Page MenuHomePhabricator
Differential D13692

[lib] Add Angelika to staff list
ClosedPublic
Actions

Authored by ashoat on Oct 10 2024, 7:03 AM.
Tags
None
Referenced Files
F5104901: D13692.diff
Tue, Apr 1, 5:34 AM
Unknown Object (File)
Feb 28 2025, 3:31 PM
Unknown Object (File)
Feb 28 2025, 3:31 PM
Unknown Object (File)
Feb 6 2025, 10:40 AM
Unknown Object (File)
Feb 6 2025, 3:57 AM
Unknown Object (File)
Feb 6 2025, 3:57 AM
Unknown Object (File)
Feb 3 2025, 12:13 PM
Unknown Object (File)
Dec 31 2024, 2:12 PM
View All 51 Files
Subscribers
None

Details

Reviewers
tomek
Commits
rCOMM8308ae871579: [lib] Add Angelika to staff list
Test Plan

N/A

Diff Detail

Repository
rCOMM Comm
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
lib/
facts/
1 line

Diff 45055

View Options

lib/facts/staff.js

// @flow // @flow
import olm from '@commapp/olm'; import olm from '@commapp/olm';
import type { EncryptResult } from '@commapp/olm'; import type { EncryptResult } from '@commapp/olm';
import invariant from 'invariant'; import invariant from 'invariant';
import localforage from 'localforage'; import localforage from 'localforage';
import uuid from 'uuid'; import uuid from 'uuid';
import { import {
olmEncryptedMessageTypes, olmEncryptedMessageTypes,
type NotificationsOlmDataType, type NotificationsOlmDataType,
type PickledOLMAccount, type PickledOLMAccount,
} from 'lib/types/crypto-types.js'; } from 'lib/types/crypto-types.js';
import type { import type {
PlainTextWebNotification, PlainTextWebNotification,
EncryptedWebNotification, EncryptedWebNotification,
SenderDeviceDescriptor,
} from 'lib/types/notif-types.js'; } from 'lib/types/notif-types.js';
import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js'; import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';
import { getMessageForException } from 'lib/utils/errors.js'; import { getMessageForException } from 'lib/utils/errors.js';
import { promiseAll } from 'lib/utils/promises.js'; import { promiseAll } from 'lib/utils/promises.js';
import { assertWithValidator } from 'lib/utils/validation-utils.js'; import { assertWithValidator } from 'lib/utils/validation-utils.js';
import { import {
fetchAuthMetadata,
getNotifsInboundKeysForDeviceID,
} from './services-client.js';
import {
type EncryptedData, type EncryptedData,
decryptData, decryptData,
encryptData, encryptData,
importJWKKey, importJWKKey,
exportKeyToJWK, exportKeyToJWK,
generateCryptoKey, generateCryptoKey,
encryptedAESDataValidator, encryptedAESDataValidator,
extendedCryptoKeyValidator, extendedCryptoKeyValidator,
▲ Show 20 Lines • Show All 55 Lines • ▼ Show 20 Linesasync function deserializeEncryptedData<T>(
encryptedData: EncryptedData, encryptedData: EncryptedData,
encryptionKey: CryptoKey, encryptionKey: CryptoKey,
): Promise<T> { ): Promise<T> {
const serializedData = await decryptData(encryptedData, encryptionKey); const serializedData = await decryptData(encryptedData, encryptionKey);
const data: T = JSON.parse(new TextDecoder().decode(serializedData)); const data: T = JSON.parse(new TextDecoder().decode(serializedData));
return data; return data;
} }
async function deserializeEncryptedDataOptional<T>(
encryptedData: ?EncryptedData,
encryptionKey: ?CryptoKey,
): Promise<?T> {
if (!encryptedData || !encryptionKey) {
return undefined;
}
return deserializeEncryptedData<T>(encryptedData, encryptionKey);
}
async function serializeUnencryptedData<T>( async function serializeUnencryptedData<T>(
data: T, data: T,
encryptionKey: CryptoKey, encryptionKey: CryptoKey,
): Promise<EncryptedData> { ): Promise<EncryptedData> {
const dataAsString = JSON.stringify(data); const dataAsString = JSON.stringify(data);
invariant( invariant(
dataAsString, dataAsString,
'Attempt to serialize null or undefined is forbidden', 'Attempt to serialize null or undefined is forbidden',
); );
return await encryptData( return await encryptData(
new TextEncoder().encode(dataAsString), new TextEncoder().encode(dataAsString),
encryptionKey, encryptionKey,
); );
} }
async function validateCryptoKey( async function validateCryptoKey(
cryptoKey: CryptoKey | SubtleCrypto$JsonWebKey, cryptoKey: CryptoKey | SubtleCrypto$JsonWebKey,
): Promise<CryptoKey> { ): Promise<CryptoKey> {
if (!isDesktopSafari) { if (!isDesktopSafari) {
return ((cryptoKey: any): CryptoKey); return ((cryptoKey: any): CryptoKey);
} }
return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey)); return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));
} }
async function validateCryptoKeyOptional(
cryptoKey: ?CryptoKey | ?SubtleCrypto$JsonWebKey,
): Promise<?CryptoKey> {
if (!cryptoKey) {
return undefined;
}
return validateCryptoKey(cryptoKey);
}
async function getCryptoKeyPersistentForm( async function getCryptoKeyPersistentForm(
cryptoKey: CryptoKey, cryptoKey: CryptoKey,
): Promise<CryptoKey | SubtleCrypto$JsonWebKey> { ): Promise<CryptoKey | SubtleCrypto$JsonWebKey> {
if (!isDesktopSafari) { if (!isDesktopSafari) {
return cryptoKey; return cryptoKey;
} }
// Safari doesn't support structured clone algorithm in service // Safari doesn't support structured clone algorithm in service
// worker context so we have to store CryptoKey as JSON // worker context so we have to store CryptoKey as JSON
return await exportKeyToJWK(cryptoKey); return await exportKeyToJWK(cryptoKey);
} }
async function getNotifsAccountWithOlmData(
senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{
+encryptedOlmData: ?EncryptedData,
+encryptionKey: ?CryptoKey,
+olmDataKey: string,
+encryptionKeyDBLabel: string,
+encryptedOlmAccount: ?EncryptedData,
+accountEncryptionKey: ?CryptoKey,
+synchronizationValue: ?string,
}> {
let olmDataKey;
let olmDataEncryptionKeyDBLabel;
const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
if (keyserverID) {
const olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);
const { olmDataKey: fetchedOlmDataKey, encryptionKeyDBKey } = olmDBKeys;
olmDataKey = fetchedOlmDataKey;
olmDataEncryptionKeyDBLabel = encryptionKeyDBKey;
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
olmDataKey = getOlmDataKeyForDeviceID(senderDeviceID);
olmDataEncryptionKeyDBLabel =
getOlmEncryptionKeyDBLabelForDeviceID(senderDeviceID);
}
const queryResult = await localforage.getMultipleItems<{
notificationAccount: ?EncryptedData,
notificationAccountEncryptionKey: ?CryptoKey,
synchronizationValue: ?number,
[string]: ?EncryptedData | ?CryptoKey | ?SubtleCrypto$JsonWebKey,
}>(
[
INDEXED_DB_NOTIFS_ACCOUNT_KEY,
INDEXED_DB_NOTIFS_ACCOUNT_ENCRYPTION_KEY_DB_LABEL,
olmDataEncryptionKeyDBLabel,
olmDataKey,
],
INDEXED_DB_NOTIFS_SYNC_KEY,
);
const {
values: {
notificationAccount,
notificationAccountEncryptionKey,
[olmDataKey]: maybeEncryptedOlmData,
[olmDataEncryptionKeyDBLabel]: maybeOlmDataEncryptionKey,
},
synchronizationValue,
} = queryResult;
if (!notificationAccount || !notificationAccountEncryptionKey) {
throw new Error(
'Attempt to decrypt notification but olm account not initialized.',
);
}
const encryptedOlmData: ?EncryptedData = maybeEncryptedOlmData
? assertWithValidator(maybeEncryptedOlmData, encryptedAESDataValidator)
: undefined;
const olmDataEncryptionKey: ?CryptoKey | ?SubtleCrypto$JsonWebKey =
maybeOlmDataEncryptionKey
? assertWithValidator(
maybeOlmDataEncryptionKey,
extendedCryptoKeyValidator,
)
: undefined;
const [encryptionKey, accountEncryptionKey] = await Promise.all([
validateCryptoKeyOptional(olmDataEncryptionKey),
validateCryptoKey(notificationAccountEncryptionKey),
]);
return {
encryptedOlmData,
encryptionKey,
encryptionKeyDBLabel: olmDataEncryptionKeyDBLabel,
encryptedOlmAccount: notificationAccount,
olmDataKey,
accountEncryptionKey,
synchronizationValue,
};
}
async function persistNotifsAccountWithOlmData(input: { async function persistNotifsAccountWithOlmData(input: {
+olmDataKey?: string, +olmDataKey?: string,
+olmEncryptionKeyDBLabel?: string, +olmEncryptionKeyDBLabel?: string,
+olmData?: ?NotificationsOlmDataType, +olmData?: ?NotificationsOlmDataType,
+encryptionKey?: ?CryptoKey, +encryptionKey?: ?CryptoKey,
+accountEncryptionKey?: ?CryptoKey, +accountEncryptionKey?: ?CryptoKey,
+accountWithPicklingKey?: PickledOLMAccount, +accountWithPicklingKey?: PickledOLMAccount,
+synchronizationValue: ?string, +synchronizationValue: ?string,
▲ Show 20 Lines • Show All 79 Lines • ▼ Show 20 Lines try {
// likely shared worker persisted its own data // likely shared worker persisted its own data
console.log(e); console.log(e);
} }
} }
async function decryptWebNotification( async function decryptWebNotification(
encryptedNotification: EncryptedWebNotification, encryptedNotification: EncryptedWebNotification,
): Promise<PlainTextWebNotification | WebNotifDecryptionError> { ): Promise<PlainTextWebNotification | WebNotifDecryptionError> {
const { id, keyserverID, encryptedPayload } = encryptedNotification; const {
invariant(keyserverID, 'KeyserverID must be present to decrypt a notif'); id,
encryptedPayload,
type: messageType,
...rest
} = encryptedNotification;
const senderDeviceDescriptor: SenderDeviceDescriptor = rest;
const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>( const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(
WEB_NOTIFS_SERVICE_UTILS_KEY, WEB_NOTIFS_SERVICE_UTILS_KEY,
); );
if (!utilsData) { if (!utilsData) {
return { id, error: 'Necessary data not found in IndexedDB' }; return { id, error: 'Necessary data not found in IndexedDB' };
} }
const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData); const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);
let olmDBKeys; let notifsAccountWithOlmData;
try { try {
olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID); notifsAccountWithOlmData = await getNotifsAccountWithOlmData(
senderDeviceDescriptor,
);
} catch (e) { } catch (e) {
return { return {
id, id,
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
const { olmDataKey, encryptionKeyDBKey } = olmDBKeys;
const [encryptedOlmData, encryptionKey] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),
retrieveEncryptionKey(encryptionKeyDBKey),
]);
if (!encryptionKey || !encryptedOlmData) { const {
return { encryptionKey,
id, encryptedOlmData,
error: 'Received encrypted notification but olm session was not created', olmDataKey,
displayErrorMessage: staffCanSee, encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
}; accountEncryptionKey,
} encryptedOlmAccount,
synchronizationValue,
} = notifsAccountWithOlmData;
try { try {
await olm.init({ locateFile: () => olmWasmPath }); const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
deserializeEncryptedDataOptional<NotificationsOlmDataType>(
const decryptedNotification = await commonDecrypt<PlainTextWebNotification>(
encryptedOlmData, encryptedOlmData,
olmDataKey,
encryptionKey, encryptionKey,
),
deserializeEncryptedDataOptional<PickledOLMAccount>(
encryptedOlmAccount,
accountEncryptionKey,
),
olm.init({ locateFile: () => olmWasmPath }),
]);
let decryptedNotification;
let updatedOlmData;
let updatedNotifsAccount;
const { senderDeviceID, keyserverID } = senderDeviceDescriptor;
if (keyserverID) {
invariant(
notificationsOlmData && encryptionKey,
'Received encrypted notification but keyserver olm session was not created',
);
const {
decryptedNotification: resultDecryptedNotification,
updatedOlmData: resultUpdatedOlmData,
} = await commonDecrypt<PlainTextWebNotification>(
notificationsOlmData,
encryptedPayload, encryptedPayload,
); );
decryptedNotification = resultDecryptedNotification;
updatedOlmData = resultUpdatedOlmData;
const { unreadCount } = decryptedNotification; const { unreadCount } = decryptedNotification;
invariant(keyserverID, 'Keyserver ID must be set to update badge counts'); invariant(keyserverID, 'Keyserver ID must be set to update badge counts');
await updateNotifsUnreadCountStorage({ await Promise.all([
persistNotifsAccountWithOlmData({
olmDataKey,
olmData: updatedOlmData,
olmEncryptionKeyDBLabel,
encryptionKey,
forceWrite: false,
synchronizationValue,
}),
updateNotifsUnreadCountStorage({
[keyserverID]: unreadCount, [keyserverID]: unreadCount,
}),
]);
return { id, ...decryptedNotification };
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
invariant(
accountWithPicklingKey,
'Received encrypted notification but notifs olm account not created',
);
const {
decryptedNotification: resultDecryptedNotification,
updatedOlmData: resultUpdatedOlmData,
updatedNotifsAccount: resultUpdatedNotifsAccount,
} = await commonPeerDecrypt<PlainTextWebNotification>(
senderDeviceID,
notificationsOlmData,
accountWithPicklingKey,
messageType,
encryptedPayload,
);
decryptedNotification = resultDecryptedNotification;
updatedOlmData = resultUpdatedOlmData;
updatedNotifsAccount = resultUpdatedNotifsAccount;
await persistNotifsAccountWithOlmData({
accountWithPicklingKey: updatedNotifsAccount,
accountEncryptionKey,
encryptionKey,
olmData: updatedOlmData,
olmDataKey,
olmEncryptionKeyDBLabel,
synchronizationValue,
forceWrite: false,
}); });
return { id, ...decryptedNotification }; return { id, ...decryptedNotification };
}
} catch (e) { } catch (e) {
return { return {
id, id,
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
} }
async function decryptDesktopNotification( async function decryptDesktopNotification(
encryptedPayload: string, encryptedPayload: string,
messageType: string,
staffCanSee: boolean, staffCanSee: boolean,
keyserverID?: string, senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{ +[string]: mixed }> { ): Promise<{ +[string]: mixed }> {
let encryptedOlmData, encryptionKey, olmDataKey; const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
try {
const { olmDataKey: olmDataKeyValue, encryptionKeyDBKey } =
await getNotifsOlmSessionDBKeys(keyserverID);
olmDataKey = olmDataKeyValue; let notifsAccountWithOlmData;
try {
[encryptedOlmData, encryptionKey] = await Promise.all([ [notifsAccountWithOlmData] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey), getNotifsAccountWithOlmData(senderDeviceDescriptor),
retrieveEncryptionKey(encryptionKeyDBKey),
initOlm(), initOlm(),
]); ]);
} catch (e) { } catch (e) {
return { return {
error: e.message, error: e.message,
displayErrorMessage: staffCanSee, displayErrorMessage: staffCanSee,
}; };
} }
if (!encryptionKey || !encryptedOlmData) { const {
return { encryptionKey,
error: 'Received encrypted notification but olm session was not created', encryptedOlmData,
displayErrorMessage: staffCanSee, olmDataKey,
}; encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
} accountEncryptionKey,
encryptedOlmAccount,
synchronizationValue,
} = notifsAccountWithOlmData;
let decryptedNotification;
try { try {
decryptedNotification = await commonDecrypt<{ +[string]: mixed }>( const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
deserializeEncryptedDataOptional<NotificationsOlmDataType>(
encryptedOlmData, encryptedOlmData,
olmDataKey,
encryptionKey, encryptionKey,
encryptedPayload, ),
deserializeEncryptedDataOptional<PickledOLMAccount>(
encryptedOlmAccount,
accountEncryptionKey,
),
]);
if (keyserverID) {
invariant(
notificationsOlmData && encryptionKey,
'Received encrypted notification but keyserver olm session was not created',
); );
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}
if (!keyserverID) { const { decryptedNotification, updatedOlmData } = await commonDecrypt<{
return decryptedNotification; +[string]: mixed,
} }>(notificationsOlmData, encryptedPayload);
const updatedOlmDataPersistencePromise = persistNotifsAccountWithOlmData({
olmDataKey,
olmData: updatedOlmData,
olmEncryptionKeyDBLabel,
encryptionKey,
forceWrite: false,
synchronizationValue,
});
// iOS notifications require that unread count is set under // iOS notifications require that unread count is set under
// `badge` key. Since MacOS notifications are created by the // `badge` key. Since MacOS notifications are created by the
// same function the unread count is also set under `badge` key // same function the unread count is also set under `badge` key
const { badge } = decryptedNotification; const { badge } = decryptedNotification;
if (typeof badge === 'number') { if (typeof badge === 'number') {
await updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }); await Promise.all([
updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }),
updatedOlmDataPersistencePromise,
]);
return decryptedNotification; return decryptedNotification;
} }
const { unreadCount } = decryptedNotification; const { unreadCount } = decryptedNotification;
if (typeof unreadCount === 'number') { if (typeof unreadCount === 'number') {
await updateNotifsUnreadCountStorage({ await Promise.all([
updateNotifsUnreadCountStorage({
[(keyserverID: string)]: unreadCount, [(keyserverID: string)]: unreadCount,
}); }),
updatedOlmDataPersistencePromise,
]);
} }
return decryptedNotification;
} else {
invariant(
senderDeviceID,
'keyserverID or SenderDeviceID must be present to decrypt a notif',
);
invariant(
accountWithPicklingKey,
'Received encrypted notification but notifs olm account not created',
);
const { decryptedNotification, updatedOlmData, updatedNotifsAccount } =
await commonPeerDecrypt<{
+[string]: mixed,
}>(
senderDeviceID,
notificationsOlmData,
accountWithPicklingKey,
messageType,
encryptedPayload,
);
await persistNotifsAccountWithOlmData({
accountWithPicklingKey: updatedNotifsAccount,
accountEncryptionKey,
encryptionKey,
olmData: updatedOlmData,
olmDataKey,
olmEncryptionKeyDBLabel,
synchronizationValue,
forceWrite: false,
});
return decryptedNotification; return decryptedNotification;
} }
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}
}
async function commonDecrypt<T>( async function commonDecrypt<T>(
encryptedOlmData: EncryptedData, notificationsOlmData: NotificationsOlmDataType,
olmDataKey: string,
encryptionKey: CryptoKey,
encryptedPayload: string, encryptedPayload: string,
): Promise<T> { ): Promise<{
const serializedOlmData = await decryptData(encryptedOlmData, encryptionKey); +decryptedNotification: T,
+updatedOlmData: NotificationsOlmDataType,
}> {
const { const {
mainSession, mainSession,
picklingKey, picklingKey,
pendingSessionUpdate, pendingSessionUpdate,
updateCreationTimestamp, updateCreationTimestamp,
}: NotificationsOlmDataType = JSON.parse( } = notificationsOlmData;
new TextDecoder().decode(serializedOlmData),
);
let updatedOlmData: NotificationsOlmDataType; let updatedOlmData: NotificationsOlmDataType;
let decryptedNotification: T; let decryptedNotification: T;
const shouldUpdateMainSession = const shouldUpdateMainSession =
Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME; Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;
const decryptionWithPendingSessionResult = decryptWithPendingSession<T>( const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(
Show All 26 Lines if (decryptionWithPendingSessionResult.decryptedNotification) {
updatedOlmData = { updatedOlmData = {
mainSession: mainSession, mainSession: mainSession,
pendingSessionUpdate, pendingSessionUpdate,
updateCreationTimestamp: newUpdateCreationTimestamp, updateCreationTimestamp: newUpdateCreationTimestamp,
picklingKey, picklingKey,
}; };
} }
const updatedEncryptedSession = await encryptData( return { decryptedNotification, updatedOlmData };
new TextEncoder().encode(JSON.stringify(updatedOlmData)), }
encryptionKey,
async function commonPeerDecrypt<T>(
senderDeviceID: string,
notificationsOlmData: ?NotificationsOlmDataType,
notificationAccount: PickledOLMAccount,
messageType: string,
encryptedPayload: string,
): Promise<{
+decryptedNotification: T,
+updatedOlmData?: NotificationsOlmDataType,
+updatedNotifsAccount?: PickledOLMAccount,
}> {
if (
messageType !== olmEncryptedMessageTypes.PREKEY.toString() &&
messageType !== olmEncryptedMessageTypes.TEXT.toString()
) {
throw new Error(
`Received message of invalid type from device: ${senderDeviceID}`,
); );
}
await localforage.setItem(olmDataKey, updatedEncryptedSession); let isSenderChainEmpty = true;
let hasReceivedMessage = false;
const sessionExists = !!notificationsOlmData;
return decryptedNotification; if (notificationsOlmData) {
const session = new olm.Session();
session.unpickle(
notificationsOlmData.picklingKey,
notificationsOlmData.pendingSessionUpdate,
);
isSenderChainEmpty = session.is_sender_chain_empty();
hasReceivedMessage = session.has_received_message();
}
// regular message
const isRegularMessage =
!!notificationsOlmData &&
messageType === olmEncryptedMessageTypes.TEXT.toString();
const isRegularPrekeyMessage =
!!notificationsOlmData &&
messageType === olmEncryptedMessageTypes.PREKEY.toString() &&
isSenderChainEmpty &&
hasReceivedMessage;
if (!!notificationsOlmData && (isRegularMessage || isRegularPrekeyMessage)) {
return await commonDecrypt<T>(notificationsOlmData, encryptedPayload);
}
// At this point we either face race condition or session reset attempt or
// session initialization attempt. For each of this scenario new inbound
// session must be created in order to decrypt message
const authMetadata = await fetchAuthMetadata();
const notifInboundKeys = await getNotifsInboundKeysForDeviceID(
senderDeviceID,
authMetadata,
);
const account = new olm.Account();
const session = new olm.Session();
account.unpickle(
notificationAccount.picklingKey,
notificationAccount.pickledAccount,
);
if (notifInboundKeys.error) {
throw new Error(notifInboundKeys.error);
}
invariant(
notifInboundKeys.curve25519,
'curve25519 must be present in notifs inbound keys',
);
session.create_inbound_from(
account,
notifInboundKeys.curve25519,
encryptedPayload,
);
const decryptedNotification: T = JSON.parse(
session.decrypt(Number(messageType), encryptedPayload),
);
// session reset attempt or session initialization - handled the same
const sessionResetAttempt =
sessionExists && !isSenderChainEmpty && hasReceivedMessage;
// race condition
const raceCondition =
sessionExists && !isSenderChainEmpty && !hasReceivedMessage;
const { deviceID: ourDeviceID } = authMetadata;
invariant(ourDeviceID, 'Session creation attempt but no device id');
const thisDeviceWinsRaceCondition = ourDeviceID > senderDeviceID;
if (
!sessionExists ||
sessionResetAttempt ||
(raceCondition && !thisDeviceWinsRaceCondition)
) {
const pickledOlmSession = session.pickle(notificationAccount.picklingKey);
const updatedOlmData = {
mainSession: pickledOlmSession,
pendingSessionUpdate: pickledOlmSession,
updateCreationTimestamp: Date.now(),
picklingKey: notificationAccount.picklingKey,
};
const updatedNotifsAccount = {
pickledAccount: account.pickle(notificationAccount.picklingKey),
picklingKey: notificationAccount.picklingKey,
};
return {
decryptedNotification,
updatedOlmData,
updatedNotifsAccount,
};
}
// If there is a race condition but we win device id comparison
// we return object that carries decrypted data but won't persist
// any session state
return { decryptedNotification };
} }
function decryptWithSession<T>( function decryptWithSession<T>(
pickledSession: string, pickledSession: string,
picklingKey: string, picklingKey: string,
encryptedPayload: string, encryptedPayload: string,
): DecryptionResult<T> { ): DecryptionResult<T> {
const session = new olm.Session(); const session = new olm.Session();
▲ Show 20 Lines • Show All 472 Lines • Show Last 20 Lines