diff --git a/keyserver/src/push/crypto.js b/keyserver/src/push/crypto.js index 538973402..dbe52b0e3 100644 --- a/keyserver/src/push/crypto.js +++ b/keyserver/src/push/crypto.js @@ -1,216 +1,217 @@ // @flow import apn from '@parse/node-apn'; import crypto from 'crypto'; import invariant from 'invariant'; import _cloneDeep from 'lodash/fp/cloneDeep.js'; import type { NotificationTargetDevice, SenderDeviceDescriptor, EncryptedNotifUtilsAPI, } from 'lib/types/notif-types.js'; import { toBase64URL } from 'lib/utils/base64.js'; import { encrypt, generateKey } from '../utils/aes-crypto-utils.js'; import { getOlmUtility } from '../utils/olm-utils.js'; async function encryptAPNsNotification( encryptedNotifUtilsAPI: EncryptedNotifUtilsAPI, cookieID: string, senderDeviceDescriptor: SenderDeviceDescriptor, notification: apn.Notification, codeVersion?: ?number, notificationSizeValidator?: apn.Notification => boolean, blobHolder?: ?string, ): Promise<{ +notification: apn.Notification, +payloadSizeExceeded: boolean, +encryptedPayloadHash?: string, +encryptionOrder?: number, }> { invariant( !notification.collapseId, `Collapse ID can't be directly stored in apn.Notification object due ` + `to security reasons. Please put it in payload property`, ); const encryptedNotification = new apn.Notification(); encryptedNotification.id = notification.id; encryptedNotification.payload.id = notification.id; if (blobHolder) { encryptedNotification.payload.blobHolder = blobHolder; } - encryptedNotification.payload.keyserverID = notification.payload.keyserverID; encryptedNotification.topic = notification.topic; encryptedNotification.sound = notification.aps.sound; encryptedNotification.pushType = 'alert'; encryptedNotification.mutableContent = true; const { id, ...payloadSansUnencryptedData } = notification.payload; const unencryptedPayload = { ...payloadSansUnencryptedData, badge: notification.aps.badge.toString(), merged: notification.body, }; try { const unencryptedSerializedPayload = JSON.stringify(unencryptedPayload); let dbPersistCondition; if (notificationSizeValidator) { dbPersistCondition = (serializedPayload: string) => { const notifCopy = _cloneDeep(encryptedNotification); notifCopy.payload.encryptedPayload = serializedPayload; return notificationSizeValidator(notifCopy); }; } const { encryptedData: serializedPayload, sizeLimitViolated: dbPersistConditionViolated, encryptionOrder, } = await encryptedNotifUtilsAPI.encryptSerializedNotifPayload( cookieID, unencryptedSerializedPayload, dbPersistCondition, ); encryptedNotification.payload.encryptedPayload = serializedPayload.body; encryptedNotification.payload = { ...encryptedNotification.payload, ...senderDeviceDescriptor, }; if (codeVersion && codeVersion >= 254 && codeVersion % 2 === 0) { encryptedNotification.aps = { alert: { body: 'ENCRYPTED' }, ...encryptedNotification.aps, }; } const encryptedPayloadHash = getOlmUtility().sha256(serializedPayload.body); return { notification: encryptedNotification, payloadSizeExceeded: !!dbPersistConditionViolated, encryptedPayloadHash, encryptionOrder, }; } catch (e) { console.log('Notification encryption failed: ' + e); encryptedNotification.body = notification.body; encryptedNotification.threadId = notification.payload.threadID; invariant( typeof notification.aps.badge === 'number', 'Unencrypted notification must have badge as a number', ); encryptedNotification.badge = notification.aps.badge; encryptedNotification.payload = { ...encryptedNotification.payload, ...notification.payload, - encryptionFailed: 1, + ...senderDeviceDescriptor, + encryptionFailed: '1', }; + return { notification: encryptedNotification, payloadSizeExceeded: notificationSizeValidator ? notificationSizeValidator(_cloneDeep(encryptedNotification)) : false, }; } } function prepareEncryptedAPNsNotifications( encryptedNotifUtilsAPI: EncryptedNotifUtilsAPI, senderDeviceDescriptor: SenderDeviceDescriptor, devices: $ReadOnlyArray, notification: apn.Notification, codeVersion?: ?number, notificationSizeValidator?: apn.Notification => boolean, ): Promise< $ReadOnlyArray<{ +cryptoID: string, +deliveryID: string, +notification: apn.Notification, +payloadSizeExceeded: boolean, +encryptedPayloadHash?: string, +encryptionOrder?: number, }>, > { const notificationPromises = devices.map( async ({ cryptoID, deliveryID, blobHolder }) => { const notif = await encryptAPNsNotification( encryptedNotifUtilsAPI, cryptoID, senderDeviceDescriptor, notification, codeVersion, notificationSizeValidator, blobHolder, ); return { cryptoID, deliveryID, ...notif }; }, ); return Promise.all(notificationPromises); } function prepareEncryptedIOSNotificationRescind( encryptedNotifUtilsAPI: EncryptedNotifUtilsAPI, senderDeviceDescriptor: SenderDeviceDescriptor, devices: $ReadOnlyArray, notification: apn.Notification, codeVersion?: ?number, ): Promise< $ReadOnlyArray<{ +cryptoID: string, +deliveryID: string, +notification: apn.Notification, }>, > { const notificationPromises = devices.map(async ({ deliveryID, cryptoID }) => { const { notification: notif } = await encryptAPNsNotification( encryptedNotifUtilsAPI, cryptoID, senderDeviceDescriptor, notification, codeVersion, ); return { cryptoID, deliveryID, notification: notif }; }); return Promise.all(notificationPromises); } async function encryptBlobPayload(payload: string): Promise<{ +encryptionKey: string, +encryptedPayload: Blob, +encryptedPayloadHash: string, }> { const encryptionKey = await generateKey(); const encryptedPayload = await encrypt( encryptionKey, new TextEncoder().encode(payload), ); const encryptedPayloadBuffer = Buffer.from(encryptedPayload); const blobHashBase64 = await crypto .createHash('sha256') .update(encryptedPayloadBuffer) .digest('base64'); const blobHash = toBase64URL(blobHashBase64); const payloadBlob = new Blob([encryptedPayloadBuffer]); const encryptionKeyString = Buffer.from(encryptionKey).toString('base64'); return { encryptionKey: encryptionKeyString, encryptedPayload: payloadBlob, encryptedPayloadHash: blobHash, }; } export { prepareEncryptedAPNsNotifications, prepareEncryptedIOSNotificationRescind, encryptBlobPayload, }; diff --git a/native/android/app/src/main/java/app/comm/android/notifications/CommNotificationsHandler.java b/native/android/app/src/main/java/app/comm/android/notifications/CommNotificationsHandler.java index cd2d0ac13..2f3688522 100644 --- a/native/android/app/src/main/java/app/comm/android/notifications/CommNotificationsHandler.java +++ b/native/android/app/src/main/java/app/comm/android/notifications/CommNotificationsHandler.java @@ -1,651 +1,658 @@ package app.comm.android.notifications; import android.app.Notification; import android.app.NotificationManager; import android.app.PendingIntent; import android.content.Context; import android.content.Intent; import android.graphics.Bitmap; import android.graphics.BitmapFactory; import android.os.Bundle; import android.service.notification.StatusBarNotification; import android.util.JsonReader; import android.util.Log; import androidx.core.app.NotificationCompat; import androidx.lifecycle.Lifecycle; import androidx.lifecycle.ProcessLifecycleOwner; import androidx.localbroadcastmanager.content.LocalBroadcastManager; import app.comm.android.ExpoUtils; import app.comm.android.MainActivity; import app.comm.android.R; import app.comm.android.aescrypto.AESCryptoModuleCompat; import app.comm.android.commservices.CommAndroidBlobClient; import app.comm.android.fbjni.CommMMKV; import app.comm.android.fbjni.CommSecureStore; import app.comm.android.fbjni.GlobalDBSingleton; import app.comm.android.fbjni.MessageOperationsUtilities; import app.comm.android.fbjni.NetworkModule; import app.comm.android.fbjni.NotificationsCryptoModule; import app.comm.android.fbjni.StaffUtils; import app.comm.android.fbjni.ThreadOperations; import com.google.firebase.messaging.FirebaseMessagingService; import com.google.firebase.messaging.RemoteMessage; import java.io.File; import java.io.IOException; import java.lang.OutOfMemoryError; import java.lang.StringBuilder; import java.nio.charset.StandardCharsets; import java.util.ArrayList; import java.util.Arrays; import java.util.Base64; import java.util.Map; import me.leolin.shortcutbadger.ShortcutBadger; import org.json.JSONException; import org.json.JSONObject; public class CommNotificationsHandler extends FirebaseMessagingService { private static final String BADGE_KEY = "badge"; private static final String BADGE_ONLY_KEY = "badgeOnly"; private static final String SET_UNREAD_STATUS_KEY = "setUnreadStatus"; private static final String NOTIF_ID_KEY = "id"; private static final String ENCRYPTED_PAYLOAD_KEY = "encryptedPayload"; private static final String ENCRYPTION_FAILED_KEY = "encryptionFailed"; private static final String BLOB_HASH_KEY = "blobHash"; private static final String BLOB_HOLDER_KEY = "blobHolder"; private static final String AES_ENCRYPTION_KEY_LABEL = "encryptionKey"; private static final String GROUP_NOTIF_IDS_KEY = "groupNotifIDs"; private static final String COLLAPSE_ID_KEY = "collapseKey"; private static final String KEYSERVER_ID_KEY = "keyserverID"; private static final String CHANNEL_ID = "default"; private static final long[] VIBRATION_SPEC = {500, 500}; private static final Map NOTIF_PRIORITY_VERBOSE = Map.of(0, "UNKNOWN", 1, "HIGH", 2, "NORMAL"); // Those and future MMKV-related constants should match // similar constants in NotificationService.mm private static final String MMKV_KEY_SEPARATOR = "."; private static final String MMKV_KEYSERVER_PREFIX = "KEYSERVER"; private static final String MMKV_UNREAD_COUNT_SUFFIX = "UNREAD_COUNT"; private Bitmap displayableNotificationLargeIcon; private NotificationManager notificationManager; private LocalBroadcastManager localBroadcastManager; private CommAndroidBlobClient blobClient; private AESCryptoModuleCompat aesCryptoModule; public static final String RESCIND_KEY = "rescind"; public static final String RESCIND_ID_KEY = "rescindID"; public static final String TITLE_KEY = "title"; public static final String PREFIX_KEY = "prefix"; public static final String BODY_KEY = "body"; public static final String MESSAGE_INFOS_KEY = "messageInfos"; public static final String THREAD_ID_KEY = "threadID"; public static final String TOKEN_EVENT = "TOKEN_EVENT"; public static final String MESSAGE_EVENT = "MESSAGE_EVENT"; @Override public void onCreate() { super.onCreate(); CommSecureStore.getInstance().initialize( ExpoUtils.createExpoSecureStoreSupplier(this.getApplicationContext())); notificationManager = (NotificationManager)this.getSystemService( Context.NOTIFICATION_SERVICE); localBroadcastManager = LocalBroadcastManager.getInstance(this); displayableNotificationLargeIcon = BitmapFactory.decodeResource( this.getApplicationContext().getResources(), R.mipmap.ic_launcher); blobClient = new CommAndroidBlobClient(); aesCryptoModule = new AESCryptoModuleCompat(); } @Override public void onNewToken(String token) { Intent intent = new Intent(TOKEN_EVENT); intent.putExtra("token", token); localBroadcastManager.sendBroadcast(intent); } @Override public void onMessageReceived(RemoteMessage message) { handleAlteredNotificationPriority(message); if (StaffUtils.isStaffRelease() && message.getData().get(KEYSERVER_ID_KEY) == null) { displayErrorMessageNotification( "Received notification without keyserver ID.", "Missing keyserver ID.", null); return; } String senderKeyserverID = message.getData().get(KEYSERVER_ID_KEY); if (message.getData().get(ENCRYPTED_PAYLOAD_KEY) != null) { try { message = this.olmDecryptRemoteMessage(message, senderKeyserverID); } catch (JSONException e) { Log.w("COMM", "Malformed notification JSON payload.", e); return; } catch (IllegalStateException e) { Log.w("COMM", "Android notification type violation.", e); return; } catch (Exception e) { Log.w("COMM", "Notification decryption failure.", e); return; } - } else if ("1".equals(message.getData().get(ENCRYPTION_FAILED_KEY))) { - Log.w( - "COMM", - "Received unencrypted notification for client with existing olm session for notifications"); + } + + if (StaffUtils.isStaffRelease() && + "1".equals(message.getData().get(ENCRYPTION_FAILED_KEY))) { + displayErrorMessageNotification( + "Notification encryption failed on the keyserver. Please investigate", + "Unencrypted notification", + null); + } + if ("1".equals(message.getData().get(ENCRYPTION_FAILED_KEY))) { + Log.w("COMM", "Received erroneously unencrypted notification."); } String rescind = message.getData().get(RESCIND_KEY); if ("true".equals(rescind) && android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M) { handleNotificationRescind(message); } try { handleUnreadCountUpdate(message); } catch (Exception e) { Log.w("COMM", "Unread count update failure.", e); } String badgeOnly = message.getData().get(BADGE_ONLY_KEY); if ("1".equals(badgeOnly)) { return; } if (message.getData().get(MESSAGE_INFOS_KEY) != null) { handleMessageInfosPersistence(message); } if (message.getData().get(BLOB_HASH_KEY) != null && message.getData().get(AES_ENCRYPTION_KEY_LABEL) != null && message.getData().get(BLOB_HOLDER_KEY) != null) { handleLargeNotification(message); } Intent intent = new Intent(MESSAGE_EVENT); intent.putExtra( "message", serializeMessageDataForIntentAttachment(message)); localBroadcastManager.sendBroadcast(intent); if (this.isAppInForeground()) { return; } this.displayNotification(message); } private void handleAlteredNotificationPriority(RemoteMessage message) { if (!StaffUtils.isStaffRelease()) { return; } int originalPriority = message.getOriginalPriority(); int priority = message.getPriority(); String priorityName = NOTIF_PRIORITY_VERBOSE.get(priority); String originalPriorityName = NOTIF_PRIORITY_VERBOSE.get(originalPriority); if (priorityName == null || originalPriorityName == null) { // Technically this will never happen as // it would violate FCM documentation return; } if (priority != originalPriority) { displayErrorMessageNotification( "System changed notification priority from " + priorityName + " to " + originalPriorityName, "Notification priority altered.", null); } } private boolean isAppInForeground() { return ProcessLifecycleOwner.get().getLifecycle().getCurrentState() == Lifecycle.State.RESUMED; } private boolean notificationGroupingSupported() { // Comm doesn't support notification grouping for clients running // Android versions older than 23 return android.os.Build.VERSION.SDK_INT > android.os.Build.VERSION_CODES.M; } private void handleNotificationRescind(RemoteMessage message) { String setUnreadStatus = message.getData().get(SET_UNREAD_STATUS_KEY); String threadID = message.getData().get(THREAD_ID_KEY); if ("true".equals(setUnreadStatus)) { File sqliteFile = this.getApplicationContext().getDatabasePath("comm.sqlite"); if (sqliteFile.exists()) { GlobalDBSingleton.scheduleOrRun(() -> { ThreadOperations.updateSQLiteUnreadStatus( sqliteFile.getPath(), threadID, false); }); } else { Log.w( "COMM", "Database not existing yet. Skipping thread status update."); } } String rescindID = message.getData().get(RESCIND_ID_KEY); boolean groupSummaryPresent = false; boolean threadGroupPresent = false; for (StatusBarNotification notification : notificationManager.getActiveNotifications()) { String tag = notification.getTag(); boolean isGroupMember = threadID.equals(notification.getNotification().getGroup()); boolean isGroupSummary = (notification.getNotification().flags & Notification.FLAG_GROUP_SUMMARY) == Notification.FLAG_GROUP_SUMMARY; if (tag != null && tag.equals(rescindID)) { notificationManager.cancel(notification.getTag(), notification.getId()); } else if ( isGroupMember && isGroupSummary && StaffUtils.isStaffRelease()) { groupSummaryPresent = true; removeNotificationFromGroupSummary(threadID, rescindID, notification); } else if (isGroupMember && isGroupSummary) { groupSummaryPresent = true; } else if (isGroupMember) { threadGroupPresent = true; } else if (isGroupSummary && StaffUtils.isStaffRelease()) { checkForUnmatchedRescind(threadID, rescindID, notification); } } if (groupSummaryPresent && !threadGroupPresent) { notificationManager.cancel(threadID, threadID.hashCode()); } } private void handleUnreadCountUpdate(RemoteMessage message) { String badge = message.getData().get(BADGE_KEY); if (badge == null) { return; } if (message.getData().get(KEYSERVER_ID_KEY) == null) { throw new RuntimeException("Received badge update without keyserver ID."); } String senderKeyserverID = message.getData().get(KEYSERVER_ID_KEY); String senderKeyserverUnreadCountKey = String.join( MMKV_KEY_SEPARATOR, MMKV_KEYSERVER_PREFIX, senderKeyserverID, MMKV_UNREAD_COUNT_SUFFIX); int senderKeyserverUnreadCount; try { senderKeyserverUnreadCount = Integer.parseInt(badge); } catch (NumberFormatException e) { Log.w("COMM", "Invalid badge count", e); return; } CommMMKV.setInt(senderKeyserverUnreadCountKey, senderKeyserverUnreadCount); int totalUnreadCount = 0; String[] allKeys = CommMMKV.getAllKeys(); for (String key : allKeys) { if (!key.startsWith(MMKV_KEYSERVER_PREFIX) || !key.endsWith(MMKV_UNREAD_COUNT_SUFFIX)) { continue; } Integer unreadCount = CommMMKV.getInt(key, -1); if (unreadCount == null) { continue; } totalUnreadCount += unreadCount; } if (totalUnreadCount > 0) { ShortcutBadger.applyCount(this, totalUnreadCount); } else { ShortcutBadger.removeCount(this); } } private void handleMessageInfosPersistence(RemoteMessage message) { String rawMessageInfosString = message.getData().get(MESSAGE_INFOS_KEY); File sqliteFile = this.getApplicationContext().getDatabasePath("comm.sqlite"); if (rawMessageInfosString != null && sqliteFile.exists()) { GlobalDBSingleton.scheduleOrRun(() -> { MessageOperationsUtilities.storeMessageInfos( sqliteFile.getPath(), rawMessageInfosString); }); } else if (rawMessageInfosString != null) { Log.w("COMM", "Database not existing yet. Skipping notification"); } } private void handleLargeNotification(RemoteMessage message) { String blobHash = message.getData().get(BLOB_HASH_KEY); String blobHolder = message.getData().get(BLOB_HOLDER_KEY); try { byte[] largePayload = blobClient.getBlobSync(blobHash); message = aesDecryptRemoteMessage(message, largePayload); handleMessageInfosPersistence(message); } catch (Exception e) { Log.w("COMM", "Failure when handling large notification.", e); } blobClient.scheduleDeferredBlobDeletion( blobHash, blobHolder, this.getApplicationContext()); } private void addToThreadGroupAndDisplay( String notificationID, NotificationCompat.Builder notificationBuilder, String threadID) { notificationBuilder.setGroup(threadID).setGroupAlertBehavior( NotificationCompat.GROUP_ALERT_CHILDREN); NotificationCompat.Builder groupSummaryNotificationBuilder = new NotificationCompat.Builder(this.getApplicationContext()) .setChannelId(CHANNEL_ID) .setSmallIcon(R.drawable.notif_icon) .setContentIntent( this.createStartMainActivityAction(threadID, threadID)) .setGroup(threadID) .setGroupSummary(true) .setGroupAlertBehavior(NotificationCompat.GROUP_ALERT_CHILDREN); if (StaffUtils.isStaffRelease()) { ArrayList groupNotifIDs = recordNotificationInGroupSummary(threadID, notificationID); String notificationSummaryBody = "Notif IDs: " + String.join(System.lineSeparator(), groupNotifIDs); Bundle data = new Bundle(); data.putStringArrayList(GROUP_NOTIF_IDS_KEY, groupNotifIDs); groupSummaryNotificationBuilder .setContentTitle("Summary for thread id " + threadID) .setExtras(data) .setStyle(new NotificationCompat.BigTextStyle().bigText( notificationSummaryBody)) .setAutoCancel(false); } else { groupSummaryNotificationBuilder.setAutoCancel(true); } notificationManager.notify( notificationID, notificationID.hashCode(), notificationBuilder.build()); notificationManager.notify( threadID, threadID.hashCode(), groupSummaryNotificationBuilder.build()); } private void displayNotification(RemoteMessage message) { if (message.getData().get(RESCIND_KEY) != null) { // don't attempt to display rescinds return; } String id = message.getData().get(NOTIF_ID_KEY); String collapseKey = message.getData().get(COLLAPSE_ID_KEY); String notificationID = id; if (collapseKey != null) { notificationID = collapseKey; } String title = message.getData().get(TITLE_KEY); String prefix = message.getData().get(PREFIX_KEY); String body = message.getData().get(BODY_KEY); String threadID = message.getData().get(THREAD_ID_KEY); if (prefix != null) { body = prefix + " " + body; } Bundle data = new Bundle(); data.putString(THREAD_ID_KEY, threadID); NotificationCompat.Builder notificationBuilder = new NotificationCompat.Builder(this.getApplicationContext()) .setDefaults(Notification.DEFAULT_ALL) .setContentText(body) .setExtras(data) .setChannelId(CHANNEL_ID) .setVibrate(VIBRATION_SPEC) .setSmallIcon(R.drawable.notif_icon) .setLargeIcon(displayableNotificationLargeIcon) .setAutoCancel(true); if (title != null) { notificationBuilder.setContentTitle(title); } if (threadID != null) { notificationBuilder.setContentIntent( this.createStartMainActivityAction(id, threadID)); } if (!this.notificationGroupingSupported() || threadID == null) { notificationManager.notify( notificationID, notificationID.hashCode(), notificationBuilder.build()); return; } this.addToThreadGroupAndDisplay( notificationID, notificationBuilder, threadID); } private PendingIntent createStartMainActivityAction(String notificationID, String threadID) { Intent intent = new Intent(this.getApplicationContext(), MainActivity.class); intent.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP); intent.putExtra("threadID", threadID); return PendingIntent.getActivity( this.getApplicationContext(), notificationID.hashCode(), intent, PendingIntent.FLAG_UPDATE_CURRENT | PendingIntent.FLAG_MUTABLE); } private RemoteMessage updateRemoteMessageWithDecryptedPayload( RemoteMessage message, String decryptedSerializedPayload) throws JSONException, IllegalStateException { JSONObject decryptedPayload = new JSONObject(decryptedSerializedPayload); ((Iterable)() -> decryptedPayload.keys()) .forEach(payloadFieldName -> { if (decryptedPayload.optJSONArray(payloadFieldName) != null || decryptedPayload.optJSONObject(payloadFieldName) != null) { throw new IllegalStateException( "Notification payload JSON is not {[string]: string} type."); } String payloadFieldValue = decryptedPayload.optString(payloadFieldName); message.getData().put(payloadFieldName, payloadFieldValue); }); return message; } private RemoteMessage olmDecryptRemoteMessage(RemoteMessage message, String senderKeyserverID) throws JSONException, IllegalStateException { String encryptedSerializedPayload = message.getData().get(ENCRYPTED_PAYLOAD_KEY); String decryptedSerializedPayload = NotificationsCryptoModule.decrypt( senderKeyserverID, encryptedSerializedPayload, NotificationsCryptoModule.olmEncryptedTypeMessage()); return updateRemoteMessageWithDecryptedPayload( message, decryptedSerializedPayload); } private RemoteMessage aesDecryptRemoteMessage(RemoteMessage message, byte[] blob) throws JSONException, IllegalStateException { String aesEncryptionKey = message.getData().get(AES_ENCRYPTION_KEY_LABEL); // On the keyserver AES key is generated as raw bytes // so to send it in JSON it is encoded to Base64 string. byte[] aesEncryptionKeyBytes = Base64.getDecoder().decode(aesEncryptionKey); // On the keyserver notification is a string so it is // first encoded into UTF8 bytes. Therefore bytes // obtained from blob decryption are correct UTF8 bytes. String decryptedSerializedPayload = new String( aesCryptoModule.decrypt(aesEncryptionKeyBytes, blob), StandardCharsets.UTF_8); return updateRemoteMessageWithDecryptedPayload( message, decryptedSerializedPayload); } private Bundle serializeMessageDataForIntentAttachment(RemoteMessage message) { Bundle bundle = new Bundle(); message.getData().forEach(bundle::putString); return bundle; } private void displayErrorMessageNotification( String errorMessage, String errorTitle, String largeErrorData) { NotificationCompat.Builder errorNotificationBuilder = new NotificationCompat.Builder(this.getApplicationContext()) .setDefaults(Notification.DEFAULT_ALL) .setChannelId(CHANNEL_ID) .setSmallIcon(R.drawable.notif_icon) .setLargeIcon(displayableNotificationLargeIcon); if (errorMessage != null) { errorNotificationBuilder.setContentText(errorMessage); } if (errorTitle != null) { errorNotificationBuilder.setContentTitle(errorTitle); } if (largeErrorData != null) { errorNotificationBuilder.setStyle( new NotificationCompat.BigTextStyle().bigText(largeErrorData)); } notificationManager.notify( errorMessage, errorMessage.hashCode(), errorNotificationBuilder.build()); } private boolean isGroupSummary(StatusBarNotification notification, String threadID) { boolean isAnySummary = (notification.getNotification().flags & Notification.FLAG_GROUP_SUMMARY) != 0; if (threadID == null) { return isAnySummary; } return isAnySummary && threadID.equals(notification.getNotification().getGroup()); } private ArrayList recordNotificationInGroupSummary(String threadID, String notificationID) { ArrayList groupNotifIDs = Arrays.stream(notificationManager.getActiveNotifications()) .filter(notif -> isGroupSummary(notif, threadID)) .findFirst() .map( notif -> notif.getNotification().extras.getStringArrayList( GROUP_NOTIF_IDS_KEY)) .orElse(new ArrayList<>()); groupNotifIDs.add(notificationID); return groupNotifIDs; } private void removeNotificationFromGroupSummary( String threadID, String notificationID, StatusBarNotification groupSummaryNotification) { ArrayList groupNotifIDs = groupSummaryNotification.getNotification().extras.getStringArrayList( GROUP_NOTIF_IDS_KEY); if (groupNotifIDs == null) { displayErrorMessageNotification( "Empty summary notif for thread ID " + threadID, "Empty Summary Notif", "Summary notification for thread ID " + threadID + " had empty body when rescinding " + notificationID); } boolean notificationRemoved = groupNotifIDs.removeIf(notifID -> notifID.equals(notificationID)); if (!notificationRemoved) { displayErrorMessageNotification( "Notif with ID " + notificationID + " not in " + threadID, "Unrecorded Notif", "Rescinded notification with id " + notificationID + " not found in group summary for thread id " + threadID); return; } String notificationSummaryBody = "Notif IDs: " + String.join(System.lineSeparator(), groupNotifIDs); Bundle data = new Bundle(); data.putStringArrayList(GROUP_NOTIF_IDS_KEY, groupNotifIDs); NotificationCompat.Builder groupSummaryNotificationBuilder = new NotificationCompat.Builder(this.getApplicationContext()) .setChannelId(CHANNEL_ID) .setSmallIcon(R.drawable.notif_icon) .setContentIntent( this.createStartMainActivityAction(threadID, threadID)) .setContentTitle("Summary for thread id " + threadID) .setExtras(data) .setStyle(new NotificationCompat.BigTextStyle().bigText( notificationSummaryBody)) .setGroup(threadID) .setGroupSummary(true) .setAutoCancel(false) .setGroupAlertBehavior(NotificationCompat.GROUP_ALERT_CHILDREN); notificationManager.notify( threadID, threadID.hashCode(), groupSummaryNotificationBuilder.build()); } private void checkForUnmatchedRescind( String threadID, String notificationID, StatusBarNotification anySummaryNotification) { ArrayList anyGroupNotifIDs = anySummaryNotification.getNotification().extras.getStringArrayList( GROUP_NOTIF_IDS_KEY); if (anyGroupNotifIDs == null) { return; } String groupID = anySummaryNotification.getNotification().getGroup(); for (String notifID : anyGroupNotifIDs) { if (!notificationID.equals(notifID)) { continue; } displayErrorMessageNotification( "Summary for thread id " + groupID + "has " + notifID, "Rescind Mismatch", "Summary notif for thread id " + groupID + " contains notif id " + notifID + " which was received in rescind with thread id " + threadID); } } } diff --git a/native/ios/NotificationService/NotificationService.mm b/native/ios/NotificationService/NotificationService.mm index 8f5b99ca5..4050c9a5c 100644 --- a/native/ios/NotificationService/NotificationService.mm +++ b/native/ios/NotificationService/NotificationService.mm @@ -1,910 +1,916 @@ #import "NotificationService.h" #import "AESCryptoModuleObjCCompat.h" #import "CommIOSBlobClient.h" #import "CommMMKV.h" #import "Logger.h" #import "NotificationsCryptoModule.h" #import "StaffUtils.h" #import "TemporaryMessageStorage.h" #import #include #include NSString *const backgroundNotificationTypeKey = @"backgroundNotifType"; NSString *const messageInfosKey = @"messageInfos"; NSString *const encryptedPayloadKey = @"encryptedPayload"; -NSString *const encryptionFailureKey = @"encryptionFailure"; +NSString *const encryptionFailedKey = @"encryptionFailed"; NSString *const collapseIDKey = @"collapseID"; NSString *const keyserverIDKey = @"keyserverID"; NSString *const blobHashKey = @"blobHash"; NSString *const blobHolderKey = @"blobHolder"; NSString *const encryptionKeyLabel = @"encryptionKey"; NSString *const needsSilentBadgeUpdateKey = @"needsSilentBadgeUpdate"; // Those and future MMKV-related constants should match // similar constants in CommNotificationsHandler.java const std::string mmkvKeySeparator = "."; const std::string mmkvKeyserverPrefix = "KEYSERVER"; const std::string mmkvUnreadCountSuffix = "UNREAD_COUNT"; // The context for this constant can be found here: // https://linear.app/comm/issue/ENG-3074#comment-bd2f5e28 int64_t const notificationRemovalDelay = (int64_t)(0.1 * NSEC_PER_SEC); // Apple gives us about 30 seconds to process single notification, // se we let any semaphore wait for at most 20 seconds int64_t const semaphoreAwaitTimeLimit = (int64_t)(20 * NSEC_PER_SEC); CFStringRef newMessageInfosDarwinNotification = CFSTR("app.comm.darwin_new_message_infos"); // Implementation below was inspired by the // following discussion with Apple staff member: // https://developer.apple.com/forums/thread/105088 size_t getMemoryUsageInBytes() { task_vm_info_data_t vmInfo; mach_msg_type_number_t count = TASK_VM_INFO_COUNT; kern_return_t result = task_info(mach_task_self(), TASK_VM_INFO, (task_info_t)&vmInfo, &count); if (result != KERN_SUCCESS) { return -1; } size_t memory_usage = static_cast(vmInfo.phys_footprint); return memory_usage; } std::string joinStrings( const std::string &separator, const std::vector &array) { std::ostringstream joinedStream; std::copy( array.begin(), array.end(), std::ostream_iterator(joinedStream, separator.c_str())); std::string joined = joinedStream.str(); return joined.empty() ? joined : joined.substr(0, joined.size() - 1); } @interface NotificationService () @property(strong) NSMutableDictionary *contentHandlers; @property(strong) NSMutableDictionary *contents; @end @implementation NotificationService - (void)didReceiveNotificationRequest:(UNNotificationRequest *)request withContentHandler: (void (^)(UNNotificationContent *_Nonnull)) contentHandler { // Set-up methods are idempotent [NotificationService setUpNSEProcess]; [self setUpNSEInstance]; NSString *contentHandlerKey = [request.identifier copy]; UNMutableNotificationContent *content = [request.content mutableCopy]; [self putContent:content withHandler:contentHandler forKey:contentHandlerKey]; UNNotificationContent *publicUserContent = content; // Step 1: notification decryption. std::unique_ptr statefulDecryptResultPtr; BOOL decryptionExecuted = NO; if ([self shouldBeDecrypted:content.userInfo]) { std::optional notifID; NSString *objcNotifID = content.userInfo[@"id"]; if (objcNotifID) { notifID = std::string([objcNotifID UTF8String]); } std::string decryptErrorMessage; try { @try { statefulDecryptResultPtr = [self decryptContentInPlace:content]; decryptionExecuted = YES; } @catch (NSException *e) { decryptErrorMessage = "NSE: Received Obj-C exception: " + std::string([e.name UTF8String]) + " during notification decryption."; if (notifID.has_value()) { decryptErrorMessage += " Notif ID: " + notifID.value(); } } } catch (const std::exception &e) { decryptErrorMessage = "NSE: Received C++ exception: " + std::string(e.what()) + " during notification decryption."; if (notifID.has_value()) { decryptErrorMessage += " Notif ID: " + notifID.value(); } } if (decryptErrorMessage.size()) { NSString *errorMessage = [NSString stringWithUTF8String:decryptErrorMessage.c_str()]; if (notifID.has_value() && [self isAppShowingNotificationWith: [NSString stringWithCString:notifID.value().c_str() encoding:NSUTF8StringEncoding]]) { errorMessage = [errorMessage stringByAppendingString:@" App shows notif with this ID."]; } [self callContentHandlerForKey:contentHandlerKey onErrorMessage:errorMessage withPublicUserContent:[[UNNotificationContent alloc] init]]; return; } - } else if ([self shouldAlertUnencryptedNotification:content.userInfo]) { - // In future this will be replaced by notification content - // modification for DEV environment and staff members - comm::Logger::log("NSE: Received erroneously unencrypted notitication."); } NSMutableArray *errorMessages = [[NSMutableArray alloc] init]; + if (comm::StaffUtils::isStaffRelease() && + [self shouldAlertUnencryptedNotification:content.userInfo]) { + [errorMessages addObject: + @"Notification encryption failed on the keyserver. " + @"Please investigate!"]; + } + if ([self shouldAlertUnencryptedNotification:content.userInfo]) { + comm::Logger::log("NSE: Received erroneously unencrypted notification."); + } + // Step 2: notification persistence in a temporary storage std::string persistErrorMessage; try { @try { [self persistMessagePayload:content.userInfo]; } @catch (NSException *e) { persistErrorMessage = "Obj-C exception: " + std::string([e.name UTF8String]) + " during notification persistence."; } } catch (const std::exception &e) { persistErrorMessage = "C++ exception: " + std::string(e.what()) + " during notification persistence."; } if (persistErrorMessage.size()) { [errorMessages addObject:[NSString stringWithUTF8String:persistErrorMessage.c_str()]]; } // Step 3: Cumulative unread count calculation if (content.badge) { std::string unreadCountCalculationError; try { @try { [self calculateTotalUnreadCountInPlace:content]; } @catch (NSException *e) { unreadCountCalculationError = "Obj-C exception: " + std::string([e.name UTF8String]) + " during unread count calculation."; } } catch (const std::exception &e) { unreadCountCalculationError = "C++ exception: " + std::string(e.what()) + " during unread count calculation."; } if (unreadCountCalculationError.size() && comm::StaffUtils::isStaffRelease()) { [errorMessages addObject:[NSString stringWithUTF8String:unreadCountCalculationError .c_str()]]; } } // Step 4: (optional) rescind read notifications // Message payload persistence is a higher priority task, so it has // to happen prior to potential notification center clearing. if ([self isRescind:content.userInfo]) { std::string rescindErrorMessage; try { @try { [self removeNotificationsWithCondition:^BOOL( UNNotification *_Nonnull notif) { return [content.userInfo[@"notificationId"] isEqualToString:notif.request.content.userInfo[@"id"]]; }]; } @catch (NSException *e) { rescindErrorMessage = "Obj-C exception: " + std::string([e.name UTF8String]) + " during notification rescind."; } } catch (const std::exception &e) { rescindErrorMessage = "C++ exception: " + std::string(e.what()) + " during notification rescind."; } if (rescindErrorMessage.size()) { [errorMessages addObject:[NSString stringWithUTF8String:persistErrorMessage.c_str()]]; } publicUserContent = [[UNNotificationContent alloc] init]; } // Step 5: (optional) execute notification coalescing if ([self isCollapsible:content.userInfo]) { std::string coalescingErrorMessage; try { @try { [self displayLocalNotificationFromContent:content forCollapseKey:content .userInfo[collapseIDKey]]; } @catch (NSException *e) { coalescingErrorMessage = "Obj-C exception: " + std::string([e.name UTF8String]) + " during notification coalescing."; } } catch (const std::exception &e) { coalescingErrorMessage = "C++ exception: " + std::string(e.what()) + " during notification coalescing."; } if (coalescingErrorMessage.size()) { [errorMessages addObject:[NSString stringWithUTF8String:coalescingErrorMessage.c_str()]]; // Even if we fail to execute coalescing then public users // should still see the original message. publicUserContent = content; } else { publicUserContent = [[UNNotificationContent alloc] init]; } } // Step 6: (optional) create empty notification that // only provides badge count. // For notifs that only contain badge update the // server sets BODY to "ENCRYPTED" for internal // builds for debugging purposes. So instead of // letting such notif go through, we construct // another notif that doesn't have a body. if (content.userInfo[needsSilentBadgeUpdateKey]) { publicUserContent = [self getBadgeOnlyContentFor:content]; } // Step 7: (optional) download notification paylaod // from blob service in case it is large notification if ([self isLargeNotification:content.userInfo]) { std::string processLargeNotificationError; try { @try { [self fetchAndPersistLargeNotifPayload:content]; } @catch (NSException *e) { processLargeNotificationError = "Obj-C exception: " + std::string([e.name UTF8String]) + " during large notification processing."; } } catch (const std::exception &e) { processLargeNotificationError = "C++ exception: " + std::string(e.what()) + " during large notification processing."; } if (processLargeNotificationError.size()) { [errorMessages addObject:[NSString stringWithUTF8String:processLargeNotificationError .c_str()]]; } } // Step 8: notify main app that there is data // to transfer to SQLite and redux. [self sendNewMessageInfosNotification]; if (NSString *currentMemoryEventMessage = [NotificationService getAndSetMemoryEventMessage:nil]) { [errorMessages addObject:currentMemoryEventMessage]; } if (errorMessages.count) { NSString *cumulatedErrorMessage = [@"NSE: Received " stringByAppendingString:[errorMessages componentsJoinedByString:@" "]]; [self callContentHandlerForKey:contentHandlerKey onErrorMessage:cumulatedErrorMessage withPublicUserContent:publicUserContent]; return; } [self callContentHandlerForKey:contentHandlerKey withContent:publicUserContent]; if (decryptionExecuted) { comm::NotificationsCryptoModule::flushState( std::move(statefulDecryptResultPtr)); } } - (void)serviceExtensionTimeWillExpire { // Called just before the extension will be terminated by the system. // Use this as an opportunity to deliver your "best attempt" at modified // content, otherwise the original push payload will be used. NSMutableArray *allHandlers = [[NSMutableArray alloc] init]; NSMutableArray *allContents = [[NSMutableArray alloc] init]; @synchronized(self.contentHandlers) { for (NSString *key in self.contentHandlers) { [allHandlers addObject:self.contentHandlers[key]]; [allContents addObject:self.contents[key]]; } [self.contentHandlers removeAllObjects]; [self.contents removeAllObjects]; } for (int i = 0; i < allContents.count; i++) { UNNotificationContent *content = allContents[i]; void (^handler)(UNNotificationContent *_Nonnull) = allHandlers[i]; if ([self isRescind:content.userInfo]) { // If we get to this place it means we were unable to // remove relevant notification from notification center in // in time given to NSE to process notification. // It is an extremely unlikely to happen. if (!comm::StaffUtils::isStaffRelease()) { handler([[UNNotificationContent alloc] init]); continue; } NSString *errorMessage = @"NSE: Exceeded time limit to rescind a notification."; UNNotificationContent *errorContent = [self buildContentForError:errorMessage]; handler(errorContent); continue; } if ([self isCollapsible:content.userInfo]) { // If we get to this place it means we were unable to // execute notification coalescing with local notification // mechanism in time given to NSE to process notification. if (!comm::StaffUtils::isStaffRelease()) { handler(content); continue; } NSString *errorMessage = @"NSE: Exceeded time limit to collapse a notitication."; UNNotificationContent *errorContent = [self buildContentForError:errorMessage]; handler(errorContent); continue; } if ([self shouldBeDecrypted:content.userInfo] && !content.userInfo[@"successfullyDecrypted"]) { // If we get to this place it means we were unable to // decrypt encrypted notification content in time // given to NSE to process notification. if (!comm::StaffUtils::isStaffRelease()) { handler([[UNNotificationContent alloc] init]); continue; } NSString *errorMessage = @"NSE: Exceeded time limit to decrypt a notification."; UNNotificationContent *errorContent = [self buildContentForError:errorMessage]; handler(errorContent); continue; } // At this point we know that the content is at least // correctly decrypted so we can display it to the user. // Another operation, like persistence, had failed. if (content.userInfo[needsSilentBadgeUpdateKey]) { UNNotificationContent *badgeOnlyContent = [self getBadgeOnlyContentFor:content]; handler(badgeOnlyContent); continue; } handler(content); } } - (void)removeNotificationsWithCondition: (BOOL (^)(UNNotification *_Nonnull))condition { dispatch_semaphore_t semaphore = dispatch_semaphore_create(0); void (^delayedSemaphorePostCallback)() = ^() { dispatch_time_t timeToPostSemaphore = dispatch_time(DISPATCH_TIME_NOW, notificationRemovalDelay); dispatch_after(timeToPostSemaphore, dispatch_get_main_queue(), ^{ dispatch_semaphore_signal(semaphore); }); }; [UNUserNotificationCenter.currentNotificationCenter getDeliveredNotificationsWithCompletionHandler:^( NSArray *_Nonnull notifications) { NSMutableArray *notificationsToRemove = [[NSMutableArray alloc] init]; for (UNNotification *notif in notifications) { if (condition(notif)) { [notificationsToRemove addObject:notif.request.identifier]; } } [UNUserNotificationCenter.currentNotificationCenter removeDeliveredNotificationsWithIdentifiers:notificationsToRemove]; delayedSemaphorePostCallback(); }]; dispatch_semaphore_wait( semaphore, dispatch_time(DISPATCH_TIME_NOW, semaphoreAwaitTimeLimit)); } - (void)displayLocalNotificationFromContent:(UNNotificationContent *)content forCollapseKey:(NSString *)collapseKey { UNMutableNotificationContent *localNotifContent = [[UNMutableNotificationContent alloc] init]; localNotifContent.title = content.title; localNotifContent.body = content.body; localNotifContent.badge = content.badge; localNotifContent.userInfo = content.userInfo; UNNotificationRequest *localNotifRequest = [UNNotificationRequest requestWithIdentifier:collapseKey content:localNotifContent trigger:nil]; [self displayLocalNotificationFor:localNotifRequest]; } - (void)persistMessagePayload:(NSDictionary *)payload { if (payload[messageInfosKey]) { TemporaryMessageStorage *temporaryStorage = [[TemporaryMessageStorage alloc] init]; [temporaryStorage writeMessage:payload[messageInfosKey]]; return; } if (![self isRescind:payload]) { return; } NSError *jsonError = nil; NSData *binarySerializedRescindPayload = [NSJSONSerialization dataWithJSONObject:payload options:0 error:&jsonError]; if (jsonError) { comm::Logger::log( "NSE: Failed to serialize rescind payload. Details: " + std::string([jsonError.localizedDescription UTF8String])); return; } NSString *serializedRescindPayload = [[NSString alloc] initWithData:binarySerializedRescindPayload encoding:NSUTF8StringEncoding]; TemporaryMessageStorage *temporaryRescindsStorage = [[TemporaryMessageStorage alloc] initForRescinds]; [temporaryRescindsStorage writeMessage:serializedRescindPayload]; } - (BOOL)isRescind:(NSDictionary *)payload { return payload[backgroundNotificationTypeKey] && [payload[backgroundNotificationTypeKey] isEqualToString:@"CLEAR"]; } - (void)calculateTotalUnreadCountInPlace: (UNMutableNotificationContent *)content { if (!content.userInfo[keyserverIDKey]) { throw std::runtime_error("Received badge update without keyserver ID."); } std::string senderKeyserverID = std::string([content.userInfo[keyserverIDKey] UTF8String]); std::string senderKeyserverUnreadCountKey = joinStrings( mmkvKeySeparator, {mmkvKeyserverPrefix, senderKeyserverID, mmkvUnreadCountSuffix}); int senderKeyserverUnreadCount = [content.badge intValue]; comm::CommMMKV::setInt( senderKeyserverUnreadCountKey, senderKeyserverUnreadCount); int totalUnreadCount = 0; std::vector allKeys = comm::CommMMKV::getAllKeys(); for (const auto &key : allKeys) { if (key.size() < mmkvKeyserverPrefix.size() + mmkvUnreadCountSuffix.size() || key.compare(0, mmkvKeyserverPrefix.size(), mmkvKeyserverPrefix) || key.compare( key.size() - mmkvUnreadCountSuffix.size(), mmkvUnreadCountSuffix.size(), mmkvUnreadCountSuffix)) { continue; } std::optional unreadCount = comm::CommMMKV::getInt(key, -1); if (!unreadCount.has_value()) { continue; } totalUnreadCount += unreadCount.value(); } content.badge = @(totalUnreadCount); } - (void)fetchAndPersistLargeNotifPayload: (UNMutableNotificationContent *)content { NSString *blobHash = content.userInfo[blobHashKey]; NSData *encryptionKey = [[NSData alloc] initWithBase64EncodedString:content.userInfo[encryptionKeyLabel] options:0]; __block NSError *fetchError = nil; NSData *largePayloadBinary = [CommIOSBlobClient.sharedInstance getBlobSync:blobHash orSetError:&fetchError]; if (fetchError) { comm::Logger::log( "Failed to fetch notif payload from blob service. Details: " + std::string([fetchError.localizedDescription UTF8String])); return; } NSDictionary *largePayload = [NotificationService aesDecryptAndParse:largePayloadBinary withKey:encryptionKey]; [self persistMessagePayload:largePayload]; [CommIOSBlobClient.sharedInstance storeBlobForDeletionWithHash:blobHash andHolder:content.userInfo[blobHolderKey]]; } - (BOOL)isCollapsible:(NSDictionary *)payload { return payload[collapseIDKey]; } - (BOOL)isLargeNotification:(NSDictionary *)payload { return payload[blobHashKey] && payload[encryptionKeyLabel] && payload[blobHolderKey]; } - (UNNotificationContent *)getBadgeOnlyContentFor: (UNNotificationContent *)content { UNMutableNotificationContent *badgeOnlyContent = [[UNMutableNotificationContent alloc] init]; badgeOnlyContent.badge = content.badge; return badgeOnlyContent; } - (void)sendNewMessageInfosNotification { CFNotificationCenterPostNotification( CFNotificationCenterGetDarwinNotifyCenter(), newMessageInfosDarwinNotification, (__bridge const void *)(self), nil, TRUE); } - (BOOL)shouldBeDecrypted:(NSDictionary *)payload { return payload[encryptedPayloadKey]; } - (BOOL)shouldAlertUnencryptedNotification:(NSDictionary *)payload { - return payload[encryptionFailureKey] && - [payload[encryptionFailureKey] isEqualToNumber:@(1)]; + return payload[encryptionFailedKey] && + [payload[encryptionFailedKey] isEqualToString:@"1"]; } - (std::unique_ptr) decryptContentInPlace:(UNMutableNotificationContent *)content { std::string encryptedData = std::string([content.userInfo[encryptedPayloadKey] UTF8String]); if (!content.userInfo[keyserverIDKey]) { throw std::runtime_error( "Received encrypted notification without keyserverID."); } std::string senderKeyserverID = std::string([content.userInfo[keyserverIDKey] UTF8String]); auto decryptResult = comm::NotificationsCryptoModule::statefulDecrypt( senderKeyserverID, encryptedData, comm::NotificationsCryptoModule::olmEncryptedTypeMessage); NSString *decryptedSerializedPayload = [NSString stringWithUTF8String:decryptResult->getDecryptedData().c_str()]; NSDictionary *decryptedPayload = [NSJSONSerialization JSONObjectWithData:[decryptedSerializedPayload dataUsingEncoding:NSUTF8StringEncoding] options:0 error:nil]; NSMutableDictionary *mutableUserInfo = [content.userInfo mutableCopy]; NSMutableDictionary *mutableAps = nil; if (mutableUserInfo[@"aps"]) { mutableAps = [mutableUserInfo[@"aps"] mutableCopy]; } NSString *body = decryptedPayload[@"merged"]; if (body) { content.body = body; if (mutableAps && mutableAps[@"alert"]) { mutableAps[@"alert"] = body; } } else { mutableUserInfo[needsSilentBadgeUpdateKey] = @(YES); } NSString *threadID = decryptedPayload[@"threadID"]; if (threadID) { content.threadIdentifier = threadID; mutableUserInfo[@"threadID"] = threadID; if (mutableAps) { mutableAps[@"thread-id"] = threadID; } } NSString *badgeStr = decryptedPayload[@"badge"]; if (badgeStr) { NSNumber *badge = @([badgeStr intValue]); content.badge = badge; if (mutableAps) { mutableAps[@"badge"] = badge; } } // The rest have been already decrypted and handled. static NSArray *handledKeys = @[ @"merged", @"badge", @"threadID" ]; for (NSString *payloadKey in decryptedPayload) { if ([handledKeys containsObject:payloadKey]) { continue; } mutableUserInfo[payloadKey] = decryptedPayload[payloadKey]; } if (mutableAps) { mutableUserInfo[@"aps"] = mutableAps; } [mutableUserInfo removeObjectForKey:encryptedPayloadKey]; mutableUserInfo[@"successfullyDecrypted"] = @(YES); content.userInfo = mutableUserInfo; return decryptResult; } // Apple documentation for NSE does not explicitly state // that single NSE instance will be used by only one thread // at a time. Even though UNNotificationServiceExtension API // suggests that it could be the case we don't trust it // and keep a synchronized collection of handlers and contents. // We keep reports of events that strongly suggest there is // parallelism in notifications processing. In particular we // have see notifications not being decrypted when access // to encryption keys had not been correctly implemented. // Similar behaviour is adopted by other apps such as Signal, // Telegram or Element. - (void)setUpNSEInstance { @synchronized(self) { if (self.contentHandlers) { return; } self.contentHandlers = [[NSMutableDictionary alloc] init]; self.contents = [[NSMutableDictionary alloc] init]; } } - (void)putContent:(UNNotificationContent *)content withHandler:(void (^)(UNNotificationContent *_Nonnull))handler forKey:(NSString *)key { @synchronized(self.contentHandlers) { [self.contentHandlers setObject:handler forKey:key]; [self.contents setObject:content forKey:key]; } } - (void)callContentHandlerForKey:(NSString *)key withContent:(UNNotificationContent *)content { void (^handler)(UNNotificationContent *_Nonnull); @synchronized(self.contentHandlers) { handler = [self.contentHandlers objectForKey:key]; [self.contentHandlers removeObjectForKey:key]; [self.contents removeObjectForKey:key]; } if (!handler) { return; } handler(content); } - (UNNotificationContent *)buildContentForError:(NSString *)error { UNMutableNotificationContent *content = [[UNMutableNotificationContent alloc] init]; content.body = error; return content; } - (void)callContentHandlerForKey:(NSString *)key onErrorMessage:(NSString *)errorMessage withPublicUserContent:(UNNotificationContent *)publicUserContent { comm::Logger::log(std::string([errorMessage UTF8String])); if (comm::StaffUtils::isStaffRelease()) { NSString *errorNotifId = [@"error_for_" stringByAppendingString:key]; UNNotificationContent *content = [self buildContentForError:errorMessage]; UNNotificationRequest *localNotifRequest = [UNNotificationRequest requestWithIdentifier:errorNotifId content:content trigger:nil]; [self displayLocalNotificationFor:localNotifRequest]; } [self callContentHandlerForKey:key withContent:publicUserContent]; } - (void)displayLocalNotificationFor:(UNNotificationRequest *)localNotifRequest { // We must wait until local notif display completion // handler returns. Context: // https://developer.apple.com/forums/thread/108340?answerId=331640022#331640022 dispatch_semaphore_t localNotifDisplaySemaphore = dispatch_semaphore_create(0); __block NSError *localNotifDisplayError = nil; [UNUserNotificationCenter.currentNotificationCenter addNotificationRequest:localNotifRequest withCompletionHandler:^(NSError *_Nullable error) { if (error) { localNotifDisplayError = error; } dispatch_semaphore_signal(localNotifDisplaySemaphore); }]; dispatch_semaphore_wait( localNotifDisplaySemaphore, dispatch_time(DISPATCH_TIME_NOW, semaphoreAwaitTimeLimit)); if (localNotifDisplayError) { throw std::runtime_error( std::string([localNotifDisplayError.localizedDescription UTF8String])); } } - (BOOL)isAppShowingNotificationWith:(NSString *)identifier { dispatch_semaphore_t getAllDeliveredNotifsSemaphore = dispatch_semaphore_create(0); __block BOOL foundNotification = NO; [UNUserNotificationCenter.currentNotificationCenter getDeliveredNotificationsWithCompletionHandler:^( NSArray *_Nonnull notifications) { for (UNNotification *notif in notifications) { if (notif.request.content.userInfo[@"id"] && [notif.request.content.userInfo[@"id"] isEqualToString:identifier]) { foundNotification = YES; break; } } dispatch_semaphore_signal(getAllDeliveredNotifsSemaphore); }]; dispatch_semaphore_wait( getAllDeliveredNotifsSemaphore, dispatch_time(DISPATCH_TIME_NOW, semaphoreAwaitTimeLimit)); return foundNotification; } // Monitor memory usage + (NSString *)getAndSetMemoryEventMessage:(NSString *)message { static NSString *memoryEventMessage = nil; static NSLock *memoryEventLock = [[NSLock alloc] init]; @try { if (![memoryEventLock tryLock]) { return nil; } NSString *currentMemoryEventMessage = memoryEventMessage ? [memoryEventMessage copy] : nil; memoryEventMessage = [message copy]; return currentMemoryEventMessage; } @finally { [memoryEventLock unlock]; } } + (dispatch_source_t)registerForMemoryEvents { dispatch_source_t memorySource = dispatch_source_create( DISPATCH_SOURCE_TYPE_MEMORYPRESSURE, 0L, DISPATCH_MEMORYPRESSURE_CRITICAL, dispatch_get_main_queue()); dispatch_block_t eventHandler = ^{ NSString *criticalMemoryEventMessage = [NSString stringWithFormat: @"NSE: Received CRITICAL memory event. Memory usage: %ld bytes", getMemoryUsageInBytes()]; comm::Logger::log(std::string([criticalMemoryEventMessage UTF8String])); if (!comm::StaffUtils::isStaffRelease()) { // If it is not a staff release we don't set // memoryEventMessage variable since it will // not be displayed to the client anyway return; } [NotificationService getAndSetMemoryEventMessage:criticalMemoryEventMessage]; }; dispatch_source_set_event_handler(memorySource, eventHandler); dispatch_activate(memorySource); return memorySource; } // AES Cryptography static AESCryptoModuleObjCCompat *_aesCryptoModule = nil; + (AESCryptoModuleObjCCompat *)processLocalAESCryptoModule { return _aesCryptoModule; } + (NSDictionary *)aesDecryptAndParse:(NSData *)sealedData withKey:(NSData *)key { NSError *decryptError = nil; NSInteger destinationLength = [[NotificationService processLocalAESCryptoModule] decryptedLength:sealedData]; NSMutableData *destination = [NSMutableData dataWithLength:destinationLength]; [[NotificationService processLocalAESCryptoModule] decryptWithKey:key sealedData:sealedData destination:destination withError:&decryptError]; if (decryptError) { comm::Logger::log( "NSE: Notification aes decryption failure. Details: " + std::string([decryptError.localizedDescription UTF8String])); return nil; } NSString *decryptedSerializedPayload = [[NSString alloc] initWithData:destination encoding:NSUTF8StringEncoding]; return [NSJSONSerialization JSONObjectWithData:[decryptedSerializedPayload dataUsingEncoding:NSUTF8StringEncoding] options:0 error:nil]; } // Process-local initialization code NSE may use different threads and instances // of this class to process notifs, but it usually keeps the same process for // extended period of time. Objects that can be initialized once and reused on // each notif should be declared in a method below to avoid wasting resources + (void)setUpNSEProcess { static dispatch_source_t memoryEventSource; static dispatch_once_t onceToken; dispatch_once(&onceToken, ^{ _aesCryptoModule = [[AESCryptoModuleObjCCompat alloc] init]; memoryEventSource = [NotificationService registerForMemoryEvents]; }); } @end diff --git a/web/cpp/SQLiteQueryExecutorBindings.cpp b/web/cpp/SQLiteQueryExecutorBindings.cpp index 42a68d513..cab08e2a0 100644 --- a/web/cpp/SQLiteQueryExecutorBindings.cpp +++ b/web/cpp/SQLiteQueryExecutorBindings.cpp @@ -1,403 +1,402 @@ #include "SQLiteQueryExecutor.cpp" #include "entities/InboundP2PMessage.h" #include "entities/Nullable.h" #include "entities/OutboundP2PMessage.h" #include #include #include namespace comm { using namespace emscripten; std::string getExceptionMessage(int exceptionPtr) { if (exceptionPtr == 0) { return std::string("Exception pointer value was null"); } std::exception *e = reinterpret_cast(exceptionPtr); if (e) { return std::string(e->what()); } return std::string("Pointer to exception was invalid"); } EMSCRIPTEN_BINDINGS(SQLiteQueryExecutor) { function("getExceptionMessage", &getExceptionMessage); value_object("NullableString") .field("value", &NullableString::value) .field("isNull", &NullableString::isNull); value_object("NullableInt") .field("value", &NullableInt::value) .field("isNull", &NullableInt::isNull); value_object("Draft") .field("key", &Draft::key) .field("text", &Draft::text); value_object("Report") .field("id", &Report::id) .field("report", &Report::report); value_object("PersistItem") .field("key", &PersistItem::key) .field("item", &PersistItem::item); value_object("UserInfo") .field("id", &UserInfo::id) .field("userInfo", &UserInfo::user_info); value_object("KeyserverInfo") .field("id", &KeyserverInfo::id) .field("keyserverInfo", &KeyserverInfo::keyserver_info) .field("syncedKeyserverInfo", &KeyserverInfo::synced_keyserver_info); value_object("MessageStoreThreads") .field("id", &MessageStoreThread::id) .field("startReached", &MessageStoreThread::start_reached); value_object("CommunityInfo") .field("id", &CommunityInfo::id) .field("communityInfo", &CommunityInfo::community_info); value_object("IntegrityThreadHash") .field("id", &IntegrityThreadHash::id) .field("threadHash", &IntegrityThreadHash::thread_hash); value_object("SyncedMetadataEntry") .field("name", &SyncedMetadataEntry::name) .field("data", &SyncedMetadataEntry::data); value_object("AuxUserInfo") .field("id", &AuxUserInfo::id) .field("auxUserInfo", &AuxUserInfo::aux_user_info); value_object("ThreadActivityEntry") .field("id", &ThreadActivityEntry::id) .field( "threadActivityStoreEntry", &ThreadActivityEntry::thread_activity_store_entry); value_object("EntryInfo") .field("id", &EntryInfo::id) .field("entry", &EntryInfo::entry); value_object("LocalMessageInfo") .field("id", &LocalMessageInfo::id) .field("localMessageInfo", &LocalMessageInfo::local_message_info); value_object("WebThread") .field("id", &WebThread::id) .field("type", &WebThread::type) .field("name", &WebThread::name) .field("description", &WebThread::description) .field("color", &WebThread::color) .field("creationTime", &WebThread::creation_time) .field("parentThreadID", &WebThread::parent_thread_id) .field("containingThreadID", &WebThread::containing_thread_id) .field("community", &WebThread::community) .field("members", &WebThread::members) .field("roles", &WebThread::roles) .field("currentUser", &WebThread::current_user) .field("sourceMessageID", &WebThread::source_message_id) .field("repliesCount", &WebThread::replies_count) .field("avatar", &WebThread::avatar) .field("pinnedCount", &WebThread::pinned_count); value_object("WebMessage") .field("id", &WebMessage::id) .field("localID", &WebMessage::local_id) .field("thread", &WebMessage::thread) .field("user", &WebMessage::user) .field("type", &WebMessage::type) .field("futureType", &WebMessage::future_type) .field("content", &WebMessage::content) .field("time", &WebMessage::time); value_object("Media") .field("id", &Media::id) .field("container", &Media::container) .field("thread", &Media::thread) .field("uri", &Media::uri) .field("type", &Media::type) .field("extras", &Media::extras); value_object("MessageWithMedias") .field("message", &MessageWithMedias::message) .field("medias", &MessageWithMedias::medias); value_object("OlmPersistSession") .field("targetDeviceID", &OlmPersistSession::target_device_id) .field("sessionData", &OlmPersistSession::session_data) .field("version", &OlmPersistSession::version); value_object("OutboundP2PMessage") .field("messageID", &OutboundP2PMessage::message_id) .field("deviceID", &OutboundP2PMessage::device_id) .field("userID", &OutboundP2PMessage::user_id) .field("timestamp", &OutboundP2PMessage::timestamp) .field("plaintext", &OutboundP2PMessage::plaintext) .field("ciphertext", &OutboundP2PMessage::ciphertext) .field("status", &OutboundP2PMessage::status); value_object("InboundP2PMessage") .field("messageID", &InboundP2PMessage::message_id) .field("senderDeviceID", &InboundP2PMessage::sender_device_id) .field("plaintext", &InboundP2PMessage::plaintext) .field("status", &InboundP2PMessage::status); class_("SQLiteQueryExecutor") .constructor() .function("updateDraft", &SQLiteQueryExecutor::updateDraft) .function("moveDraft", &SQLiteQueryExecutor::moveDraft) .function("getAllDrafts", &SQLiteQueryExecutor::getAllDrafts) .function("removeAllDrafts", &SQLiteQueryExecutor::removeAllDrafts) .function("removeDrafts", &SQLiteQueryExecutor::removeDrafts) .function("getAllMessagesWeb", &SQLiteQueryExecutor::getAllMessagesWeb) .function("removeAllMessages", &SQLiteQueryExecutor::removeAllMessages) .function("removeMessages", &SQLiteQueryExecutor::removeMessages) .function( "removeMessagesForThreads", &SQLiteQueryExecutor::removeMessagesForThreads) .function("replaceMessageWeb", &SQLiteQueryExecutor::replaceMessageWeb) .function("rekeyMessage", &SQLiteQueryExecutor::rekeyMessage) .function("removeAllMedia", &SQLiteQueryExecutor::removeAllMedia) .function( "removeMediaForThreads", &SQLiteQueryExecutor::removeMediaForThreads) .function( "removeMediaForMessage", &SQLiteQueryExecutor::removeMediaForMessage) .function( "removeMediaForMessages", &SQLiteQueryExecutor::removeMediaForMessages) .function("replaceMedia", &SQLiteQueryExecutor::replaceMedia) .function( "rekeyMediaContainers", &SQLiteQueryExecutor::rekeyMediaContainers) .function( "replaceMessageStoreThreads", &SQLiteQueryExecutor::replaceMessageStoreThreads) .function( "removeMessageStoreThreads", &SQLiteQueryExecutor::removeMessageStoreThreads) .function( "getAllMessageStoreThreads", &SQLiteQueryExecutor::getAllMessageStoreThreads) .function( "removeAllMessageStoreThreads", &SQLiteQueryExecutor::removeAllMessageStoreThreads) .function("setMetadata", &SQLiteQueryExecutor::setMetadata) .function("clearMetadata", &SQLiteQueryExecutor::clearMetadata) .function("getMetadata", &SQLiteQueryExecutor::getMetadata) .function("replaceReport", &SQLiteQueryExecutor::replaceReport) .function("removeReports", &SQLiteQueryExecutor::removeReports) .function("removeAllReports", &SQLiteQueryExecutor::removeAllReports) .function("getAllReports", &SQLiteQueryExecutor::getAllReports) .function( "setPersistStorageItem", &SQLiteQueryExecutor::setPersistStorageItem) .function( "removePersistStorageItem", &SQLiteQueryExecutor::removePersistStorageItem) .function( "getPersistStorageItem", &SQLiteQueryExecutor::getPersistStorageItem) .function("replaceUser", &SQLiteQueryExecutor::replaceUser) .function("removeUsers", &SQLiteQueryExecutor::removeUsers) .function("removeAllUsers", &SQLiteQueryExecutor::removeAllUsers) .function("getAllUsers", &SQLiteQueryExecutor::getAllUsers) .function("replaceThreadWeb", &SQLiteQueryExecutor::replaceThreadWeb) .function("getAllThreadsWeb", &SQLiteQueryExecutor::getAllThreadsWeb) .function("removeAllThreads", &SQLiteQueryExecutor::removeAllThreads) .function("removeThreads", &SQLiteQueryExecutor::removeThreads) .function("replaceKeyserver", &SQLiteQueryExecutor::replaceKeyserver) .function("removeKeyservers", &SQLiteQueryExecutor::removeKeyservers) .function( "removeAllKeyservers", &SQLiteQueryExecutor::removeAllKeyservers) .function("getAllKeyservers", &SQLiteQueryExecutor::getAllKeyservers) .function("replaceCommunity", &SQLiteQueryExecutor::replaceCommunity) .function("removeCommunities", &SQLiteQueryExecutor::removeCommunities) .function( "removeAllCommunities", &SQLiteQueryExecutor::removeAllCommunities) .function("getAllCommunities", &SQLiteQueryExecutor::getAllCommunities) .function( "replaceIntegrityThreadHashes", &SQLiteQueryExecutor::replaceIntegrityThreadHashes) .function( "removeIntegrityThreadHashes", &SQLiteQueryExecutor::removeIntegrityThreadHashes) .function( "removeAllIntegrityThreadHashes", &SQLiteQueryExecutor::removeAllIntegrityThreadHashes) .function( "getAllIntegrityThreadHashes", &SQLiteQueryExecutor::getAllIntegrityThreadHashes) .function( "replaceSyncedMetadataEntry", &SQLiteQueryExecutor::replaceSyncedMetadataEntry) .function( "removeSyncedMetadata", &SQLiteQueryExecutor::removeSyncedMetadata) .function( "removeAllSyncedMetadata", &SQLiteQueryExecutor::removeAllSyncedMetadata) .function( "getAllSyncedMetadata", &SQLiteQueryExecutor::getAllSyncedMetadata) .function("replaceAuxUserInfo", &SQLiteQueryExecutor::replaceAuxUserInfo) .function("removeAuxUserInfos", &SQLiteQueryExecutor::removeAuxUserInfos) .function( "removeAllAuxUserInfos", &SQLiteQueryExecutor::removeAllAuxUserInfos) .function("getAllAuxUserInfos", &SQLiteQueryExecutor::getAllAuxUserInfos) .function( "replaceThreadActivityEntry", &SQLiteQueryExecutor::replaceThreadActivityEntry) .function( "removeThreadActivityEntries", &SQLiteQueryExecutor::removeThreadActivityEntries) .function( "removeAllThreadActivityEntries", &SQLiteQueryExecutor::removeAllThreadActivityEntries) .function( "getAllThreadActivityEntries", &SQLiteQueryExecutor::getAllThreadActivityEntries) .function("replaceEntry", &SQLiteQueryExecutor::replaceEntry) .function("removeEntries", &SQLiteQueryExecutor::removeEntries) .function("removeAllEntries", &SQLiteQueryExecutor::removeAllEntries) .function("getAllEntries", &SQLiteQueryExecutor::getAllEntries) .function( "replaceMessageStoreLocalMessageInfo", &SQLiteQueryExecutor::replaceMessageStoreLocalMessageInfo) .function( "removeMessageStoreLocalMessageInfos", &SQLiteQueryExecutor::removeMessageStoreLocalMessageInfos) .function( "removeAllMessageStoreLocalMessageInfos", &SQLiteQueryExecutor::removeAllMessageStoreLocalMessageInfos) .function( "getAllMessageStoreLocalMessageInfos", &SQLiteQueryExecutor::getAllMessageStoreLocalMessageInfos) .function("beginTransaction", &SQLiteQueryExecutor::beginTransaction) .function("commitTransaction", &SQLiteQueryExecutor::commitTransaction) .function( "getContentAccountID", &SQLiteQueryExecutor::getContentAccountID) .function("getNotifsAccountID", &SQLiteQueryExecutor::getNotifsAccountID) .function( "getOlmPersistSessionsData", &SQLiteQueryExecutor::getOlmPersistSessionsData) .function( "getOlmPersistAccountDataWeb", &SQLiteQueryExecutor::getOlmPersistAccountDataWeb) .function( "storeOlmPersistSession", &SQLiteQueryExecutor::storeOlmPersistSession) .function( "storeOlmPersistAccount", &SQLiteQueryExecutor::storeOlmPersistAccount) .function( "rollbackTransaction", &SQLiteQueryExecutor::rollbackTransaction) .function( "restoreFromMainCompaction", &SQLiteQueryExecutor::restoreFromMainCompaction) .function( "restoreFromBackupLog", &SQLiteQueryExecutor::restoreFromBackupLog) .function( "addOutboundP2PMessages", &SQLiteQueryExecutor::addOutboundP2PMessages) .function( "removeOutboundP2PMessagesOlderThan", &SQLiteQueryExecutor::removeOutboundP2PMessagesOlderThan) .function( "removeAllOutboundP2PMessages", &SQLiteQueryExecutor::removeAllOutboundP2PMessages) .function( "getAllOutboundP2PMessages", &SQLiteQueryExecutor::getAllOutboundP2PMessages) .function( "setCiphertextForOutboundP2PMessage", &SQLiteQueryExecutor::setCiphertextForOutboundP2PMessage) .function( "markOutboundP2PMessageAsSent", &SQLiteQueryExecutor::markOutboundP2PMessageAsSent) .function( "addInboundP2PMessage", &SQLiteQueryExecutor::addInboundP2PMessage) .function( "getAllInboundP2PMessage", &SQLiteQueryExecutor::getAllInboundP2PMessage) .function( "removeInboundP2PMessages", &SQLiteQueryExecutor::removeInboundP2PMessages) .function( - "getRelatedMessagesWeb", - &SQLiteQueryExecutor::getRelatedMessagesWeb); + "getRelatedMessagesWeb", &SQLiteQueryExecutor::getRelatedMessagesWeb); } } // namespace comm namespace emscripten { namespace internal { template struct BindingType> { using ValBinding = BindingType; using WireType = ValBinding::WireType; static WireType toWireType(const std::vector &vec) { std::vector valVec(vec.begin(), vec.end()); return BindingType::toWireType(val::array(valVec)); } static std::vector fromWireType(WireType value) { return vecFromJSArray(ValBinding::fromWireType(value)); } }; template struct TypeID< T, typename std::enable_if_t::type, std::vector< typename Canonicalized::type::value_type, typename Canonicalized::type::allocator_type>>::value>> { static constexpr TYPEID get() { return TypeID::get(); } }; template struct TypeID> { static constexpr TYPEID get() { return LightTypeID::get(); } }; template struct TypeID> { static constexpr TYPEID get() { return LightTypeID::get(); } }; template struct TypeID &> { static constexpr TYPEID get() { return LightTypeID::get(); } }; template struct TypeID &&> { static constexpr TYPEID get() { return LightTypeID::get(); } }; template struct TypeID &> { static constexpr TYPEID get() { return LightTypeID::get(); } }; template struct BindingType> { using ValBinding = BindingType; using WireType = ValBinding::WireType; static WireType toWireType(std::optional const &opt) { if (!opt.has_value()) { return ValBinding::toWireType(val::null()); } return ValBinding::toWireType(val(opt.value())); } static std::optional fromWireType(WireType value) { val convertedVal = ValBinding::fromWireType(value); if (convertedVal.isNull() || convertedVal.isUndefined()) { return std::nullopt; } return std::make_optional(convertedVal.as()); } }; } // namespace internal } // namespace emscripten