInboundKeys = await getNotifsInboundKeysForDeviceID(
senderDeviceID,
authMetadata,
);
const account = new olm.Account();
const session = new olm.Session();
account.unpickle(
notificationAccount.picklingKey,
notificationAccount.pickledAccount,
);
if (notifInboundKeys.error) {
throw new Error(notifInboundKeys.error);
}
invariant(
notifInboundKeys.curve25519,
'curve25519 must be present in notifs inbound keys',
);
session.create_inbound_from(
account,
notifInboundKeys.curve25519,
encryptedPayload,
);
const decryptedNotification: T = JSON.parse(
session.decrypt(Number(messageType), encryptedPayload),
);
// session reset attempt or session initialization - handled the same
const sessionResetAttempt =
sessionExists && !isSenderChainEmpty && hasReceivedMessage;
// race condition
const raceCondition =
sessionExists && !isSenderChainEmpty && !hasReceivedMessage;
const { deviceID: ourDeviceID } = authMetadata;
invariant(ourDeviceID, 'Session creation attempt but no device id');
const thisDeviceWinsRaceCondition = ourDeviceID > senderDeviceID;
if (
!sessionExists ||
sessionResetAttempt ||
(raceCondition && !thisDeviceWinsRaceCondition)
) {
const pickledOlmSession = session.pickle(notificationAccount.picklingKey);
const updatedOlmData = {
mainSession: pickledOlmSession,
pendingSessionUpdate: pickledOlmSession,
updateCreationTimestamp: Date.now(),
picklingKey: notificationAccount.picklingKey,
};
const updatedNotifsAccount = {
pickledAccount: account.pickle(notificationAccount.picklingKey),
picklingKey: notificationAccount.picklingKey,
};
return {
decryptedNotification,
updatedOlmData,
updatedNotifsAccount,
};
}
// If there is a race condition but we win device id comparison
// we return object that carries decrypted data but won't persist
// any session state
return { decryptedNotification };
} }
function decryptWithSession<T>( function decryptWithSession<T>(
pickledSession: string, pickledSession: string,
picklingKey: string, picklingKey: string,
encryptedPayload: string, encryptedPayload: string,
): DecryptionResult<T> { ): DecryptionResult<T> {
const session = new olm.Session(); const session = new olm.Session();
▲ Show 20 Lines • Show All 472 Lines • Show Last 20 Lines
View Options

services/terraform/self-host/aws_vpc.tf

// @flow // @flow
import olm from '@commapp/olm'; import olm from '@commapp/olm';
import type { EncryptResult } from '@commapp/olm'; import type { EncryptResult } from '@commapp/olm';
import invariant from 'invariant'; import invariant from 'invariant';
import localforage from 'localforage'; import localforage from 'localforage';
import uuid from 'uuid'; import uuid from 'uuid';
import { import {
olmEncryptedMessageTypes, olmEncryptedMessageTypes,
type NotificationsOlmDataType, type NotificationsOlmDataType,
type PickledOLMAccount, type PickledOLMAccount,
} from 'lib/types/crypto-types.js'; } from 'lib/types/crypto-types.js';
import type { import type {
PlainTextWebNotification, PlainTextWebNotification,
EncryptedWebNotification, EncryptedWebNotification,
SenderDeviceDescriptor,
} from 'lib/types/notif-types.js'; } from 'lib/types/notif-types.js';
import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js'; import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';
import { getMessageForException } from 'lib/utils/errors.js'; import { getMessageForException } from 'lib/utils/errors.js';
import { promiseAll } from 'lib/utils/promises.js'; import { promiseAll } from 'lib/utils/promises.js';
import { assertWithValidator } from 'lib/utils/validation-utils.js'; import { assertWithValidator } from 'lib/utils/validation-utils.js';
import { import {
fetchAuthMetadata,
getNotifsInboundKeysForDeviceID,
} from './services-client.js';
import {
type EncryptedData, type EncryptedData,
decryptData, decryptData,
encryptData, encryptData,
importJWKKey, importJWKKey,
exportKeyToJWK, exportKeyToJWK,
generateCryptoKey, generateCryptoKey,
encryptedAESDataValidator, encryptedAESDataValidator,
extendedCryptoKeyValidator, extendedCryptoKeyValidator,
▲ Show 20 Lines • Show All 55 Lines • ▼ Show 20 Linesasync function deserializeEncryptedData<T>(
encryptedData: EncryptedData, encryptedData: EncryptedData,
encryptionKey: CryptoKey, encryptionKey: CryptoKey,
): Promise<T> { ): Promise<T> {
const serializedData = await decryptData(encryptedData, encryptionKey); const serializedData = await decryptData(encryptedData, encryptionKey);
const data: T = JSON.parse(new TextDecoder().decode(serializedData)); const data: T = JSON.parse(new TextDecoder().decode(serializedData));
return data; return data;
} }
async function deserializeEncryptedDataOptional<T>(
encryptedData: ?EncryptedData,
encryptionKey: ?CryptoKey,
): Promise<?T> {
if (!encryptedData || !encryptionKey) {
return undefined;
}
return deserializeEncryptedData<T>(encryptedData, encryptionKey);
}
async function serializeUnencryptedData<T>( async function serializeUnencryptedData<T>(
data: T, data: T,
encryptionKey: CryptoKey, encryptionKey: CryptoKey,
): Promise<EncryptedData> { ): Promise<EncryptedData> {
const dataAsString = JSON.stringify(data); const dataAsString = JSON.stringify(data);
invariant( invariant(
dataAsString, dataAsString,
'Attempt to serialize null or undefined is forbidden', 'Attempt to serialize null or undefined is forbidden',
); );
return await encryptData( return await encryptData(
new TextEncoder().encode(dataAsString), new TextEncoder().encode(dataAsString),
encryptionKey, encryptionKey,
); );
} }
async function validateCryptoKey( async function validateCryptoKey(
cryptoKey: CryptoKey | SubtleCrypto$JsonWebKey, cryptoKey: CryptoKey | SubtleCrypto$JsonWebKey,
): Promise<CryptoKey> { ): Promise<CryptoKey> {
if (!isDesktopSafari) { if (!isDesktopSafari) {
return ((cryptoKey: any): CryptoKey); return ((cryptoKey: any): CryptoKey);
} }
return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey)); return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));
} }
async function validateCryptoKeyOptional(
cryptoKey: ?CryptoKey | ?SubtleCrypto$JsonWebKey,
): Promise<?CryptoKey> {
if (!cryptoKey) {
return undefined;
}
return validateCryptoKey(cryptoKey);
}
async function getCryptoKeyPersistentForm( async function getCryptoKeyPersistentForm(
cryptoKey: CryptoKey, cryptoKey: CryptoKey,
): Promise<CryptoKey | SubtleCrypto$JsonWebKey> { ): Promise<CryptoKey | SubtleCrypto$JsonWebKey> {
if (!isDesktopSafari) { if (!isDesktopSafari) {
return cryptoKey; return cryptoKey;
} }
// Safari doesn't support structured clone algorithm in service // Safari doesn't support structured clone algorithm in service
// worker context so we have to store CryptoKey as JSON // worker context so we have to store CryptoKey as JSON
return await exportKeyToJWK(cryptoKey); return await exportKeyToJWK(cryptoKey);
} }
async function getNotifsAccountWithOlmData(
senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{
+encryptedOlmData: ?EncryptedData,
+encryptionKey: ?CryptoKey,
+olmDataKey: string,
+encryptionKeyDBLabel: string,
+encryptedOlmAccount: ?EncryptedData,
+accountEncryptionKey: ?CryptoKey,
+synchronizationValue: ?string,
}> {
let olmDataKey;
let olmDataEncryptionKeyDBLabel;
const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
if (keyserverID) {
const olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);
const { olmDataKey: fetchedOlmDataKey, encryptionKeyDBKey } = olmDBKeys;
olmDataKey = fetchedOlmDataKey;
olmDataEncryptionKeyDBLabel = encryptionKeyDBKey;
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
olmDataKey = getOlmDataKeyForDeviceID(senderDeviceID);
olmDataEncryptionKeyDBLabel =
getOlmEncryptionKeyDBLabelForDeviceID(senderDeviceID);
}
const queryResult = await localforage.getMultipleItems<{
notificationAccount: ?EncryptedData,
notificationAccountEncryptionKey: ?CryptoKey,
synchronizationValue: ?number,
[string]: ?EncryptedData | ?CryptoKey | ?SubtleCrypto$JsonWebKey,
}>(
[
INDEXED_DB_NOTIFS_ACCOUNT_KEY,
INDEXED_DB_NOTIFS_ACCOUNT_ENCRYPTION_KEY_DB_LABEL,
olmDataEncryptionKeyDBLabel,
olmDataKey,
],
INDEXED_DB_NOTIFS_SYNC_KEY,
);
const {
values: {
notificationAccount,
notificationAccountEncryptionKey,
[olmDataKey]: maybeEncryptedOlmData,
[olmDataEncryptionKeyDBLabel]: maybeOlmDataEncryptionKey,
},
synchronizationValue,
} = queryResult;
if (!notificationAccount || !notificationAccountEncryptionKey) {
throw new Error(
'Attempt to decrypt notification but olm account not initialized.',
);
}
const encryptedOlmData: ?EncryptedData = maybeEncryptedOlmData
? assertWithValidator(maybeEncryptedOlmData, encryptedAESDataValidator)
: undefined;
const olmDataEncryptionKey: ?CryptoKey | ?SubtleCrypto$JsonWebKey =
maybeOlmDataEncryptionKey
? assertWithValidator(
maybeOlmDataEncryptionKey,
extendedCryptoKeyValidator,
)
: undefined;
const [encryptionKey, accountEncryptionKey] = await Promise.all([
validateCryptoKeyOptional(olmDataEncryptionKey),
validateCryptoKey(notificationAccountEncryptionKey),
]);
return {
encryptedOlmData,
encryptionKey,
encryptionKeyDBLabel: olmDataEncryptionKeyDBLabel,
encryptedOlmAccount: notificationAccount,
olmDataKey,
accountEncryptionKey,
synchronizationValue,
};
}
async function persistNotifsAccountWithOlmData(input: { async function persistNotifsAccountWithOlmData(input: {
+olmDataKey?: string, +olmDataKey?: string,
+olmEncryptionKeyDBLabel?: string, +olmEncryptionKeyDBLabel?: string,
+olmData?: ?NotificationsOlmDataType, +olmData?: ?NotificationsOlmDataType,
+encryptionKey?: ?CryptoKey, +encryptionKey?: ?CryptoKey,
+accountEncryptionKey?: ?CryptoKey, +accountEncryptionKey?: ?CryptoKey,
+accountWithPicklingKey?: PickledOLMAccount, +accountWithPicklingKey?: PickledOLMAccount,
+synchronizationValue: ?string, +synchronizationValue: ?string,
▲ Show 20 Lines • Show All 79 Lines • ▼ Show 20 Lines try {
// likely shared worker persisted its own data // likely shared worker persisted its own data
console.log(e); console.log(e);
} }
} }
async function decryptWebNotification( async function decryptWebNotification(
encryptedNotification: EncryptedWebNotification, encryptedNotification: EncryptedWebNotification,
): Promise<PlainTextWebNotification | WebNotifDecryptionError> { ): Promise<PlainTextWebNotification | WebNotifDecryptionError> {
const { id, keyserverID, encryptedPayload } = encryptedNotification; const {
invariant(keyserverID, 'KeyserverID must be present to decrypt a notif'); id,
encryptedPayload,
type: messageType,
...rest
} = encryptedNotification;
const senderDeviceDescriptor: SenderDeviceDescriptor = rest;
const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>( const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(
WEB_NOTIFS_SERVICE_UTILS_KEY, WEB_NOTIFS_SERVICE_UTILS_KEY,
); );
if (!utilsData) { if (!utilsData) {
return { id, error: 'Necessary data not found in IndexedDB' }; return { id, error: 'Necessary data not found in IndexedDB' };
} }
const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData); const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);
let olmDBKeys; let notifsAccountWithOlmData;
try { try {
olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID); notifsAccountWithOlmData = await getNotifsAccountWithOlmData(
senderDeviceDescriptor,
);
} catch (e) { } catch (e) {
return { return {
id, id,
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
const { olmDataKey, encryptionKeyDBKey } = olmDBKeys;
const [encryptedOlmData, encryptionKey] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),
retrieveEncryptionKey(encryptionKeyDBKey),
]);
if (!encryptionKey || !encryptedOlmData) { const {
return { encryptionKey,
id, encryptedOlmData,
error: 'Received encrypted notification but olm session was not created', olmDataKey,
displayErrorMessage: staffCanSee, encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
}; accountEncryptionKey,
} encryptedOlmAccount,
synchronizationValue,
} = notifsAccountWithOlmData;
try { try {
await olm.init({ locateFile: () => olmWasmPath }); const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
deserializeEncryptedDataOptional<NotificationsOlmDataType>(
const decryptedNotification = await commonDecrypt<PlainTextWebNotification>(
encryptedOlmData, encryptedOlmData,
olmDataKey,
encryptionKey, encryptionKey,
),
deserializeEncryptedDataOptional<PickledOLMAccount>(
encryptedOlmAccount,
accountEncryptionKey,
),
olm.init({ locateFile: () => olmWasmPath }),
]);
let decryptedNotification;
let updatedOlmData;
let updatedNotifsAccount;
const { senderDeviceID, keyserverID } = senderDeviceDescriptor;
if (keyserverID) {
invariant(
notificationsOlmData && encryptionKey,
'Received encrypted notification but keyserver olm session was not created',
);
const {
decryptedNotification: resultDecryptedNotification,
updatedOlmData: resultUpdatedOlmData,
} = await commonDecrypt<PlainTextWebNotification>(
notificationsOlmData,
encryptedPayload, encryptedPayload,
); );
decryptedNotification = resultDecryptedNotification;
updatedOlmData = resultUpdatedOlmData;
const { unreadCount } = decryptedNotification; const { unreadCount } = decryptedNotification;
invariant(keyserverID, 'Keyserver ID must be set to update badge counts'); invariant(keyserverID, 'Keyserver ID must be set to update badge counts');
await updateNotifsUnreadCountStorage({ await Promise.all([
persistNotifsAccountWithOlmData({
olmDataKey,
olmData: updatedOlmData,
olmEncryptionKeyDBLabel,
encryptionKey,
forceWrite: false,
synchronizationValue,
}),
updateNotifsUnreadCountStorage({
[keyserverID]: unreadCount, [keyserverID]: unreadCount,
}),
]);
return { id, ...decryptedNotification };
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
invariant(
accountWithPicklingKey,
'Received encrypted notification but notifs olm account not created',
);
const {
decryptedNotification: resultDecryptedNotification,
updatedOlmData: resultUpdatedOlmData,
updatedNotifsAccount: resultUpdatedNotifsAccount,
} = await commonPeerDecrypt<PlainTextWebNotification>(
senderDeviceID,
notificationsOlmData,
accountWithPicklingKey,
messageType,
encryptedPayload,
);
decryptedNotification = resultDecryptedNotification;
updatedOlmData = resultUpdatedOlmData;
updatedNotifsAccount = resultUpdatedNotifsAccount;
await persistNotifsAccountWithOlmData({
accountWithPicklingKey: updatedNotifsAccount,
accountEncryptionKey,
encryptionKey,
olmData: updatedOlmData,
olmDataKey,
olmEncryptionKeyDBLabel,
synchronizationValue,
forceWrite: false,
}); });
return { id, ...decryptedNotification }; return { id, ...decryptedNotification };
}
} catch (e) { } catch (e) {
return { return {
id, id,
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
} }
async function decryptDesktopNotification( async function decryptDesktopNotification(
encryptedPayload: string, encryptedPayload: string,
messageType: string,
staffCanSee: boolean, staffCanSee: boolean,
keyserverID?: string, senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{ +[string]: mixed }> { ): Promise<{ +[string]: mixed }> {
let encryptedOlmData, encryptionKey, olmDataKey; const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
try {
const { olmDataKey: olmDataKeyValue, encryptionKeyDBKey } =
await getNotifsOlmSessionDBKeys(keyserverID);
olmDataKey = olmDataKeyValue; let notifsAccountWithOlmData;
try {
[encryptedOlmData, encryptionKey] = await Promise.all([ [notifsAccountWithOlmData] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey), getNotifsAccountWithOlmData(senderDeviceDescriptor),
retrieveEncryptionKey(encryptionKeyDBKey),
initOlm(), initOlm(),
]); ]);
} catch (e) { } catch (e) {
return { return {
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
if (!encryptionKey || !encryptedOlmData) { const {
return { encryptionKey,
error: 'Received encrypted notification but olm session was not created', encryptedOlmData,
displayErrorMessage: staffCanSee, olmDataKey,
}; encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
} accountEncryptionKey,
encryptedOlmAccount,
synchronizationValue,
} = notifsAccountWithOlmData;
let decryptedNotification;
try { try {
decryptedNotification = await commonDecrypt<{ +[string]: mixed }>( const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
deserializeEncryptedDataOptional<NotificationsOlmDataType>(
encryptedOlmData, encryptedOlmData,
olmDataKey,
encryptionKey, encryptionKey,
encryptedPayload, ),
deserializeEncryptedDataOptional<PickledOLMAccount>(
encryptedOlmAccount,
accountEncryptionKey,
),
]);
if (keyserverID) {
invariant(
notificationsOlmData && encryptionKey,
'Received encrypted notification but keyserver olm session was not created',
); );
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}
if (!keyserverID) { const { decryptedNotification, updatedOlmData } = await commonDecrypt<{
return decryptedNotification; +[string]: mixed,
} }>(notificationsOlmData, encryptedPayload);
const updatedOlmDataPersistencePromise = persistNotifsAccountWithOlmData({
olmDataKey,
olmData: updatedOlmData,
olmEncryptionKeyDBLabel,
encryptionKey,
forceWrite: false,
synchronizationValue,
});
// iOS notifications require that unread count is set under // iOS notifications require that unread count is set under
// `badge` key. Since MacOS notifications are created by the // `badge` key. Since MacOS notifications are created by the
// same function the unread count is also set under `badge` key // same function the unread count is also set under `badge` key
const { badge } = decryptedNotification; const { badge } = decryptedNotification;
if (typeof badge === 'number') { if (typeof badge === 'number') {
await updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }); await Promise.all([
updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }),
updatedOlmDataPersistencePromise,
]);
return decryptedNotification; return decryptedNotification;
} }
const { unreadCount } = decryptedNotification; const { unreadCount } = decryptedNotification;
if (typeof unreadCount === 'number') { if (typeof unreadCount === 'number') {
await updateNotifsUnreadCountStorage({ await Promise.all([
updateNotifsUnreadCountStorage({
[(keyserverID: string)]: unreadCount, [(keyserverID: string)]: unreadCount,
}); }),
updatedOlmDataPersistencePromise,
]);
} }
return decryptedNotification;
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
invariant(
accountWithPicklingKey,
'Received encrypted notification but notifs olm account not created',
);
const { decryptedNotification, updatedOlmData, updatedNotifsAccount } =
await commonPeerDecrypt<{
+[string]: mixed,
}>(
senderDeviceID,
notificationsOlmData,
accountWithPicklingKey,
messageType,
encryptedPayload,
);
await persistNotifsAccountWithOlmData({
accountWithPicklingKey: updatedNotifsAccount,
accountEncryptionKey,
encryptionKey,
olmData: updatedOlmData,
olmDataKey,
olmEncryptionKeyDBLabel,
synchronizationValue,
forceWrite: false,
});
return decryptedNotification; return decryptedNotification;
} }
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}
}
async function commonDecrypt<T>( async function commonDecrypt<T>(
encryptedOlmData: EncryptedData, notificationsOlmData: NotificationsOlmDataType,
olmDataKey: string,
encryptionKey: CryptoKey,
encryptedPayload: string, encryptedPayload: string,
): Promise<T> { ): Promise<{
const serializedOlmData = await decryptData(encryptedOlmData, encryptionKey); +decryptedNotification: T,
+updatedOlmData: NotificationsOlmDataType,
}> {
const { const {
mainSession, mainSession,
picklingKey, picklingKey,
pendingSessionUpdate, pendingSessionUpdate,
updateCreationTimestamp, updateCreationTimestamp,
}: NotificationsOlmDataType = JSON.parse( } = notificationsOlmData;
new TextDecoder().decode(serializedOlmData),
);
let updatedOlmData: NotificationsOlmDataType; let updatedOlmData: NotificationsOlmDataType;
let decryptedNotification: T; let decryptedNotification: T;
const shouldUpdateMainSession = const shouldUpdateMainSession =
Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME; Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;
const decryptionWithPendingSessionResult = decryptWithPendingSession<T>( const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(
Show All 26 Lines if (decryptionWithPendingSessionResult.decryptedNotification) {
updatedOlmData = { updatedOlmData = {
mainSession: mainSession, mainSession: mainSession,
pendingSessionUpdate, pendingSessionUpdate,
updateCreationTimestamp: newUpdateCreationTimestamp, updateCreationTimestamp: newUpdateCreationTimestamp,
picklingKey, picklingKey,
}; };
} }
const updatedEncryptedSession = await encryptData( return { decryptedNotification, updatedOlmData };
new TextEncoder().encode(JSON.stringify(updatedOlmData)), }
encryptionKey,
async function commonPeerDecrypt<T>(
senderDeviceID: string,
notificationsOlmData: ?NotificationsOlmDataType,
notificationAccount: PickledOLMAccount,
messageType: string,
encryptedPayload: string,
): Promise<{
+decryptedNotification: T,
+updatedOlmData?: NotificationsOlmDataType,
+updatedNotifsAccount?: PickledOLMAccount,
}> {
if (
messageType !== olmEncryptedMessageTypes.PREKEY.toString() &&
messageType !== olmEncryptedMessageTypes.TEXT.toString()
) {
throw new Error(
`Received message of invalid type from device: ${senderDeviceID}`,
); );
}
await localforage.setItem(olmDataKey, updatedEncryptedSession); let isSenderChainEmpty = true;
let hasReceivedMessage = false;
const sessionExists = !!notificationsOlmData;
return decryptedNotification; if (notificationsOlmData) {
const session = new olm.Session();
session.unpickle(
notificationsOlmData.picklingKey,
notificationsOlmData.pendingSessionUpdate,
);
isSenderChainEmpty = session.is_sender_chain_empty();
hasReceivedMessage = session.has_received_message();
}
// regular message
const isRegularMessage =
!!notificationsOlmData &&
messageType === olmEncryptedMessageTypes.TEXT.toString();
const isRegularPrekeyMessage =
!!notificationsOlmData &&
messageType === olmEncryptedMessageTypes.PREKEY.toString() &&
isSenderChainEmpty &&
hasReceivedMessage;
if (!!notificationsOlmData && (isRegularMessage || isRegularPrekeyMessage)) {
return await commonDecrypt<T>(notificationsOlmData, encryptedPayload);
}
// At this point we either face race condition or session reset attempt or
// session initialization attempt. For each of this scenario new inbound
// session must be created in order to decrypt message
const authMetadata = await fetchAuthMetadata();
const notifInboundKeys = await getNotifsInboundKeysForDeviceID(
senderDeviceID,
authMetadata,
);
const account = new olm.Account();
const session = new olm.Session();
account.unpickle(
notificationAccount.picklingKey,
notificationAccount.pickledAccount,
);
if (notifInboundKeys.error) {
throw new Error(notifInboundKeys.error);
}
invariant(
notifInboundKeys.curve25519,
'curve25519 must be present in notifs inbound keys',
);
session.create_inbound_from(
account,
notifInboundKeys.curve25519,
encryptedPayload,
);
const decryptedNotification: T = JSON.parse(
session.decrypt(Number(messageType), encryptedPayload),
);
// session reset attempt or session initialization - handled the same
const sessionResetAttempt =
sessionExists && !isSenderChainEmpty && hasReceivedMessage;
// race condition
const raceCondition =
sessionExists && !isSenderChainEmpty && !hasReceivedMessage;
const { deviceID: ourDeviceID } = authMetadata;
invariant(ourDeviceID, 'Session creation attempt but no device id');
const thisDeviceWinsRaceCondition = ourDeviceID > senderDeviceID;
if (
!sessionExists ||
sessionResetAttempt ||
(raceCondition && !thisDeviceWinsRaceCondition)
) {
const pickledOlmSession = session.pickle(notificationAccount.picklingKey);
const updatedOlmData = {
mainSession: pickledOlmSession,
pendingSessionUpdate: pickledOlmSession,
updateCreationTimestamp: Date.now(),
picklingKey: notificationAccount.picklingKey,
};
const updatedNotifsAccount = {
pickledAccount: account.pickle(notificationAccount.picklingKey),
picklingKey: notificationAccount.picklingKey,
};
return {
decryptedNotification,
updatedOlmData,
updatedNotifsAccount,
};
}
// If there is a race condition but we win device id comparison
// we return object that carries decrypted data but won't persist
// any session state
return { decryptedNotification };
} }
function decryptWithSession<T>( function decryptWithSession<T>(
pickledSession: string, pickledSession: string,
picklingKey: string, picklingKey: string,
encryptedPayload: string, encryptedPayload: string,
): DecryptionResult<T> { ): DecryptionResult<T> {
const session = new olm.Session(); const session = new olm.Session();
▲ Show 20 Lines • Show All 472 Lines • Show Last 20 Lines