Page MenuHomePhabricator
Differential D14460

[identity] Verify prekeys in RefreshUserPrekeys RPC
ClosedPublic
Actions

Authored by bartek on Mar 18 2025, 2:17 AM.
Tags
None
Referenced Files
F6236331: D14460.id.diff
Thu, Apr 24, 3:19 PM
Unknown Object (File)
Thu, Apr 24, 8:46 AM
Unknown Object (File)
Thu, Apr 24, 3:54 AM
Unknown Object (File)
Tue, Apr 22, 10:12 PM
Unknown Object (File)
Wed, Apr 9, 11:26 AM
Unknown Object (File)
Mon, Apr 7, 4:41 PM
Unknown Object (File)
Mon, Apr 7, 1:49 PM
Unknown Object (File)
Sun, Apr 6, 3:32 PM
View All 28 Files
Subscribers
ashoat
tomek

Details

Reviewers
kamil
Commits
rCOMM42d533bb18be: [identity] Verify prekeys in RefreshUserPrekeys RPC
Summary
  • Adds prekey signature verification in RefreshUserPrekeys RPC (ENG-10381)
  • Some helper APIs to get notif signing public key

Depends on D14459

Test Plan

Commtest fails without D14459 which introduced valid signatures

Diff Detail

Repository
rCOMM Comm
Lint
No Lint Coverage
Unit
No Test Coverage

Event Timeline

bartek created this revision.Mar 18 2025, 2:17 AM
bartek held this revision as a draft.
Herald added subscribers: tomek, ashoat. · View Herald TranscriptMar 18 2025, 2:17 AM
Harbormaster completed remote builds in B33754: Diff 47444.Mar 18 2025, 2:35 AM
bartek published this revision for review.Mar 18 2025, 2:50 AM
kamil accepted this revision.Mar 18 2025, 3:13 AM

It might be good to test it on staging before publishing it to prod:

  • trigger PrekeysHandler to test client
  • trigger cron job on keyserver

A test both correct and malformed keys

This revision is now accepted and ready to land.Mar 18 2025, 3:13 AM
bartek added a comment.Mar 18 2025, 7:05 AM
In D14460#401548, @kamil wrote:

It might be good to test it on staging before publishing it to prod:

  • trigger PrekeysHandler to test client
  • trigger cron job on keyserver

A test both correct and malformed keys

Good idea, I'll deploy to staging and do that

Closed by commit rCOMM42d533bb18be: [identity] Verify prekeys in RefreshUserPrekeys RPC (authored by bartek). · Explain WhyMar 18 2025, 7:07 AM
This revision was automatically updated to reflect the committed changes.
bartek added a commit: rCOMM42d533bb18be: [identity] Verify prekeys in RefreshUserPrekeys RPC.

Revision Contents
Changeset List

PathSize
services/
identity/
src/
1 line
4 lines
database/
11 lines
grpc_services/
47 lines

Diff 47444

View Options

services/identity/src/constants.rs

Show First 20 Lines • Show All 48 Lines • ▼ Show 20 Lines
import { import {
type RobotextMessageInfo, type RobotextMessageInfo,
type ComposableMessageInfo, type ComposableMessageInfo,
} from '../types/message-types.js'; } from '../types/message-types.js';
import { userRelationshipStatus } from '../types/relationship-types.js'; import { userRelationshipStatus } from '../types/relationship-types.js';
import { import {
threadPermissionPropagationPrefixes, threadPermissionPropagationPrefixes,
threadPermissions, threadPermissions,
configurableCommunityPermissions,
type ThreadPermission, type ThreadPermission,
type ThreadPermissionsInfo, type ThreadPermissionsInfo,
type UserSurfacedPermission,
} from '../types/thread-permission-types.js'; } from '../types/thread-permission-types.js';
import { import {
type ThreadType, type ThreadType,
threadTypes, threadTypes,
threadTypeIsCommunityRoot, threadTypeIsCommunityRoot,
assertThreadType, assertThreadType,
} from '../types/thread-types-enum.js'; } from '../types/thread-types-enum.js';
import { import {
▲ Show 20 Lines • Show All 1,496 Lines • ▼ Show 20 Lines Object.keys(roleIDsToNames).forEach(roleName => {
roleNamesToMemberCount[roleIDsToNames[roleName]] = 0; roleNamesToMemberCount[roleIDsToNames[roleName]] = 0;
} }
}); });
return roleNamesToMemberCount; return roleNamesToMemberCount;
}, [threadInfo]); }, [threadInfo]);
} }
type RoleUserSurfacedPermissions = {
+[roleName: string]: $ReadOnlyArray<UserSurfacedPermission>,
};
// Iterates through the existing roles in the community and 'reverse maps'
// the set of permission literals for each role to user-facing permission enums
// to help pre-populate the permission checkboxes when editing roles.
function useRoleUserSurfacedPermissions(
threadInfo: ThreadInfo,
): RoleUserSurfacedPermissions {
return React.useMemo(() => {
const roleNamesToPermissions = {};
Object.keys(threadInfo.roles).forEach(roleID => {
const roleName = threadInfo.roles[roleID].name;
const rolePermissions = Object.keys(threadInfo.roles[roleID].permissions);
const setOfUserSurfacedPermissions = new Set();
rolePermissions.forEach(rolePermission => {
const userSurfacedPermission = Object.keys(
configurableCommunityPermissions,
).find(key =>
configurableCommunityPermissions[key].has(rolePermission),
);
if (userSurfacedPermission) {
setOfUserSurfacedPermissions.add(userSurfacedPermission);
}
});
roleNamesToPermissions[roleName] = [...setOfUserSurfacedPermissions];
});
return roleNamesToPermissions;
}, [threadInfo]);
}
export { export {
threadHasPermission, threadHasPermission,
viewerIsMember, viewerIsMember,
threadInChatList, threadInChatList,
threadIsTopLevel, threadIsTopLevel,
threadIsChannel, threadIsChannel,
threadIsSidebar, threadIsSidebar,
threadInBackgroundChatList, threadInBackgroundChatList,
▲ Show 20 Lines • Show All 50 Lines • ▼ Show 20 Linesexport {
switchMemberAdminRoleInThread, switchMemberAdminRoleInThread,
getAvailableThreadMemberActions, getAvailableThreadMemberActions,
threadMembersWithoutAddedAshoat, threadMembersWithoutAddedAshoat,
validChatNameRegex, validChatNameRegex,
chatNameMaxLength, chatNameMaxLength,
patchThreadInfoToIncludeMentionedMembersOfParent, patchThreadInfoToIncludeMentionedMembersOfParent,
threadInfoInsideCommunity, threadInfoInsideCommunity,
useRoleMemberCountsForCommunity, useRoleMemberCountsForCommunity,
useRoleUserSurfacedPermissions,
}; };
View Options

services/identity/src/database.rs

Show First 20 Lines • Show All 48 Lines • ▼ Show 20 Lines
import { import {
type RobotextMessageInfo, type RobotextMessageInfo,
type ComposableMessageInfo, type ComposableMessageInfo,
} from '../types/message-types.js'; } from '../types/message-types.js';
import { userRelationshipStatus } from '../types/relationship-types.js'; import { userRelationshipStatus } from '../types/relationship-types.js';
import { import {
threadPermissionPropagationPrefixes, threadPermissionPropagationPrefixes,
threadPermissions, threadPermissions,
configurableCommunityPermissions,
type ThreadPermission, type ThreadPermission,
type ThreadPermissionsInfo, type ThreadPermissionsInfo,
type UserSurfacedPermission,
} from '../types/thread-permission-types.js'; } from '../types/thread-permission-types.js';
import { import {
type ThreadType, type ThreadType,
threadTypes, threadTypes,
threadTypeIsCommunityRoot, threadTypeIsCommunityRoot,
assertThreadType, assertThreadType,
} from '../types/thread-types-enum.js'; } from '../types/thread-types-enum.js';
import { import {
▲ Show 20 Lines • Show All 1,496 Lines • ▼ Show 20 Lines Object.keys(roleIDsToNames).forEach(roleName => {
roleNamesToMemberCount[roleIDsToNames[roleName]] = 0; roleNamesToMemberCount[roleIDsToNames[roleName]] = 0;
} }
}); });
return roleNamesToMemberCount; return roleNamesToMemberCount;
}, [threadInfo]); }, [threadInfo]);
} }
type RoleUserSurfacedPermissions = {
+[roleName: string]: $ReadOnlyArray<UserSurfacedPermission>,
};
// Iterates through the existing roles in the community and 'reverse maps'
// the set of permission literals for each role to user-facing permission enums
// to help pre-populate the permission checkboxes when editing roles.
function useRoleUserSurfacedPermissions(
threadInfo: ThreadInfo,
): RoleUserSurfacedPermissions {
return React.useMemo(() => {
const roleNamesToPermissions = {};
Object.keys(threadInfo.roles).forEach(roleID => {
const roleName = threadInfo.roles[roleID].name;
const rolePermissions = Object.keys(threadInfo.roles[roleID].permissions);
const setOfUserSurfacedPermissions = new Set();
rolePermissions.forEach(rolePermission => {
const userSurfacedPermission = Object.keys(
configurableCommunityPermissions,
).find(key =>
configurableCommunityPermissions[key].has(rolePermission),
);
if (userSurfacedPermission) {
setOfUserSurfacedPermissions.add(userSurfacedPermission);
}
});
roleNamesToPermissions[roleName] = [...setOfUserSurfacedPermissions];
});
return roleNamesToPermissions;
}, [threadInfo]);
}
export { export {
threadHasPermission, threadHasPermission,
viewerIsMember, viewerIsMember,
threadInChatList, threadInChatList,
threadIsTopLevel, threadIsTopLevel,
threadIsChannel, threadIsChannel,
threadIsSidebar, threadIsSidebar,
threadInBackgroundChatList, threadInBackgroundChatList,
▲ Show 20 Lines • Show All 50 Lines • ▼ Show 20 Linesexport {
switchMemberAdminRoleInThread, switchMemberAdminRoleInThread,
getAvailableThreadMemberActions, getAvailableThreadMemberActions,
threadMembersWithoutAddedAshoat, threadMembersWithoutAddedAshoat,
validChatNameRegex, validChatNameRegex,
chatNameMaxLength, chatNameMaxLength,
patchThreadInfoToIncludeMentionedMembersOfParent, patchThreadInfoToIncludeMentionedMembersOfParent,
threadInfoInsideCommunity, threadInfoInsideCommunity,
useRoleMemberCountsForCommunity, useRoleMemberCountsForCommunity,
useRoleUserSurfacedPermissions,
}; };
View Options

services/identity/src/database/device_list.rs

Show First 20 Lines • Show All 48 Lines • ▼ Show 20 Lines
import { import {
type RobotextMessageInfo, type RobotextMessageInfo,
type ComposableMessageInfo, type ComposableMessageInfo,
} from '../types/message-types.js'; } from '../types/message-types.js';
import { userRelationshipStatus } from '../types/relationship-types.js'; import { userRelationshipStatus } from '../types/relationship-types.js';
import { import {
threadPermissionPropagationPrefixes, threadPermissionPropagationPrefixes,
threadPermissions, threadPermissions,
configurableCommunityPermissions,
type ThreadPermission, type ThreadPermission,
type ThreadPermissionsInfo, type ThreadPermissionsInfo,
type UserSurfacedPermission,
} from '../types/thread-permission-types.js'; } from '../types/thread-permission-types.js';
import { import {
type ThreadType, type ThreadType,
threadTypes, threadTypes,
threadTypeIsCommunityRoot, threadTypeIsCommunityRoot,
assertThreadType, assertThreadType,
} from '../types/thread-types-enum.js'; } from '../types/thread-types-enum.js';
import { import {
▲ Show 20 Lines • Show All 1,496 Lines • ▼ Show 20 Lines Object.keys(roleIDsToNames).forEach(roleName => {
roleNamesToMemberCount[roleIDsToNames[roleName]] = 0; roleNamesToMemberCount[roleIDsToNames[roleName]] = 0;
} }
}); });
return roleNamesToMemberCount; return roleNamesToMemberCount;
}, [threadInfo]); }, [threadInfo]);
} }
type RoleUserSurfacedPermissions = {
+[roleName: string]: $ReadOnlyArray<UserSurfacedPermission>,
};
// Iterates through the existing roles in the community and 'reverse maps'
// the set of permission literals for each role to user-facing permission enums
// to help pre-populate the permission checkboxes when editing roles.
function useRoleUserSurfacedPermissions(
threadInfo: ThreadInfo,
): RoleUserSurfacedPermissions {
return React.useMemo(() => {
const roleNamesToPermissions = {};
Object.keys(threadInfo.roles).forEach(roleID => {
const roleName = threadInfo.roles[roleID].name;
const rolePermissions = Object.keys(threadInfo.roles[roleID].permissions);
const setOfUserSurfacedPermissions = new Set();
rolePermissions.forEach(rolePermission => {
const userSurfacedPermission = Object.keys(
configurableCommunityPermissions,
).find(key =>
configurableCommunityPermissions[key].has(rolePermission),
);
if (userSurfacedPermission) {
setOfUserSurfacedPermissions.add(userSurfacedPermission);
}
});
roleNamesToPermissions[roleName] = [...setOfUserSurfacedPermissions];
});
return roleNamesToPermissions;
}, [threadInfo]);
}
export { export {
threadHasPermission, threadHasPermission,
viewerIsMember, viewerIsMember,
threadInChatList, threadInChatList,
threadIsTopLevel, threadIsTopLevel,
threadIsChannel, threadIsChannel,
threadIsSidebar, threadIsSidebar,
threadInBackgroundChatList, threadInBackgroundChatList,
▲ Show 20 Lines • Show All 50 Lines • ▼ Show 20 Linesexport {
switchMemberAdminRoleInThread, switchMemberAdminRoleInThread,
getAvailableThreadMemberActions, getAvailableThreadMemberActions,
threadMembersWithoutAddedAshoat, threadMembersWithoutAddedAshoat,
validChatNameRegex, validChatNameRegex,
chatNameMaxLength, chatNameMaxLength,
patchThreadInfoToIncludeMentionedMembersOfParent, patchThreadInfoToIncludeMentionedMembersOfParent,
threadInfoInsideCommunity, threadInfoInsideCommunity,
useRoleMemberCountsForCommunity, useRoleMemberCountsForCommunity,
useRoleUserSurfacedPermissions,
}; };
View Options

services/identity/src/grpc_services/authenticated.rs

Show First 20 Lines • Show All 48 Lines • ▼ Show 20 Lines
import { import {
type RobotextMessageInfo, type RobotextMessageInfo,
type ComposableMessageInfo, type ComposableMessageInfo,
} from '../types/message-types.js'; } from '../types/message-types.js';
import { userRelationshipStatus } from '../types/relationship-types.js'; import { userRelationshipStatus } from '../types/relationship-types.js';
import { import {
threadPermissionPropagationPrefixes, threadPermissionPropagationPrefixes,
threadPermissions, threadPermissions,
configurableCommunityPermissions,
type ThreadPermission, type ThreadPermission,
type ThreadPermissionsInfo, type ThreadPermissionsInfo,
type UserSurfacedPermission,
} from '../types/thread-permission-types.js'; } from '../types/thread-permission-types.js';
import { import {
type ThreadType, type ThreadType,
threadTypes, threadTypes,
threadTypeIsCommunityRoot, threadTypeIsCommunityRoot,
assertThreadType, assertThreadType,
} from '../types/thread-types-enum.js'; } from '../types/thread-types-enum.js';
import { import {
▲ Show 20 Lines • Show All 1,496 Lines • ▼ Show 20 Lines Object.keys(roleIDsToNames).forEach(roleName => {
roleNamesToMemberCount[roleIDsToNames[roleName]] = 0; roleNamesToMemberCount[roleIDsToNames[roleName]] = 0;
} }
}); });
return roleNamesToMemberCount; return roleNamesToMemberCount;
}, [threadInfo]); }, [threadInfo]);
} }
type RoleUserSurfacedPermissions = {
+[roleName: string]: $ReadOnlyArray<UserSurfacedPermission>,
};
// Iterates through the existing roles in the community and 'reverse maps'
// the set of permission literals for each role to user-facing permission enums
// to help pre-populate the permission checkboxes when editing roles.
function useRoleUserSurfacedPermissions(
threadInfo: ThreadInfo,
): RoleUserSurfacedPermissions {
return React.useMemo(() => {
const roleNamesToPermissions = {};
Object.keys(threadInfo.roles).forEach(roleID => {
const roleName = threadInfo.roles[roleID].name;
const rolePermissions = Object.keys(threadInfo.roles[roleID].permissions);
const setOfUserSurfacedPermissions = new Set();
rolePermissions.forEach(rolePermission => {
const userSurfacedPermission = Object.keys(
configurableCommunityPermissions,
).find(key =>
configurableCommunityPermissions[key].has(rolePermission),
);
if (userSurfacedPermission) {
setOfUserSurfacedPermissions.add(userSurfacedPermission);
}
});
roleNamesToPermissions[roleName] = [...setOfUserSurfacedPermissions];
});
return roleNamesToPermissions;
}, [threadInfo]);
}
export { export {
threadHasPermission, threadHasPermission,
viewerIsMember, viewerIsMember,
threadInChatList, threadInChatList,
threadIsTopLevel, threadIsTopLevel,
threadIsChannel, threadIsChannel,
threadIsSidebar, threadIsSidebar,
threadInBackgroundChatList, threadInBackgroundChatList,
▲ Show 20 Lines • Show All 50 Lines • ▼ Show 20 Linesexport {
switchMemberAdminRoleInThread, switchMemberAdminRoleInThread,
getAvailableThreadMemberActions, getAvailableThreadMemberActions,
threadMembersWithoutAddedAshoat, threadMembersWithoutAddedAshoat,
validChatNameRegex, validChatNameRegex,
chatNameMaxLength, chatNameMaxLength,
patchThreadInfoToIncludeMentionedMembersOfParent, patchThreadInfoToIncludeMentionedMembersOfParent,
threadInfoInsideCommunity, threadInfoInsideCommunity,
useRoleMemberCountsForCommunity, useRoleMemberCountsForCommunity,
useRoleUserSurfacedPermissions,
}; };