Suffix web olm notifs session with cookieID to avoid race condition during multiple simultaneous log-in processes.
Summary:
This differential implements solution for a bug described in https://linear.app/comm/issue/ENG-5911/olmbad-message-mac-on-web. The solution works as follows:
- Web client creates olm session and corresponding encryption key and persists it under key that is suffixed with its cookieID.
- When notifications arrives all keys in IndexedDB are retrieved and filtered against those that keep olm sessions and their encryption keys.
- Keys are sorted lexicographically and last ones are used to actually perform decryption. This means that for decryption we will use olm session that was created by lexicographically largest cookie ID. We have strong reasons to believe that keyserver uses olm session associated with the largest cookie ID for encryption.
- Other sessions are deleted
It is important to review this code closely since it implements quite complex solution for rather infrequent bug.
Test Plan:
- Open three pages with logged-out modal. Paste credentials for the same user in each and start log in process in each card. Initially this was the way to reproduce the issue.
- Open developer tools in one page and see that there are multiple sessions and encryption keys and each of them is suffixed with cookie id that exists in your MariaDB instance.
- Send notification. Ensure that:
- it is correctly decrypted
- once it is received there is just one olm session in IndexedDB and it is the one that initially had largest cookie ID
Reviewers: tomek, kamil, michal
Reviewed By: michal
Subscribers: inka, ashoat
Differential Revision: https://phab.comm.dev/D10245