Paths

Table of Contentst

-
keyserver/src/updaters/
-
src/
-
updaters/
-
thread-updaters.js

Differential D13640

[keyserver] cache findUserIdentities response
ClosedPublic
Actions

Authored by varun on Oct 8 2024, 9:36 PM.

Details

Reviewers

ashoat

Commits

rCOMMe22e879f9a0d: [keyserver] cache findUserIdentities response

Summary

when possible, we should get the user identity in question from the redis cache. if we can't get it, then we call identity and -- in the background -- cache the response

Depends on D13639

Test Plan

called getUserFarcasterID in a loop 10 times with a 10 second sleep in between each call and confirmed that only the first invocation of the function led to an identity service API call

Diff Detail

Repository

rCOMM Comm

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

varun created this revision.Oct 8 2024, 9:36 PM

Herald added a subscriber: tomek. · View Herald TranscriptOct 8 2024, 9:36 PM

Harbormaster completed remote builds in B32118: Diff 44988.Oct 8 2024, 9:53 PM

varun requested review of this revision.Oct 8 2024, 9:53 PM

ashoat accepted this revision.Oct 9 2024, 5:57 AM

ashoat added inline comments.

keyserver/src/updaters/thread-updaters.js
971–975 ↗	(On Diff #44988)	What's the point of the IIFE?

This revision is now accepted and ready to land.Oct 9 2024, 5:57 AM

ashoat added inline comments.Oct 9 2024, 5:58 AM

keyserver/src/updaters/thread-updaters.js
970 ↗	(On Diff #44988)	Can we invert this condition to early exit? Wondering – why don't we cache null results?

varun added inline comments.Oct 9 2024, 9:41 AM

keyserver/src/updaters/thread-updaters.js
970 ↗	(On Diff #44988)	yeah to avoid overcomplicating the API. we could store null results but then `redisCache.getUserIdentity` and the above function would have to distinguish between `null` and `undefined`. this seems error-prone and i'm not sure it's worth the trouble. in this case, we only call `getUserFarcasterID` with the viewer's userID, so we expect the identity service to have this user's identity. the other place where we might want to use this cache is in `updateRelationships`, where we call `findUserIdentities`. caching null results might be more useful here but i'm not sure

exit early and remove iife

This revision was landed with ongoing or failed builds.Oct 10 2024, 9:10 AM

Closed by commit rCOMMe22e879f9a0d: [keyserver] cache findUserIdentities response (authored by varun). · Explain Why

This revision was automatically updated to reflect the committed changes.

varun added a commit: rCOMMe22e879f9a0d: [keyserver] cache findUserIdentities response.

Harbormaster completed remote builds in B32180: Diff 45060.Oct 10 2024, 9:26 AM

Revision Contents
Changeset List

Path

Size

keyserver/

src/

updaters/

thread-updaters.js

20 lines

Diff 45062

View Options

keyserver/src/updaters/thread-updaters.js

// @flow		// @flow

import olm from '@commapp/olm';		import olm from '@commapp/olm';
import type { EncryptResult } from '@commapp/olm';		import type { EncryptResult } from '@commapp/olm';
import invariant from 'invariant';		import invariant from 'invariant';
import localforage from 'localforage';		import localforage from 'localforage';
import uuid from 'uuid';		import uuid from 'uuid';

import {		import {
olmEncryptedMessageTypes,		olmEncryptedMessageTypes,
type NotificationsOlmDataType,		type NotificationsOlmDataType,
type PickledOLMAccount,		type PickledOLMAccount,
} from 'lib/types/crypto-types.js';		} from 'lib/types/crypto-types.js';
import type {		import type {
PlainTextWebNotification,		PlainTextWebNotification,
EncryptedWebNotification,		EncryptedWebNotification,
		SenderDeviceDescriptor,
} from 'lib/types/notif-types.js';		} from 'lib/types/notif-types.js';
import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';		import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';
import { getMessageForException } from 'lib/utils/errors.js';		import { getMessageForException } from 'lib/utils/errors.js';
import { promiseAll } from 'lib/utils/promises.js';		import { promiseAll } from 'lib/utils/promises.js';
import { assertWithValidator } from 'lib/utils/validation-utils.js';		import { assertWithValidator } from 'lib/utils/validation-utils.js';

import {		import {
		fetchAuthMetadata,
		getNotifsInboundKeysForDeviceID,
		} from './services-client.js';
		import {
type EncryptedData,		type EncryptedData,
decryptData,		decryptData,
encryptData,		encryptData,
importJWKKey,		importJWKKey,
exportKeyToJWK,		exportKeyToJWK,
generateCryptoKey,		generateCryptoKey,
encryptedAESDataValidator,		encryptedAESDataValidator,
extendedCryptoKeyValidator,		extendedCryptoKeyValidator,
▲ Show 20 Lines • Show All 55 Lines • ▼ Show 20 Lines	async function deserializeEncryptedData<T>(
encryptedData: EncryptedData,		encryptedData: EncryptedData,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<T> {		): Promise<T> {
const serializedData = await decryptData(encryptedData, encryptionKey);		const serializedData = await decryptData(encryptedData, encryptionKey);
const data: T = JSON.parse(new TextDecoder().decode(serializedData));		const data: T = JSON.parse(new TextDecoder().decode(serializedData));
return data;		return data;
}		}

		async function deserializeEncryptedDataOptional<T>(
		encryptedData: ?EncryptedData,
		encryptionKey: ?CryptoKey,
		): Promise<?T> {
		if (!encryptedData \|\| !encryptionKey) {
		return undefined;
		}
		return deserializeEncryptedData<T>(encryptedData, encryptionKey);
		}

async function serializeUnencryptedData<T>(		async function serializeUnencryptedData<T>(
data: T,		data: T,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<EncryptedData> {		): Promise<EncryptedData> {
const dataAsString = JSON.stringify(data);		const dataAsString = JSON.stringify(data);
invariant(		invariant(
dataAsString,		dataAsString,
'Attempt to serialize null or undefined is forbidden',		'Attempt to serialize null or undefined is forbidden',
);		);
return await encryptData(		return await encryptData(
new TextEncoder().encode(dataAsString),		new TextEncoder().encode(dataAsString),
encryptionKey,		encryptionKey,
);		);
}		}

async function validateCryptoKey(		async function validateCryptoKey(
cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,		cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,
): Promise<CryptoKey> {		): Promise<CryptoKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return ((cryptoKey: any): CryptoKey);		return ((cryptoKey: any): CryptoKey);
}		}
return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));		return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));
}		}

		async function validateCryptoKeyOptional(
		cryptoKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		): Promise<?CryptoKey> {
		if (!cryptoKey) {
		return undefined;
		}
		return validateCryptoKey(cryptoKey);
		}

async function getCryptoKeyPersistentForm(		async function getCryptoKeyPersistentForm(
cryptoKey: CryptoKey,		cryptoKey: CryptoKey,
): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {		): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return cryptoKey;		return cryptoKey;
}		}

// Safari doesn't support structured clone algorithm in service		// Safari doesn't support structured clone algorithm in service
// worker context so we have to store CryptoKey as JSON		// worker context so we have to store CryptoKey as JSON
return await exportKeyToJWK(cryptoKey);		return await exportKeyToJWK(cryptoKey);
}		}

		async function getNotifsAccountWithOlmData(
		senderDeviceDescriptor: SenderDeviceDescriptor,
		): Promise<{
		+encryptedOlmData: ?EncryptedData,
		+encryptionKey: ?CryptoKey,
		+olmDataKey: string,
		+encryptionKeyDBLabel: string,
		+encryptedOlmAccount: ?EncryptedData,
		+accountEncryptionKey: ?CryptoKey,
		+synchronizationValue: ?string,
		}> {
		let olmDataKey;
		let olmDataEncryptionKeyDBLabel;
		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;

		if (keyserverID) {
		const olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);
		const { olmDataKey: fetchedOlmDataKey, encryptionKeyDBKey } = olmDBKeys;
		olmDataKey = fetchedOlmDataKey;
		olmDataEncryptionKeyDBLabel = encryptionKeyDBKey;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		olmDataKey = getOlmDataKeyForDeviceID(senderDeviceID);
		olmDataEncryptionKeyDBLabel =
		getOlmEncryptionKeyDBLabelForDeviceID(senderDeviceID);
		}

		const queryResult = await localforage.getMultipleItems<{
		notificationAccount: ?EncryptedData,
		notificationAccountEncryptionKey: ?CryptoKey,
		synchronizationValue: ?number,
		[string]: ?EncryptedData \| ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		}>(
		[
		INDEXED_DB_NOTIFS_ACCOUNT_KEY,
		INDEXED_DB_NOTIFS_ACCOUNT_ENCRYPTION_KEY_DB_LABEL,
		olmDataEncryptionKeyDBLabel,
		olmDataKey,
		],
		INDEXED_DB_NOTIFS_SYNC_KEY,
		);

		const {
		values: {
		notificationAccount,
		notificationAccountEncryptionKey,
		[olmDataKey]: maybeEncryptedOlmData,
		[olmDataEncryptionKeyDBLabel]: maybeOlmDataEncryptionKey,
		},
		synchronizationValue,
		} = queryResult;

		if (!notificationAccount \|\| !notificationAccountEncryptionKey) {
		throw new Error(
		'Attempt to decrypt notification but olm account not initialized.',
		);
		}

		const encryptedOlmData: ?EncryptedData = maybeEncryptedOlmData
		? assertWithValidator(maybeEncryptedOlmData, encryptedAESDataValidator)
		: undefined;

		const olmDataEncryptionKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey =
		maybeOlmDataEncryptionKey
		? assertWithValidator(
		maybeOlmDataEncryptionKey,
		extendedCryptoKeyValidator,
		)
		: undefined;

		const [encryptionKey, accountEncryptionKey] = await Promise.all([
		validateCryptoKeyOptional(olmDataEncryptionKey),
		validateCryptoKey(notificationAccountEncryptionKey),
		]);

		return {
		encryptedOlmData,
		encryptionKey,
		encryptionKeyDBLabel: olmDataEncryptionKeyDBLabel,
		encryptedOlmAccount: notificationAccount,
		olmDataKey,
		accountEncryptionKey,
		synchronizationValue,
		};
		}

async function persistNotifsAccountWithOlmData(input: {		async function persistNotifsAccountWithOlmData(input: {
+olmDataKey?: string,		+olmDataKey?: string,
+olmEncryptionKeyDBLabel?: string,		+olmEncryptionKeyDBLabel?: string,
+olmData?: ?NotificationsOlmDataType,		+olmData?: ?NotificationsOlmDataType,
+encryptionKey?: ?CryptoKey,		+encryptionKey?: ?CryptoKey,
+accountEncryptionKey?: ?CryptoKey,		+accountEncryptionKey?: ?CryptoKey,
+accountWithPicklingKey?: PickledOLMAccount,		+accountWithPicklingKey?: PickledOLMAccount,
+synchronizationValue: ?string,		+synchronizationValue: ?string,
▲ Show 20 Lines • Show All 79 Lines • ▼ Show 20 Lines	try {
// likely shared worker persisted its own data		// likely shared worker persisted its own data
console.log(e);		console.log(e);
}		}
}		}

async function decryptWebNotification(		async function decryptWebNotification(
encryptedNotification: EncryptedWebNotification,		encryptedNotification: EncryptedWebNotification,
): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {		): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {
const { id, keyserverID, encryptedPayload } = encryptedNotification;		const {
invariant(keyserverID, 'KeyserverID must be present to decrypt a notif');		id,
		encryptedPayload,
		type: messageType,
		...rest
		} = encryptedNotification;
		const senderDeviceDescriptor: SenderDeviceDescriptor = rest;

const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(		const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(
WEB_NOTIFS_SERVICE_UTILS_KEY,		WEB_NOTIFS_SERVICE_UTILS_KEY,
);		);

if (!utilsData) {		if (!utilsData) {
return { id, error: 'Necessary data not found in IndexedDB' };		return { id, error: 'Necessary data not found in IndexedDB' };
}		}
const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);		const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);

let olmDBKeys;		let notifsAccountWithOlmData;
try {		try {
olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);		notifsAccountWithOlmData = await getNotifsAccountWithOlmData(
		senderDeviceDescriptor,
		);
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
const { olmDataKey, encryptionKeyDBKey } = olmDBKeys;
const [encryptedOlmData, encryptionKey] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),
retrieveEncryptionKey(encryptionKeyDBKey),
]);

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
id,		encryptedOlmData,
error: 'Received encrypted notification but olm session was not created',		olmDataKey,
displayErrorMessage: staffCanSee,		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
};		accountEncryptionKey,
}		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

try {		try {
await olm.init({ locateFile: () => olmWasmPath });		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
const decryptedNotification = await commonDecrypt<PlainTextWebNotification>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		olm.init({ locateFile: () => olmWasmPath }),
		]);

		let decryptedNotification;
		let updatedOlmData;
		let updatedNotifsAccount;

		const { senderDeviceID, keyserverID } = senderDeviceDescriptor;

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		} = await commonDecrypt<PlainTextWebNotification>(
		notificationsOlmData,
encryptedPayload,		encryptedPayload,
);		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;

invariant(keyserverID, 'Keyserver ID must be set to update badge counts');		invariant(keyserverID, 'Keyserver ID must be set to update badge counts');
await updateNotifsUnreadCountStorage({		await Promise.all([
		persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		}),
		updateNotifsUnreadCountStorage({
[keyserverID]: unreadCount,		[keyserverID]: unreadCount,
		}),
		]);

		return { id, ...decryptedNotification };
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		updatedNotifsAccount: resultUpdatedNotifsAccount,
		} = await commonPeerDecrypt<PlainTextWebNotification>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
		updatedNotifsAccount = resultUpdatedNotifsAccount;

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
});		});

return { id, ...decryptedNotification };		return { id, ...decryptedNotification };
		}
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
}		}

async function decryptDesktopNotification(		async function decryptDesktopNotification(
encryptedPayload: string,		encryptedPayload: string,
		messageType: string,
staffCanSee: boolean,		staffCanSee: boolean,
keyserverID?: string,		senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{ +[string]: mixed }> {		): Promise<{ +[string]: mixed }> {
let encryptedOlmData, encryptionKey, olmDataKey;		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
try {
const { olmDataKey: olmDataKeyValue, encryptionKeyDBKey } =
await getNotifsOlmSessionDBKeys(keyserverID);

olmDataKey = olmDataKeyValue;		let notifsAccountWithOlmData;
		try {
[encryptedOlmData, encryptionKey] = await Promise.all([		[notifsAccountWithOlmData] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),		getNotifsAccountWithOlmData(senderDeviceDescriptor),
retrieveEncryptionKey(encryptionKeyDBKey),
initOlm(),		initOlm(),
]);		]);
} catch (e) {		} catch (e) {
return {		return {
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
error: 'Received encrypted notification but olm session was not created',		encryptedOlmData,
displayErrorMessage: staffCanSee,		olmDataKey,
};		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
}		accountEncryptionKey,
		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

let decryptedNotification;
try {		try {
decryptedNotification = await commonDecrypt<{ +[string]: mixed }>(		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
encryptedPayload,		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		]);

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
);		);
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}

if (!keyserverID) {		const { decryptedNotification, updatedOlmData } = await commonDecrypt<{
return decryptedNotification;		+[string]: mixed,
}		}>(notificationsOlmData, encryptedPayload);

		const updatedOlmDataPersistencePromise = persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		});

// iOS notifications require that unread count is set under		// iOS notifications require that unread count is set under
// `badge` key. Since MacOS notifications are created by the		// `badge` key. Since MacOS notifications are created by the
// same function the unread count is also set under `badge` key		// same function the unread count is also set under `badge` key
const { badge } = decryptedNotification;		const { badge } = decryptedNotification;
if (typeof badge === 'number') {		if (typeof badge === 'number') {
await updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge });		await Promise.all([
		updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }),
		updatedOlmDataPersistencePromise,
		]);
return decryptedNotification;		return decryptedNotification;
}		}

const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;
if (typeof unreadCount === 'number') {		if (typeof unreadCount === 'number') {
await updateNotifsUnreadCountStorage({		await Promise.all([
		updateNotifsUnreadCountStorage({
[(keyserverID: string)]: unreadCount,		[(keyserverID: string)]: unreadCount,
});		}),
		updatedOlmDataPersistencePromise,
		]);
}		}

		return decryptedNotification;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);

		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const { decryptedNotification, updatedOlmData, updatedNotifsAccount } =
		await commonPeerDecrypt<{
		+[string]: mixed,
		}>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
		});

return decryptedNotification;		return decryptedNotification;
}		}
		} catch (e) {
		return {
		error: e.message,
		staffCanSee,
		};
		}
		}

async function commonDecrypt<T>(		async function commonDecrypt<T>(
encryptedOlmData: EncryptedData,		notificationsOlmData: NotificationsOlmDataType,
olmDataKey: string,
encryptionKey: CryptoKey,
encryptedPayload: string,		encryptedPayload: string,
): Promise<T> {		): Promise<{
const serializedOlmData = await decryptData(encryptedOlmData, encryptionKey);		+decryptedNotification: T,
		+updatedOlmData: NotificationsOlmDataType,
		}> {
const {		const {
mainSession,		mainSession,
picklingKey,		picklingKey,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp,		updateCreationTimestamp,
}: NotificationsOlmDataType = JSON.parse(		} = notificationsOlmData;
new TextDecoder().decode(serializedOlmData),
);

let updatedOlmData: NotificationsOlmDataType;		let updatedOlmData: NotificationsOlmDataType;
let decryptedNotification: T;		let decryptedNotification: T;

const shouldUpdateMainSession =		const shouldUpdateMainSession =
Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;		Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;

const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(		const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(
Show All 26 Lines	if (decryptionWithPendingSessionResult.decryptedNotification) {
updatedOlmData = {		updatedOlmData = {
mainSession: mainSession,		mainSession: mainSession,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp: newUpdateCreationTimestamp,		updateCreationTimestamp: newUpdateCreationTimestamp,
picklingKey,		picklingKey,
};		};
}		}

const updatedEncryptedSession = await encryptData(		return { decryptedNotification, updatedOlmData };
new TextEncoder().encode(JSON.stringify(updatedOlmData)),		}
encryptionKey,
		async function commonPeerDecrypt<T>(
		senderDeviceID: string,
		notificationsOlmData: ?NotificationsOlmDataType,
		notificationAccount: PickledOLMAccount,
		messageType: string,
		encryptedPayload: string,
		): Promise<{
		+decryptedNotification: T,
		+updatedOlmData?: NotificationsOlmDataType,
		+updatedNotifsAccount?: PickledOLMAccount,
		}> {
		if (
		messageType !== olmEncryptedMessageTypes.PREKEY.toString() &&
		messageType !== olmEncryptedMessageTypes.TEXT.toString()
		) {
		throw new Error(
		`Received message of invalid type from device: ${senderDeviceID}`,
);		);
		}

await localforage.setItem(olmDataKey, updatedEncryptedSession);		let isSenderChainEmpty = true;
		let hasReceivedMessage = false;
		const sessionExists = !!notificationsOlmData;

return decryptedNotification;		if (notificationsOlmData) {
		const session = new olm.Session();
		session.unpickle(
		notificationsOlmData.picklingKey,
		notificationsOlmData.pendingSessionUpdate,
		);

		isSenderChainEmpty = session.is_sender_chain_empty();
		hasReceivedMessage = session.has_received_message();
		}

		// regular message
		const isRegularMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.TEXT.toString();

		const isRegularPrekeyMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.PREKEY.toString() &&
		isSenderChainEmpty &&
		hasReceivedMessage;

		if (!!notificationsOlmData && (isRegularMessage \|\| isRegularPrekeyMessage)) {
		return await commonDecrypt<T>(notificationsOlmData, encryptedPayload);
		}

		// At this point we either face race condition or session reset attempt or
		// session initialization attempt. For each of this scenario new inbound
		// session must be created in order to decrypt message
		const authMetadata = await fetchAuthMetadata();
		const notifInboundKeys = await getNotifsInboundKeysForDeviceID(
		senderDeviceID,
		authMetadata,
		);

		const account = new olm.Account();
		const session = new olm.Session();

		account.unpickle(
		notificationAccount.picklingKey,
		notificationAccount.pickledAccount,
		);

		if (notifInboundKeys.error) {
		throw new Error(notifInboundKeys.error);
		}

		invariant(
		notifInboundKeys.curve25519,
		'curve25519 must be present in notifs inbound keys',
		);

		session.create_inbound_from(
		account,
		notifInboundKeys.curve25519,
		encryptedPayload,
		);

		const decryptedNotification: T = JSON.parse(
		session.decrypt(Number(messageType), encryptedPayload),
		);

		// session reset attempt or session initialization - handled the same
		const sessionResetAttempt =
		sessionExists && !isSenderChainEmpty && hasReceivedMessage;

		// race condition
		const raceCondition =
		sessionExists && !isSenderChainEmpty && !hasReceivedMessage;
		const { deviceID: ourDeviceID } = authMetadata;
		invariant(ourDeviceID, 'Session creation attempt but no device id');

		const thisDeviceWinsRaceCondition = ourDeviceID > senderDeviceID;

		if (
		!sessionExists \|\|
		sessionResetAttempt \|\|
		(raceCondition && !thisDeviceWinsRaceCondition)
		) {
		const pickledOlmSession = session.pickle(notificationAccount.picklingKey);
		const updatedOlmData = {
		mainSession: pickledOlmSession,
		pendingSessionUpdate: pickledOlmSession,
		updateCreationTimestamp: Date.now(),
		picklingKey: notificationAccount.picklingKey,
		};
		const updatedNotifsAccount = {
		pickledAccount: account.pickle(notificationAccount.picklingKey),
		picklingKey: notificationAccount.picklingKey,
		};
		return {
		decryptedNotification,
		updatedOlmData,
		updatedNotifsAccount,
		};
		}

		// If there is a race condition but we win device id comparison
		// we return object that carries decrypted data but won't persist
		// any session state
		return { decryptedNotification };
}		}

function decryptWithSession<T>(		function decryptWithSession<T>(
pickledSession: string,		pickledSession: string,
picklingKey: string,		picklingKey: string,
encryptedPayload: string,		encryptedPayload: string,
): DecryptionResult<T> {		): DecryptionResult<T> {
const session = new olm.Session();		const session = new olm.Session();
▲ Show 20 Lines • Show All 472 Lines • Show Last 20 Lines

[keyserver] cache findUserIdentities responseClosedPublicActions