Page MenuHomePhabricator
Differential D14380

[identity] Better handle new flow users in v1 logout
ClosedPublic
Actions

Authored by bartek on Feb 18 2025, 1:51 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Apr 1, 6:26 PM
Unknown Object (File)
Sat, Mar 29, 8:05 PM
Unknown Object (File)
Sat, Mar 29, 10:52 AM
Unknown Object (File)
Mon, Mar 24, 12:58 PM
Unknown Object (File)
Mon, Mar 24, 6:01 AM
Unknown Object (File)
Mon, Mar 24, 1:34 AM
Unknown Object (File)
Sun, Mar 23, 5:12 PM
Unknown Object (File)
Mon, Mar 17, 9:45 PM
View All 35 Files
Subscribers
ashoat

Details

Reviewers
kamil
tomek
Commits
rCOMM635dfc954c2b: [identity] Better handle new flow users in v1 logout
Summary

Addresses 1 and 2a from ENG-10202.

  • For v2 flow primary device logout, display an error message
  • For v1 flow primary device logout, remove backup to future-proof restore flow (make sure it falls back to v1).
Test Plan

Tested on staging

Diff Detail

Repository
rCOMM Comm
Branch
barthap/dev
Lint
No Lint Coverage
Unit
No Test Coverage

Event Timeline

bartek created this revision.Feb 18 2025, 1:51 AM
bartek held this revision as a draft.
Herald added a subscriber: ashoat. · View Herald TranscriptFeb 18 2025, 1:51 AM
Harbormaster failed remote builds in B33535: Diff 47136!Feb 18 2025, 2:17 AM
bartek updated this revision to Diff 47143.Feb 18 2025, 5:35 AM

Add backup service url to commtest config

bartek published this revision for review.Feb 18 2025, 6:44 AM
bartek added inline comments.
services/identity/src/grpc_services/authenticated.rs
398–401

This can trigger alarms. Wondering if should lower it to warn.

kamil accepted this revision.Feb 19 2025, 2:34 AM
kamil added inline comments.
services/identity/src/grpc_services/authenticated.rs
398–401

I would leave it as it is - we can lower if needed

1291

should we reuse to reduce code duplication, e.g. verify_device_on_device_list?

This revision is now accepted and ready to land.Feb 19 2025, 2:34 AM
bartek added inline comments.Feb 20 2025, 6:19 AM
services/identity/src/grpc_services/authenticated.rs
1291

Yes, good find

bartek updated this revision to Diff 47167.Feb 20 2025, 6:19 AM

Use get_current_device_list helper in other places

Harbormaster completed remote builds in B33555: Diff 47167.Feb 20 2025, 6:38 AM
Closed by commit rCOMM635dfc954c2b: [identity] Better handle new flow users in v1 logout (authored by bartek). · Explain WhyFeb 20 2025, 6:40 AM
This revision was automatically updated to reflect the committed changes.
bartek added a commit: rCOMM635dfc954c2b: [identity] Better handle new flow users in v1 logout.
bartek mentioned this in D14392: [terraform] Bump staging Identity to 0.51.1.Feb 20 2025, 6:42 AM
bartek mentioned this in rCOMM24d01125df19: [terraform] Bump staging Identity to 0.51.1.Feb 20 2025, 6:54 AM

Revision Contents
Changeset List

PathSize
services/
1 line
identity/
src/
grpc_services/
79 lines

Diff 47143

View Options

services/docker-compose.tests.yml

// @flow // @flow
import * as React from 'react'; import * as React from 'react';
import { getOneTimeKeyValues } from 'lib/shared/crypto-utils.js'; import { getOneTimeKeyValues } from 'lib/shared/crypto-utils.js';
import { IdentityClientContext } from 'lib/shared/identity-client-context.js'; import { IdentityClientContext } from 'lib/shared/identity-client-context.js';
import { import {
type IdentityKeysBlob, type IdentityKeysBlob,
identityKeysBlobValidator, identityKeysBlobValidator,
type OneTimeKeysResultValues, type OneTimeKeysResultValues,
} from 'lib/types/crypto-types.js'; } from 'lib/types/crypto-types.js';
import { import {
type SignedDeviceList, type SignedDeviceList,
signedDeviceListHistoryValidator, signedDeviceListHistoryValidator,
type SignedMessage,
type DeviceOlmOutboundKeys, type DeviceOlmOutboundKeys,
deviceOlmOutboundKeysValidator, deviceOlmOutboundKeysValidator,
type IdentityServiceClient, type IdentityServiceClient,
type UserDevicesOlmOutboundKeys, type UserDevicesOlmOutboundKeys,
type UserAuthMetadata, type UserAuthMetadata,
ONE_TIME_KEYS_NUMBER, ONE_TIME_KEYS_NUMBER,
identityAuthResultValidator, identityAuthResultValidator,
type DeviceOlmInboundKeys, type DeviceOlmInboundKeys,
▲ Show 20 Lines • Show All 422 Lines • ▼ Show 20 Lines () => ({
await commCoreModule.setCommServicesAuthMetadata( await commCoreModule.setCommServicesAuthMetadata(
validatedResult.userID, validatedResult.userID,
primaryIdentityPublicKeys.ed25519, primaryIdentityPublicKeys.ed25519,
validatedResult.accessToken, validatedResult.accessToken,
); );
return validatedResult; return validatedResult;
}, },
uploadKeysForRegisteredDeviceAndLogIn: async (
userID: string,
nonceChallengeResponse: SignedMessage,
) => {
await commCoreModule.initializeCryptoAccount();
const [
{ blobPayload, signature, primaryIdentityPublicKeys },
{ contentOneTimeKeys, notificationsOneTimeKeys },
prekeys,
] = await Promise.all([
commCoreModule.getUserPublicKey(),
commCoreModule.getOneTimeKeys(ONE_TIME_KEYS_NUMBER),
commCoreModule.validateAndGetPrekeys(),
]);
const challengeResponse = JSON.stringify(nonceChallengeResponse);
const registrationResult =
await commRustModule.uploadSecondaryDeviceKeysAndLogIn(
userID,
challengeResponse,
blobPayload,
signature,
prekeys.contentPrekey,
prekeys.contentPrekeySignature,
prekeys.notifPrekey,
prekeys.notifPrekeySignature,
getOneTimeKeyValues(contentOneTimeKeys),
getOneTimeKeyValues(notificationsOneTimeKeys),
);
const { accessToken: token } = JSON.parse(registrationResult);
const identityAuthResult = { accessToken: token, userID, username: '' };
const validatedResult = assertWithValidator(
identityAuthResult,
identityAuthResultValidator,
);
await commCoreModule.setCommServicesAuthMetadata(
validatedResult.userID,
primaryIdentityPublicKeys.ed25519,
validatedResult.accessToken,
);
return validatedResult;
},
generateNonce: commRustModule.generateNonce, generateNonce: commRustModule.generateNonce,
getDeviceListHistoryForUser: async ( getDeviceListHistoryForUser: async (
userID: string, userID: string,
sinceTimestamp?: number, sinceTimestamp?: number,
) => { ) => {
const { const {
deviceID: authDeviceID, deviceID: authDeviceID,
userID: authUserID, userID: authUserID,
▲ Show 20 Lines • Show All 52 Lines • Show Last 20 Lines
View Options

services/identity/src/grpc_services/authenticated.rs

// @flow // @flow
import * as React from 'react'; import * as React from 'react';
import { getOneTimeKeyValues } from 'lib/shared/crypto-utils.js'; import { getOneTimeKeyValues } from 'lib/shared/crypto-utils.js';
import { IdentityClientContext } from 'lib/shared/identity-client-context.js'; import { IdentityClientContext } from 'lib/shared/identity-client-context.js';
import { import {
type IdentityKeysBlob, type IdentityKeysBlob,
identityKeysBlobValidator, identityKeysBlobValidator,
type OneTimeKeysResultValues, type OneTimeKeysResultValues,
} from 'lib/types/crypto-types.js'; } from 'lib/types/crypto-types.js';
import { import {
type SignedDeviceList, type SignedDeviceList,
signedDeviceListHistoryValidator, signedDeviceListHistoryValidator,
type SignedMessage,
type DeviceOlmOutboundKeys, type DeviceOlmOutboundKeys,
deviceOlmOutboundKeysValidator, deviceOlmOutboundKeysValidator,
type IdentityServiceClient, type IdentityServiceClient,
type UserDevicesOlmOutboundKeys, type UserDevicesOlmOutboundKeys,
type UserAuthMetadata, type UserAuthMetadata,
ONE_TIME_KEYS_NUMBER, ONE_TIME_KEYS_NUMBER,
identityAuthResultValidator, identityAuthResultValidator,
type DeviceOlmInboundKeys, type DeviceOlmInboundKeys,
▲ Show 20 Lines • Show All 422 Lines • ▼ Show 20 Lines () => ({
await commCoreModule.setCommServicesAuthMetadata( await commCoreModule.setCommServicesAuthMetadata(
validatedResult.userID, validatedResult.userID,
primaryIdentityPublicKeys.ed25519, primaryIdentityPublicKeys.ed25519,
validatedResult.accessToken, validatedResult.accessToken,
); );
return validatedResult; return validatedResult;
}, },
uploadKeysForRegisteredDeviceAndLogIn: async (
userID: string,
nonceChallengeResponse: SignedMessage,
) => {
await commCoreModule.initializeCryptoAccount();
const [
{ blobPayload, signature, primaryIdentityPublicKeys },
{ contentOneTimeKeys, notificationsOneTimeKeys },
prekeys,
] = await Promise.all([
commCoreModule.getUserPublicKey(),
commCoreModule.getOneTimeKeys(ONE_TIME_KEYS_NUMBER),
commCoreModule.validateAndGetPrekeys(),
]);
const challengeResponse = JSON.stringify(nonceChallengeResponse);
const registrationResult =
await commRustModule.uploadSecondaryDeviceKeysAndLogIn(
userID,
challengeResponse,
blobPayload,
signature,
prekeys.contentPrekey,
prekeys.contentPrekeySignature,
prekeys.notifPrekey,
prekeys.notifPrekeySignature,
getOneTimeKeyValues(contentOneTimeKeys),
getOneTimeKeyValues(notificationsOneTimeKeys),
);
const { accessToken: token } = JSON.parse(registrationResult);
const identityAuthResult = { accessToken: token, userID, username: '' };
const validatedResult = assertWithValidator(
identityAuthResult,
identityAuthResultValidator,
);
await commCoreModule.setCommServicesAuthMetadata(
validatedResult.userID,
primaryIdentityPublicKeys.ed25519,
validatedResult.accessToken,
);
return validatedResult;
},
generateNonce: commRustModule.generateNonce, generateNonce: commRustModule.generateNonce,
getDeviceListHistoryForUser: async ( getDeviceListHistoryForUser: async (
userID: string, userID: string,
sinceTimestamp?: number, sinceTimestamp?: number,
) => { ) => {
const { const {
deviceID: authDeviceID, deviceID: authDeviceID,
userID: authUserID, userID: authUserID,
▲ Show 20 Lines • Show All 52 Lines • Show Last 20 Lines