Implements PLAN.md Phase 7: the server half of end-to-end encryption.
Devices upload identity, one-time and fallback keys; other devices query
and claim them, across servers too, and every one-time key is handed out
exactly once. Cross-signing, signature uploads, device list tracking and
server-side key backup complete the set.
internal/keyserver is the component. Keys are stored in canonical JSON
so that re-uploading the same key is a byte comparison, and signatures
uploaded later are kept apart from the key they sign and merged in on
read, so a key's own JSON stays what its owner uploaded. Device keys must
be for the caller's own device; cross-signing keys must be the
uploader's, carry the right usage and, for self- and user-signing keys,
be signed by the master key. Signatures are verified against the key as
stored. Replacing a master key asks for the password; a first upload or
an upload of the keys already stored does not, as the spec allows. A
signature of another user's master key is shown only to the user who
made it and never federated.
Every write that changes what /keys/query answers moves the device list
stream in the same transaction, one position per device, and wakes the
syncs of everyone sharing a room. The stream is the sixth field of a sync
token; older tokens still parse. The syncapi works out device_lists
changed and left from the stream and from membership moves in the
window, skipping invites and knocks, and reports
device_one_time_keys_count and device_unused_fallback_key_types, the
latter as [] when empty. GET /keys/changes uses the same logic.
Over federation: /user/keys/query, /user/keys/claim and
/user/devices/{userId}, and m.device_list_update and m.signing_key_update
both ways. Remote keys are not cached; an update about a remote user
sharing a room moves them in the stream so local clients re-query.
Device display names are not sent to other servers. With federation off,
remote users are reported in failures at once.
Deleting a device deletes its keys, through a new userapi
DeviceObserver. Key backup keeps the better copy of each session by the
spec's rule, never reuses a deleted version's number, and answers writes
to a stale version with M_WRONG_ROOM_KEYS_VERSION.
Storage is migration 0008 for sqlite and postgres, with a PocketBase
stub. The Complement target sets gain the key, device list, fallback,
cross-signing and backup tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
107 lines
3.2 KiB
Go
107 lines
3.2 KiB
Go
package syncapi_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/dariuszjaniak/warp/server/internal/syncapi"
|
|
)
|
|
|
|
func TestTokenRoundTrips(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
name string
|
|
token syncapi.Token
|
|
want string
|
|
}{
|
|
{"the initial token", syncapi.Token{}, "s0"},
|
|
{"events only", syncapi.Token{PDU: 12}, "s12"},
|
|
{"events and receipts", syncapi.Token{PDU: 12, Receipt: 3}, "s12_3"},
|
|
{
|
|
"every stream",
|
|
syncapi.Token{PDU: 1, Receipt: 2, ToDevice: 3, AccountData: 4, Presence: 5, DeviceList: 6},
|
|
"s1_2_3_4_5_6",
|
|
},
|
|
{
|
|
// /messages pages back into history backfilled from other
|
|
// servers, which is numbered downwards from -1.
|
|
"a position inside backfilled history",
|
|
syncapi.Token{PDU: -7},
|
|
"s-7",
|
|
},
|
|
{
|
|
// A zero in the middle has to be written, because the
|
|
// positions are read by place.
|
|
"a gap in the middle",
|
|
syncapi.Token{PDU: 1, Presence: 5},
|
|
"s1_0_0_0_5",
|
|
},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
if got := tc.token.String(); got != tc.want {
|
|
t.Fatalf("String() = %q, want %q", got, tc.want)
|
|
}
|
|
parsed, err := syncapi.ParseToken(tc.want)
|
|
if err != nil {
|
|
t.Fatalf("ParseToken(%q): %v", tc.want, err)
|
|
}
|
|
if parsed != tc.token {
|
|
t.Errorf("ParseToken(%q) = %+v, want %+v", tc.want, parsed, tc.token)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseTokenAcceptsAnEmptyString(t *testing.T) {
|
|
// /sync without ?since= and /messages without ?from= both mean "from
|
|
// the beginning"; refusing the empty string would make every caller
|
|
// special-case it.
|
|
parsed, err := syncapi.ParseToken("")
|
|
if err != nil {
|
|
t.Fatalf("ParseToken(\"\"): %v", err)
|
|
}
|
|
if !parsed.IsInitial() {
|
|
t.Errorf("ParseToken(\"\") = %+v, want the initial token", parsed)
|
|
}
|
|
}
|
|
|
|
func TestParseTokenAcceptsAShortToken(t *testing.T) {
|
|
// A token a client stored before a stream existed must go on working:
|
|
// the stream it does not mention reads as "seen nothing", so the
|
|
// client is sent that stream in full once and is in step afterwards.
|
|
parsed, err := syncapi.ParseToken("s7")
|
|
if err != nil {
|
|
t.Fatalf("ParseToken(\"s7\"): %v", err)
|
|
}
|
|
if parsed.PDU != 7 {
|
|
t.Errorf("PDU = %d, want 7", parsed.PDU)
|
|
}
|
|
if parsed.Receipt != 0 || parsed.ToDevice != 0 || parsed.AccountData != 0 || parsed.Presence != 0 {
|
|
t.Errorf("the streams a short token omits must read as zero: %+v", parsed)
|
|
}
|
|
}
|
|
|
|
func TestParseTokenRejectsNonsense(t *testing.T) {
|
|
for _, raw := range []string{
|
|
"nonsense", // no prefix
|
|
"t1_2", // a prefix this build does not write
|
|
"s", // a prefix and nothing else
|
|
"s1_-1", // a negative position outside the event stream
|
|
"sx", // not a number
|
|
"s1_", // a trailing separator
|
|
"s1_2_3_4_5_6_7", // more positions than there are streams
|
|
"s1.5",
|
|
} {
|
|
if _, err := syncapi.ParseToken(raw); err == nil {
|
|
t.Errorf("ParseToken(%q) was accepted", raw)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestParseTokenIsNotFooledByOverflow(t *testing.T) {
|
|
// A position larger than an int64 is not a position this server ever
|
|
// handed out, and silently wrapping it would mean a client being sent
|
|
// the whole of every room again.
|
|
if _, err := syncapi.ParseToken("s99999999999999999999"); err == nil {
|
|
t.Error("a position that does not fit in an int64 was accepted")
|
|
}
|
|
}
|