No OneTemporary
Actions

Size

113 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/base/debug.cpp b/src/base/debug.cpp
	index b4dd6e9..8501b3e 100644
	--- a/src/base/debug.cpp
	+++ b/src/base/debug.cpp
	@@ -1,112 +1,114 @@
	/*
	* This file is part of libkazv.
	- * SPDX-FileCopyrightText: 2020-2021 Tusooa Zhu <tusooa@kazv.moe>
	+ * SPDX-FileCopyrightText: 2020-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include "libkazv-config.hpp"

	#include <vector>
	#include <cstdlib>

	#include <boost/algorithm/string.hpp>

	#include "debug.hpp"

	#ifndef NDEBUG
	#define KAZV_DEFAULT_OUTPUT_LEVEL DEBUG
	#else
	#define KAZV_DEFAULT_OUTPUT_LEVEL WARNING
	#endif

	namespace Kazv
	{
	namespace detail
	{
	boost::iostreams::stream<boost::iostreams::null_sink> voidOutputHelper{boost::iostreams::null_sink()};

	std::string toStr(OutputLevel l)
	{
	if (l == ERROR) {
	return "error";
	} else if (l == WARNING) {
	return "warning";
	} else if (l == INFO) {
	return "info";
	} else if (l == DEBUG) {
	return "debug";
	} else {
	return "none";
	}
	}

	std::ostream &OutputHelper::basicFormat() const
	{
	auto now = std::chrono::system_clock::now();
	std::time_t nowTimeT = std::chrono::system_clock::to_time_t(now);

	std::vector<char> timeStr(40, '0');
	+ auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(now.time_since_epoch());
	std::strftime(timeStr.data(), 40, "%Y,%-m,%-d (%u) %H,%M,%S", std::localtime(&nowTimeT));
	- return std::cerr << "[" << timeStr.data() << "]["
	+ return std::cerr << "[" << timeStr.data() << "]"
	+ << "[" << duration.count() << "ms]["
	<< category << "]["
	<< toStr(severity) << "] ";
	}

	OutputHelper OutputGroup::dbg() const { return OutputHelper{name, DEBUG, level}; }
	OutputHelper OutputGroup::info() const { return OutputHelper{name, INFO, level}; }
	OutputHelper OutputGroup::warn() const { return OutputHelper{name, WARNING, level}; }
	OutputHelper OutputGroup::err() const { return OutputHelper{name, ERROR, level}; }

	OutputConfig::OutputConfig()
	: api{"api", KAZV_DEFAULT_OUTPUT_LEVEL}
	, base{"base", KAZV_DEFAULT_OUTPUT_LEVEL}
	, client{"client", KAZV_DEFAULT_OUTPUT_LEVEL}
	, ee{"eventemitter", KAZV_DEFAULT_OUTPUT_LEVEL}
	, job{"job", KAZV_DEFAULT_OUTPUT_LEVEL}
	, crypto{"crypto", KAZV_DEFAULT_OUTPUT_LEVEL}
	{
	auto env = std::getenv("KAZV_OUTPUT_LEVELS");
	std::string s{env ? env : ""};
	using namespace boost::algorithm;

	std::vector<std::string> groups;
	split(groups, s, is_any_of(","));

	for (auto g : groups) {
	std::vector<std::string> cfg;
	split(cfg, g, is_any_of("="));
	if (cfg.size() != 2) {
	return;
	}
	OutputLevel l;
	if (cfg[1] == "debug") {
	l = DEBUG;
	} else if (cfg[1] == "info") {
	l = INFO;
	} else if (cfg[1] == "warning") {
	l = WARNING;
	} else if (cfg[1] == "error") {
	l = ERROR;
	} else {
	l = NONE;
	}

	if (cfg[0] == "api") {
	api.level = l;
	} else if (cfg[0] == "base") {
	base.level = l;
	} else if (cfg[0] == "client") {
	client.level = l;
	} else if (cfg[0] == "eventemitter") {
	ee.level = l;
	} else if (cfg[0] == "job") {
	job.level = l;
	} else if (cfg[0] == "crypto") {
	crypto.level = l;
	}
	}
	}
	}

	const detail::OutputConfig kzo{};
	}
	diff --git a/src/client/actions/encryption.cpp b/src/client/actions/encryption.cpp
	index edbf7a6..29174e9 100644
	--- a/src/client/actions/encryption.cpp
	+++ b/src/client/actions/encryption.cpp
	@@ -1,646 +1,634 @@
	/*
	* This file is part of libkazv.
	- * SPDX-FileCopyrightText: 2021-2023 tusooa <tusooa@kazv.moe>
	+ * SPDX-FileCopyrightText: 2021-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <zug/transducer/filter.hpp>
	#include <zug/transducer/cat.hpp>

	#include "encryption.hpp"

	#include <immer-utils.hpp>
	#include <debug.hpp>
	#include "cursorutil.hpp"
	#include "status-utils.hpp"

	namespace Kazv
	{
	using namespace CryptoConstants;

	static json convertSignature(const ClientModel &m, std::string signature)
	{
	auto j = json::object();
	j[m.userId] = json::object();
	j[m.userId][ed25519 + ":" + m.deviceId] = signature;

	return j;
	}

	ClientResult updateClient(ClientModel m, UploadIdentityKeysAction)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), lager::noop };
	}

	- auto &crypto = m.crypto.value();
	-
	auto keys =
	immer::map<std::string, std::string>{}
	- .set(ed25519 + ":" + m.deviceId, crypto.ed25519IdentityKey())
	- .set(curve25519 + ":" + m.deviceId, crypto.curve25519IdentityKey());
	+ .set(ed25519 + ":" + m.deviceId, m.constCrypto().ed25519IdentityKey())
	+ .set(curve25519 + ":" + m.deviceId, m.constCrypto().curve25519IdentityKey());

	DeviceKeys k {
	m.userId,
	m.deviceId,
	{olmAlgo, megOlmAlgo},
	keys,
	{} // signatures to be added soon
	};

	auto j = json(k);

	- auto sig = crypto.sign(j);
	+ auto sig = m.withCrypto([&](auto &crypto) { return crypto.sign(j); });

	k.signatures = convertSignature(m, sig);

	auto job = m.job<UploadKeysJob>()
	.make(k)
	.withData(json{{"is", "identityKeys"}});

	kzo.client.dbg() << "Uploading identity keys" << std::endl;

	m.addJob(std::move(job));

	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, GenerateAndUploadOneTimeKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), simpleFail };
	}

	- auto &crypto = m.crypto.value();
	-
	kzo.client.dbg() << "Generating one-time keys..." << std::endl;

	- auto maxNumKeys = crypto.maxNumberOfOneTimeKeys();
	- auto numLocalKeys = crypto.numUnpublishedOneTimeKeys();
	- auto numStoredKeys = crypto.uploadedOneTimeKeysCount(signedCurve25519) + numLocalKeys;
	+ auto maxNumKeys = m.constCrypto().maxNumberOfOneTimeKeys();
	+ auto numLocalKeys = m.constCrypto().numUnpublishedOneTimeKeys();
	+ auto numStoredKeys = m.constCrypto().uploadedOneTimeKeysCount(signedCurve25519) + numLocalKeys;
	auto numKeysToGenerate = a.numToGen;
	auto genKeysLimit = maxNumKeys - numStoredKeys;

	if (numKeysToGenerate > genKeysLimit) {
	numKeysToGenerate = genKeysLimit;
	}

	if (numLocalKeys <= 0 && numKeysToGenerate <= 0) { // we have enough already
	kzo.client.dbg() << "We have enough one-time keys. Ignoring this." << std::endl;
	return { std::move(m), lager::noop };
	}

	if (numKeysToGenerate > 0) {
	- crypto.genOneTimeKeysWithRandom(a.random, numKeysToGenerate);
	+ m.withCrypto([&](auto &c) { c.genOneTimeKeysWithRandom(a.random, numKeysToGenerate); });
	}
	kzo.client.dbg() << "Generating done." << std::endl;

	- auto keys = crypto.unpublishedOneTimeKeys();
	+ auto keys = m.constCrypto().unpublishedOneTimeKeys();

	auto cv25519Keys = keys.at(curve25519);
	json oneTimeKeys = json::object();
	for (auto [id, keyStr] : cv25519Keys.items()) {
	json keyObject = json::object();
	keyObject["key"] = keyStr;
	- keyObject["signatures"] = convertSignature(m, crypto.sign(keyObject));
	+ keyObject["signatures"] = convertSignature(m, m.withCrypto([&](auto &c) { return c.sign(keyObject); }));

	oneTimeKeys[signedCurve25519 + ":" + id] = keyObject;
	}

	auto job = m.job<UploadKeysJob>()
	.make(
	std::nullopt, // deviceKeys
	oneTimeKeys)
	.withData(json{{"is", "oneTimeKeys"}});

	kzo.client.dbg() << "Uploading one time keys" << std::endl;

	m.addJob(std::move(job));

	return { std::move(m), lager::noop };

	};

	ClientResult processResponse(ClientModel m, UploadKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), lager::noop };
	}

	- auto &crypto = m.crypto.value();
	-
	auto is = r.dataStr("is");

	if (is == "identityKeys") {
	if (! r.success()) {
	kzo.client.dbg() << "Uploading identity keys failed" << std::endl;
	m.addTrigger(UploadIdentityKeysFailed{r.errorCode(), r.errorMessage()});
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Uploading identity keys successful" << std::endl;
	m.addTrigger(UploadIdentityKeysSuccessful{});

	m.identityKeysUploaded = true;
	} else {
	if (! r.success()) {
	kzo.client.dbg() << "Uploading one-time keys failed" << std::endl;
	m.addTrigger(UploadOneTimeKeysFailed{r.errorCode(), r.errorMessage()});
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Uploading one-time keys successful" << std::endl;
	m.addTrigger(UploadOneTimeKeysSuccessful{});

	- crypto.markOneTimeKeysAsPublished();
	+ m.withCrypto([&](auto &c) { c.markOneTimeKeysAsPublished(); });
	}

	- crypto.setUploadedOneTimeKeysCount(r.oneTimeKeyCounts());
	+ m.withCrypto([&](auto &c) { c.setUploadedOneTimeKeysCount(r.oneTimeKeyCounts()); });

	return { std::move(m), lager::noop };
	}

	static JsonWrap cannotDecryptEvent(std::string reason)
	{
	return json{
	{"type", "m.room.message"},
	{"content", {
	{"msgtype","moe.kazv.mxc.cannot.decrypt"},
	{"body", "This message cannot be decrypted due to " + reason + "."}}}};
	}

	static bool verifyEvent(ClientModel &m, Event e, const json &plainJson)
	{
	- auto crypto = m.crypto.value();
	-
	bool valid = true;

	try {
	std::string senderCurve25519Key = e.originalJson().get()
	.at("content").at("sender_key");

	auto deviceInfoOpt = m.deviceLists.findByCurve25519Key(e.sender(), senderCurve25519Key);

	if (! deviceInfoOpt) {
	kzo.client.dbg() << "Device key " << senderCurve25519Key
	<< " unknown, thus invalid" << std::endl;
	valid = false;
	}

	auto deviceInfo = deviceInfoOpt.value();

	std::string algo = e.originalJson().get().at("content").at("algorithm");
	if (algo == olmAlgo) {
	if (! (plainJson.at("sender") == e.sender())) {
	kzo.client.dbg() << "Sender does not match, thus invalid" << std::endl;
	valid = false;
	}
	if (! (plainJson.at("recipient") == m.userId)) {
	kzo.client.dbg() << "Recipient does not match, thus invalid" << std::endl;
	valid = false;
	}
	- if (! (plainJson.at("recipient_keys").at(ed25519) == crypto.ed25519IdentityKey())) {
	+ if (! (plainJson.at("recipient_keys").at(ed25519) == m.constCrypto().ed25519IdentityKey())) {
	kzo.client.dbg() << "Recipient key does not match, thus invalid" << std::endl;
	valid = false;
	}
	auto thisEd25519Key = plainJson.at("keys").at(ed25519).get<std::string>();
	if (thisEd25519Key != deviceInfo.ed25519Key) {
	kzo.client.dbg() << "Sender ed25519 key does not match, thus invalid" << std::endl;
	valid = false;
	}
	} else if (algo == megOlmAlgo) {
	if (! (plainJson.at("room_id").get<std::string>() ==
	e.originalJson().get().at("room_id").get<std::string>())) {
	kzo.client.dbg() << "Room id does not match, thus invalid" << std::endl;
	valid = false;
	}
	if (e.originalJson().get().at("content").at("device_id").get<std::string>()
	!= deviceInfo.deviceId) {
	kzo.client.dbg() << "Device id does not match, thus invalid" << std::endl;
	valid = false;
	}
	- auto actualEd25519Key = crypto.getInboundGroupSessionEd25519KeyFromEvent(e.originalJson().get());
	+ auto actualEd25519Key = m.constCrypto().getInboundGroupSessionEd25519KeyFromEvent(e.originalJson().get());
	if ((! actualEd25519Key)
	\|\| deviceInfo.ed25519Key != actualEd25519Key.value()) {
	kzo.client.dbg() << "sender ed25519 key does not match, thus invalid" << std::endl;
	kzo.client.dbg() << "From group session: "
	<< (actualEd25519Key ? actualEd25519Key.value() : "<none>") << std::endl;
	kzo.client.dbg() << "From device info: " << deviceInfo.ed25519Key << std::endl;
	valid = false;
	}
	} else {
	kzo.client.dbg() << "Unknown algorithm, thus invalid" << std::endl;
	valid = false;
	}
	} catch (const std::exception &) {
	kzo.client.dbg() << "json format is not correct, thus invalid" << std::endl;
	valid = false;
	}

	return valid;
	}

	static Event decryptEvent(ClientModel &m, Event e)
	{
	// no need for decryption
	if (e.decrypted() \|\| (! e.encrypted())) {
	return e;
	}

	- auto &crypto = m.crypto.value();
	-
	kzo.client.dbg() << "About to decrypt event: "
	<< e.id() << std::endl;

	- auto maybePlainText = crypto.decrypt(e.originalJson().get());
	+ auto maybePlainText = m.withCrypto([&](Crypto &c) {
	+ return c.decrypt(e.originalJson().get());
	+ });

	if (! maybePlainText) {
	kzo.client.dbg() << "Cannot decrypt: " << maybePlainText.reason() << std::endl;
	return e.setDecryptedJson(cannotDecryptEvent(maybePlainText.reason()), Event::NotDecrypted);
	} else {
	auto plainJson = json::parse(maybePlainText.value());
	auto valid = verifyEvent(m, e, plainJson);
	if (valid) {
	kzo.client.dbg() << "The decrypted event is valid." << std::endl;
	}
	return valid
	? e.setDecryptedJson(plainJson, Event::Decrypted)
	: e.setDecryptedJson(cannotDecryptEvent("invalid event"), Event::NotDecrypted);
	}
	}

	ClientModel tryDecryptEvents(ClientModel m)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring decryption request" << std::endl;
	return m;
	}
	- auto &crypto = m.crypto.value();

	kzo.client.dbg() << "Trying to decrypt events..." << std::endl;

	auto decryptFunc = [&](auto e) { return decryptEvent(m, e); };

	auto takeOutRoomKeyEvents =
	[&](auto e) {
	if (e.type() != "m.room_key") {
	// Leave it as it is
	return true;
	}

	try {
	auto content = e.content();
	std::string roomId = content.get().at("room_id");
	std::string sessionId = content.get().at("session_id");
	std::string sessionKey = content.get().at("session_key");
	std::string senderKey = e.originalJson().get().at("content").at("sender_key");

	auto k = KeyOfGroupSession{roomId, senderKey, sessionId};

	std::string ed25519Key = e.decryptedJson().get().at("keys").at(ed25519);

	- if (crypto.createInboundGroupSession(k, sessionKey, ed25519Key)) {
	+ if (m.withCrypto([&](auto &c) { return c.createInboundGroupSession(k, sessionKey, ed25519Key); })) {
	return false; // such that this event is removed
	}
	} catch (...) {
	kzo.client.dbg() << "cannot create group session";
	return false;
	}
	return true;
	};

	m.toDevice = intoImmer(
	EventList{},
	zug::map(decryptFunc)
	\| zug::filter(takeOutRoomKeyEvents),
	std::move(m.toDevice));

	auto decryptEventInRoom =
	[&](auto id, auto room) {
	if (! room.encrypted) {
	return;
	} else {
	auto messages = room.messages;
	room.messages = merge(
	room.messages,
	intoImmer(
	EventList{},
	zug::filter([](auto n) {
	auto e = n.second;
	return e.encrypted();
	})
	\| zug::map([=](auto n) {
	auto event = n.second;
	return decryptFunc(event);
	}),
	std::move(messages)),
	keyOfTimeline);
	m.roomList.rooms = std::move(m.roomList.rooms).set(id, room);
	}
	};

	auto rooms = m.roomList.rooms;
	for (auto [id, room]: rooms) {
	decryptEventInRoom(id, room);
	}

	return m;
	}

	std::optional<BaseJob> clientPerform(ClientModel m, QueryKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return std::nullopt;
	}

	immer::map<std::string, immer::array<std::string>> deviceKeys;
	auto encryptedUsers = m.deviceLists.outdatedUsers();

	if (encryptedUsers.empty()) {
	kzo.client.dbg() << "Keys are up-to-date." << std::endl;
	return std::nullopt;
	}

	kzo.client.dbg() << "We need to query keys for: " << std::endl;
	for (auto userId: encryptedUsers) {
	kzo.client.dbg() << userId << std::endl;
	deviceKeys = std::move(deviceKeys).set(userId, {});
	}
	kzo.client.dbg() << "^" << std::endl;

	auto job = m.job<QueryKeysJob>()
	.make(std::move(deviceKeys),
	std::nullopt, // timeout
	a.isInitialSync ? std::nullopt : m.syncToken
	);
	return job;
	}

	ClientResult updateClient(ClientModel m, QueryKeysAction a)
	{
	auto jobOpt = clientPerform(m, a);
	if (jobOpt) {
	m.addJob(jobOpt.value());
	}

	return { std::move(m), lager::noop };
	}

	ClientResult processResponse(ClientModel m, QueryKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), simpleFail };
	}

	if (! r.success()) {
	kzo.client.dbg() << "query keys failed: " << r.errorCode() << r.errorMessage() << std::endl;
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Received a query key response" << std::endl;
	- auto &crypto = m.crypto.value();

	auto usersMap = r.deviceKeys();

	for (auto [userId, deviceMap] : usersMap) {
	for (auto [deviceId, deviceInfo] : deviceMap) {
	kzo.client.dbg() << "Key for " << userId
	<< "/" << deviceId
	<< ": " << json(deviceInfo).dump()
	<< std::endl;
	- m.deviceLists.addDevice(userId, deviceId, deviceInfo, crypto);
	+ m.withCrypto([&](Crypto &c) {
	+ m.deviceLists.addDevice(userId, deviceId, deviceInfo, c);
	+ });
	}
	m.deviceLists.markUpToDate(userId);
	}

	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, ClaimKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), lager::noop };
	}

	- auto &c = m.crypto.value();
	-
	kzo.client.dbg() << "claim keys for: " << json(a.devicesToSend).dump() << std::endl;

	auto keyMap = immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>>{};


	for (auto [userId, devices] : a.devicesToSend) {
	kzo.client.dbg() << "Iterating through user " << userId << std::endl;
	auto deviceToKey = immer::map<std::string, std::string>{};
	for (auto deviceId : devices) {
	kzo.client.dbg() << "Device: " << deviceId << std::endl;
	auto infoOpt = m.deviceLists.get(userId, deviceId);
	if (infoOpt) {
	kzo.client.dbg() << "Got device info, curve25519 key is: " << infoOpt.value().curve25519Key << std::endl;
	deviceToKey = std::move(deviceToKey)
	.set(deviceId, infoOpt.value().curve25519Key);
	} else {
	kzo.client.dbg() << "Did not get device info" << std::endl;
	}
	}
	keyMap = std::move(keyMap).set(userId, deviceToKey);
	}

	- auto devicesToClaimKeys = c.devicesMissingOutboundSessionKey(keyMap);
	+ auto devicesToClaimKeys = m.withCrypto([&](auto &c) { return c.devicesMissingOutboundSessionKey(keyMap); });

	kzo.client.dbg() << "Really claim keys for: " << json(devicesToClaimKeys).dump() << std::endl;

	auto oneTimeKeys = immer::map<std::string, immer::map<std::string, std::string>>{};
	for (auto [userId, devices] : devicesToClaimKeys) {
	auto devKeys = immer::map<std::string, std::string>{};
	for (auto deviceId: devices) {
	devKeys = std::move(devKeys).set(deviceId, signedCurve25519);
	}
	oneTimeKeys = std::move(oneTimeKeys).set(userId, devKeys);
	}

	auto job = m.job<ClaimKeysJob>()
	.make(std::move(oneTimeKeys))
	.withData(json{
	{"roomId", a.roomId},
	{"sessionId", a.sessionId},
	{"sessionKey", a.sessionKey},
	{"devicesToSend", a.devicesToSend},
	{"random", a.random}
	});
	m.addJob(std::move(job));

	return { std::move(m), lager::noop };
	}

	ClientResult processResponse(ClientModel m, ClaimKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), simpleFail };
	}

	if (! r.success()) {
	kzo.client.dbg() << "claim keys failed" << std::endl;
	m.addTrigger(ClaimKeysFailed{r.errorCode(), r.errorMessage()});
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "claim keys successful" << std::endl;

	kzo.client.dbg() << "Json body: " << r.jsonBody().get().dump() << std::endl;

	- auto &c = m.crypto.value();
	-
	auto roomId = r.dataStr("roomId");
	auto sessionKey = r.dataStr("sessionKey");
	auto sessionId = r.dataStr("sessionId");
	auto devicesToSend =
	immer::map<std::string, immer::flex_vector<std::string>>(r.dataJson("devicesToSend"));
	auto random = r.dataJson("random").template get<RandomData>();

	// create outbound sessions for those devices
	auto oneTimeKeys = r.oneTimeKeys();

	for (auto [userId, deviceMap] : oneTimeKeys) {
	for (auto [deviceId, keyVar] : deviceMap) {
	auto keys = keyVar.get();
	for (auto [keyId, key] : keys.items()) {
	auto deviceInfoOpt = m.deviceLists.get(userId, deviceId);
	if (deviceInfoOpt) {
	auto deviceInfo = deviceInfoOpt.value();
	kzo.client.dbg() << "Verifying key for " << userId
	<< "/" << deviceId
	<< key.dump()
	<< " with ed25519 key "
	<< deviceInfo.ed25519Key << std::endl;
	- auto verified = c.verify(key, userId, deviceId, deviceInfo.ed25519Key);
	+ auto verified = m.withCrypto([&](auto &c) { return c.verify(key, userId, deviceId, deviceInfo.ed25519Key); });
	kzo.client.dbg() << (verified ? "passed" : "did not pass") << std::endl;
	if (verified && key.contains("key")) {
	auto theirOneTimeKey = key.at("key");
	kzo.client.dbg() << "creating outbound session for it" << std::endl;
	- c.createOutboundSessionWithRandom(random, deviceInfo.curve25519Key, theirOneTimeKey);
	+ m.withCrypto([&](auto &c) { c.createOutboundSessionWithRandom(random, deviceInfo.curve25519Key, theirOneTimeKey); });
	random.erase(0, Crypto::createOutboundSessionRandomSize());
	kzo.client.dbg() << "done" << std::endl;
	}
	}
	}
	}
	}

	auto eventJson = json{
	{"content", {{"algorithm", megOlmAlgo},
	{"room_id", roomId},
	{"session_id", sessionId},
	{"session_key", sessionKey}}},
	{"type", "m.room_key"}
	};

	auto event = Event(JsonWrap(eventJson));

	return {
	std::move(m),
	[event](auto &&) { return EffectStatus{ /* success = */ true, json{{ "keyEvent", event.originalJson() }} }; }
	};
	}

	ClientResult updateClient(ClientModel m, EncryptMegOlmEventAction a)
	{
	auto [encryptedEvent, maybeKey] = m.megOlmEncrypt(a.e, a.roomId, a.timeMs, a.random);

	return {
	std::move(m),
	[=](auto && /* ctx */) {
	auto retJson = json::object({
	{"encrypted", encryptedEvent.originalJson()},
	});
	if (maybeKey.has_value()) {
	retJson["key"] = maybeKey.value();
	}
	return EffectStatus(/* succ = */ true, retJson);
	}
	};
	}

	ClientResult updateClient(ClientModel m, EncryptOlmEventAction a)
	{
	auto encryptedEvent = m.olmEncrypt(a.e, a.devices, a.random);

	return {
	std::move(m),
	[=](auto && /* ctx */) {
	auto retJson = json::object({
	{"encrypted", encryptedEvent.originalJson()},
	});

	return EffectStatus(/* succ = */ true, retJson);
	}
	};
	}

	ClientResult updateClient(ClientModel m, SetDeviceTrustLevelAction a)
	{
	auto maybeOldInfo = m.deviceLists.get(a.userId, a.deviceId);
	if (!maybeOldInfo) {
	return {
	std::move(m),
	[=](auto && /* ctx */) {
	auto retJson = json::object({
	{"error", "No such device"},
	{"errorCode", "MOE_KAZV_MXC_KAZV_NO_SUCH_DEVICE"},
	});

	return EffectStatus(/* succ = */ false, retJson);
	}
	};
	}

	m.deviceLists.deviceLists = updateIn(
	std::move(m.deviceLists.deviceLists),
	[a](auto device) {
	device.trustLevel = a.trustLevel;
	return device;
	},
	a.userId,
	a.deviceId
	);

	return { m, lager::noop };
	}

	ClientResult updateClient(ClientModel m, SetTrustLevelNeededToSendKeysAction a)
	{
	m.trustLevelNeededToSendKeys = a.trustLevel;
	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, PrepareForSharingRoomKeyAction a)
	{
	auto encryptedEvent = m.olmEncrypt(a.e, a.devices, a.random);

	auto txnId = getTxnId(a.e, m);

	m.roomList = RoomListModel::update(
	std::move(m.roomList),
	UpdateRoomAction{
	a.roomId,
	AddPendingRoomKeyAction{
	PendingRoomKeyEvent{txnId, encryptedEvent, a.devices}
	}
	}
	);

	return { std::move(m), [txnId](auto &&) {
	return EffectStatus(/* succ = */ true, json::object({{"txnId", txnId}}));
	} };
	}
	}
	diff --git a/src/client/actions/sync.cpp b/src/client/actions/sync.cpp
	index 6f099fc..25eefbb 100644
	--- a/src/client/actions/sync.cpp
	+++ b/src/client/actions/sync.cpp
	@@ -1,363 +1,363 @@
	/*
	* This file is part of libkazv.
	- * SPDX-FileCopyrightText: 2021-2023 tusooa <tusooa@kazv.moe>
	+ * SPDX-FileCopyrightText: 2021-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <lager/util.hpp>
	#include <zug/transducer/map.hpp>
	#include <zug/transducer/cat.hpp>
	#include <zug/transducer/filter.hpp>
	#include <zug/sequence.hpp>

	#include <jobinterface.hpp>
	#include <debug.hpp>

	#include "cursorutil.hpp"

	#include "sync.hpp"

	#include "encryption.hpp"
	#include "status-utils.hpp"

	namespace Kazv
	{
	// Atomicity guaranteed: if the sync action is created
	// before an action that reasonably changes Client
	// (e.g. roll back to an earlier state, obtain other
	// events), but executed
	// after that action, the sync will still give continuous
	// data about the events. (Sync will not "skip" events)
	// This is because this function takes the sync token
	// from the ClientModel model it is passed.
	ClientResult updateClient(ClientModel m, SyncAction)
	{
	kzo.client.dbg() << "Start syncing with token " <<
	(m.syncToken ? m.syncToken.value() : "<null>") << std::endl;

	bool isInitialSync = ! m.syncToken;

	m.syncing = true;

	std::string filter = m.syncToken ? m.incrementalSyncFilterId : m.initialSyncFilterId;
	m.addJob(m.job<SyncJob>()
	.make(filter,
	m.syncToken,
	std::nullopt, // fullState
	std::nullopt, // setPresence
	// Let initial sync return immediately
	isInitialSync ? 0 : m.syncTimeoutMs
	)
	.withData(json{{"is", isInitialSync ? "initial" : "incremental"}}));
	return { m, lager::noop };
	}


	static KazvEventList loadRoomsFromSyncInPlace(ClientModel &m, SyncJob::Rooms rooms)
	{
	auto l = std::move(m.roomList);
	auto eventsToEmit = KazvEventList{}.transient();

	auto updateRoomImpl =
	[&l](auto id, auto a) {
	l = RoomListModel::update(
	std::move(l),
	UpdateRoomAction{std::move(id), std::move(a)});
	};
	auto updateSingleRoom =
	[&, updateRoomImpl](const auto &id, const auto &room, auto membership) {
	if (!l.has(id) \|\| l[id].membership != membership) {
	eventsToEmit.push_back(RoomMembershipChanged{membership, id});
	}
	updateRoomImpl(id, ChangeMembershipAction{membership});

	auto timelineEvents =
	intoImmer(
	EventList{},
	zug::map([=](Event e) {
	return Event::fromSync(e, id);
	}),
	room.timeline.events);
	eventsToEmit.append(
	intoImmer(
	KazvEventList{},
	zug::map([=](Event e) -> KazvEvent {
	return ReceivingRoomTimelineEvent{std::move(e), id};
	}),
	timelineEvents).transient());
	updateRoomImpl(id, AddToTimelineAction{timelineEvents,
	room.timeline.prevBatch,
	room.timeline.limited,
	std::nullopt // we do not have a gapEventId
	});
	if (room.state) {
	eventsToEmit.append(
	intoImmer(
	KazvEventList{},
	zug::map([=](Event e) -> KazvEvent {
	return ReceivingRoomStateEvent{std::move(e), id};
	}),
	room.state.value().events).transient());
	updateRoomImpl(id, AddStateEventsAction{room.state.value().events});
	}

	// Process state events in timeline, which should have arrived later
	// than those in room.state .
	updateRoomImpl(id, AddStateEventsAction{
	intoImmer(EventList{},
	zug::filter([=](Event e) {
	return e.isState();
	}),
	timelineEvents)});

	if (room.accountData) {
	eventsToEmit.append(
	intoImmer(
	KazvEventList{},
	zug::map([=](Event e) -> KazvEvent {
	return ReceivingRoomAccountDataEvent{std::move(e), id};
	}),
	room.state.value().events).transient());
	updateRoomImpl(id, AddAccountDataAction{room.accountData.value().events});
	}
	};

	auto updateRoomSummary =
	[=](const auto &id, const auto &room) {
	if (!room.summary.has_value()) {
	return;
	}
	if (!room.summary->mHeroes.empty()) {
	auto newHeroes = room.summary->mHeroes;
	updateRoomImpl(id, SetHeroIdsAction{immer::flex_vector<std::string>(newHeroes.begin(), newHeroes.end())});
	}
	if (room.summary->mJoinedMemberCount.has_value()) {
	updateRoomImpl(id, UpdateJoinedMemberCountAction{static_cast<std::size_t>(room.summary->mJoinedMemberCount.value())});
	}
	if (room.summary->mInvitedMemberCount.has_value()) {
	updateRoomImpl(id, UpdateInvitedMemberCountAction{static_cast<std::size_t>(room.summary->mInvitedMemberCount.value())});
	}
	};

	auto updateJoinedRoom =
	[=](const auto &id, const auto &room) {
	updateSingleRoom(id, room, RoomMembership::Join);
	if (room.ephemeral) {
	updateRoomImpl(id, AddEphemeralAction{room.ephemeral.value().events});
	}
	// TODO update other info such as
	// notification and summary

	updateRoomSummary(id, room);
	};

	auto updateInvitedRoom =
	[=](const auto &id, const auto &room) {
	updateRoomImpl(id, ChangeMembershipAction{RoomMembership::Invite});
	if (room.inviteState) {
	updateRoomImpl(id, ChangeInviteStateAction{room.inviteState.value().events});
	}
	};

	auto updateLeftRoom =
	[=](const auto &id, const auto &room) {
	updateSingleRoom(id, room, RoomMembership::Leave);
	};

	for (const auto &[id, room]: rooms.join) {
	updateJoinedRoom(id, room);
	}

	// TODO update info for invited rooms
	for (const auto &[id, room]: rooms.invite) {
	updateInvitedRoom(id, room);
	}

	for (const auto &[id, room]: rooms.leave) {
	updateLeftRoom(id, room);
	}

	m.roomList = std::move(l);
	return eventsToEmit.persistent();
	}

	static KazvEventList loadPresenceFromSyncInPlace(ClientModel &m, EventList presence)
	{
	auto eventsToEmit = intoImmer(
	KazvEventList{},
	zug::map([](Event e) { return ReceivingPresenceEvent{e}; }),
	presence);
	m.presence = merge(std::move(m.presence), presence, keyOfPresence);
	return eventsToEmit;
	}

	static KazvEventList loadAccountDataFromSyncInPlace(ClientModel &m, EventList accountData)
	{
	auto eventsToEmit = intoImmer(
	KazvEventList{},
	zug::map([](Event e) { return ReceivingPresenceEvent{e}; }),
	accountData);
	m.accountData = merge(std::move(m.accountData), accountData, keyOfAccountData);
	return eventsToEmit;
	}

	static KazvEventList loadToDeviceFromSyncInPlace(ClientModel &m, JsonWrap toDevice)
	{
	if (toDevice.get().contains("events")) {
	auto events = toDevice.get()["events"];
	auto msgs = intoImmer(
	EventList{},
	zug::map([](const json &j) { return Event(j); }),
	events);

	m.toDevice = std::move(m.toDevice) + msgs;

	return intoImmer(
	KazvEventList{},
	zug::map([](Event e) { return ReceivingToDeviceMessage{e}; }),
	msgs);
	}
	return {};
	}

	ClientResult processResponse(ClientModel m, SyncResponse r)
	{
	if (! r.success()) {
	m.addTrigger(SyncFailed{});
	kzo.client.dbg() << "Sync failed" << std::endl;
	kzo.client.dbg() << r.statusCode << std::endl;
	if (isBodyJson(r.body)) {
	auto j = r.jsonBody();
	kzo.client.dbg() << "Json says: " << j.get().dump() << std::endl;
	} else {
	kzo.client.dbg() << "Response body: "
	<< std::get<BaseJob::BytesBody>(r.body) << std::endl;
	}
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Sync successful" << std::endl;

	auto rooms = r.rooms();
	auto accountData = r.accountData();
	auto presence = r.presence();
	// load the info that has been sync'd

	m.syncToken = r.nextBatch();

	if (rooms) {
	m.addTriggers(loadRoomsFromSyncInPlace(m, std::move(rooms.value())));
	}

	if (presence) {
	m.addTriggers(loadPresenceFromSyncInPlace(m, std::move(presence.value().events)));
	}

	if (accountData) {
	m.addTriggers(loadAccountDataFromSyncInPlace(m, std::move(accountData.value().events)));
	}

	m.addTriggers(loadToDeviceFromSyncInPlace(m, r.toDevice()));

	auto is = r.dataStr("is");
	auto isInitialSync = is == "initial";

	if (m.crypto) {
	kzo.client.dbg() << "E2EE is on. Processing device lists and one-time key counts." << std::endl;
	- auto &crypto = m.crypto.value();
	+
	// process deviceLists
	if (isInitialSync) {
	auto encryptedUsers =
	zug::sequence(
	zug::map([](auto n) { return n.second; })
	\| zug::filter([](auto room) { return room.encrypted; })
	\| zug::map([](auto room) { return room.joinedMemberIds(); })
	\| zug::cat,
	// no need to use distinct here as the map will overwrite
	m.roomList.rooms);

	m.deviceLists.track(std::move(encryptedUsers));

	} else {
	auto l = r.deviceLists().get();
	if (l.contains("changed")) {
	const auto &changed = l.at("changed");
	m.deviceLists.track(changed);
	}

	if (l.contains("left")) {
	const auto &left = l.at("left");
	m.deviceLists.untrack(left);
	}
	}

	// deviceOneTimeKeysCount
	- crypto.setUploadedOneTimeKeysCount(r.deviceOneTimeKeysCount());
	+ m.withCrypto([&](auto &c) { c.setUploadedOneTimeKeysCount(r.deviceOneTimeKeysCount()); });

	auto model = tryDecryptEvents(std::move(m));
	m = std::move(model);
	}

	m.addTrigger(SyncSuccessful{r.nextBatch()});

	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, SetShouldSyncAction a)
	{
	m.shouldSync = a.shouldSync;
	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, PostInitialFiltersAction)
	{
	if (m.syncing) {
	return { std::move(m), lager::noop };
	}

	Filter initialSyncFilter;
	initialSyncFilter.room.timeline.limit = 1;
	initialSyncFilter.room.state.lazyLoadMembers = true;
	auto firstJob = m.job<DefineFilterJob>()
	.make(m.userId, initialSyncFilter)
	.withData(json{{"is", "initialSyncFilter"}})
	.withQueue("post-filter", CancelFutureIfFailed);

	m.addJob(firstJob);
	Filter incrementalSyncFilter;
	incrementalSyncFilter.room.timeline.limit = 20;
	incrementalSyncFilter.room.state.lazyLoadMembers = true;
	m.addJob(m.job<DefineFilterJob>()
	.make(m.userId, incrementalSyncFilter)
	.withData(json{{"is", "incrementalSyncFilter"}})
	.withQueue("post-filter", CancelFutureIfFailed));

	m.syncing = true;

	return { std::move(m), lager::noop };
	}

	ClientResult processResponse(ClientModel m, DefineFilterResponse r)
	{
	auto is = r.dataStr("is");
	if (! r.success()) {
	m.syncing = false;
	kzo.client.dbg() << "posting filter failed: " << r.errorCode() << r.errorMessage() << std::endl;
	m.addTrigger(PostInitialFiltersFailed{r.errorCode(), r.errorMessage()});
	return { std::move(m), lager::noop };
	}

	kzo.client.dbg() << "filter " << is << " is posted" << std::endl;

	if (is == "incrementalSyncFilter") {
	m.incrementalSyncFilterId = r.filterId();
	m.addTrigger(PostInitialFiltersSuccessful{});
	} else {
	m.initialSyncFilterId = r.filterId();
	}

	return { std::move(m), lager::noop };
	}
	}
	diff --git a/src/client/client-model.cpp b/src/client/client-model.cpp
	index 122a65a..2c9ab3c 100644
	--- a/src/client/client-model.cpp
	+++ b/src/client/client-model.cpp
	@@ -1,416 +1,417 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2020-2023 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <immer/algorithm.hpp>
	#include <lager/util.hpp>
	#include <lager/context.hpp>
	#include <functional>

	#include <zug/transducer/filter.hpp>

	#include <immer/flex_vector_transient.hpp>

	#include "debug.hpp"

	#include "immer-utils.hpp"
	#include "json-utils.hpp"

	#include "client-model.hpp"

	#include "actions/states.hpp"
	#include "actions/auth.hpp"
	#include "actions/membership.hpp"
	#include "actions/paginate.hpp"
	#include "actions/send.hpp"
	#include "actions/states.hpp"
	#include "actions/account-data.hpp"
	#include "actions/sync.hpp"
	#include "actions/ephemeral.hpp"
	#include "actions/content.hpp"
	#include "actions/encryption.hpp"
	#include "actions/profile.hpp"

	namespace Kazv
	{
	auto ClientModel::update(ClientModel m, Action a) -> Result
	{
	auto oldClient = m;
	auto oldDeviceLists = m.deviceLists;

	auto [newClient, effect] = lager::match(std::move(a))(
	[&](RoomListAction a) -> Result {
	m.roomList = RoomListModel::update(std::move(m.roomList), a);
	return {std::move(m), lager::noop};
	},
	[&](ResubmitJobAction a) -> Result {
	m.addJob(std::move(a.job));
	return { std::move(m), lager::noop };
	},
	[&](auto a) -> decltype(updateClient(m, a)) {
	return updateClient(m, a);
	},
	#define RESPONSE_FOR(_jobId) \
	if (r.jobId() == #_jobId) { \
	return processResponse(m, _jobId##Response{std::move(r)}); \
	}

	[&](ProcessResponseAction a) -> Result {
	auto r = std::move(a.response);

	// auth
	RESPONSE_FOR(Login);
	RESPONSE_FOR(GetWellknown);
	RESPONSE_FOR(GetVersions);
	// paginate
	RESPONSE_FOR(GetRoomEvents);
	// sync
	RESPONSE_FOR(Sync);
	RESPONSE_FOR(DefineFilter);
	// membership
	RESPONSE_FOR(CreateRoom);
	RESPONSE_FOR(InviteUser);
	RESPONSE_FOR(JoinRoomById);
	RESPONSE_FOR(JoinRoom);
	RESPONSE_FOR(LeaveRoom);
	RESPONSE_FOR(ForgetRoom);
	RESPONSE_FOR(Kick);
	RESPONSE_FOR(Ban);
	RESPONSE_FOR(Unban);
	// send
	RESPONSE_FOR(SendMessage);
	RESPONSE_FOR(SendToDevice);
	RESPONSE_FOR(RedactEvent);
	// states
	RESPONSE_FOR(GetRoomState);
	RESPONSE_FOR(SetRoomStateWithKey);
	RESPONSE_FOR(GetRoomStateWithKey);
	// account data
	RESPONSE_FOR(SetAccountData);
	RESPONSE_FOR(SetAccountDataPerRoom);
	// ephemeral
	RESPONSE_FOR(SetTyping);
	RESPONSE_FOR(PostReceipt);
	RESPONSE_FOR(SetReadMarker);
	// content
	RESPONSE_FOR(UploadContent);
	RESPONSE_FOR(GetContent);
	RESPONSE_FOR(GetContentThumbnail);
	// encryption
	RESPONSE_FOR(UploadKeys);
	RESPONSE_FOR(QueryKeys);
	RESPONSE_FOR(ClaimKeys);
	// profile
	RESPONSE_FOR(GetUserProfile);
	RESPONSE_FOR(SetAvatarUrl);
	RESPONSE_FOR(SetDisplayName);

	m.addTrigger(UnrecognizedResponse{std::move(r)});
	return { std::move(m), lager::noop };
	}

	#undef RESPONSE_FOR
	);

	newClient.maybeRotateSessions(oldClient);

	return { std::move(newClient), std::move(effect) };
	}

	std::pair<Event, std::optional<std::string>> ClientModel::megOlmEncrypt(
	Event e, std::string roomId, Timestamp timeMs, RandomData random)
	{
	if (!crypto) {
	kzo.client.dbg() << "We do not have e2ee, so do not encrypt events" << std::endl;
	return { e, std::nullopt };
	}

	if (e.encrypted()) {
	kzo.client.dbg() << "The event is already encrypted. Ignoring it." << std::endl;
	return { e, std::nullopt };
	}

	- auto &c = crypto.value();
	-
	auto j = e.originalJson().get();
	auto r = roomList[roomId];

	if (! r.encrypted) {
	kzo.client.dbg() << "The room " << roomId
	<< " is not encrypted, so do not encrypt events" << std::endl;
	return { e, std::nullopt };
	}

	auto desc = r.sessionRotateDesc();

	auto keyOpt = std::optional<std::string>{};
	if (r.shouldRotateSessionKey) {
	kzo.client.dbg() << "We should rotate this session." << std::endl;
	- keyOpt = c.rotateMegOlmSessionWithRandom(random, timeMs, roomId);
	+ keyOpt = withCrypto([&](auto &c) { return c.rotateMegOlmSessionWithRandom(random, timeMs, roomId); });
	} else {
	- keyOpt = c.rotateMegOlmSessionWithRandomIfNeeded(random, timeMs, roomId, desc);
	+ keyOpt = withCrypto([&](auto &c) { return c.rotateMegOlmSessionWithRandomIfNeeded(random, timeMs, roomId, desc); });
	}

	// we no longer need to rotate session
	// until next time a device change happens
	roomList.rooms = std::move(roomList.rooms)
	.update(roomId, [](auto r) { r.shouldRotateSessionKey = false; return r; });

	auto relation = hasAtThat(j["content"], "m.relates_to", &json::is_object) ? j["content"]["m.relates_to"] : json(nullptr);
	// so that Crypto::encryptMegOlm() can find room id
	j["room_id"] = roomId;
	- auto content = c.encryptMegOlm(j);
	+ auto content = withCrypto([&](auto &c) { return c.encryptMegOlm(j); });
	j["type"] = "m.room.encrypted";
	j["content"] = std::move(content);
	j["content"]["device_id"] = deviceId;
	// add relationship to plaintext
	if (relation.is_object()) {
	j["content"]["m.relates_to"] = relation;
	}

	kzo.client.dbg() << "Encrypted json is " << j.dump() << std::endl;
	kzo.client.dbg() << "Session key is " << (keyOpt ? keyOpt.value() : "<not rotated>") << std::endl;

	return { Event(JsonWrap(j)), keyOpt };
	}

	Event ClientModel::olmEncrypt(Event e,
	immer::map<std::string, immer::flex_vector<std::string>> userIdToDeviceIdMap, RandomData random)
	{
	if (!crypto) {
	kzo.client.dbg() << "We do not have e2ee, so do not encrypt events" << std::endl;
	return e;
	}

	if (e.encrypted()) {
	kzo.client.dbg() << "The event is already encrypted. Ignoring it." << std::endl;
	return e;
	}

	- auto &c = crypto.value();
	-
	auto origJson = e.originalJson().get();

	auto encJson = json::object();
	encJson["content"] = json{
	{"algorithm", CryptoConstants::olmAlgo},
	{"ciphertext", json::object()},
	- {"sender_key", c.curve25519IdentityKey()},
	+ {"sender_key", constCrypto().curve25519IdentityKey()},
	};

	encJson["type"] = "m.room.encrypted";

	for (auto [userId, devices] : userIdToDeviceIdMap) {
	for (auto dev : devices) {
	auto devInfoOpt = deviceLists.get(userId, dev);
	if (! devInfoOpt) {
	continue;
	}
	auto devInfo = devInfoOpt.value();
	auto jsonForThisDevice = origJson;
	jsonForThisDevice["sender"] = this->userId;
	jsonForThisDevice["recipient"] = userId;
	jsonForThisDevice["recipient_keys"] = json{
	{CryptoConstants::ed25519, devInfo.ed25519Key}
	};
	jsonForThisDevice["keys"] = json{
	- {CryptoConstants::ed25519, c.ed25519IdentityKey()}
	+ {CryptoConstants::ed25519, constCrypto().ed25519IdentityKey()}
	};
	encJson["content"]["ciphertext"]
	- .merge_patch(c.encryptOlmWithRandom(random, jsonForThisDevice, devInfo.curve25519Key));
	+ .merge_patch(withCrypto([&](auto &c) { return c.encryptOlmWithRandom(random, jsonForThisDevice, devInfo.curve25519Key); }));
	random.erase(0, Crypto::encryptOlmMaxRandomSize());
	}
	}

	return Event(JsonWrap(encJson));
	}

	immer::flex_vector<std::string /* deviceId */> ClientModel::devicesToSendKeys(std::string userId) const
	{
	auto trustLevelNeeded = this->trustLevelNeededToSendKeys;

	// XXX: preliminary approach
	auto shouldSendP = [=](auto deviceInfo, auto /* deviceMap */) {
	return deviceInfo.trustLevel >= trustLevelNeeded;
	};


	auto devices = deviceLists.devicesFor(userId);

	return intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([=](auto n) {
	auto [id, dev] = n;
	return shouldSendP(dev, devices);
	})
	\| zug::map([=](auto n) {
	return n.first;
	}),
	devices);
	}

	std::size_t ClientModel::numOneTimeKeysNeeded() const
	{
	- auto &crypto = this->crypto.value();
	+ const auto &crypto = constCrypto();

	// Keep half of max supported number of keys
	int numUploadedKeys = crypto.uploadedOneTimeKeysCount(CryptoConstants::signedCurve25519);
	int numKeysNeeded = crypto.maxNumberOfOneTimeKeys() / 2
	- numUploadedKeys;

	// Subtract the number of existing one-time keys, in case
	// the previous upload was not successful.
	int numKeysToGenerate = numKeysNeeded - crypto.numUnpublishedOneTimeKeys();

	return numKeysToGenerate;
	}

	std::size_t EncryptMegOlmEventAction::maxRandomSize()
	{
	return Crypto::rotateMegOlmSessionRandomSize();
	}

	std::size_t EncryptMegOlmEventAction::minRandomSize()
	{
	return 0;
	}

	std::size_t EncryptOlmEventAction::randomSize(EncryptOlmEventAction::UserIdToDeviceIdMap devices)
	{
	auto singleRandomSize = Crypto::encryptOlmMaxRandomSize();
	auto deviceNum = accumulate(devices, std::size_t{},
	[](auto counter, auto pair) { return counter + pair.second.size(); });
	return deviceNum * singleRandomSize;
	}

	std::size_t GenerateAndUploadOneTimeKeysAction::randomSize(std::size_t numToGen)
	{
	return Crypto::genOneTimeKeysRandomSize(numToGen);
	}

	std::size_t ClaimKeysAction::randomSize(immer::map<std::string, immer::flex_vector<std::string>> devicesToSend)
	{
	auto singleRandomSize = Crypto::createOutboundSessionRandomSize();
	auto deviceNum = accumulate(devicesToSend, std::size_t{},
	[](auto counter, auto pair) { return counter + pair.second.size(); });
	return deviceNum * singleRandomSize;
	}

	void ClientModel::maybeRotateSessions(ClientModel oldClient)
	{
	auto roomIds = intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([](const auto &pair) {
	return pair.second.encrypted && !pair.second.shouldRotateSessionKey;
	})
	\| zug::map([](const auto &pair) { return pair.first; }),
	roomList.rooms
	);

	auto markRotate = [this](const auto &roomId) {
	roomList.rooms =
	std::move(roomList.rooms)
	.update(roomId, [](auto room) {
	room.shouldRotateSessionKey = true;
	return room;
	});
	};

	// Rotate megolm keys for rooms whose users' device list has changed
	auto changedUsers = deviceLists.diff(oldClient.deviceLists);
	if (! changedUsers.empty()) {
	for (auto roomId : roomIds) {
	auto it = std::find_if(changedUsers.begin(), changedUsers.end(),
	[=](auto userId) { return roomList.rooms[roomId].hasUser(userId); });
	if (it != changedUsers.end()) {
	kzo.client.dbg() << "rotate keys for room " << roomId << std::endl;
	markRotate(roomId);
	}
	}
	}

	roomIds = intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([](const auto &pair) {
	return pair.second.encrypted && !pair.second.shouldRotateSessionKey;
	})
	\| zug::map([](const auto &pair) { return pair.first; }),
	roomList.rooms
	);

	for (auto roomId : roomIds) {
	auto userIds = roomList.rooms[roomId].joinedMemberIds();
	auto devicesNotChanged = [oldClient, this](const auto &userId) {
	return oldClient.devicesToSendKeys(userId) == devicesToSendKeys(userId);
	};
	// if any user has the device changes
	if (!immer::all_of(userIds, devicesNotChanged)) {
	kzo.client.dbg() << "rotate keys for room " << roomId << std::endl;
	markRotate(roomId);
	}
	}
	}

	auto ClientModel::directRoomMap() const -> immer::map<std::string, std::string>
	{
	auto directs = accountData["m.direct"].content().get();
	auto directItems = directs.items();

	return std::accumulate(directItems.begin(), directItems.end(), immer::map<std::string, std::string>(),
	[](auto acc, const auto &cur) {
	auto [userId, roomIds] = cur;

	if (!roomIds.is_array()) {
	return acc;
	}

	for (auto roomId : roomIds) {
	if (roomId.is_string()) {
	acc = std::move(acc).set(roomId.template get<std::string>(), userId);
	}
	}
	return acc;
	}
	);
	}

	auto ClientModel::roomIdsUnderTag(std::string tagId) const -> immer::map<std::string, double>
	{
	return std::accumulate(
	roomList.rooms.begin(), roomList.rooms.end(),
	immer::map<std::string, double>{},
	[tagId](auto acc, auto cur) {
	auto [roomId, room] = cur;
	auto tags = room.tags();
	if (tags.count(tagId)) {
	acc = std::move(acc).set(roomId, tags[tagId]);
	}
	return acc;
	}
	);
	}

	auto ClientModel::roomIdsByTagId() const -> immer::map<std::string, immer::map<std::string, double>>
	{
	return std::accumulate(
	roomList.rooms.begin(), roomList.rooms.end(),
	immer::map<std::string, immer::map<std::string, double>>{},
	[](auto acc, auto cur) {
	auto [roomId, room] = cur;
	auto tags = room.tags();
	if (tags.empty()) {
	acc = setIn(std::move(acc), ROOM_TAG_DEFAULT_ORDER, "", roomId);
	} else {
	for (const auto &[tagId, order] : tags) {
	acc = setIn(std::move(acc), order, tagId, roomId);
	}
	}
	return acc;
	}
	);
	}
	+
	+ const Crypto &ClientModel::constCrypto() const
	+ {
	+ return crypto.value().get();
	+ }
	}
	diff --git a/src/client/client-model.hpp b/src/client/client-model.hpp
	index a6e1b31..6cf9b50 100644
	--- a/src/client/client-model.hpp
	+++ b/src/client/client-model.hpp
	@@ -1,593 +1,638 @@
	/*
	* This file is part of libkazv.
	- * SPDX-FileCopyrightText: 2020-2023 tusooa <tusooa@kazv.moe>
	+ * SPDX-FileCopyrightText: 2020-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/


	#pragma once
	#include <libkazv-config.hpp>

	#include <tuple>
	#include <variant>
	#include <string>
	#include <optional>

	#include <lager/context.hpp>
	#include <boost/hana.hpp>
	#include <serialization/std-optional.hpp>


	#include <csapi/sync.hpp>

	#include <file-desc.hpp>
	#include <crypto.hpp>

	#include <serialization/immer-flex-vector.hpp>
	#include <serialization/immer-box.hpp>
	#include <serialization/immer-map.hpp>
	#include <serialization/immer-array.hpp>

	#include "clientfwd.hpp"
	#include "device-list-tracker.hpp"
	#include "room/room-model.hpp"

	namespace Kazv
	{
	inline const std::string DEFTXNID{"0"};

	enum RoomVisibility
	{
	Private,
	Public,
	};

	enum CreateRoomPreset
	{
	PrivateChat,
	PublicChat,
	TrustedPrivateChat,
	};

	enum ThumbnailResizingMethod
	{
	Crop,
	Scale,
	};

	struct ClientModel
	{
	std::string serverUrl;
	std::string userId;
	std::string token;
	std::string deviceId;
	bool loggedIn{false};

	bool syncing{false};
	bool shouldSync{true};
	int firstRetryMs{1000};
	int retryTimeFactor{2};
	int maxRetryMs{30 * 1000};
	int syncTimeoutMs{20000};
	std::string initialSyncFilterId;
	std::string incrementalSyncFilterId;
	std::optional<std::string> syncToken;

	RoomListModel roomList;
	immer::map<std::string /* sender */, Event> presence;
	immer::map<std::string /* type */, Event> accountData;

	std::string nextTxnId{DEFTXNID};
	immer::flex_vector<BaseJob> nextJobs;
	immer::flex_vector<KazvEvent> nextTriggers;

	EventList toDevice;
	- std::optional<Crypto> crypto;
	+ std::optional<immer::box<Crypto>> crypto;
	bool identityKeysUploaded{false};

	DeviceListTracker deviceLists;
	DeviceTrustLevel trustLevelNeededToSendKeys{DeviceTrustLevel::Unseen};

	immer::flex_vector<std::string /* deviceId */> devicesToSendKeys(std::string userId) const;

	/// rotate sessions for a room if there is a user in the room with
	/// devicesToSendKeys changes
	void maybeRotateSessions(ClientModel oldClient);

	std::pair<Event, std::optional<std::string> /* sessionKey */>
	megOlmEncrypt(Event e, std::string roomId, Timestamp timeMs, RandomData random);
	/// precondition: the one-time keys for those devices must already be claimed
	Event olmEncrypt(Event e, immer::map<std::string, immer::flex_vector<std::string>> userIdToDeviceIdMap, RandomData random);

	/// @return number of one-time keys we need to generate
	std::size_t numOneTimeKeysNeeded() const;

	/// @return the mapping from room id to user id of direct rooms
	auto directRoomMap() const -> immer::map<std::string, std::string>;

	auto roomIdsUnderTag(std::string tagId) const -> immer::map<std::string, double>;

	auto roomIdsByTagId() const -> immer::map<std::string, immer::map<std::string, double>>;

	+ /// Get the const reference of crypto of this client.
	+ ///
	+ /// `crypto.has_value()` must be true.
	+ const Crypto &constCrypto() const;
	+
	+ /// Do func with crypto, returning its return value.
	+ ///
	+ /// `crypto.has_value()` must be true.
	+ template<class Func>
	+ auto withCrypto(Func &&func) -> std::decay_t<std::invoke_result_t<Func &&, Crypto &>>
	+ {
	+ using ResT = std::decay_t<std::invoke_result_t<Func &&, Crypto &>>;
	+ if constexpr (std::is_same_v<ResT, void>) {
	+ crypto = std::move(crypto).value()
	+ .update([f=std::forward<Func>(func)](Crypto c) mutable {
	+ std::forward<Func>(f)(c);
	+ return c;
	+ });
	+ } else {
	+ std::optional<ResT> res;
	+ crypto = std::move(crypto).value()
	+ .update([f=std::forward<Func>(func), &res](Crypto c) mutable {
	+ res = std::forward<Func>(f)(c);
	+ return c;
	+ });
	+ return std::move(res).value();
	+ }
	+ }
	+
	// helpers
	template<class Job>
	struct MakeJobT
	{
	template<class ...Args>
	constexpr auto make(Args &&...args) const {
	if constexpr (Job::needsAuth()) {
	return Job(
	serverUrl,
	token,
	std::forward<Args>(args)...);
	} else {
	return Job(
	serverUrl,
	std::forward<Args>(args)...);
	}
	}

	std::string serverUrl;
	std::string token;
	};

	template<class Job>
	constexpr auto job() const {
	return MakeJobT<Job>{serverUrl, token};
	}

	inline void addJob(BaseJob j) {
	nextJobs = std::move(nextJobs).push_back(std::move(j));
	}

	inline auto popAllJobs() {
	auto jobs = std::move(nextJobs);
	nextJobs = DEFVAL;
	return jobs;
	};

	inline void addTrigger(KazvEvent t) {
	addTriggers({t});
	}

	inline void addTriggers(immer::flex_vector<KazvEvent> c) {
	nextTriggers = std::move(nextTriggers) + c;
	}

	inline auto popAllTriggers() {
	auto triggers = std::move(nextTriggers);
	nextTriggers = DEFVAL;
	return triggers;
	}

	using Action = ClientAction;
	using Effect = ClientEffect;
	using Result = ClientResult;

	static Result update(ClientModel m, Action a);
	};

	// actions:
	struct LoginAction {
	std::string serverUrl;
	std::string username;
	std::string password;
	std::optional<std::string> deviceName;
	};

	struct TokenLoginAction
	{
	std::string serverUrl;
	std::string username;
	std::string token;
	std::string deviceId;
	};

	struct LogoutAction {};

	struct GetWellknownAction
	{
	std::string userId;
	};

	struct GetVersionsAction
	{
	std::string serverUrl;
	};

	struct SyncAction {};

	struct SetShouldSyncAction
	{
	bool shouldSync;
	};

	struct PaginateTimelineAction
	{
	std::string roomId;
	/// Must be where the Gap is
	std::string fromEventId;
	std::optional<int> limit;
	};

	struct SendMessageAction
	{
	std::string roomId;
	Event event;
	std::optional<std::string> txnId{std::nullopt};
	};

	struct SendStateEventAction
	{
	std::string roomId;
	Event event;
	};

	/**
	* Saves an local echo.
	*
	* After dispatching this action, the result should be such that
	* `result.dataStr("txnId")` contains the transaction id to be used
	* in SendMessageAction.
	*/
	struct SaveLocalEchoAction
	{
	/// The room id
	std::string roomId;
	/// The event to send
	Event event;
	/// The chosen txnId for this event. If not specified, generate from the current ClientModel.
	std::optional<std::string> txnId{std::nullopt};
	};

	/**
	* Updates the status of an local echo.
	*
	* After dispatching this action, the local echo's status will be
	* set to the one described in the action.
	*/
	struct UpdateLocalEchoStatusAction
	{
	/// The room id.
	std::string roomId;
	/// The chosen txnId for this event.
	std::string txnId;
	/// The updated status of this local echo.
	LocalEchoDesc::Status status;
	};

	struct RedactEventAction
	{
	std::string roomId;
	std::string eventId;
	std::optional<std::string> reason;
	};

	struct CreateRoomAction
	{
	using Visibility = RoomVisibility;
	using Preset = CreateRoomPreset;
	Visibility visibility;
	std::optional<std::string> roomAliasName;
	std::optional<std::string> name;
	std::optional<std::string> topic;
	immer::array<std::string> invite;
	//immer::array<Invite3pid> invite3pid;
	std::optional<std::string> roomVersion;
	JsonWrap creationContent;
	immer::array<Event> initialState;
	std::optional<Preset> preset;
	std::optional<bool> isDirect;
	JsonWrap powerLevelContentOverride;
	};

	struct GetRoomStatesAction
	{
	std::string roomId;
	};

	struct GetStateEventAction
	{
	std::string roomId;
	std::string type;
	std::string stateKey;
	};

	struct InviteToRoomAction
	{
	std::string roomId;
	std::string userId;
	};

	struct JoinRoomByIdAction
	{
	std::string roomId;
	};

	struct JoinRoomAction
	{
	std::string roomIdOrAlias;
	immer::array<std::string> serverName;
	};

	struct LeaveRoomAction
	{
	std::string roomId;
	};

	struct ForgetRoomAction
	{
	std::string roomId;
	};

	struct KickAction
	{
	std::string roomId;
	std::string userId;
	std::optional<std::string> reason;
	};

	struct BanAction
	{
	std::string roomId;
	std::string userId;
	std::optional<std::string> reason;
	};

	struct UnbanAction
	{
	std::string roomId;
	std::string userId;
	};

	struct SetAccountDataPerRoomAction
	{
	std::string roomId;
	Event accountDataEvent;
	};

	struct SetTypingAction
	{
	std::string roomId;
	bool typing;
	std::optional<int> timeoutMs;
	};

	struct PostReceiptAction
	{
	std::string roomId;
	std::string eventId;
	};

	struct SetReadMarkerAction
	{
	std::string roomId;
	std::string eventId;
	};

	struct UploadContentAction
	{
	FileDesc content;
	std::optional<std::string> filename;
	std::optional<std::string> contentType;
	std::string uploadId; // to be used by library users
	};

	struct DownloadContentAction
	{
	std::string mxcUri;
	std::optional<FileDesc> downloadTo;
	};

	struct DownloadThumbnailAction
	{
	std::string mxcUri;
	int width;
	int height;
	std::optional<ThumbnailResizingMethod> method;
	std::optional<bool> allowRemote;
	std::optional<FileDesc> downloadTo;
	};

	struct ResubmitJobAction
	{
	BaseJob job;
	};

	struct ProcessResponseAction
	{
	Response response;
	};

	struct PostInitialFiltersAction
	{
	};

	struct SetAccountDataAction
	{
	Event accountDataEvent;
	};

	struct SendToDeviceMessageAction
	{
	Event event;
	immer::map<std::string, immer::flex_vector<std::string>> devicesToSend;
	std::optional<std::string> txnId{std::nullopt};
	};

	struct UploadIdentityKeysAction
	{
	};

	/**
	* The action to generate one-time keys.
	*
	* `random.size()` must be at least `randomSize(numToGen)`.
	*
	* This action will not generate keys exceeding the local limit of olm.
	*/
	struct GenerateAndUploadOneTimeKeysAction
	{
	/// @return The size of random needed to generate
	/// `numToGen` one-time keys
	static std::size_t randomSize(std::size_t numToGen);
	/// The number of keys to generate
	std::size_t numToGen;
	/// The random data used to generate keys
	RandomData random;
	};

	struct QueryKeysAction
	{
	bool isInitialSync;
	};

	struct ClaimKeysAction
	{
	static std::size_t randomSize(immer::map<std::string, immer::flex_vector<std::string>> devicesToSend);
	std::string roomId;
	std::string sessionId;
	std::string sessionKey;
	immer::map<std::string, immer::flex_vector<std::string>> devicesToSend;
	RandomData random;
	};

	/**
	* The action to encrypt an megolm event for a room.
	*
	* If the action is successful, the result `r` will
	* be such that `r.dataJson("encrypted")` contains the encrypted event json.
	*
	* If the megolm session is rotated, `r.dataStr("key")` will contain the key
	* of the megolm session. Otherwise, `r.data().contains("key")` will be false.
	*
	* The Action may fail due to insufficient random data,
	* when the megolm session needs to be rotated.
	* In this case, the reducer for the Action will fail,
	* and its result `r` will be such that
	* `r.dataStr("reason") == "NotEnoughRandom"`.
	* The user needs to provide random data of
	* at least size `maxRandomSize()`.
	*
	*/
	struct EncryptMegOlmEventAction
	{
	static std::size_t maxRandomSize();
	static std::size_t minRandomSize();

	/// The id of the room to encrypt for.
	std::string roomId;
	/// The event to encrypt.
	Event e;
	/// The timestamp, to determine whether the session should expire.
	Timestamp timeMs;
	/// Random data for the operation. Must be of at least size
	/// `minRandomSize()`. If this is a retry of the previous operation
	/// due to NotEnoughRandom, it must be of at least size `maxRandomSize()`.
	RandomData random;
	};

	/**
	* The action to encrypt events with olm for multiple devices.
	*
	* If the action is successful,
	* The result `r` will be such that `r.dataJson("encrypted")`
	* contains the json of the encrypted event.
	*/
	struct EncryptOlmEventAction
	{
	using UserIdToDeviceIdMap = immer::map<std::string, immer::flex_vector<std::string>>;
	static std::size_t randomSize(UserIdToDeviceIdMap devices);

	/// Devices to encrypt for.
	UserIdToDeviceIdMap devices;
	/// The event to encrypt.
	Event e;
	/// The random data for the encryption. Must be of at least
	/// size `randomSize(devices)`.
	RandomData random;
	};

	struct SetDeviceTrustLevelAction
	{
	std::string userId;
	std::string deviceId;
	DeviceTrustLevel trustLevel;
	};

	struct SetTrustLevelNeededToSendKeysAction
	{
	DeviceTrustLevel trustLevel;
	};

	/// Encrypt room key as olm and add it to the room's
	/// pending keyshare slots.
	/// This is to ensure atomicity and that we do not lose an olm-encrypted event.
	struct PrepareForSharingRoomKeyAction
	{
	using UserIdToDeviceIdMap = immer::map<std::string, immer::flex_vector<std::string>>;

	/// The room to share the key event in.
	std::string roomId;
	/// Devices to encrypt for.
	UserIdToDeviceIdMap devices;
	/// The key event to encrypt.
	Event e;
	/// The random data for the encryption. Must be of at least
	/// size `EncryptOlmEventAction::randomSize(devices)`.
	RandomData random;
	};

	struct GetUserProfileAction
	{
	std::string userId;
	};

	struct SetAvatarUrlAction
	{
	std::optional<std::string> avatarUrl;
	};

	struct SetDisplayNameAction
	{
	std::optional<std::string> displayName;
	};

	template<class Archive>
	void serialize(Archive &ar, ClientModel &m, std::uint32_t const version)
	{
	bool dummySyncing{false};
	ar
	& m.serverUrl
	& m.userId
	& m.token
	& m.deviceId
	& m.loggedIn

	& dummySyncing
	& m.firstRetryMs
	& m.retryTimeFactor
	& m.maxRetryMs
	& m.syncTimeoutMs
	& m.initialSyncFilterId
	& m.incrementalSyncFilterId
	& m.syncToken

	& m.roomList
	& m.presence
	& m.accountData

	& m.nextTxnId

	- & m.toDevice
	- & m.crypto
	+ & m.toDevice;
	+ // version <= 1 uses std::optional<Crypto>
	+ // while version >= 2 uses std::optional<immer::box<Crypto>>
	+ if (version >= 2) {
	+ ar & m.crypto;
	+ } else {
	+ if constexpr (typename Archive::is_loading()) {
	+ std::optional<Crypto> crypto;
	+ ar >> crypto;
	+ if (crypto.has_value()) {
	+ m.crypto = immer::box<Crypto>(std::move(crypto).value());
	+ }
	+ }
	+ // otherwise is_saving, which will always use the latest version
	+ // this is unreachable
	+ }
	+
	+ ar
	& m.identityKeysUploaded

	& m.deviceLists
	;

	if (version >= 1) { ar & m.trustLevelNeededToSendKeys; }
	}
	}

	-BOOST_CLASS_VERSION(Kazv::ClientModel, 1)
	+BOOST_CLASS_VERSION(Kazv::ClientModel, 2)
	diff --git a/src/crypto/crypto-p.hpp b/src/crypto/crypto-p.hpp
	index b87331d..6be2388 100644
	--- a/src/crypto/crypto-p.hpp
	+++ b/src/crypto/crypto-p.hpp
	@@ -1,69 +1,69 @@
	/*
	* This file is part of libkazv.
	- * SPDX-FileCopyrightText: 2021 Tusooa Zhu <tusooa@kazv.moe>
	+ * SPDX-FileCopyrightText: 2021-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#pragma once
	#include <libkazv-config.hpp>

	#include <olm/olm.h>

	#include <unordered_map>

	#include "crypto.hpp"
	#include "crypto-util.hpp"
	#include "session.hpp"
	#include "inbound-group-session.hpp"
	#include "outbound-group-session.hpp"

	namespace Kazv
	{
	using SessionList = std::vector<Session>;

	struct CryptoPrivate
	{
	CryptoPrivate();
	CryptoPrivate(RandomTag, RandomData data);
	CryptoPrivate(const CryptoPrivate &that);
	~CryptoPrivate();

	ByteArray accountData;
	OlmAccount *account;
	immer::map<std::string /* algorithm */, int> uploadedOneTimeKeysCount;
	int numUnpublishedKeys{0};
	std::unordered_map<std::string /* theirCurve25519IdentityKey */, Session> knownSessions;
	std::unordered_map<KeyOfGroupSession, InboundGroupSession> inboundGroupSessions;

	std::unordered_map<std::string /* roomId */, OutboundGroupSession> outboundGroupSessions;

	ByteArray utilityData;
	OlmUtility *utility;
	bool valid{true};

	std::size_t checkUtilError(std::size_t code) const;

	std::string pickle() const;
	void unpickle(std::string data);

	- ByteArray identityKeys();
	- std::string ed25519IdentityKey();
	- std::string curve25519IdentityKey();
	+ ByteArray identityKeys() const;
	+ std::string ed25519IdentityKey() const;
	+ std::string curve25519IdentityKey() const;

	std::size_t checkError(std::size_t code) const;

	MaybeString decryptOlm(nlohmann::json content);
	// Here we need the full event for eventId and originServerTs
	MaybeString decryptMegOlm(nlohmann::json eventJson);

	/// returns whether the session is successfully established
	bool createInboundSession(std::string theirCurve25519IdentityKey,
	std::string message);

	bool createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key);

	bool reuseOrCreateOutboundGroupSession(RandomData random, Timestamp timeMs,
	std::string roomId, std::optional<MegOlmSessionRotateDesc> desc);
	};

	}
	diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp
	index 6eb92c4..0155a6e 100644
	--- a/src/crypto/crypto.cpp
	+++ b/src/crypto/crypto.cpp
	@@ -1,640 +1,645 @@
	/*
	* This file is part of libkazv.
	- * SPDX-FileCopyrightText: 2020-2021 Tusooa Zhu <tusooa@kazv.moe>
	+ * SPDX-FileCopyrightText: 2020-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <vector>

	#include <zug/transducer/filter.hpp>

	#include <olm/olm.h>

	#include <nlohmann/json.hpp>

	#include <debug.hpp>
	#include <event.hpp>
	#include <cursorutil.hpp>
	#include <types.hpp>

	#include "crypto-p.hpp"
	#include "session-p.hpp"

	#include "crypto-util.hpp"
	#include "time-util.hpp"

	namespace Kazv
	{
	using namespace CryptoConstants;

	CryptoPrivate::CryptoPrivate()
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	, valid(false)
	{
	}

	CryptoPrivate::CryptoPrivate(RandomTag, RandomData data)
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	{
	auto randLenNeeded = Crypto::constructRandomSize();
	checkError(olm_create_account(account, data.data(), randLenNeeded));
	}


	CryptoPrivate::~CryptoPrivate()
	{
	olm_clear_account(account);
	}

	CryptoPrivate::CryptoPrivate(const CryptoPrivate &that)
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, uploadedOneTimeKeysCount(that.uploadedOneTimeKeysCount)
	, numUnpublishedKeys(that.numUnpublishedKeys)
	, knownSessions(that.knownSessions)
	, inboundGroupSessions(that.inboundGroupSessions)
	, outboundGroupSessions(that.outboundGroupSessions)
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	{
	unpickle(that.pickle());
	}

	std::string CryptoPrivate::pickle() const
	{
	auto key = ByteArray(3, 'x');
	auto pickleData = std::string(olm_pickle_account_length(account), '\0');
	checkError(olm_pickle_account(account, key.data(), key.size(),
	pickleData.data(), pickleData.size()));
	return pickleData;
	}

	void CryptoPrivate::unpickle(std::string pickleData)
	{
	auto key = ByteArray(3, 'x');
	checkError(olm_unpickle_account(account, key.data(), key.size(),
	pickleData.data(), pickleData.size()));
	}

	std::size_t CryptoPrivate::checkError(std::size_t code) const
	{
	if (code == olm_error()) {
	kzo.crypto.warn() << "Olm error: " << olm_account_last_error(account) << std::endl;
	}
	return code;
	}

	std::size_t CryptoPrivate::checkUtilError(std::size_t code) const
	{
	if (code == olm_error()) {
	kzo.crypto.warn() << "Olm utility error: " << olm_utility_last_error(utility) << std::endl;
	}
	return code;
	}


	MaybeString CryptoPrivate::decryptOlm(nlohmann::json content)
	{
	auto theirCurve25519IdentityKey = content.at("sender_key").get<std::string>();

	auto ourCurve25519IdentityKey = curve25519IdentityKey();

	if (! content.at("ciphertext").contains(ourCurve25519IdentityKey)) {
	return NotBut("Message not intended for us");
	}

	auto type = content.at("ciphertext").at(ourCurve25519IdentityKey).at("type").get<int>();
	auto body = content.at("ciphertext").at(ourCurve25519IdentityKey).at("body").get<std::string>();

	auto hasKnownSession = knownSessions.find(theirCurve25519IdentityKey) != knownSessions.end();

	if (type == 0) { // pre-key message
	bool shouldCreateNewSession =
	// there is no possible session
	(! hasKnownSession)
	// the possible session does not match this message
	\|\| (! knownSessions.at(theirCurve25519IdentityKey).matches(body));

	if (shouldCreateNewSession) {
	auto created = createInboundSession(theirCurve25519IdentityKey, body);
	if (! created) { // cannot create session, thus cannot decrypt
	return NotBut("Cannot create session");
	}
	}

	auto &session = knownSessions.at(theirCurve25519IdentityKey);

	return session.decrypt(type, body);
	} else {
	if (! hasKnownSession) {
	return NotBut("No available session");
	}

	auto &session = knownSessions.at(theirCurve25519IdentityKey);
	return session.decrypt(type, body);
	}
	}

	MaybeString CryptoPrivate::decryptMegOlm(nlohmann::json eventJson)
	{
	auto content = eventJson.at("content");

	auto senderKey = content.at("sender_key").get<std::string>();
	auto sessionId = content.at("session_id").get<std::string>();
	auto roomId = eventJson.at("room_id").get<std::string>();

	auto k = KeyOfGroupSession{roomId, senderKey, sessionId};

	if (inboundGroupSessions.find(k) == inboundGroupSessions.end()) {
	return NotBut("We do not have the keys for this");
	} else {
	auto msg = content.at("ciphertext").get<std::string>();
	auto eventId = eventJson.at("event_id").get<std::string>();
	auto originServerTs = eventJson.at("origin_server_ts").get<Timestamp>();
	auto &session = inboundGroupSessions.at(k);

	return session.decrypt(msg, eventId, originServerTs);
	}
	}

	bool CryptoPrivate::createInboundSession(std::string theirCurve25519IdentityKey,
	std::string message)
	{
	auto s = Session(InboundSessionTag{}, account,
	theirCurve25519IdentityKey, message);

	if (s.valid()) {
	checkError(olm_remove_one_time_keys(account, s.m_d->session));
	knownSessions.insert_or_assign(theirCurve25519IdentityKey, std::move(s));
	return true;
	}

	return false;
	}

	bool CryptoPrivate::reuseOrCreateOutboundGroupSession(
	RandomData random, Timestamp timeMs,
	std::string roomId, std::optional<MegOlmSessionRotateDesc> desc)
	{
	bool valid = true;
	if (! desc.has_value()) { // force rotate
	valid = false;
	} else {
	auto it = outboundGroupSessions.find(roomId);
	if (it == outboundGroupSessions.end()) {
	valid = false;
	} else {
	auto &session = it->second;
	if (timeMs - session.creationTimeMs() >= desc.value().ms) {
	valid = false;
	} else if (session.messageIndex() >= desc.value().messages) {
	valid = false;
	}
	}
	}

	if (! valid) {
	outboundGroupSessions.insert_or_assign(roomId, OutboundGroupSession(RandomTag{}, random, timeMs));
	auto &session = outboundGroupSessions.at(roomId);
	auto sessionId = session.sessionId();
	auto sessionKey = session.sessionKey();
	auto senderKey = curve25519IdentityKey();

	auto k = KeyOfGroupSession{roomId, senderKey, sessionId};

	if (! createInboundGroupSession(k, sessionKey, ed25519IdentityKey())) {
	kzo.client.warn() << "Create inbound group session from outbound group session failed. We may not be able to read our own messages." << std::endl;
	}
	}
	return valid;
	}


	std::size_t Crypto::constructRandomSize()
	{
	static std::size_t s =
	[] {
	std::vector<char> acc(olm_account_size(), 0);
	OlmAccount *account = olm_account(acc.data());
	return olm_create_account_random_length(account);
	}();
	return s;
	}

	Crypto::Crypto()
	: m_d(new CryptoPrivate{})
	{
	}

	Crypto::Crypto(RandomTag, RandomData data)
	: m_d(new CryptoPrivate(RandomTag{}, std::move(data)))
	{
	}

	Crypto::~Crypto() = default;

	Crypto::Crypto(const Crypto &that)
	: m_d(new CryptoPrivate(*that.m_d))
	{
	}

	Crypto::Crypto(Crypto &&that)
	: m_d(std::move(that.m_d))
	{
	}

	Crypto &Crypto::operator=(const Crypto &that)
	{
	m_d.reset(new CryptoPrivate(*that.m_d));
	return *this;
	}

	Crypto &Crypto::operator=(Crypto &&that)
	{
	m_d = std::move(that.m_d);
	return *this;
	}

	+ bool Crypto::operator==(const Crypto &that) const
	+ {
	+ return this->m_d == that.m_d;
	+ }
	+
	bool Crypto::valid() const
	{
	return m_d->valid;
	}

	- ByteArray CryptoPrivate::identityKeys()
	+ ByteArray CryptoPrivate::identityKeys() const
	{
	auto ret = ByteArray(olm_account_identity_keys_length(account), '\0');
	checkError(olm_account_identity_keys(account, ret.data(), ret.size()));
	return ret;
	}

	- std::string CryptoPrivate::ed25519IdentityKey()
	+ std::string CryptoPrivate::ed25519IdentityKey() const
	{
	auto keys = identityKeys();
	auto keyStr = std::string(keys.begin(), keys.end());
	auto keyJson = nlohmann::json::parse(keyStr);
	return keyJson.at(ed25519);
	}

	- std::string CryptoPrivate::curve25519IdentityKey()
	+ std::string CryptoPrivate::curve25519IdentityKey() const
	{
	auto keys = identityKeys();
	auto keyStr = std::string(keys.begin(), keys.end());
	auto keyJson = nlohmann::json::parse(keyStr);
	return keyJson.at(curve25519);
	}

	- std::string Crypto::ed25519IdentityKey()
	+ std::string Crypto::ed25519IdentityKey() const
	{
	return m_d->ed25519IdentityKey();
	}

	- std::string Crypto::curve25519IdentityKey()
	+ std::string Crypto::curve25519IdentityKey() const
	{
	return m_d->curve25519IdentityKey();
	}

	std::string Crypto::sign(nlohmann::json j)
	{
	j.erase("signatures");
	j.erase("unsigned");

	auto str = j.dump();

	auto ret = ByteArray(olm_account_signature_length(m_d->account), '\0');

	kzo.crypto.dbg() << "We are about to sign: " << str << std::endl;

	m_d->checkError(olm_account_sign(m_d->account,
	str.data(), str.size(),
	ret.data(), ret.size()));

	return std::string{ret.begin(), ret.end()};
	}

	void Crypto::setUploadedOneTimeKeysCount(immer::map<std::string /* algorithm */, int> uploadedOneTimeKeysCount)
	{
	m_d->uploadedOneTimeKeysCount = uploadedOneTimeKeysCount;
	}

	std::size_t Crypto::maxNumberOfOneTimeKeys() const
	{
	return olm_account_max_number_of_one_time_keys(m_d->account);
	}

	std::size_t Crypto::genOneTimeKeysRandomSize(int num)
	{
	static std::size_t oneKeyRandomSize =
	[] {
	std::vector<char> acc(olm_account_size(), 0);
	OlmAccount *account = olm_account(acc.data());
	return olm_account_generate_one_time_keys_random_length(account, 1);
	}();

	return oneKeyRandomSize * num;
	}

	void Crypto::genOneTimeKeysWithRandom(RandomData random, int num)
	{
	assert(random.size() >= genOneTimeKeysRandomSize(num));

	auto res = m_d->checkError(
	olm_account_generate_one_time_keys(
	m_d->account,
	num,
	random.data(), random.size()));

	if (res != olm_error()) {
	m_d->numUnpublishedKeys += num;
	}
	}


	- nlohmann::json Crypto::unpublishedOneTimeKeys()
	+ nlohmann::json Crypto::unpublishedOneTimeKeys() const
	{
	auto keys = ByteArray(olm_account_one_time_keys_length(m_d->account), '\0');
	m_d->checkError(olm_account_one_time_keys(m_d->account, keys.data(), keys.size()));

	return nlohmann::json::parse(std::string(keys.begin(), keys.end()));
	}

	void Crypto::markOneTimeKeysAsPublished()
	{
	auto ret = m_d->checkError(olm_account_mark_keys_as_published(m_d->account));
	if (ret != olm_error()) {
	m_d->numUnpublishedKeys = 0;
	}
	}

	int Crypto::numUnpublishedOneTimeKeys() const
	{
	return m_d->numUnpublishedKeys;
	}

	int Crypto::uploadedOneTimeKeysCount(std::string algorithm) const
	{
	return m_d->uploadedOneTimeKeysCount[algorithm];
	}

	MaybeString Crypto::decrypt(nlohmann::json eventJson)
	{
	auto content = eventJson.at("content");
	auto algo = content.contains("algorithm") ? content.at("algorithm").template get<std::string>() : std::string();
	if (algo == olmAlgo) {
	return m_d->decryptOlm(std::move(content));
	} else if (algo == megOlmAlgo) {
	return m_d->decryptMegOlm(eventJson);
	}
	return NotBut("Algorithm " + algo + " not supported");
	}

	bool Crypto::createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key)
	{
	return m_d->createInboundGroupSession(std::move(k), std::move(sessionKey), std::move(ed25519Key));
	}

	bool CryptoPrivate::createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key)
	{
	auto session = InboundGroupSession(sessionKey, ed25519Key);
	if (session.valid()) {
	inboundGroupSessions.insert_or_assign(k, std::move(session));
	return true;
	}
	return false;
	}

	bool Crypto::verify(nlohmann::json object, std::string userId, std::string deviceId, std::string ed25519Key)
	{
	if (! object.contains("signatures")) {
	return false;
	}
	std::string signature;
	try {
	signature = object.at("signatures").at(userId).at(ed25519 + ":" + deviceId);
	} catch(const std::exception &) {
	return false;
	}
	object.erase("signatures");
	object.erase("unsigned");

	auto message = object.dump();

	auto res = m_d->checkUtilError(
	olm_ed25519_verify(m_d->utility,
	ed25519Key.c_str(), ed25519Key.size(),
	message.c_str(), message.size(),
	signature.data(), signature.size()));

	return res != olm_error();
	}

	MaybeString Crypto::getInboundGroupSessionEd25519KeyFromEvent(const nlohmann::json &eventJson) const
	{
	auto content = eventJson.at("content");

	auto senderKey = content.at("sender_key").get<std::string>();
	auto sessionId = content.at("session_id").get<std::string>();
	auto roomId = eventJson.at("room_id").get<std::string>();

	auto k = KeyOfGroupSession{roomId, senderKey, sessionId};

	if (m_d->inboundGroupSessions.find(k) == m_d->inboundGroupSessions.end()) {
	return NotBut("We do not have the keys for this");
	} else {
	auto &session = m_d->inboundGroupSessions.at(k);
	return session.ed25519Key();
	}
	}

	std::size_t Crypto::encryptOlmRandomSize(std::string /* theirCurve25519IdentityKey */) const
	{
	// HACK: To prevent a possible race condition where we call
	// encryptedOlmRandomSize() -> randomGenerator.generateRange() ~> [encryptOlm()]
	//
	// Here, encryptOlm() must be called in the reducer,
	// as it changes the status of
	// Crypto (so we should not risk any infomation lose in Crypto).
	// Also, for the reducer to be pure, we may not call generateRange() in the reducer,
	// as that is not a pure function. This means it can only be called in an effect,
	// or .then() continuation. This means, the sequence from encryptedOlmRandomSize()
	// to encryptOlm() can never be atomic. That is, there may be other encryptOlm()
	// calls within, and that may increase the random data needed, and as a result,
	// we will not have enough random data.
	//
	// According to the olm headers:
	// https://gitlab.matrix.org/matrix-org/olm/-/blob/master/include/olm/ratchet.hh
	// The maximum random size needed to encrypt is 32. We use this to ensure we
	// will always have enough random data fot the encryption.
	return encryptOlmMaxRandomSize();
	}

	std::size_t Crypto::encryptOlmMaxRandomSize()
	{
	static std::size_t maxRandomSizeNeeded = 32;
	return maxRandomSizeNeeded;
	}

	nlohmann::json Crypto::encryptOlmWithRandom(
	RandomData random, nlohmann::json eventJson, std::string theirCurve25519IdentityKey)
	{
	assert(random.size() >= encryptOlmRandomSize(theirCurve25519IdentityKey));
	try {
	auto &session = m_d->knownSessions.at(theirCurve25519IdentityKey);
	auto [type, body] = session.encryptWithRandom(random, eventJson.dump());
	return nlohmann::json{
	{
	theirCurve25519IdentityKey, {
	{"type", type},
	{"body", body}
	}
	}
	};
	} catch (const std::exception &) {
	return nlohmann::json::object();
	}
	}

	nlohmann::json Crypto::encryptMegOlm(nlohmann::json eventJson)
	{
	auto roomId = eventJson.at("room_id").get<std::string>();
	auto content = eventJson.at("content");
	auto type = eventJson.at("type").get<std::string>();

	auto jsonToEncrypt = nlohmann::json::object();
	jsonToEncrypt["room_id"] = roomId;
	jsonToEncrypt["content"] = std::move(content);
	jsonToEncrypt["type"] = type;

	auto textToEncrypt = std::move(jsonToEncrypt).dump();

	auto &session = m_d->outboundGroupSessions.at(roomId);

	auto ciphertext = session.encrypt(std::move(textToEncrypt));

	return
	json{
	{"algorithm", CryptoConstants::megOlmAlgo},
	{"sender_key", curve25519IdentityKey()},
	{"ciphertext", ciphertext},
	{"session_id", session.sessionId()},
	};
	}

	std::size_t Crypto::rotateMegOlmSessionRandomSize()
	{
	return OutboundGroupSession::constructRandomSize();
	}

	std::string Crypto::rotateMegOlmSessionWithRandom(RandomData random, Timestamp timeMs, std::string roomId)
	{
	m_d->reuseOrCreateOutboundGroupSession(
	random, timeMs,
	roomId, std::nullopt);
	return outboundGroupSessionCurrentKey(roomId);
	}

	std::optional<std::string> Crypto::rotateMegOlmSessionWithRandomIfNeeded(
	RandomData random, Timestamp timeMs,
	std::string roomId, MegOlmSessionRotateDesc desc)
	{
	auto oldSessionValid = m_d->reuseOrCreateOutboundGroupSession(random, timeMs, roomId, std::move(desc));
	return oldSessionValid ? std::nullopt : std::optional(outboundGroupSessionCurrentKey(roomId));
	}

	std::string Crypto::outboundGroupSessionInitialKey(std::string roomId)
	{
	auto &session = m_d->outboundGroupSessions.at(roomId);
	return session.initialSessionKey();
	}

	std::string Crypto::outboundGroupSessionCurrentKey(std::string roomId)
	{
	auto &session = m_d->outboundGroupSessions.at(roomId);
	return session.sessionKey();
	}

	auto Crypto::devicesMissingOutboundSessionKey(
	immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>> keyMap) const -> UserIdToDeviceIdMap
	{
	auto ret = UserIdToDeviceIdMap{};
	for (auto [userId, devices] : keyMap) {
	auto unknownDevices =
	intoImmer(immer::flex_vector<std::string>{},
	zug::filter([=](auto kv) {
	auto [deviceId, theirCurve25519IdentityKey] = kv;
	return m_d->knownSessions.find(theirCurve25519IdentityKey)
	== m_d->knownSessions.end();
	})
	\| zug::map([=](auto kv) {
	auto [deviceId, key] = kv;
	return deviceId;
	}),
	devices);
	if (! unknownDevices.empty()) {
	ret = std::move(ret).set(userId, std::move(unknownDevices));
	}
	}
	return ret;
	}

	std::size_t Crypto::createOutboundSessionRandomSize()
	{
	return Session::constructOutboundRandomSize();
	}

	void Crypto::createOutboundSessionWithRandom(
	RandomData random,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	{
	assert(random.size() >= createOutboundSessionRandomSize());
	auto session = Session(OutboundSessionTag{},
	RandomTag{},
	random,
	m_d->account,
	theirIdentityKey,
	theirOneTimeKey);

	if (session.valid()) {
	m_d->knownSessions.insert_or_assign(theirIdentityKey,
	std::move(session));
	}
	}

	nlohmann::json Crypto::toJson() const
	{
	std::string pickledData = m_d->valid ? m_d->pickle() : std::string();
	auto j = nlohmann::json::object({
	{"valid", m_d->valid},
	{"account", std::move(pickledData)},
	{"uploadedOneTimeKeysCount", m_d->uploadedOneTimeKeysCount},
	{"numUnpublishedKeys", m_d->numUnpublishedKeys},
	{"knownSessions", nlohmann::json(m_d->knownSessions)},
	{"inboundGroupSessions", nlohmann::json(m_d->inboundGroupSessions)},
	{"outboundGroupSessions", nlohmann::json(m_d->outboundGroupSessions)},
	});

	return j;
	}

	void Crypto::loadJson(const nlohmann::json &j)
	{
	m_d->valid = j.contains("valid") ? j["valid"].template get<bool>() : true;
	const auto &pickledData = j.at("account").template get<std::string>();
	if (m_d->valid) { m_d->unpickle(pickledData); }

	m_d->uploadedOneTimeKeysCount = j.at("uploadedOneTimeKeysCount");
	m_d->numUnpublishedKeys = j.at("numUnpublishedKeys");
	m_d->knownSessions = j.at("knownSessions").template get<decltype(m_d->knownSessions)>();
	m_d->inboundGroupSessions = j.at("inboundGroupSessions").template get<decltype(m_d->inboundGroupSessions)>();
	m_d->outboundGroupSessions = j.at("outboundGroupSessions").template get<decltype(m_d->outboundGroupSessions)>();
	}
	}
	diff --git a/src/crypto/crypto.hpp b/src/crypto/crypto.hpp
	index bd9f631..98730ae 100644
	--- a/src/crypto/crypto.hpp
	+++ b/src/crypto/crypto.hpp
	@@ -1,258 +1,260 @@
	/*
	* This file is part of libkazv.
	- * SPDX-FileCopyrightText: 2020-2021 Tusooa Zhu <tusooa@kazv.moe>
	+ * SPDX-FileCopyrightText: 2020-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#pragma once
	#include <libkazv-config.hpp>

	#include <memory>

	#include <nlohmann/json.hpp>

	#include <immer/map.hpp>
	#include <immer/flex_vector.hpp>

	#include <maybe.hpp>

	#include "crypto-util.hpp"
	#include "time-util.hpp"

	namespace Kazv
	{
	class Session;

	struct MegOlmSessionRotateDesc
	{
	/// The time limit of the megolm session, in milliseconds.
	Timestamp ms{};
	/// The message limit of the megolm session.
	int messages{};
	};

	struct CryptoPrivate;
	class Crypto
	{
	public:
	/**
	* Construct an invalid Crypto.
	*/
	explicit Crypto();

	/**
	* @return The size of random data needed to construct a Crypto.
	*/
	static std::size_t constructRandomSize();

	/**
	* Constructs a Crypto using user-provided random data.
	*
	* @param data Random data of size at least `constructRandomSize()`.
	*/
	Crypto(RandomTag, RandomData data);

	Crypto(const Crypto &that);
	Crypto(Crypto &&that);
	Crypto &operator=(const Crypto &that);
	Crypto &operator=(Crypto &&that);
	~Crypto();

	+ bool operator==(const Crypto &that) const;
	+
	/**
	* @return whether this Crypto is valid.
	*/
	bool valid() const;

	- std::string ed25519IdentityKey();
	- std::string curve25519IdentityKey();
	+ std::string ed25519IdentityKey() const;
	+ std::string curve25519IdentityKey() const;

	std::string sign(nlohmann::json j);

	void setUploadedOneTimeKeysCount(immer::map<std::string /* algorithm */, int> uploadedOneTimeKeysCount);

	int uploadedOneTimeKeysCount(std::string algorithm) const;

	std::size_t maxNumberOfOneTimeKeys() const;

	/**
	* Get the size of random data needed to generate `num`
	* one-time keys.
	*
	* @param num The number of one-time keys to generate.
	*
	* @return The size of random data needed to generate
	* `num` one-time keys.
	*/
	static std::size_t genOneTimeKeysRandomSize(int num);

	/**
	* Generate `num` one-time keys with user-provided random data.
	*
	* @param random The random data. Must be of at least size
	* `genOneTimeKeysRandomSize(num)`.
	* @param num The number of one-time keys to generate.
	*/
	void genOneTimeKeysWithRandom(RandomData random, int num);

	/**
	* According to olm.h, this returns an object like
	*
	* {
	* curve25519: {
	* "AAAAAA": "wo76WcYtb0Vk/pBOdmduiGJ0wIEjW4IBMbbQn7aSnTo",
	* "AAAAAB": "LRvjo46L1X2vx69sS9QNFD29HWulxrmW11Up5AfAjgU"
	* }
	* }
	*/
	- nlohmann::json unpublishedOneTimeKeys();
	+ nlohmann::json unpublishedOneTimeKeys() const;

	int numUnpublishedOneTimeKeys() const;

	void markOneTimeKeysAsPublished();

	/// Returns decrypted message if we can decrypt it
	/// otherwise returns the error
	MaybeString decrypt(nlohmann::json eventJson);

	/**
	* @return The size of random data needed to encrypt a message
	* for the session identified with `theirCurve25519IdentityKey`.
	*/
	std::size_t encryptOlmRandomSize(std::string theirCurve25519IdentityKey) const;

	/**
	* @return The maximum size of random data needed to encrypt a message
	* for the session identified with `theirCurve25519IdentityKey`.
	*/
	static std::size_t encryptOlmMaxRandomSize();

	/**
	* Encrypt `eventJson` with olm, for the recipient identified with `theirCurve25519IdentityKey`.
	*
	* @param random The random data to use for encryption. Must be of
	* at least size `encryptOlmRandomSize(theirCurve25519IdentityKey)`.
	* @param eventJson The event json to encrypt.
	* @param theirCurve25519IdentityKey The curve25519 identity key of the recipient.
	*
	* @return A json object that looks like
	* ```
	* {
	* "<their identity key>": {
	* "type": <number>,
	* "body": "<body>"
	* }
	* }
	* ```
	*/
	nlohmann::json encryptOlmWithRandom(
	RandomData random, nlohmann::json eventJson, std::string theirCurve25519IdentityKey);

	/// returns the content template with everything but deviceId
	/// eventJson should contain type, room_id and content
	nlohmann::json encryptMegOlm(nlohmann::json eventJson);

	bool createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key);

	std::string outboundGroupSessionInitialKey(std::string roomId);

	std::string outboundGroupSessionCurrentKey(std::string roomId);

	/// Check whether the signature of userId/deviceId is valid in object
	bool verify(nlohmann::json object, std::string userId, std::string deviceId, std::string ed25519Key);

	MaybeString getInboundGroupSessionEd25519KeyFromEvent(const nlohmann::json &eventJson) const;

	/**
	* @return The size of random data needed for `rotateMegOlmSessionWithRandom()`
	* and `rotateMegOlmSessionWithRandomIfNeeded()`.
	*/
	static std::size_t rotateMegOlmSessionRandomSize();

	/**
	* Rotate the megolm session using user-provided random data.
	*
	* @param random The random data. Must be of at least size
	* `rotateMegOlmSessionRandomSize()`.
	* @param timeMs The creation time of the new megolm session.
	* @param roomId The room id of the megolm session to rotate.
	*
	* @return The new session key.
	*/
	std::string rotateMegOlmSessionWithRandom(RandomData random, Timestamp timeMs, std::string roomId);

	/**
	* Rotate the megolm session using user-provided random data,
	* if we need to rotate it.
	*
	* The session will be rotated if and only if
	* - The difference between `timeMs` and the creation time of
	* the megolm session has reached the time limit in `desc`, OR;
	* - The number of messages this megolm session has encrypted has
	* reached the message limit in `desc`.
	*
	* @param random The random data. Must be of at least size
	* `rotateMegOlmSessionRandomSize()`.
	* @param timeMs The timestamp to judge whether the session
	* has reached its time limit. If the megolm session is rotated,
	* this will also be the creation time of the new megolm session.
	* @param roomId The room id of the megolm session to rotate.
	* @param desc The rotation specification of this room.
	*
	* @return The session key if the session is rotated,
	* `std::nullopt` otherwise.
	*/
	std::optional<std::string> rotateMegOlmSessionWithRandomIfNeeded(
	RandomData random,
	Timestamp timeMs,
	std::string roomId,
	MegOlmSessionRotateDesc desc);

	using UserIdToDeviceIdMap = immer::map<std::string, immer::flex_vector<std::string>>;
	UserIdToDeviceIdMap devicesMissingOutboundSessionKey(
	immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>> keyMap) const;

	/**
	* @return The size of random data needed for `createOutboundSessionWithRandom()`.
	*/
	static std::size_t createOutboundSessionRandomSize();

	/**
	* Create an outbound session using user-provided random data.
	*
	* @param random The random data to use. It must be at least of
	* size `createOutboundSessionRandomSize()`.
	* @param theirIdeneityKey The identity key of the recipient.
	* @param theirOneTimeKey The one-time key of the recipient.
	*/
	void createOutboundSessionWithRandom(
	RandomData random,
	std::string theirIdentityKey,
	std::string theirOneTimeKey);

	template<class Archive>
	void save(Archive & ar, const unsigned int /* version */) const {
	ar << toJson().dump();
	}

	template<class Archive>
	void load(Archive &ar, const unsigned int /* version */) {
	std::string j;
	ar >> j;
	loadJson(nlohmann::json::parse(std::move(j)));
	}

	BOOST_SERIALIZATION_SPLIT_MEMBER()

	nlohmann::json toJson() const;
	void loadJson(const nlohmann::json &j);

	private:

	friend class Session;
	friend class SessionPrivate;
	std::unique_ptr<CryptoPrivate> m_d;
	};
	}

	BOOST_CLASS_VERSION(Kazv::Crypto, 0)

File Metadata

Mime Type: text/x-diff
Expires: Sun, Oct 11, 10:16 AM (1 d, 9 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1785725
Default Alt Text: (113 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions