[terraform] bump staging identity to 0.31-staging
ClosedPublic
Actions

Authored by varun on Jul 18 2024, 2:05 PM.

Details

Reviewers

ashoat
will
bartek

Commits

rCOMM2bfca588eb95: [terraform] bump staging identity to 0.31-staging

Summary

0.31-staging contains the increased aws ddb client connect timeout

Test Plan

terraform plan

Diff Detail

Repository

rCOMM Comm

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

varun created this revision.Jul 18 2024, 2:05 PM

Herald added a subscriber: tomek. · View Herald TranscriptJul 18 2024, 2:05 PM

Harbormaster completed remote builds in B30492: Diff 42497.Jul 18 2024, 2:21 PM

varun requested review of this revision.Jul 18 2024, 2:21 PM

will accepted this revision.Jul 18 2024, 3:22 PM

This revision is now accepted and ready to land.Jul 18 2024, 3:22 PM

Closed by commit rCOMM2bfca588eb95: [terraform] bump staging identity to 0.31-staging (authored by varun). · Explain WhyJul 18 2024, 3:49 PM

This revision was automatically updated to reflect the committed changes.

varun added a commit: rCOMM2bfca588eb95: [terraform] bump staging identity to 0.31-staging.

Revision Contents
Changeset List

Path

Size

services/

terraform/

remote/

service_identity.tf

2 lines

Diff 42507

View Options

services/terraform/remote/service_identity.tf

// @flow		// @flow

import olm from '@commapp/olm';		import olm from '@commapp/olm';
import type { EncryptResult } from '@commapp/olm';		import type { EncryptResult } from '@commapp/olm';
import invariant from 'invariant';		import invariant from 'invariant';
import localforage from 'localforage';		import localforage from 'localforage';
import uuid from 'uuid';		import uuid from 'uuid';

import {		import {
olmEncryptedMessageTypes,		olmEncryptedMessageTypes,
type NotificationsOlmDataType,		type NotificationsOlmDataType,
type PickledOLMAccount,		type PickledOLMAccount,
} from 'lib/types/crypto-types.js';		} from 'lib/types/crypto-types.js';
import type {		import type {
PlainTextWebNotification,		PlainTextWebNotification,
EncryptedWebNotification,		EncryptedWebNotification,
		SenderDeviceDescriptor,
} from 'lib/types/notif-types.js';		} from 'lib/types/notif-types.js';
import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';		import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';
import { getMessageForException } from 'lib/utils/errors.js';		import { getMessageForException } from 'lib/utils/errors.js';
import { promiseAll } from 'lib/utils/promises.js';		import { promiseAll } from 'lib/utils/promises.js';
import { assertWithValidator } from 'lib/utils/validation-utils.js';		import { assertWithValidator } from 'lib/utils/validation-utils.js';

import {		import {
		fetchAuthMetadata,
		getNotifsInboundKeysForDeviceID,
		} from './services-client.js';
		import {
type EncryptedData,		type EncryptedData,
decryptData,		decryptData,
encryptData,		encryptData,
importJWKKey,		importJWKKey,
exportKeyToJWK,		exportKeyToJWK,
generateCryptoKey,		generateCryptoKey,
encryptedAESDataValidator,		encryptedAESDataValidator,
extendedCryptoKeyValidator,		extendedCryptoKeyValidator,
▲ Show 20 Lines • Show All 55 Lines • ▼ Show 20 Lines	async function deserializeEncryptedData<T>(
encryptedData: EncryptedData,		encryptedData: EncryptedData,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<T> {		): Promise<T> {
const serializedData = await decryptData(encryptedData, encryptionKey);		const serializedData = await decryptData(encryptedData, encryptionKey);
const data: T = JSON.parse(new TextDecoder().decode(serializedData));		const data: T = JSON.parse(new TextDecoder().decode(serializedData));
return data;		return data;
}		}

		async function deserializeEncryptedDataOptional<T>(
		encryptedData: ?EncryptedData,
		encryptionKey: ?CryptoKey,
		): Promise<?T> {
		if (!encryptedData \|\| !encryptionKey) {
		return undefined;
		}
		return deserializeEncryptedData<T>(encryptedData, encryptionKey);
		}

async function serializeUnencryptedData<T>(		async function serializeUnencryptedData<T>(
data: T,		data: T,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<EncryptedData> {		): Promise<EncryptedData> {
const dataAsString = JSON.stringify(data);		const dataAsString = JSON.stringify(data);
invariant(		invariant(
dataAsString,		dataAsString,
'Attempt to serialize null or undefined is forbidden',		'Attempt to serialize null or undefined is forbidden',
);		);
return await encryptData(		return await encryptData(
new TextEncoder().encode(dataAsString),		new TextEncoder().encode(dataAsString),
encryptionKey,		encryptionKey,
);		);
}		}

async function validateCryptoKey(		async function validateCryptoKey(
cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,		cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,
): Promise<CryptoKey> {		): Promise<CryptoKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return ((cryptoKey: any): CryptoKey);		return ((cryptoKey: any): CryptoKey);
}		}
return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));		return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));
}		}

		async function validateCryptoKeyOptional(
		cryptoKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		): Promise<?CryptoKey> {
		if (!cryptoKey) {
		return undefined;
		}
		return validateCryptoKey(cryptoKey);
		}

async function getCryptoKeyPersistentForm(		async function getCryptoKeyPersistentForm(
cryptoKey: CryptoKey,		cryptoKey: CryptoKey,
): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {		): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return cryptoKey;		return cryptoKey;
}		}

// Safari doesn't support structured clone algorithm in service		// Safari doesn't support structured clone algorithm in service
// worker context so we have to store CryptoKey as JSON		// worker context so we have to store CryptoKey as JSON
return await exportKeyToJWK(cryptoKey);		return await exportKeyToJWK(cryptoKey);
}		}

		async function getNotifsAccountWithOlmData(
		senderDeviceDescriptor: SenderDeviceDescriptor,
		): Promise<{
		+encryptedOlmData: ?EncryptedData,
		+encryptionKey: ?CryptoKey,
		+olmDataKey: string,
		+encryptionKeyDBLabel: string,
		+encryptedOlmAccount: ?EncryptedData,
		+accountEncryptionKey: ?CryptoKey,
		+synchronizationValue: ?string,
		}> {
		let olmDataKey;
		let olmDataEncryptionKeyDBLabel;
		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;

		if (keyserverID) {
		const olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);
		const { olmDataKey: fetchedOlmDataKey, encryptionKeyDBKey } = olmDBKeys;
		olmDataKey = fetchedOlmDataKey;
		olmDataEncryptionKeyDBLabel = encryptionKeyDBKey;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		olmDataKey = getOlmDataKeyForDeviceID(senderDeviceID);
		olmDataEncryptionKeyDBLabel =
		getOlmEncryptionKeyDBLabelForDeviceID(senderDeviceID);
		}

		const queryResult = await localforage.getMultipleItems<{
		notificationAccount: ?EncryptedData,
		notificationAccountEncryptionKey: ?CryptoKey,
		synchronizationValue: ?number,
		[string]: ?EncryptedData \| ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		}>(
		[
		INDEXED_DB_NOTIFS_ACCOUNT_KEY,
		INDEXED_DB_NOTIFS_ACCOUNT_ENCRYPTION_KEY_DB_LABEL,
		olmDataEncryptionKeyDBLabel,
		olmDataKey,
		],
		INDEXED_DB_NOTIFS_SYNC_KEY,
		);

		const {
		values: {
		notificationAccount,
		notificationAccountEncryptionKey,
		[olmDataKey]: maybeEncryptedOlmData,
		[olmDataEncryptionKeyDBLabel]: maybeOlmDataEncryptionKey,
		},
		synchronizationValue,
		} = queryResult;

		if (!notificationAccount \|\| !notificationAccountEncryptionKey) {
		throw new Error(
		'Attempt to decrypt notification but olm account not initialized.',
		);
		}

		const encryptedOlmData: ?EncryptedData = maybeEncryptedOlmData
		? assertWithValidator(maybeEncryptedOlmData, encryptedAESDataValidator)
		: undefined;

		const olmDataEncryptionKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey =
		maybeOlmDataEncryptionKey
		? assertWithValidator(
		maybeOlmDataEncryptionKey,
		extendedCryptoKeyValidator,
		)
		: undefined;

		const [encryptionKey, accountEncryptionKey] = await Promise.all([
		validateCryptoKeyOptional(olmDataEncryptionKey),
		validateCryptoKey(notificationAccountEncryptionKey),
		]);

		return {
		encryptedOlmData,
		encryptionKey,
		encryptionKeyDBLabel: olmDataEncryptionKeyDBLabel,
		encryptedOlmAccount: notificationAccount,
		olmDataKey,
		accountEncryptionKey,
		synchronizationValue,
		};
		}

async function persistNotifsAccountWithOlmData(input: {		async function persistNotifsAccountWithOlmData(input: {
+olmDataKey?: string,		+olmDataKey?: string,
+olmEncryptionKeyDBLabel?: string,		+olmEncryptionKeyDBLabel?: string,
+olmData?: ?NotificationsOlmDataType,		+olmData?: ?NotificationsOlmDataType,
+encryptionKey?: ?CryptoKey,		+encryptionKey?: ?CryptoKey,
+accountEncryptionKey?: ?CryptoKey,		+accountEncryptionKey?: ?CryptoKey,
+accountWithPicklingKey?: PickledOLMAccount,		+accountWithPicklingKey?: PickledOLMAccount,
+synchronizationValue: ?string,		+synchronizationValue: ?string,
▲ Show 20 Lines • Show All 79 Lines • ▼ Show 20 Lines	try {
// likely shared worker persisted its own data		// likely shared worker persisted its own data
console.log(e);		console.log(e);
}		}
}		}

async function decryptWebNotification(		async function decryptWebNotification(
encryptedNotification: EncryptedWebNotification,		encryptedNotification: EncryptedWebNotification,
): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {		): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {
const { id, keyserverID, encryptedPayload } = encryptedNotification;		const {
invariant(keyserverID, 'KeyserverID must be present to decrypt a notif');		id,
		encryptedPayload,
		type: messageType,
		...rest
		} = encryptedNotification;
		const senderDeviceDescriptor: SenderDeviceDescriptor = rest;

const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(		const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(
WEB_NOTIFS_SERVICE_UTILS_KEY,		WEB_NOTIFS_SERVICE_UTILS_KEY,
);		);

if (!utilsData) {		if (!utilsData) {
return { id, error: 'Necessary data not found in IndexedDB' };		return { id, error: 'Necessary data not found in IndexedDB' };
}		}
const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);		const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);

let olmDBKeys;		let notifsAccountWithOlmData;
try {		try {
olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);		notifsAccountWithOlmData = await getNotifsAccountWithOlmData(
		senderDeviceDescriptor,
		);
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
const { olmDataKey, encryptionKeyDBKey } = olmDBKeys;
const [encryptedOlmData, encryptionKey] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),
retrieveEncryptionKey(encryptionKeyDBKey),
]);

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
id,		encryptedOlmData,
error: 'Received encrypted notification but olm session was not created',		olmDataKey,
displayErrorMessage: staffCanSee,		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
};		accountEncryptionKey,
}		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

try {		try {
await olm.init({ locateFile: () => olmWasmPath });		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
const decryptedNotification = await commonDecrypt<PlainTextWebNotification>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		olm.init({ locateFile: () => olmWasmPath }),
		]);

		let decryptedNotification;
		let updatedOlmData;
		let updatedNotifsAccount;

		const { senderDeviceID, keyserverID } = senderDeviceDescriptor;

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		} = await commonDecrypt<PlainTextWebNotification>(
		notificationsOlmData,
encryptedPayload,		encryptedPayload,
);		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;

invariant(keyserverID, 'Keyserver ID must be set to update badge counts');		invariant(keyserverID, 'Keyserver ID must be set to update badge counts');
await updateNotifsUnreadCountStorage({		await Promise.all([
		persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		}),
		updateNotifsUnreadCountStorage({
[keyserverID]: unreadCount,		[keyserverID]: unreadCount,
		}),
		]);

		return { id, ...decryptedNotification };
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		updatedNotifsAccount: resultUpdatedNotifsAccount,
		} = await commonPeerDecrypt<PlainTextWebNotification>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
		updatedNotifsAccount = resultUpdatedNotifsAccount;

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
});		});

return { id, ...decryptedNotification };		return { id, ...decryptedNotification };
		}
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
}		}

async function decryptDesktopNotification(		async function decryptDesktopNotification(
encryptedPayload: string,		encryptedPayload: string,
		messageType: string,
staffCanSee: boolean,		staffCanSee: boolean,
keyserverID?: string,		senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{ +[string]: mixed }> {		): Promise<{ +[string]: mixed }> {
let encryptedOlmData, encryptionKey, olmDataKey;		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
try {
const { olmDataKey: olmDataKeyValue, encryptionKeyDBKey } =
await getNotifsOlmSessionDBKeys(keyserverID);

olmDataKey = olmDataKeyValue;		let notifsAccountWithOlmData;
		try {
[encryptedOlmData, encryptionKey] = await Promise.all([		[notifsAccountWithOlmData] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),		getNotifsAccountWithOlmData(senderDeviceDescriptor),
retrieveEncryptionKey(encryptionKeyDBKey),
initOlm(),		initOlm(),
]);		]);
} catch (e) {		} catch (e) {
return {		return {
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
error: 'Received encrypted notification but olm session was not created',		encryptedOlmData,
displayErrorMessage: staffCanSee,		olmDataKey,
};		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
}		accountEncryptionKey,
		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

let decryptedNotification;
try {		try {
decryptedNotification = await commonDecrypt<{ +[string]: mixed }>(		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
encryptedPayload,		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		]);

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
);		);
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}

if (!keyserverID) {		const { decryptedNotification, updatedOlmData } = await commonDecrypt<{
return decryptedNotification;		+[string]: mixed,
}		}>(notificationsOlmData, encryptedPayload);

		const updatedOlmDataPersistencePromise = persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		});

// iOS notifications require that unread count is set under		// iOS notifications require that unread count is set under
// `badge` key. Since MacOS notifications are created by the		// `badge` key. Since MacOS notifications are created by the
// same function the unread count is also set under `badge` key		// same function the unread count is also set under `badge` key
const { badge } = decryptedNotification;		const { badge } = decryptedNotification;
if (typeof badge === 'number') {		if (typeof badge === 'number') {
await updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge });		await Promise.all([
		updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }),
		updatedOlmDataPersistencePromise,
		]);
return decryptedNotification;		return decryptedNotification;
}		}

const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;
if (typeof unreadCount === 'number') {		if (typeof unreadCount === 'number') {
await updateNotifsUnreadCountStorage({		await Promise.all([
		updateNotifsUnreadCountStorage({
[(keyserverID: string)]: unreadCount,		[(keyserverID: string)]: unreadCount,
});		}),
		updatedOlmDataPersistencePromise,
		]);
}		}

		return decryptedNotification;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);

		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const { decryptedNotification, updatedOlmData, updatedNotifsAccount } =
		await commonPeerDecrypt<{
		+[string]: mixed,
		}>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
		});

return decryptedNotification;		return decryptedNotification;
}		}
		} catch (e) {
		return {
		error: e.message,
		staffCanSee,
		};
		}
		}

async function commonDecrypt<T>(		async function commonDecrypt<T>(
encryptedOlmData: EncryptedData,		notificationsOlmData: NotificationsOlmDataType,
olmDataKey: string,
encryptionKey: CryptoKey,
encryptedPayload: string,		encryptedPayload: string,
): Promise<T> {		): Promise<{
const serializedOlmData = await decryptData(encryptedOlmData, encryptionKey);		+decryptedNotification: T,
		+updatedOlmData: NotificationsOlmDataType,
		}> {
const {		const {
mainSession,		mainSession,
picklingKey,		picklingKey,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp,		updateCreationTimestamp,
}: NotificationsOlmDataType = JSON.parse(		} = notificationsOlmData;
new TextDecoder().decode(serializedOlmData),
);

let updatedOlmData: NotificationsOlmDataType;		let updatedOlmData: NotificationsOlmDataType;
let decryptedNotification: T;		let decryptedNotification: T;

const shouldUpdateMainSession =		const shouldUpdateMainSession =
Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;		Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;

const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(		const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(
Show All 26 Lines	if (decryptionWithPendingSessionResult.decryptedNotification) {
updatedOlmData = {		updatedOlmData = {
mainSession: mainSession,		mainSession: mainSession,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp: newUpdateCreationTimestamp,		updateCreationTimestamp: newUpdateCreationTimestamp,
picklingKey,		picklingKey,
};		};
}		}

const updatedEncryptedSession = await encryptData(		return { decryptedNotification, updatedOlmData };
new TextEncoder().encode(JSON.stringify(updatedOlmData)),		}
encryptionKey,
		async function commonPeerDecrypt<T>(
		senderDeviceID: string,
		notificationsOlmData: ?NotificationsOlmDataType,
		notificationAccount: PickledOLMAccount,
		messageType: string,
		encryptedPayload: string,
		): Promise<{
		+decryptedNotification: T,
		+updatedOlmData?: NotificationsOlmDataType,
		+updatedNotifsAccount?: PickledOLMAccount,
		}> {
		if (
		messageType !== olmEncryptedMessageTypes.PREKEY.toString() &&
		messageType !== olmEncryptedMessageTypes.TEXT.toString()
		) {
		throw new Error(
		`Received message of invalid type from device: ${senderDeviceID}`,
);		);
		}

await localforage.setItem(olmDataKey, updatedEncryptedSession);		let isSenderChainEmpty = true;
		let hasReceivedMessage = false;
		const sessionExists = !!notificationsOlmData;

return decryptedNotification;		if (notificationsOlmData) {
		const session = new olm.Session();
		session.unpickle(
		notificationsOlmData.picklingKey,
		notificationsOlmData.pendingSessionUpdate,
		);

		isSenderChainEmpty = session.is_sender_chain_empty();
		hasReceivedMessage = session.has_received_message();
		}

		// regular message
		const isRegularMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.TEXT.toString();

		const isRegularPrekeyMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.PREKEY.toString() &&
		isSenderChainEmpty &&
		hasReceivedMessage;

		if (!!notificationsOlmData && (isRegularMessage \|\| isRegularPrekeyMessage)) {
		return await commonDecrypt<T>(notificationsOlmData, encryptedPayload);
		}

		// At this point we either face race condition or session reset attempt or
		// session initialization attempt. For each of this scenario new inbound
		// session must be created in order to decrypt message
		const authMetadata = await fetchAuthMetadata();
		const notifInboundKeys = await getNotifsInboundKeysForDeviceID(
		senderDeviceID,
		authMetadata,
		);

		const account = new olm.Account();
		const session = new olm.Session();

		account.unpickle(
		notificationAccount.picklingKey,
		notificationAccount.pickledAccount,
		);

		if (notifInboundKeys.error) {
		throw new Error(notifInboundKeys.error);
		}

		invariant(
		notifInboundKeys.curve25519,
		'curve25519 must be present in notifs inbound keys',
		);

		session.create_inbound_from(
		account,
		notifInboundKeys.curve25519,
		encryptedPayload,
		);

		const decryptedNotification: T = JSON.parse(
		session.decrypt(Number(messageType), encryptedPayload),
		);

		// session reset attempt or session initialization - handled the same
		const sessionResetAttempt =
		sessionExists && !isSenderChainEmpty && hasReceivedMessage;

		// race condition
		const raceCondition =
		sessionExists && !isSenderChainEmpty && !hasReceivedMessage;
		const { deviceID: ourDeviceID } = authMetadata;
		invariant(ourDeviceID, 'Session creation attempt but no device id');

		const thisDeviceWinsRaceCondition = ourDeviceID > senderDeviceID;

		if (
		!sessionExists \|\|
		sessionResetAttempt \|\|
		(raceCondition && !thisDeviceWinsRaceCondition)
		) {
		const pickledOlmSession = session.pickle(notificationAccount.picklingKey);
		const updatedOlmData = {
		mainSession: pickledOlmSession,
		pendingSessionUpdate: pickledOlmSession,
		updateCreationTimestamp: Date.now(),
		picklingKey: notificationAccount.picklingKey,
		};
		const updatedNotifsAccount = {
		pickledAccount: account.pickle(notificationAccount.picklingKey),
		picklingKey: notificationAccount.picklingKey,
		};
		return {
		decryptedNotification,
		updatedOlmData,
		updatedNotifsAccount,
		};
		}

		// If there is a race condition but we win device id comparison
		// we return object that carries decrypted data but won't persist
		// any session state
		return { decryptedNotification };
}		}

function decryptWithSession<T>(		function decryptWithSession<T>(
pickledSession: string,		pickledSession: string,
picklingKey: string,		picklingKey: string,
encryptedPayload: string,		encryptedPayload: string,
): DecryptionResult<T> {		): DecryptionResult<T> {
const session = new olm.Session();		const session = new olm.Session();
▲ Show 20 Lines • Show All 472 Lines • Show Last 20 Lines

[terraform] bump staging identity to 0.31-stagingClosedPublicActions