[keyserver] Bump serverResponseTimeout to 10s
ClosedPublic
Actions

Authored by ashoat on Jun 6 2024, 8:06 PM.

Details

Reviewers

will
tomek

Commits

rCOMMbb1d4333d8eb: [keyserver] Bump serverResponseTimeout to 10s

Summary

serverResponseTimeout is used only in keyserver/src/socket/socket.js, and is the time before the keyserver will time out a Websocket connection with a client.

This change brings it in line with clientRequestSocketTimeout, which is the client's timeout for a Websocket connection to the keyserver.

I've had this change for some time on my production keyserver and never diffed it up for some reason.

Test Plan

Been running it in production for some time

Diff Detail

Repository

rCOMM Comm

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

ashoat created this revision.Jun 6 2024, 8:06 PM

Harbormaster completed remote builds in B29503: Diff 41076.Jun 6 2024, 8:21 PM

ashoat requested review of this revision.Jun 6 2024, 8:21 PM

will accepted this revision.Jun 6 2024, 8:49 PM

This revision is now accepted and ready to land.Jun 6 2024, 8:49 PM

Closed by commit rCOMMbb1d4333d8eb: [keyserver] Bump serverResponseTimeout to 10s (authored by ashoat). · Explain WhyJun 7 2024, 5:55 AM

This revision was automatically updated to reflect the committed changes.

ashoat added a commit: rCOMMbb1d4333d8eb: [keyserver] Bump serverResponseTimeout to 10s.

Revision Contents
Changeset List

Path

Size

lib/

shared/

timeouts.js

2 lines

Diff 41105

View Options

lib/shared/timeouts.js

// @flow		// @flow

import olm from '@commapp/olm';		import olm from '@commapp/olm';
import type { EncryptResult } from '@commapp/olm';		import type { EncryptResult } from '@commapp/olm';
import invariant from 'invariant';		import invariant from 'invariant';
import localforage from 'localforage';		import localforage from 'localforage';
import uuid from 'uuid';		import uuid from 'uuid';

import {		import {
olmEncryptedMessageTypes,		olmEncryptedMessageTypes,
type NotificationsOlmDataType,		type NotificationsOlmDataType,
type PickledOLMAccount,		type PickledOLMAccount,
} from 'lib/types/crypto-types.js';		} from 'lib/types/crypto-types.js';
import type {		import type {
PlainTextWebNotification,		PlainTextWebNotification,
EncryptedWebNotification,		EncryptedWebNotification,
		SenderDeviceDescriptor,
} from 'lib/types/notif-types.js';		} from 'lib/types/notif-types.js';
import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';		import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';
import { getMessageForException } from 'lib/utils/errors.js';		import { getMessageForException } from 'lib/utils/errors.js';
import { promiseAll } from 'lib/utils/promises.js';		import { promiseAll } from 'lib/utils/promises.js';
import { assertWithValidator } from 'lib/utils/validation-utils.js';		import { assertWithValidator } from 'lib/utils/validation-utils.js';

import {		import {
		fetchAuthMetadata,
		getNotifsInboundKeysForDeviceID,
		} from './services-client.js';
		import {
type EncryptedData,		type EncryptedData,
decryptData,		decryptData,
encryptData,		encryptData,
importJWKKey,		importJWKKey,
exportKeyToJWK,		exportKeyToJWK,
generateCryptoKey,		generateCryptoKey,
encryptedAESDataValidator,		encryptedAESDataValidator,
extendedCryptoKeyValidator,		extendedCryptoKeyValidator,
▲ Show 20 Lines • Show All 55 Lines • ▼ Show 20 Lines	async function deserializeEncryptedData<T>(
encryptedData: EncryptedData,		encryptedData: EncryptedData,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<T> {		): Promise<T> {
const serializedData = await decryptData(encryptedData, encryptionKey);		const serializedData = await decryptData(encryptedData, encryptionKey);
const data: T = JSON.parse(new TextDecoder().decode(serializedData));		const data: T = JSON.parse(new TextDecoder().decode(serializedData));
return data;		return data;
}		}

		async function deserializeEncryptedDataOptional<T>(
		encryptedData: ?EncryptedData,
		encryptionKey: ?CryptoKey,
		): Promise<?T> {
		if (!encryptedData \|\| !encryptionKey) {
		return undefined;
		}
		return deserializeEncryptedData<T>(encryptedData, encryptionKey);
		}

async function serializeUnencryptedData<T>(		async function serializeUnencryptedData<T>(
data: T,		data: T,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<EncryptedData> {		): Promise<EncryptedData> {
const dataAsString = JSON.stringify(data);		const dataAsString = JSON.stringify(data);
invariant(		invariant(
dataAsString,		dataAsString,
'Attempt to serialize null or undefined is forbidden',		'Attempt to serialize null or undefined is forbidden',
);		);
return await encryptData(		return await encryptData(
new TextEncoder().encode(dataAsString),		new TextEncoder().encode(dataAsString),
encryptionKey,		encryptionKey,
);		);
}		}

async function validateCryptoKey(		async function validateCryptoKey(
cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,		cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,
): Promise<CryptoKey> {		): Promise<CryptoKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return ((cryptoKey: any): CryptoKey);		return ((cryptoKey: any): CryptoKey);
}		}
return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));		return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));
}		}

		async function validateCryptoKeyOptional(
		cryptoKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		): Promise<?CryptoKey> {
		if (!cryptoKey) {
		return undefined;
		}
		return validateCryptoKey(cryptoKey);
		}

async function getCryptoKeyPersistentForm(		async function getCryptoKeyPersistentForm(
cryptoKey: CryptoKey,		cryptoKey: CryptoKey,
): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {		): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return cryptoKey;		return cryptoKey;
}		}

// Safari doesn't support structured clone algorithm in service		// Safari doesn't support structured clone algorithm in service
// worker context so we have to store CryptoKey as JSON		// worker context so we have to store CryptoKey as JSON
return await exportKeyToJWK(cryptoKey);		return await exportKeyToJWK(cryptoKey);
}		}

		async function getNotifsAccountWithOlmData(
		senderDeviceDescriptor: SenderDeviceDescriptor,
		): Promise<{
		+encryptedOlmData: ?EncryptedData,
		+encryptionKey: ?CryptoKey,
		+olmDataKey: string,
		+encryptionKeyDBLabel: string,
		+encryptedOlmAccount: ?EncryptedData,
		+accountEncryptionKey: ?CryptoKey,
		+synchronizationValue: ?string,
		}> {
		let olmDataKey;
		let olmDataEncryptionKeyDBLabel;
		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;

		if (keyserverID) {
		const olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);
		const { olmDataKey: fetchedOlmDataKey, encryptionKeyDBKey } = olmDBKeys;
		olmDataKey = fetchedOlmDataKey;
		olmDataEncryptionKeyDBLabel = encryptionKeyDBKey;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		olmDataKey = getOlmDataKeyForDeviceID(senderDeviceID);
		olmDataEncryptionKeyDBLabel =
		getOlmEncryptionKeyDBLabelForDeviceID(senderDeviceID);
		}

		const queryResult = await localforage.getMultipleItems<{
		notificationAccount: ?EncryptedData,
		notificationAccountEncryptionKey: ?CryptoKey,
		synchronizationValue: ?number,
		[string]: ?EncryptedData \| ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		}>(
		[
		INDEXED_DB_NOTIFS_ACCOUNT_KEY,
		INDEXED_DB_NOTIFS_ACCOUNT_ENCRYPTION_KEY_DB_LABEL,
		olmDataEncryptionKeyDBLabel,
		olmDataKey,
		],
		INDEXED_DB_NOTIFS_SYNC_KEY,
		);

		const {
		values: {
		notificationAccount,
		notificationAccountEncryptionKey,
		[olmDataKey]: maybeEncryptedOlmData,
		[olmDataEncryptionKeyDBLabel]: maybeOlmDataEncryptionKey,
		},
		synchronizationValue,
		} = queryResult;

		if (!notificationAccount \|\| !notificationAccountEncryptionKey) {
		throw new Error(
		'Attempt to decrypt notification but olm account not initialized.',
		);
		}

		const encryptedOlmData: ?EncryptedData = maybeEncryptedOlmData
		? assertWithValidator(maybeEncryptedOlmData, encryptedAESDataValidator)
		: undefined;

		const olmDataEncryptionKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey =
		maybeOlmDataEncryptionKey
		? assertWithValidator(
		maybeOlmDataEncryptionKey,
		extendedCryptoKeyValidator,
		)
		: undefined;

		const [encryptionKey, accountEncryptionKey] = await Promise.all([
		validateCryptoKeyOptional(olmDataEncryptionKey),
		validateCryptoKey(notificationAccountEncryptionKey),
		]);

		return {
		encryptedOlmData,
		encryptionKey,
		encryptionKeyDBLabel: olmDataEncryptionKeyDBLabel,
		encryptedOlmAccount: notificationAccount,
		olmDataKey,
		accountEncryptionKey,
		synchronizationValue,
		};
		}

async function persistNotifsAccountWithOlmData(input: {		async function persistNotifsAccountWithOlmData(input: {
+olmDataKey?: string,		+olmDataKey?: string,
+olmEncryptionKeyDBLabel?: string,		+olmEncryptionKeyDBLabel?: string,
+olmData?: ?NotificationsOlmDataType,		+olmData?: ?NotificationsOlmDataType,
+encryptionKey?: ?CryptoKey,		+encryptionKey?: ?CryptoKey,
+accountEncryptionKey?: ?CryptoKey,		+accountEncryptionKey?: ?CryptoKey,
+accountWithPicklingKey?: PickledOLMAccount,		+accountWithPicklingKey?: PickledOLMAccount,
+synchronizationValue: ?string,		+synchronizationValue: ?string,
▲ Show 20 Lines • Show All 79 Lines • ▼ Show 20 Lines	try {
// likely shared worker persisted its own data		// likely shared worker persisted its own data
console.log(e);		console.log(e);
}		}
}		}

async function decryptWebNotification(		async function decryptWebNotification(
encryptedNotification: EncryptedWebNotification,		encryptedNotification: EncryptedWebNotification,
): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {		): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {
const { id, keyserverID, encryptedPayload } = encryptedNotification;		const {
invariant(keyserverID, 'KeyserverID must be present to decrypt a notif');		id,
		encryptedPayload,
		type: messageType,
		...rest
		} = encryptedNotification;
		const senderDeviceDescriptor: SenderDeviceDescriptor = rest;

const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(		const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(
WEB_NOTIFS_SERVICE_UTILS_KEY,		WEB_NOTIFS_SERVICE_UTILS_KEY,
);		);

if (!utilsData) {		if (!utilsData) {
return { id, error: 'Necessary data not found in IndexedDB' };		return { id, error: 'Necessary data not found in IndexedDB' };
}		}
const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);		const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);

let olmDBKeys;		let notifsAccountWithOlmData;
try {		try {
olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);		notifsAccountWithOlmData = await getNotifsAccountWithOlmData(
		senderDeviceDescriptor,
		);
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
const { olmDataKey, encryptionKeyDBKey } = olmDBKeys;
const [encryptedOlmData, encryptionKey] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),
retrieveEncryptionKey(encryptionKeyDBKey),
]);

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
id,		encryptedOlmData,
error: 'Received encrypted notification but olm session was not created',		olmDataKey,
displayErrorMessage: staffCanSee,		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
};		accountEncryptionKey,
}		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

try {		try {
await olm.init({ locateFile: () => olmWasmPath });		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
const decryptedNotification = await commonDecrypt<PlainTextWebNotification>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		olm.init({ locateFile: () => olmWasmPath }),
		]);

		let decryptedNotification;
		let updatedOlmData;
		let updatedNotifsAccount;

		const { senderDeviceID, keyserverID } = senderDeviceDescriptor;

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		} = await commonDecrypt<PlainTextWebNotification>(
		notificationsOlmData,
encryptedPayload,		encryptedPayload,
);		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;

invariant(keyserverID, 'Keyserver ID must be set to update badge counts');		invariant(keyserverID, 'Keyserver ID must be set to update badge counts');
await updateNotifsUnreadCountStorage({		await Promise.all([
		persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		}),
		updateNotifsUnreadCountStorage({
[keyserverID]: unreadCount,		[keyserverID]: unreadCount,
		}),
		]);

		return { id, ...decryptedNotification };
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		updatedNotifsAccount: resultUpdatedNotifsAccount,
		} = await commonPeerDecrypt<PlainTextWebNotification>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
		updatedNotifsAccount = resultUpdatedNotifsAccount;

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
});		});

return { id, ...decryptedNotification };		return { id, ...decryptedNotification };
		}
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
}		}

async function decryptDesktopNotification(		async function decryptDesktopNotification(
encryptedPayload: string,		encryptedPayload: string,
		messageType: string,
staffCanSee: boolean,		staffCanSee: boolean,
keyserverID?: string,		senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{ +[string]: mixed }> {		): Promise<{ +[string]: mixed }> {
let encryptedOlmData, encryptionKey, olmDataKey;		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
try {
const { olmDataKey: olmDataKeyValue, encryptionKeyDBKey } =
await getNotifsOlmSessionDBKeys(keyserverID);

olmDataKey = olmDataKeyValue;		let notifsAccountWithOlmData;
		try {
[encryptedOlmData, encryptionKey] = await Promise.all([		[notifsAccountWithOlmData] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),		getNotifsAccountWithOlmData(senderDeviceDescriptor),
retrieveEncryptionKey(encryptionKeyDBKey),
initOlm(),		initOlm(),
]);		]);
} catch (e) {		} catch (e) {
return {		return {
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
error: 'Received encrypted notification but olm session was not created',		encryptedOlmData,
displayErrorMessage: staffCanSee,		olmDataKey,
};		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
}		accountEncryptionKey,
		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

let decryptedNotification;
try {		try {
decryptedNotification = await commonDecrypt<{ +[string]: mixed }>(		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
encryptedPayload,		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		]);

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
);		);
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}

if (!keyserverID) {		const { decryptedNotification, updatedOlmData } = await commonDecrypt<{
return decryptedNotification;		+[string]: mixed,
}		}>(notificationsOlmData, encryptedPayload);

		const updatedOlmDataPersistencePromise = persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		});

// iOS notifications require that unread count is set under		// iOS notifications require that unread count is set under
// `badge` key. Since MacOS notifications are created by the		// `badge` key. Since MacOS notifications are created by the
// same function the unread count is also set under `badge` key		// same function the unread count is also set under `badge` key
const { badge } = decryptedNotification;		const { badge } = decryptedNotification;
if (typeof badge === 'number') {		if (typeof badge === 'number') {
await updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge });		await Promise.all([
		updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }),
		updatedOlmDataPersistencePromise,
		]);
return decryptedNotification;		return decryptedNotification;
}		}

const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;
if (typeof unreadCount === 'number') {		if (typeof unreadCount === 'number') {
await updateNotifsUnreadCountStorage({		await Promise.all([
		updateNotifsUnreadCountStorage({
[(keyserverID: string)]: unreadCount,		[(keyserverID: string)]: unreadCount,
});		}),
		updatedOlmDataPersistencePromise,
		]);
}		}

		return decryptedNotification;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);

		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const { decryptedNotification, updatedOlmData, updatedNotifsAccount } =
		await commonPeerDecrypt<{
		+[string]: mixed,
		}>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
		});

return decryptedNotification;		return decryptedNotification;
}		}
		} catch (e) {
		return {
		error: e.message,
		staffCanSee,
		};
		}
		}

async function commonDecrypt<T>(		async function commonDecrypt<T>(
encryptedOlmData: EncryptedData,		notificationsOlmData: NotificationsOlmDataType,
olmDataKey: string,
encryptionKey: CryptoKey,
encryptedPayload: string,		encryptedPayload: string,
): Promise<T> {		): Promise<{
const serializedOlmData = await decryptData(encryptedOlmData, encryptionKey);		+decryptedNotification: T,
		+updatedOlmData: NotificationsOlmDataType,
		}> {
const {		const {
mainSession,		mainSession,
picklingKey,		picklingKey,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp,		updateCreationTimestamp,
}: NotificationsOlmDataType = JSON.parse(		} = notificationsOlmData;
new TextDecoder().decode(serializedOlmData),
);

let updatedOlmData: NotificationsOlmDataType;		let updatedOlmData: NotificationsOlmDataType;
let decryptedNotification: T;		let decryptedNotification: T;

const shouldUpdateMainSession =		const shouldUpdateMainSession =
Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;		Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;

const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(		const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(
Show All 26 Lines	if (decryptionWithPendingSessionResult.decryptedNotification) {
updatedOlmData = {		updatedOlmData = {
mainSession: mainSession,		mainSession: mainSession,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp: newUpdateCreationTimestamp,		updateCreationTimestamp: newUpdateCreationTimestamp,
picklingKey,		picklingKey,
};		};
}		}

const updatedEncryptedSession = await encryptData(		return { decryptedNotification, updatedOlmData };
new TextEncoder().encode(JSON.stringify(updatedOlmData)),		}
encryptionKey,
		async function commonPeerDecrypt<T>(
		senderDeviceID: string,
		notificationsOlmData: ?NotificationsOlmDataType,
		notificationAccount: PickledOLMAccount,
		messageType: string,
		encryptedPayload: string,
		): Promise<{
		+decryptedNotification: T,
		+updatedOlmData?: NotificationsOlmDataType,
		+updatedNotifsAccount?: PickledOLMAccount,
		}> {
		if (
		messageType !== olmEncryptedMessageTypes.PREKEY.toString() &&
		messageType !== olmEncryptedMessageTypes.TEXT.toString()
		) {
		throw new Error(
		`Received message of invalid type from device: ${senderDeviceID}`,
);		);
		}

await localforage.setItem(olmDataKey, updatedEncryptedSession);		let isSenderChainEmpty = true;
		let hasReceivedMessage = false;
		const sessionExists = !!notificationsOlmData;

return decryptedNotification;		if (notificationsOlmData) {
		const session = new olm.Session();
		session.unpickle(
		notificationsOlmData.picklingKey,
		notificationsOlmData.pendingSessionUpdate,
		);

		isSenderChainEmpty = session.is_sender_chain_empty();
		hasReceivedMessage = session.has_received_message();
		}

		// regular message
		const isRegularMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.TEXT.toString();

		const isRegularPrekeyMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.PREKEY.toString() &&
		isSenderChainEmpty &&
		hasReceivedMessage;

		if (!!notificationsOlmData && (isRegularMessage \|\| isRegularPrekeyMessage)) {
		return await commonDecrypt<T>(notificationsOlmData, encryptedPayload);
		}

		// At this point we either face race condition or session reset attempt or
		// session initialization attempt. For each of this scenario new inbound
		// session must be created in order to decrypt message
		const authMetadata = await fetchAuthMetadata();
		const notifInboundKeys = await getNotifsInboundKeysForDeviceID(
		senderDeviceID,
		authMetadata,
		);

		const account = new olm.Account();
		const session = new olm.Session();

		account.unpickle(
		notificationAccount.picklingKey,
		notificationAccount.pickledAccount,
		);

		if (notifInboundKeys.error) {
		throw new Error(notifInboundKeys.error);
		}

		invariant(
		notifInboundKeys.curve25519,
		'curve25519 must be present in notifs inbound keys',
		);

		session.create_inbound_from(
		account,
		notifInboundKeys.curve25519,
		encryptedPayload,
		);

		const decryptedNotification: T = JSON.parse(
		session.decrypt(Number(messageType), encryptedPayload),
		);

		// session reset attempt or session initialization - handled the same
		const sessionResetAttempt =
		sessionExists && !isSenderChainEmpty && hasReceivedMessage;

		// race condition
		const raceCondition =
		sessionExists && !isSenderChainEmpty && !hasReceivedMessage;
		const { deviceID: ourDeviceID } = authMetadata;
		invariant(ourDeviceID, 'Session creation attempt but no device id');

		const thisDeviceWinsRaceCondition = ourDeviceID > senderDeviceID;

		if (
		!sessionExists \|\|
		sessionResetAttempt \|\|
		(raceCondition && !thisDeviceWinsRaceCondition)
		) {
		const pickledOlmSession = session.pickle(notificationAccount.picklingKey);
		const updatedOlmData = {
		mainSession: pickledOlmSession,
		pendingSessionUpdate: pickledOlmSession,
		updateCreationTimestamp: Date.now(),
		picklingKey: notificationAccount.picklingKey,
		};
		const updatedNotifsAccount = {
		pickledAccount: account.pickle(notificationAccount.picklingKey),
		picklingKey: notificationAccount.picklingKey,
		};
		return {
		decryptedNotification,
		updatedOlmData,
		updatedNotifsAccount,
		};
		}

		// If there is a race condition but we win device id comparison
		// we return object that carries decrypted data but won't persist
		// any session state
		return { decryptedNotification };
}		}

function decryptWithSession<T>(		function decryptWithSession<T>(
pickledSession: string,		pickledSession: string,
picklingKey: string,		picklingKey: string,
encryptedPayload: string,		encryptedPayload: string,
): DecryptionResult<T> {		): DecryptionResult<T> {
const session = new olm.Session();		const session = new olm.Session();
▲ Show 20 Lines • Show All 472 Lines • Show Last 20 Lines

[keyserver] Bump serverResponseTimeout to 10sClosedPublicActions