No OneTemporary
Actions

Size

83 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/client/actions/encryption.cpp b/src/client/actions/encryption.cpp
	index b0236e4..70e9b84 100644
	--- a/src/client/actions/encryption.cpp
	+++ b/src/client/actions/encryption.cpp
	@@ -1,816 +1,829 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2021-2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <zug/transducer/filter.hpp>
	#include <zug/transducer/cat.hpp>

	#include "encryption.hpp"

	#include <immer-utils.hpp>
	#include <debug.hpp>
	#include "cursorutil.hpp"
	#include "status-utils.hpp"
	#include "key-export.hpp"

	namespace Kazv
	{
	using namespace CryptoConstants;

	ClientResult updateClient(ClientModel m, UploadIdentityKeysAction)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), lager::noop };
	}

	auto k = m.makeSelfDeviceKeys();

	auto job = m.job<UploadKeysJob>()
	.make(k)
	.withData(json{{"is", "identityKeys"}});

	kzo.client.dbg() << "Uploading identity keys" << std::endl;

	m.addJob(std::move(job));

	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, GenerateAndUploadOneTimeKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), simpleFail };
	}

	kzo.client.dbg() << "Generating " << a.numToGen << " one-time keys..." << std::endl;

	auto maxNumKeys = m.constCrypto().maxNumberOfOneTimeKeys();
	auto numLocalKeys = m.constCrypto().numUnpublishedOneTimeKeys();
	auto numStoredKeys = m.constCrypto().uploadedOneTimeKeysCount(signedCurve25519) + numLocalKeys;
	auto numKeysToGenerate = a.numToGen;
	auto genKeysLimit = maxNumKeys - numStoredKeys;

	if (numKeysToGenerate > genKeysLimit) {
	numKeysToGenerate = genKeysLimit;
	}

	if (numLocalKeys <= 0 && numKeysToGenerate <= 0) { // we have enough already
	kzo.client.dbg() << "We have enough one-time keys. Ignoring this." << std::endl;
	return { std::move(m), lager::noop };
	}

	if (numKeysToGenerate > 0) {
	m.withCrypto([&](auto &c) { c.genOneTimeKeysWithRandom(a.random, numKeysToGenerate); });
	}
	kzo.client.dbg() << "Generating done." << std::endl;

	auto keys = m.constCrypto().unpublishedOneTimeKeys();

	auto cv25519Keys = keys.at(curve25519);
	json oneTimeKeys = json::object();
	for (auto [id, keyStr] : cv25519Keys.items()) {
	json keyObject = json::object();
	keyObject["key"] = keyStr;
	keyObject["signatures"] = m.convertSignature(m.withCrypto([&](auto &c) { return c.sign(keyObject); }));

	oneTimeKeys[signedCurve25519 + ":" + id] = keyObject;
	}

	auto job = m.job<UploadKeysJob>()
	.make(
	std::nullopt, // deviceKeys
	oneTimeKeys)
	.withData(json{{"is", "oneTimeKeys"}});

	kzo.client.dbg() << "Uploading one time keys" << std::endl;

	m.addJob(std::move(job));

	return { std::move(m), lager::noop };

	};

	ClientResult processResponse(ClientModel m, UploadKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.warn() << "Client::crypto is invalid, ignoring it." << std::endl;
	return { std::move(m), lager::noop };
	}

	auto is = r.dataStr("is");

	if (is == "identityKeys") {
	if (! r.success()) {
	kzo.client.dbg() << "Uploading identity keys failed" << std::endl;
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Uploading identity keys successful" << std::endl;

	m.identityKeysUploaded = true;
	} else {
	if (! r.success()) {
	kzo.client.dbg() << "Uploading one-time keys failed" << std::endl;
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Uploading one-time keys successful" << std::endl;
	m.withCrypto([&](auto &c) { c.markOneTimeKeysAsPublished(); });
	}

	m.withCrypto([&](auto &c) { c.setUploadedOneTimeKeysCount(r.oneTimeKeyCounts()); });

	return { std::move(m), lager::noop };
	}

	static JsonWrap cannotDecryptEvent(
	const std::string &reason,
	const std::string &errcode,
	const json &raw)
	{
	return json{
	{"type", "m.room.message"},
	{"content", {
	{"msgtype","moe.kazv.mxc.cannot.decrypt"},
	{"body", "This message cannot be decrypted due to " + reason + "."},
	{"moe.kazv.mxc.error", reason},
	{"moe.kazv.mxc.errcode", errcode},
	{"moe.kazv.mxc.raw", raw},
	}},
	};
	}

	// returns std::nullopt on success, and an error event on failure
	static std::optional<JsonWrap> verifyEvent(ClientModel &m, Event e, const json &plainJson)
	{
	try {
	std::string algo = e.originalJson().get().at("content").at("algorithm");
	if (algo == olmAlgo) {
	// Perform checks described in
	// https://spec.matrix.org/v1.18/client-server-api/#validation-of-incoming-decrypted-events

	// (5) Where sender_device_keys is present in the decrypted content:
	auto [status, deviceInfo] = m.deviceLists.findByOlmEvent(e.setDecryptedJson(plainJson, Event::Decrypted));

	if (status == DeviceListTracker::NotFound) {
	kzo.client.dbg() << "Device key unknown, thus invalid" << std::endl;
	return cannotDecryptEvent(
	"device key unknown",
	"MOE.KAZV.MXC_DEVICE_KEY_UNKNOWN",
	plainJson
	);
	}

	// (1) The sender property in the decrypted content must match the sender of the event.
	if (! (plainJson.at("sender") == e.sender())) {
	kzo.client.dbg() << "Sender does not match, thus invalid" << std::endl;
	return cannotDecryptEvent(
	"sender does not match",
	"MOE.KAZV.MXC_BAD_SENDER",
	plainJson
	);
	}

	// (3) The recipient property in the decrypted content must match the user ID of the local user.
	if (! (plainJson.at("recipient") == m.userId)) {
	kzo.client.dbg() << "Recipient does not match, thus invalid" << std::endl;
	return cannotDecryptEvent(
	"recipient does not match",
	"MOE.KAZV.MXC_BAD_RECIPIENT",
	plainJson
	);
	}

	// (4) The recipient_keys.ed25519 property in the decrypted content must match the client
	// device's Ed25519 signing key.
	if (! (plainJson.at("recipient_keys").at(ed25519) == m.constCrypto().ed25519IdentityKey())) {
	kzo.client.dbg() << "Recipient key does not match, thus invalid" << std::endl;
	return cannotDecryptEvent(
	"recipient keys do not match",
	"MOE.KAZV.MXC_BAD_RECIPIENT_KEYS",
	plainJson
	);
	}

	// (2) The keys.ed25519 property in the decrypted content must match the
	// [CORRECTED: ed25519 identity key of the sending device]
	auto thisEd25519Key = plainJson.at("keys").at(ed25519).get<std::string>();
	// If `sender_device_keys` is present, this also checks:
	// (3) [CORRECTED: sender_device_keys.keys.ed25519:<device_id> must be the same as the `keys.ed25519` property in the decrypted content.]
	if (thisEd25519Key != deviceInfo.ed25519Key) {
	kzo.client.dbg() << "Sender ed25519 key does not match, thus invalid" << std::endl;
	return cannotDecryptEvent(
	"sender keys do not match",
	"MOE.KAZV.MXC_BAD_SENDER_KEYS",
	plainJson
	);
	}

	// if everything looks good, add the deviceInfo if it is not yet in tracker
	if (status == DeviceListTracker::InEvent) {
	m.deviceLists.addVerifiedDeviceKeyInfo(
	e.sender(),
	deviceInfo.deviceId,
	deviceInfo
	);
	}
	} else if (algo == megOlmAlgo) {
	auto roomId = plainJson.at("room_id").get<std::string>();
	if (roomId.empty() \|\|
	roomId != e.originalJson().get().at("room_id").template get<std::string>()) {
	kzo.client.dbg() << "Room id does not match, thus invalid" << std::endl;
	return cannotDecryptEvent(
	"room id does not match",
	"MOE.KAZV.MXC_BAD_ROOM_ID",
	plainJson
	);
	}
	} else {
	kzo.client.dbg() << "Unknown algorithm, thus invalid" << std::endl;
	return cannotDecryptEvent(
	"unknown algorithm",
	"MOE.KAZV.MXC_UNKNOWN_ALGORITHM",
	plainJson
	);
	}
	} catch (const std::exception &exception) {
	kzo.client.dbg() << "json format is not correct, thus invalid" << std::endl;
	return cannotDecryptEvent(
	exception.what(),
	"M_BAD_JSON",
	plainJson
	);
	}

	return std::nullopt;
	}

	Event decryptEvent(ClientModel &m, Event e)
	{
	// no need for decryption
	if (e.decrypted() \|\| (! e.encrypted())) {
	return e;
	}

	kzo.client.dbg() << "About to decrypt event: "
	<< e.id() << std::endl;

	auto maybePlainText = m.withCrypto([&](Crypto &c) {
	return c.decrypt(e.originalJson().get());
	});

	if (! maybePlainText) {
	kzo.client.dbg() << "Cannot decrypt: " << maybePlainText.reason() << std::endl;
	return e.setDecryptedJson(
	cannotDecryptEvent(
	maybePlainText.reason(),
	"MOE.KAZV.MXC_DECRYPT_ERROR",
	json(nullptr)
	),
	Event::NotDecrypted);
	} else {
	try {
	auto plainJson = json::parse(maybePlainText.value());
	auto error = verifyEvent(m, e, plainJson);
	auto valid = !error.has_value();
	if (valid) {
	kzo.client.dbg() << "The decrypted event is valid." << std::endl;
	}
	return valid
	? e.setDecryptedJson(plainJson, Event::Decrypted)
	: e.setDecryptedJson(
	error.value(),
	Event::NotDecrypted);
	} catch (const std::exception &exception) {
	return e.setDecryptedJson(
	cannotDecryptEvent(
	exception.what(),
	"M_NOT_JSON",
	maybePlainText.value()
	),
	Event::NotDecrypted
	);
	}
	}
	}

	ClientModel tryDecryptEvents(ClientModel m)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring decryption request" << std::endl;
	return m;
	}

	kzo.client.dbg() << "Trying to decrypt events..." << std::endl;

	auto decryptFunc = [&](auto e) { return decryptEvent(m, e); };

	auto takeOutRoomKeyEvents =
	[&](auto e) {
	if (e.type() != "m.room_key") {
	// Leave it as it is
	return true;
	}

	// It is a room key event, but unencrypted.
	// Per matrix spec, we should not trust it as a E2EE key.
	// matrix spec also says we should make sure it's Olm-encrypted.
	// This is realized by verifying all MegOlm-encrypted events have
	// a room_id.
	if (!e.encrypted()) {
	kzo.client.warn() << "Received an unencrypted room key event. Ignoring." << std::endl;
	return false;
	}

	try {
	auto content = e.content();
	std::string roomId = content.get().at("room_id");
	std::string sessionId = content.get().at("session_id");
	kzo.client.dbg() << "Got a room key for room " << roomId
	<< ", session id: " << sessionId << std::endl;
	std::string sessionKey = content.get().at("session_key");

	auto k = KeyOfGroupSession{roomId, sessionId};

	std::string ed25519Key = e.decryptedJson().get().at("keys").at(ed25519);

	if (m.withCrypto([&](auto &c) { return c.createInboundGroupSession(k, sessionKey, ed25519Key); })) {
	return false; // such that this event is removed
	} else {
	kzo.client.warn() << "The session exists and cannot be merged. Someone is trying to do a session-replace attack." << std::endl;
	kzo.client.dbg() << "sender key is " << ed25519Key << std::endl;
	return true;
	}
	} catch (...) {
	kzo.client.dbg() << "cannot create group session";
	return false;
	}
	return true;
	};

	m.toDevice = intoImmer(
	EventList{},
	zug::map(decryptFunc)
	\| zug::filter(takeOutRoomKeyEvents),
	std::move(m.toDevice));

	auto decryptEventInRoom =
	[&](auto id, auto room) {
	if (! room.encrypted) {
	return;
	} else {
	auto messages = room.messages;
	auto undecryptedEvents = room.undecryptedEvents;
	for (auto [sessionId, eventIds] : undecryptedEvents) {
	if (m.constCrypto().hasInboundGroupSession({
	room.roomId,
	sessionId,
	})) {
	auto nextEventIds = intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([&](auto eventId) {
	auto event = room.messages[eventId];
	auto decrypted = decryptFunc(event);
	room.messages = std::move(room.messages)
	.set(eventId, decrypted);

	return !decrypted.decrypted();
	}),
	eventIds
	);
	if (nextEventIds.empty()) {
	room.undecryptedEvents = std::move(room.undecryptedEvents).erase(sessionId);
	} else {
	room.undecryptedEvents = std::move(room.undecryptedEvents).set(sessionId, nextEventIds);
	}
	}
	}

	m.roomList.rooms = std::move(m.roomList.rooms).set(id, room);
	}
	};

	auto rooms = m.roomList.rooms;
	for (auto [id, room]: rooms) {
	decryptEventInRoom(id, room);
	}

	return m;
	}

	std::optional<BaseJob> clientPerform(ClientModel m, QueryKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return std::nullopt;
	}

	immer::map<std::string, immer::array<std::string>> deviceKeys;
	auto encryptedUsers = m.deviceLists.outdatedUsers();

	if (encryptedUsers.empty()) {
	kzo.client.dbg() << "Keys are up-to-date." << std::endl;
	return std::nullopt;
	}

	kzo.client.dbg() << "We need to query keys for: " << std::endl;
	for (auto userId: encryptedUsers) {
	kzo.client.dbg() << userId << std::endl;
	deviceKeys = std::move(deviceKeys).set(userId, {});
	}
	kzo.client.dbg() << "^" << std::endl;

	auto job = m.job<QueryKeysJob>()
	.make(deviceKeys,
	std::nullopt, // timeout
	a.isInitialSync ? std::nullopt : m.syncToken
	)
	.withData(json::object({
	{"deviceKeys", deviceKeys},
	}));
	return job;
	}

	ClientResult updateClient(ClientModel m, QueryKeysAction a)
	{
	auto jobOpt = clientPerform(m, a);
	if (jobOpt) {
	m.addJob(jobOpt.value());
	}

	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, EnsureKeysFromDevicesAction a)
	{
	immer::map<std::string, immer::array<std::string>> deviceKeys;
	for (auto [userId, deviceIds] : a.userIdToDeviceIdsMap) {
	if (deviceIds.empty()) {
	deviceKeys = std::move(deviceKeys).set(userId, {});
	} else {
	auto devicesToFetch = intoImmer(
	immer::array<std::string>{},
	zug::filter([&m, userId](const auto &deviceId) {
	return !m.deviceLists.get(userId, deviceId).has_value();
	}),
	deviceIds
	);
	if (!devicesToFetch.empty()) {
	// Originally we want to ensure a subset of the devices
	// of some user, but we are still missing some
	deviceKeys = std::move(deviceKeys).set(userId, devicesToFetch);
	}
	// Otherwise, we already have all the keys we need.
	}
	}
	if (!deviceKeys.empty()) {
	auto job = m.job<QueryKeysJob>()
	.make(deviceKeys,
	std::nullopt, // timeout
	std::nullopt // sync token
	)
	.withData(json::object({
	{"deviceKeys", deviceKeys},
	}));
	m.addJob(job);
	}
	return { std::move(m), lager::noop };
	}

	ClientResult processResponse(ClientModel m, QueryKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), simpleFail };
	}

	if (! r.success()) {
	kzo.client.dbg() << "query keys failed: " << r.errorCode() << r.errorMessage() << std::endl;
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "Received a query key response" << std::endl;

	auto requested = r.dataJson("deviceKeys").template get<immer::map<std::string, immer::array<std::string>>>();
	auto wantedToFetchAllForUser = [&requested](const std::string &userId) {
	return requested.count(userId) && requested[userId].empty();
	};
	auto usersMap = r.deviceKeys();
	auto unsatisfied = json::object({
	{"users", zug::into(
	json::array(), zug::filter([usersMap](const auto &p) {
	return !usersMap.count(p.first);
	}),
	requested
	)},
	{"devices", zug::into(
	json::array(),
	zug::filter([usersMap](const auto &p) {
	return p.second.size() && usersMap.count(p.first);
	})
	\| zug::map([usersMap](const auto &p) {
	auto [userId, deviceIds] = p;
	auto deviceMap = usersMap[p.first];
	return zug::into(
	std::vector<json>(),
	zug::filter([deviceMap](const auto &deviceId) {
	return !deviceMap.count(deviceId);
	})
	\| zug::map([userId](const auto &deviceId) {
	return json::array({userId, deviceId});
	}),
	deviceIds
	);
	})
	\| zug::cat,
	requested
	)},
	});

	for (auto [userId, deviceMap] : usersMap) {
	for (auto [deviceId, deviceInfo] : deviceMap) {
	kzo.client.dbg() << "Key for " << userId
	<< "/" << deviceId
	<< ": " << json(deviceInfo).dump()
	<< std::endl;
	m.deviceLists.addDevice(userId, deviceId, deviceInfo);
	}
	if (wantedToFetchAllForUser(userId)) {
	+ // We requested all devices for this user, so any
	+ // device currently tracked but absent from the
	+ // response has been deleted by its owner. Mark it
	+ // as deleted rather than removing it, so we can still
	+ // verify past decrypted events from that device.
	+ auto existingDevices = m.deviceLists.devicesFor(userId);
	+ for (auto [deviceId, info] : existingDevices) {
	+ if (!deviceMap.count(deviceId)) {
	+ kzo.client.dbg() << "Marking deleted device " << userId
	+ << "/" << deviceId << std::endl;
	+ m.deviceLists.markDeviceAsDeleted(userId, deviceId);
	+ }
	+ }
	m.deviceLists.markUpToDate(userId);
	}
	}

	return { std::move(m), detail::ReturnEffectStatusT{
	EffectStatus{/* succ = */ true, json::object({
	{"unsatisfied", unsatisfied}
	})}
	} };
	}

	ClientResult updateClient(ClientModel m, ClaimKeysAction a)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), lager::noop };
	}

	kzo.client.dbg() << "claim keys for: " << json(a.devicesToSend).dump() << std::endl;

	auto keyMap = immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>>{};


	for (auto [userId, devices] : a.devicesToSend) {
	kzo.client.dbg() << "Iterating through user " << userId << std::endl;
	auto deviceToKey = immer::map<std::string, std::string>{};
	for (auto deviceId : devices) {
	kzo.client.dbg() << "Device: " << deviceId << std::endl;
	auto infoOpt = m.deviceLists.get(userId, deviceId);
	if (infoOpt) {
	kzo.client.dbg() << "Got device info, curve25519 key is: " << infoOpt.value().curve25519Key << std::endl;
	deviceToKey = std::move(deviceToKey)
	.set(deviceId, infoOpt.value().curve25519Key);
	} else {
	kzo.client.dbg() << "Did not get device info" << std::endl;
	}
	}
	keyMap = std::move(keyMap).set(userId, deviceToKey);
	}

	auto devicesToClaimKeys = m.withCrypto([&](auto &c) { return c.devicesMissingOutboundSessionKey(keyMap); });

	kzo.client.dbg() << "Really claim keys for: " << json(devicesToClaimKeys).dump() << std::endl;

	auto oneTimeKeys = immer::map<std::string, immer::map<std::string, std::string>>{};
	for (auto [userId, devices] : devicesToClaimKeys) {
	auto devKeys = immer::map<std::string, std::string>{};
	for (auto deviceId: devices) {
	devKeys = std::move(devKeys).set(deviceId, signedCurve25519);
	}
	oneTimeKeys = std::move(oneTimeKeys).set(userId, devKeys);
	}

	auto job = m.job<ClaimKeysJob>()
	.make(std::move(oneTimeKeys))
	.withData(json{
	{"roomId", a.roomId},
	{"sessionId", a.sessionId},
	{"sessionKey", a.sessionKey},
	{"devicesToSend", a.devicesToSend},
	{"random", a.random}
	});
	m.addJob(std::move(job));

	return { std::move(m), lager::noop };
	}

	ClientResult processResponse(ClientModel m, ClaimKeysResponse r)
	{
	if (! m.crypto) {
	kzo.client.dbg() << "We have no encryption enabled--ignoring this" << std::endl;
	return { std::move(m), simpleFail };
	}

	if (! r.success()) {
	kzo.client.dbg() << "claim keys failed" << std::endl;
	return { std::move(m), failWithResponse(r) };
	}

	kzo.client.dbg() << "claim keys successful" << std::endl;

	kzo.client.dbg() << "Json body: " << r.jsonBody().get().dump() << std::endl;

	auto roomId = r.dataStr("roomId");
	auto sessionKey = r.dataStr("sessionKey");
	auto sessionId = r.dataStr("sessionId");
	auto devicesToSend =
	immer::map<std::string, immer::flex_vector<std::string>>(r.dataJson("devicesToSend"));
	auto random = r.dataJson("random").template get<RandomData>();

	// create outbound sessions for those devices
	auto oneTimeKeys = r.oneTimeKeys();

	for (auto [userId, deviceMap] : oneTimeKeys) {
	for (auto [deviceId, keyVar] : deviceMap) {
	auto keys = keyVar.get();
	for (auto [keyId, key] : keys.items()) {
	auto deviceInfoOpt = m.deviceLists.get(userId, deviceId);
	if (deviceInfoOpt) {
	auto deviceInfo = deviceInfoOpt.value();
	kzo.client.dbg() << "Verifying key for " << userId
	<< "/" << deviceId
	<< key.dump()
	<< " with ed25519 key "
	<< deviceInfo.ed25519Key << std::endl;
	auto verified = m.withCrypto([&](auto &c) { return c.verify(key, userId, deviceId, deviceInfo.ed25519Key); });
	kzo.client.dbg() << (verified ? "passed" : "did not pass") << std::endl;
	if (verified && key.contains("key")) {
	auto theirOneTimeKey = key.at("key");
	kzo.client.dbg() << "creating outbound session for it" << std::endl;
	m.withCrypto([&](auto &c) { c.createOutboundSessionWithRandom(random, deviceInfo.curve25519Key, theirOneTimeKey); });
	random.erase(0, Crypto::createOutboundSessionRandomSize());
	kzo.client.dbg() << "done" << std::endl;
	}
	}
	}
	}
	}

	auto eventJson = json{
	{"content", {{"algorithm", megOlmAlgo},
	{"room_id", roomId},
	{"session_id", sessionId},
	{"session_key", sessionKey}}},
	{"type", "m.room_key"}
	};

	auto event = Event(JsonWrap(eventJson));

	return {
	std::move(m),
	[event](auto &&) { return EffectStatus{ /* success = */ true, json{{ "keyEvent", event.originalJson() }} }; }
	};
	}

	ClientResult updateClient(ClientModel m, EncryptMegOlmEventAction a)
	{
	auto [encryptedEvent, maybeKey] = m.megOlmEncrypt(a.e, a.roomId, a.timeMs, a.random);

	return {
	std::move(m),
	[=](auto && /* ctx */) {
	auto retJson = json::object({
	{"encrypted", encryptedEvent.originalJson()},
	});
	if (maybeKey.has_value()) {
	retJson["key"] = maybeKey.value();
	}
	return EffectStatus(/* succ = */ true, retJson);
	}
	};
	}

	ClientResult updateClient(ClientModel m, SetDeviceTrustLevelAction a)
	{
	auto maybeOldInfo = m.deviceLists.get(a.userId, a.deviceId);
	if (!maybeOldInfo) {
	return {
	std::move(m),
	[=](auto && /* ctx */) {
	auto retJson = json::object({
	{"error", "No such device"},
	{"errorCode", "MOE_KAZV_MXC_KAZV_NO_SUCH_DEVICE"},
	});

	return EffectStatus(/* succ = */ false, retJson);
	}
	};
	}

	m.deviceLists.deviceLists = updateIn(
	std::move(m.deviceLists.deviceLists),
	[a](auto device) {
	device.trustLevel = a.trustLevel;
	return device;
	},
	a.userId,
	a.deviceId
	);

	return { m, lager::noop };
	}

	ClientResult updateClient(ClientModel m, SetDevicesTrustLevelsAction a)
	{
	auto res = json::object({
	{"notFound", json::array()},
	});
	auto succ = true;
	for (const auto &[userId, devicesMap] : a.trustLevelMap) {
	for (const auto &[deviceId, trustLevel] : devicesMap) {
	kzo.client.dbg() << "SetDevicesTrustLevelsAction: user " << userId << ", device " << deviceId << ", trust level " << trustLevel << std::endl;
	auto maybeOldInfo = m.deviceLists.get(userId, deviceId);
	if (!maybeOldInfo) {
	res.at("notFound").push_back(json::array({userId, deviceId}));
	succ = false;
	continue;
	}
	m.deviceLists.deviceLists = updateIn(
	std::move(m.deviceLists.deviceLists),
	[trustLevel](auto device) {
	device.trustLevel = trustLevel;
	return device;
	},
	userId,
	deviceId
	);
	}
	}
	return {std::move(m), detail::ReturnEffectStatusT{{succ, res}}};
	}

	ClientResult updateClient(ClientModel m, SetTrustLevelNeededToSendKeysAction a)
	{
	m.trustLevelNeededToSendKeys = a.trustLevel;
	return { std::move(m), lager::noop };
	}

	ClientResult updateClient(ClientModel m, PrepareForSharingRoomKeyAction a)
	{
	auto messages = m.olmEncryptSplit(a.e, a.devices, a.random);

	auto txnId = getTxnId(Event(), m);

	m.roomList = RoomListModel::update(
	std::move(m.roomList),
	UpdateRoomAction{
	a.roomId,
	AddPendingRoomKeyAction{
	PendingRoomKeyEvent{txnId, messages}
	}
	}
	);

	return { std::move(m), [txnId](auto &&) {
	return EffectStatus(/* succ = */ true, json::object({{"txnId", txnId}}));
	} };
	}

	ClientResult updateClient(ClientModel m, ImportFromKeyBackupFileAction a)
	{
	auto maybeExportFile = decryptKeyExport(std::move(a.fileContent), std::move(a.password));
	if (!maybeExportFile) {
	return {std::move(m), Kazv::detail::ReturnEffectStatusT{{
	/* succ = */ false,
	json{
	{"errorCode", maybeExportFile.reason()},
	{"error", maybeExportFile.reason()},
	},
	}}};
	}

	std::size_t imported = 0;
	m.withCrypto([&maybeExportFile, &imported](Crypto &c) {
	imported = c.importInboundGroupSessions(std::move(maybeExportFile).value());
	});

	return {std::move(m), Kazv::detail::ReturnEffectStatusT{{
	/* succ = */ true,
	json{
	{"imported", imported},
	},
	}}};
	};

	ClientResult updateClient(ClientModel m, [[maybe_unused]] NotifyVerificationTrackerModelAction a)
	{
	m.addTrigger(VerificationTrackerModelChanged{});
	return {std::move(m), lager::noop};
	}
	}
	diff --git a/src/client/client-model.cpp b/src/client/client-model.cpp
	index bacb651..dbd3611 100644
	--- a/src/client/client-model.cpp
	+++ b/src/client/client-model.cpp
	@@ -1,538 +1,539 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2020-2023 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include <immer/algorithm.hpp>
	#include <lager/util.hpp>
	#include <lager/context.hpp>
	#include <functional>

	#include <zug/transducer/filter.hpp>

	#include <immer/flex_vector_transient.hpp>

	#include "debug.hpp"

	#include "immer-utils.hpp"
	#include "json-utils.hpp"

	#include "client-model.hpp"

	#include "actions/states.hpp"
	#include "actions/auth.hpp"
	#include "actions/membership.hpp"
	#include "actions/paginate.hpp"
	#include "actions/send.hpp"
	#include "actions/states.hpp"
	#include "actions/account-data.hpp"
	#include "actions/sync.hpp"
	#include "actions/ephemeral.hpp"
	#include "actions/content.hpp"
	#include "actions/encryption.hpp"
	#include "actions/profile.hpp"
	#include "actions/storage.hpp"

	namespace Kazv
	{
	auto ClientModel::update(ClientModel m, Action a) -> Result
	{
	auto oldClient = m;
	auto oldDeviceLists = m.deviceLists;

	auto actionIsStorage = std::holds_alternative<LoadEventsFromStorageAction>(a) \|\| std::holds_alternative<PurgeRoomTimelineAction>(a);

	auto [newClient, effect] = lager::match(std::move(a))(
	[&](RoomListAction a) -> Result {
	m.roomList = RoomListModel::update(std::move(m.roomList), a);
	return {std::move(m), lager::noop};
	},
	[&](ResubmitJobAction a) -> Result {
	m.addJob(std::move(a.job));
	return { std::move(m), lager::noop };
	},
	[&](auto a) -> decltype(updateClient(m, a)) {
	return updateClient(m, a);
	},
	#define RESPONSE_FOR(_jobId) \
	if (r.jobId() == #_jobId) { \
	return processResponse(m, _jobId##Response{std::move(r)}); \
	}

	[&](ProcessResponseAction a) -> Result {
	auto r = std::move(a.response);

	// auth
	RESPONSE_FOR(Login);
	RESPONSE_FOR(GetWellknown);
	RESPONSE_FOR(GetVersions);
	RESPONSE_FOR(Logout);
	// paginate
	RESPONSE_FOR(GetRoomEvents);
	// sync
	RESPONSE_FOR(Sync);
	RESPONSE_FOR(DefineFilter);
	// membership
	RESPONSE_FOR(CreateRoom);
	RESPONSE_FOR(InviteUser);
	RESPONSE_FOR(JoinRoomById);
	RESPONSE_FOR(JoinRoom);
	RESPONSE_FOR(LeaveRoom);
	RESPONSE_FOR(ForgetRoom);
	RESPONSE_FOR(Kick);
	RESPONSE_FOR(Ban);
	RESPONSE_FOR(Unban);
	// send
	RESPONSE_FOR(SendMessage);
	RESPONSE_FOR(SendToDevice);
	RESPONSE_FOR(RedactEvent);
	// states
	RESPONSE_FOR(GetRoomState);
	RESPONSE_FOR(SetRoomStateWithKey);
	RESPONSE_FOR(GetRoomStateWithKey);
	// account data
	RESPONSE_FOR(SetAccountData);
	RESPONSE_FOR(SetAccountDataPerRoom);
	// ephemeral
	RESPONSE_FOR(SetTyping);
	RESPONSE_FOR(PostReceipt);
	RESPONSE_FOR(SetReadMarker);
	// content
	RESPONSE_FOR(UploadContent);
	RESPONSE_FOR(GetContent);
	RESPONSE_FOR(GetContentThumbnail);
	// encryption
	RESPONSE_FOR(UploadKeys);
	RESPONSE_FOR(QueryKeys);
	RESPONSE_FOR(ClaimKeys);
	// profile
	RESPONSE_FOR(GetUserProfile);
	RESPONSE_FOR(SetAvatarUrl);
	RESPONSE_FOR(SetDisplayName);

	m.addTrigger(UnrecognizedResponse{std::move(r)});
	return { std::move(m), lager::noop };
	}

	#undef RESPONSE_FOR
	);

	newClient.maybeRotateSessions(oldClient);

	// if it is an storage action, do not add it back because the things
	// should be the same as the ones in storage
	if (!actionIsStorage) {
	newClient.maybeAddSaveEventsTrigger(oldClient);
	}

	return { std::move(newClient), std::move(effect) };
	}

	std::pair<Event, std::optional<std::string>> ClientModel::megOlmEncrypt(
	Event e, std::string roomId, Timestamp timeMs, RandomData random)
	{
	if (!crypto) {
	kzo.client.dbg() << "We do not have e2ee, so do not encrypt events" << std::endl;
	return { e, std::nullopt };
	}

	if (e.encrypted()) {
	kzo.client.dbg() << "The event is already encrypted. Ignoring it." << std::endl;
	return { e, std::nullopt };
	}

	auto j = e.originalJson().get();
	auto r = roomList[roomId];

	if (! r.encrypted) {
	kzo.client.dbg() << "The room " << roomId
	<< " is not encrypted, so do not encrypt events" << std::endl;
	return { e, std::nullopt };
	}

	auto desc = r.sessionRotateDesc();

	auto keyOpt = std::optional<std::string>{};
	if (r.shouldRotateSessionKey) {
	kzo.client.dbg() << "We should rotate this session." << std::endl;
	keyOpt = withCrypto([&](auto &c) { return c.rotateMegOlmSessionWithRandom(random, timeMs, roomId); });
	} else {
	keyOpt = withCrypto([&](auto &c) { return c.rotateMegOlmSessionWithRandomIfNeeded(random, timeMs, roomId, desc); });
	}

	// we no longer need to rotate session
	// until next time a device change happens
	roomList.rooms = std::move(roomList.rooms)
	.update(roomId, [](auto r) { r.shouldRotateSessionKey = false; return r; });

	auto relation = hasAtThat(j["content"], "m.relates_to", &json::is_object) ? j["content"]["m.relates_to"] : json(nullptr);
	// so that Crypto::encryptMegOlm() can find room id
	j["room_id"] = roomId;
	auto content = withCrypto([&](auto &c) { return c.encryptMegOlm(j); });
	j["type"] = "m.room.encrypted";
	j["content"] = std::move(content);
	j["content"]["device_id"] = deviceId;
	// add relationship to plaintext
	if (relation.is_object()) {
	j["content"]["m.relates_to"] = relation;
	}

	return { Event(JsonWrap(j)), keyOpt };
	}

	immer::map<std::string, immer::map<std::string, Event>> ClientModel::olmEncryptSplit(
	Event e,
	immer::map<std::string, immer::flex_vector<std::string>> userIdToDeviceIdMap,
	RandomData random,
	bool attachSenderDeviceKeys
	)
	{
	using ResT = immer::map<std::string, immer::map<std::string, Event>>;
	if (!crypto) {
	kzo.client.dbg() << "We do not have e2ee, so do not encrypt events" << std::endl;
	return ResT{};
	}

	if (e.encrypted()) {
	kzo.client.dbg() << "The event is already encrypted. Ignoring it." << std::endl;
	return ResT{};
	}

	auto origJson = e.originalJson().get();

	auto encJson = json::object();
	encJson["content"] = json{
	{"algorithm", CryptoConstants::olmAlgo},
	{"ciphertext", json::object()},
	{"sender_key", constCrypto().curve25519IdentityKey()},
	};

	encJson["type"] = "m.room.encrypted";

	if (attachSenderDeviceKeys) {
	auto senderDeviceKeys = makeSelfDeviceKeys();
	origJson["sender_device_keys"] = senderDeviceKeys;
	}

	ResT messages;

	for (auto [userId, devices] : userIdToDeviceIdMap) {
	messages = std::move(messages).set(userId, immer::map<std::string, Event>());
	for (auto dev : devices) {
	auto devInfoOpt = deviceLists.get(userId, dev);
	if (! devInfoOpt) {
	kzo.client.warn() << "no device info for " << userId << " / " << dev << std::endl;
	continue;
	}
	auto devInfo = devInfoOpt.value();
	auto jsonForThisDevice = origJson;
	jsonForThisDevice["sender"] = this->userId;
	jsonForThisDevice["recipient"] = userId;
	jsonForThisDevice["recipient_keys"] = json{
	{CryptoConstants::ed25519, devInfo.ed25519Key}
	};
	jsonForThisDevice["keys"] = json{
	{CryptoConstants::ed25519, constCrypto().ed25519IdentityKey()}
	};
	auto thisEventJson = encJson;
	thisEventJson["content"]["ciphertext"]
	.merge_patch(withCrypto([&](auto &c) { return c.encryptOlmWithRandom(random, jsonForThisDevice, devInfo.curve25519Key); }));
	random.erase(0, Crypto::encryptOlmMaxRandomSize());
	messages = setIn(std::move(messages), Event(thisEventJson), userId, dev);
	}
	}

	return messages;
	}

	DeviceKeys ClientModel::makeSelfDeviceKeys()
	{
	using namespace CryptoConstants;

	auto keys =
	immer::map<std::string, std::string>{}
	.set(ed25519 + ":" + deviceId, constCrypto().ed25519IdentityKey())
	.set(curve25519 + ":" + deviceId, constCrypto().curve25519IdentityKey());

	DeviceKeys k {
	userId,
	deviceId,
	{olmAlgo, megOlmAlgo},
	keys,
	{} // signatures to be added soon
	};

	auto j = json(k);

	auto sig = withCrypto([&](auto &crypto) { return crypto.sign(j); });

	k.signatures = convertSignature(sig);

	return k;
	}

	json ClientModel::convertSignature(std::string signature) const
	{
	auto j = json::object();
	j[userId] = json::object();
	j[userId][CryptoConstants::ed25519 + ":" + deviceId] = signature;

	return j;
	};

	immer::flex_vector<std::string /* deviceId */> ClientModel::devicesToSendKeys(std::string userId) const
	{
	auto trustLevelNeeded = this->trustLevelNeededToSendKeys;

	// XXX: preliminary approach
	auto shouldSendP = [=](auto deviceInfo, auto /* deviceMap */) {
	- return deviceInfo.trustLevel >= trustLevelNeeded;
	+ return deviceInfo.trustLevel >= trustLevelNeeded
	+ && !deviceInfo.deleted;
	};


	auto devices = deviceLists.devicesFor(userId);

	return intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([=](auto n) {
	auto [id, dev] = n;
	return shouldSendP(dev, devices);
	})
	\| zug::map([=](auto n) {
	return n.first;
	}),
	devices);
	}

	std::size_t ClientModel::numOneTimeKeysNeeded() const
	{
	const auto &crypto = constCrypto();

	// Keep half of max supported number of keys
	int numUploadedKeys = crypto.uploadedOneTimeKeysCount(CryptoConstants::signedCurve25519);
	int numKeysNeeded = crypto.maxNumberOfOneTimeKeys() / 2
	- numUploadedKeys;

	// Subtract the number of existing one-time keys, in case
	// the previous upload was not successful.
	int numKeysToGenerate = numKeysNeeded - crypto.numUnpublishedOneTimeKeys();
	if (numKeysToGenerate < 0) {
	numKeysToGenerate = 0;
	}

	return numKeysToGenerate;
	}

	std::size_t EncryptMegOlmEventAction::maxRandomSize()
	{
	return Crypto::rotateMegOlmSessionRandomSize();
	}

	std::size_t EncryptMegOlmEventAction::minRandomSize()
	{
	return 0;
	}

	std::size_t PrepareForSharingRoomKeyAction::randomSize(PrepareForSharingRoomKeyAction::UserIdToDeviceIdMap devices)
	{
	auto singleRandomSize = Crypto::encryptOlmMaxRandomSize();
	auto deviceNum = accumulate(devices, std::size_t{},
	[](auto counter, auto pair) { return counter + pair.second.size(); });
	return deviceNum * singleRandomSize;
	}

	std::size_t GenerateAndUploadOneTimeKeysAction::randomSize(std::size_t numToGen)
	{
	return Crypto::genOneTimeKeysRandomSize(numToGen);
	}

	std::size_t ClaimKeysAction::randomSize(immer::map<std::string, immer::flex_vector<std::string>> devicesToSend)
	{
	auto singleRandomSize = Crypto::createOutboundSessionRandomSize();
	auto deviceNum = accumulate(devicesToSend, std::size_t{},
	[](auto counter, auto pair) { return counter + pair.second.size(); });
	return deviceNum * singleRandomSize;
	}

	void ClientModel::maybeRotateSessions(ClientModel oldClient)
	{
	auto roomIds = intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([](const auto &pair) {
	return pair.second.encrypted && !pair.second.shouldRotateSessionKey;
	})
	\| zug::map([](const auto &pair) { return pair.first; }),
	roomList.rooms
	);

	auto markRotate = [this](const auto &roomId) {
	roomList.rooms =
	std::move(roomList.rooms)
	.update(roomId, [](auto room) {
	room.shouldRotateSessionKey = true;
	return room;
	});
	};

	// Rotate megolm keys for rooms whose users' device list has changed
	auto changedUsers = deviceLists.diff(oldClient.deviceLists);
	if (! changedUsers.empty()) {
	for (auto roomId : roomIds) {
	auto it = std::find_if(changedUsers.begin(), changedUsers.end(),
	[=, this](auto userId) { return roomList.rooms[roomId].hasUser(userId); });
	if (it != changedUsers.end()) {
	kzo.client.dbg() << "rotate keys for room " << roomId << std::endl;
	markRotate(roomId);
	}
	}
	}

	roomIds = intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([](const auto &pair) {
	return pair.second.encrypted && !pair.second.shouldRotateSessionKey;
	})
	\| zug::map([](const auto &pair) { return pair.first; }),
	roomList.rooms
	);

	for (auto roomId : roomIds) {
	auto userIds = roomList.rooms[roomId].joinedMemberIds();
	auto devicesNotChanged = [oldClient, this](const auto &userId) {
	return oldClient.devicesToSendKeys(userId) == devicesToSendKeys(userId);
	};
	// if any user has the device changes
	if (!immer::all_of(userIds, devicesNotChanged)) {
	kzo.client.dbg() << "rotate keys for room " << roomId << std::endl;
	markRotate(roomId);
	}
	}
	}

	auto ClientModel::directRoomMap() const -> immer::map<std::string, std::string>
	{
	auto directs = accountData["m.direct"].content().get();
	auto directItems = directs.items();

	return std::accumulate(directItems.begin(), directItems.end(), immer::map<std::string, std::string>(),
	[](auto acc, const auto &cur) {
	auto [userId, roomIds] = cur;

	if (!roomIds.is_array()) {
	return acc;
	}

	for (auto roomId : roomIds) {
	if (roomId.is_string()) {
	acc = std::move(acc).set(roomId.template get<std::string>(), userId);
	}
	}
	return acc;
	}
	);
	}

	auto ClientModel::roomIdsUnderTag(std::string tagId) const -> immer::map<std::string, double>
	{
	return std::accumulate(
	roomList.rooms.begin(), roomList.rooms.end(),
	immer::map<std::string, double>{},
	[tagId](auto acc, auto cur) {
	auto [roomId, room] = cur;
	auto tags = room.tags();
	if (tags.count(tagId)) {
	acc = std::move(acc).set(roomId, tags[tagId]);
	}
	return acc;
	}
	);
	}

	auto ClientModel::roomIdsByTagId() const -> immer::map<std::string, immer::map<std::string, double>>
	{
	return std::accumulate(
	roomList.rooms.begin(), roomList.rooms.end(),
	immer::map<std::string, immer::map<std::string, double>>{},
	[](auto acc, auto cur) {
	auto [roomId, room] = cur;
	auto tags = room.tags();
	if (tags.empty()) {
	acc = setIn(std::move(acc), ROOM_TAG_DEFAULT_ORDER, "", roomId);
	} else {
	for (const auto &[tagId, order] : tags) {
	acc = setIn(std::move(acc), order, tagId, roomId);
	}
	}
	return acc;
	}
	);
	}

	const Crypto &ClientModel::constCrypto() const
	{
	return crypto.value().get();
	}

	void ClientModel::maybeAddSaveEventsTrigger(const ClientModel &old)
	{
	SaveEventsRequested trigger;
	using ELT = immer::flex_vector_transient<Event>;
	auto addToTrigger = [&trigger](const std::string &roomId, ELT tl, ELT nonTl) {
	if (!tl.empty()) {
	trigger.timelineEvents = std::move(trigger.timelineEvents).set(roomId, std::move(tl).persistent());
	}
	if (!nonTl.empty()) {
	trigger.nonTimelineEvents = std::move(trigger.nonTimelineEvents).set(roomId, std::move(nonTl).persistent());
	}
	};
	immer::diff(old.roomList.rooms, roomList.rooms, immer::make_differ(
	/* addedFn = */ [&addToTrigger](const auto &p) {
	const auto &[roomId, room] = p;

	ELT tl;
	ELT nonTl;
	for (const auto &[id, e] : room.messages) {
	if (room.isInTimeline(id)) {
	tl.push_back(e);
	} else {
	nonTl.push_back(e);
	}
	}

	addToTrigger(roomId, std::move(tl), std::move(nonTl));
	},
	/* removedFn = */ [](auto &&) {},
	/* changedFn = */ [&addToTrigger](const auto &p1, const auto &p2) {
	const auto &roomId = p2.first;
	const auto &newRoom = p2.second;
	const auto &oldRoom = p1.second;

	ELT tl;
	ELT nonTl;
	auto addEvent = [&tl, &nonTl, &newRoom](const auto &newPair) {
	const auto &[eventId, event] = newPair;
	if (newRoom.isInTimeline(eventId)) {
	tl.push_back(event);
	} else {
	nonTl.push_back(event);
	}
	};
	immer::diff(oldRoom.messages, newRoom.messages, immer::make_differ(
	/* addedFn = */ addEvent,
	/* removedFn = */ [](auto &&) {},
	/* changedFn = */ [&addEvent](auto &&, auto &&newPair) {
	addEvent(std::forward<decltype(newPair)>(newPair));
	}
	));

	addToTrigger(roomId, std::move(tl), std::move(nonTl));
	}
	));
	if (!trigger.timelineEvents.empty() \|\| !trigger.nonTimelineEvents.empty()) {
	nextTriggers = std::move(nextTriggers).push_back(trigger);
	}
	}
	}
	diff --git a/src/client/device-list-tracker.cpp b/src/client/device-list-tracker.cpp
	index eff7d6f..9b25f70 100644
	--- a/src/client/device-list-tracker.cpp
	+++ b/src/client/device-list-tracker.cpp
	@@ -1,261 +1,273 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2021 Tusooa Zhu <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>

	#include "device-list-tracker.hpp"

	#include <algorithm>

	#include <immer/flex_vector_transient.hpp>

	#include <zug/transducer/filter.hpp>
	#include <zug/sequence.hpp>
	#include <zug/transducer/distinct.hpp>
	#include <zug/transducer/chain.hpp>

	#include <debug.hpp>

	namespace Kazv
	{
	static bool cryptographicallyEqual(DeviceKeyInfo a, DeviceKeyInfo b)
	{
	a.displayName = std::nullopt;
	b.displayName = std::nullopt;
	a.trustLevel = Unseen;
	b.trustLevel = Unseen;
	+ a.deleted = false;
	+ b.deleted = false;
	return std::move(a) == std::move(b);
	}

	static bool cryptographicallyEqual(const DeviceListTracker::DeviceMapT &a, const DeviceListTracker::DeviceMapT &b)
	{
	auto changed = false;
	auto markChanged = [&changed](const auto &) { changed = true; };
	immer::diff(a, b, immer::make_differ(
	/* added = */ markChanged,
	/* removed = */ markChanged,
	/* changed = */ [&changed](const auto &x, const auto &y) {
	if (!cryptographicallyEqual(x.second, y.second)) {
	changed = true;
	}
	}
	));
	return !changed;
	}

	immer::flex_vector<std::string> DeviceListTracker::outdatedUsers() const
	{
	return intoImmer(
	immer::flex_vector<std::string>{},
	zug::filter([](auto n) {
	auto [userId, outdated] = n;
	return outdated;
	})
	\| zug::map([](auto n) {
	auto [userId, outdated] = n;
	return userId;
	}),
	usersToTrackDeviceLists);
	}

	std::optional<DeviceKeyInfo> DeviceListTracker::verifyDeviceInfo(std::string userId, std::string deviceId, Api::QueryKeysJob::DeviceInformation deviceInfo) const
	{
	using namespace CryptoConstants;
	if (userId != deviceInfo.userId
	\|\| deviceId != deviceInfo.deviceId) {
	return std::nullopt;
	}

	DeviceTrustLevel trustLevel{Unseen};
	std::optional<std::string> displayName;

	auto curEd25519Key = deviceInfo.keys[ed25519 + ":" + deviceId];
	if (deviceLists[userId].find(deviceId)) {
	// if the ed25519 key changed, reject
	if (curEd25519Key != deviceLists[userId][deviceId].ed25519Key) {
	return std::nullopt;
	}
	// keep device trust level and display name when adding device
	trustLevel = deviceLists[userId][deviceId].trustLevel;
	displayName = deviceLists[userId][deviceId].displayName;
	}

	// reject if there is another device with the same keys
	if (auto d = findByCurve25519Key(userId, deviceInfo.keys[curve25519 + ":" + deviceId]);
	d.has_value()
	&& d.value().deviceId != deviceId) {
	return std::nullopt;
	}

	kzo.client.dbg() << "verifying device info" << std::endl;

	if (Crypto::verify(deviceInfo, userId, deviceId, curEd25519Key)) {
	kzo.client.dbg() << "passed verification" << std::endl;
	auto info = DeviceKeyInfo{
	deviceId,
	deviceInfo.keys[ed25519 + ":" + deviceId],
	deviceInfo.keys[curve25519 + ":" + deviceId],
	deviceInfo.unsignedData ? deviceInfo.unsignedData.value().deviceDisplayName : displayName,
	trustLevel,
	};
	return info;
	} else {
	kzo.client.dbg() << "did not pass verification" << std::endl;
	return std::nullopt;
	}
	}

	bool DeviceListTracker::addDevice(std::string userId, std::string deviceId, Api::QueryKeysJob::DeviceInformation deviceInfo)
	{
	using namespace CryptoConstants;
	auto res = verifyDeviceInfo(userId, deviceId, deviceInfo);
	if (!res.has_value()) {
	return false;
	}

	auto info = res.value();
	addVerifiedDeviceKeyInfo(userId, deviceId, info);

	return true;
	}

	void DeviceListTracker::addVerifiedDeviceKeyInfo(std::string userId, std::string deviceId, DeviceKeyInfo info)
	{
	deviceLists = std::move(deviceLists)
	.update(userId, [=](auto deviceMap) {
	return std::move(deviceMap).set(deviceId, info);
	});
	}

	+ void DeviceListTracker::markDeviceAsDeleted(std::string userId, std::string deviceId)
	+ {
	+ deviceLists = std::move(deviceLists)
	+ .update(userId, [=](auto deviceMap) {
	+ auto info = deviceMap[deviceId];
	+ info.deleted = true;
	+ return std::move(deviceMap).set(deviceId, info);
	+ });
	+ }
	+
	void DeviceListTracker::markUpToDate(std::string userId)
	{
	usersToTrackDeviceLists = std::move(usersToTrackDeviceLists).set(userId, false);
	}

	std::optional<DeviceKeyInfo> DeviceListTracker::get(std::string userId, std::string deviceId) const
	{
	try {
	return deviceLists.at(userId).at(deviceId);
	} catch (const std::exception &) {
	return std::nullopt;
	}
	}

	std::optional<DeviceKeyInfo> DeviceListTracker::findByEd25519Key(
	std::string userId, std::string ed25519Key) const
	{
	auto devices = deviceLists.at(userId);

	auto it = std::find_if(devices.begin(), devices.end(),
	[=](auto n) {
	auto [deviceId, info] = n;
	return info.ed25519Key == ed25519Key;
	});
	if (it != devices.end()) {
	return it->second;
	} else {
	return std::nullopt;
	}
	}

	std::optional<DeviceKeyInfo> DeviceListTracker::findByCurve25519Key(
	std::string userId, std::string curve25519Key) const
	{
	if (!deviceLists.count(userId)) {
	return std::nullopt;
	}
	auto devices = deviceLists.at(userId);

	auto it = std::find_if(devices.begin(), devices.end(),
	[=](auto n) {
	auto [deviceId, info] = n;
	return info.curve25519Key == curve25519Key;
	});
	if (it != devices.end()) {
	return it->second;
	} else {
	return std::nullopt;
	}
	}

	auto DeviceListTracker::findByOlmEvent(Event e) const
	-> std::pair<FindByOlmEventStatus, DeviceKeyInfo>
	{
	if (!(e.encrypted() && e.decrypted())) {
	return {NotFound, {}};
	}

	auto senderCurve25519Key =
	e.originalJson().get().contains("/content/sender_key"_json_pointer)
	&& e.originalJson().get().at("/content/sender_key"_json_pointer).is_string()
	? e.originalJson().get().at("/content/sender_key"_json_pointer).template get<std::string>()
	: std::string();
	if (senderCurve25519Key.empty()) {
	return {NotFound, {}};
	}
	// Perform checks described in
	// https://spec.matrix.org/v1.18/client-server-api/#validation-of-incoming-decrypted-events
	// (5) Where sender_device_keys is present in the decrypted content:
	if (e.raw().get().contains("sender_device_keys")) {
	auto deviceKeys = e.raw().get().at("sender_device_keys").template get<Api::QueryKeysJob::DeviceInformation>();
	// The following statement checks:
	// (1) sender_device_keys.user_id must also match the sender of the event.
	// (2) [CORRECTED: sender_device_keys.keys.curve25519:<device_id>] must also match the sender_key property in the cleartext m.room.encrypted event body.
	// (3) ed25519 keys not checked (the check is performed in client/actions/encryption.cpp )
	// (4) The sender_device_keys structure must have a valid signature from the key with ID ed25519:<device_id> (i.e., the sending device's Ed25519 key).
	auto verifiedInfo = verifyDeviceInfo(e.sender(), deviceKeys.deviceId, deviceKeys);
	if (verifiedInfo.has_value()) {
	auto existingDeviceOpt = get(e.sender(), deviceKeys.deviceId);
	if (existingDeviceOpt.has_value()) {
	return {InTracker, existingDeviceOpt.value()};
	} else {
	return {InEvent, verifiedInfo.value()};
	}
	} else {
	kzo.client.dbg() << "sender_device_keys present but invalid, rejecting" << std::endl;
	return {NotFound, {}};
	}
	} else {

	auto existingDeviceOpt = findByCurve25519Key(e.sender(), senderCurve25519Key);
	if (existingDeviceOpt.has_value()) {
	return {InTracker, existingDeviceOpt.value()};
	} else {
	return {NotFound, {}};
	}
	}
	}

	immer::flex_vector<std::string> DeviceListTracker::diff(DeviceListTracker that) const
	{
	auto changedUsers = immer::flex_vector_transient<std::string>{};

	immer::diff(
	that.deviceLists, deviceLists,
	immer::make_differ(
	/* addedFn = */ [&changedUsers](const auto &pair) {
	changedUsers.push_back(pair.first);
	},
	/* removedFn = */ [&changedUsers](const auto &pair) {
	changedUsers.push_back(pair.first);
	},
	/* changedFn = */ [&changedUsers](const auto &pairA, const auto &pairB) {
	// add to changed user list only if device id or trust level changes
	if (!cryptographicallyEqual(pairA.second, pairB.second)) {
	changedUsers.push_back(pairA.first);
	}
	}
	)
	);

	return changedUsers.persistent();
	}

	auto DeviceListTracker::devicesFor(std::string userId) const -> DeviceMapT
	{
	return deviceLists[userId];
	}
	}
	diff --git a/src/client/device-list-tracker.hpp b/src/client/device-list-tracker.hpp
	index 0699ec3..f28d980 100644
	--- a/src/client/device-list-tracker.hpp
	+++ b/src/client/device-list-tracker.hpp
	@@ -1,122 +1,137 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2021 Tusooa Zhu <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#pragma once
	#include <libkazv-config.hpp>
	#include <string>

	#include <immer/map.hpp>
	#include <immer/flex_vector.hpp>

	#include <boost/serialization/string.hpp>
	#include <serialization/std-optional.hpp>

	#include <serialization/immer-map.hpp>

	#include <crypto.hpp>
	#include <csapi/keys.hpp>

	#include "cursorutil.hpp"

	namespace Kazv
	{
	enum DeviceTrustLevel
	{
	Blocked,
	Unseen,
	Seen,
	Verified,
	};

	struct DeviceKeyInfo
	{
	std::string deviceId;
	std::string ed25519Key;
	std::string curve25519Key;
	std::optional<std::string> displayName;
	DeviceTrustLevel trustLevel{Unseen};
	+ /// Whether this device has been deleted by its owner.
	+ /// Deleted devices are kept in the tracker for verifying
	+ /// past decrypted events, but are excluded from
	+ /// devicesToSendKeys().
	+ bool deleted{false};
	friend bool operator==(const DeviceKeyInfo &a, const DeviceKeyInfo &b) = default;
	friend bool operator!=(const DeviceKeyInfo &a, const DeviceKeyInfo &b) = default;
	};

	template<class Archive>
	- void serialize(Archive &ar, DeviceKeyInfo &i, std::uint32_t const /version/)
	+ void serialize(Archive &ar, DeviceKeyInfo &i, std::uint32_t const version)
	{
	ar
	& i.deviceId
	& i.ed25519Key
	& i.curve25519Key
	& i.displayName
	& i.trustLevel
	;
	+ if (version >= 1) {
	+ ar & i.deleted;
	+ } else {
	+ i.deleted = false;
	+ }
	}

	struct DeviceListTracker
	{
	using DeviceMapT = immer::map<std::string /* deviceId */, DeviceKeyInfo>;
	immer::map<std::string /* userId /, bool / outdated */> usersToTrackDeviceLists;
	immer::map<std::string /* userId */, DeviceMapT> deviceLists;

	template<class RangeT>
	void track(RangeT &&userIds) {
	for (auto userId : std::forward<RangeT>(userIds)) {
	usersToTrackDeviceLists = std::move(usersToTrackDeviceLists)
	.set(userId, true);
	}
	}

	template<class RangeT>
	void untrack(RangeT &&userIds) {
	for (auto userId : std::forward<RangeT>(userIds)) {
	usersToTrackDeviceLists = std::move(usersToTrackDeviceLists).erase(userId);
	}
	}

	immer::flex_vector<std::string> outdatedUsers() const;

	std::optional<DeviceKeyInfo> verifyDeviceInfo(std::string userId, std::string deviceId, Api::QueryKeysJob::DeviceInformation deviceInfo) const;

	bool addDevice(std::string userId, std::string deviceId, Api::QueryKeysJob::DeviceInformation deviceInfo);

	void addVerifiedDeviceKeyInfo(std::string userId, std::string deviceId, DeviceKeyInfo info);

	+ /// Mark a device as deleted by its owner. The device is kept
	+ /// in the tracker (for verifying past decrypted events) but
	+ /// will be excluded from devicesToSendKeys().
	+ void markDeviceAsDeleted(std::string userId, std::string deviceId);
	+
	void markUpToDate(std::string userId);

	DeviceMapT devicesFor(std::string userId) const;

	std::optional<DeviceKeyInfo> get(std::string userId, std::string deviceId) const;

	std::optional<DeviceKeyInfo> findByEd25519Key(std::string userId, std::string ed25519Key) const;
	std::optional<DeviceKeyInfo> findByCurve25519Key(std::string userId, std::string curve25519Key) const;

	enum FindByOlmEventStatus
	{
	/// The sending device info cannot be found.
	NotFound,
	/// The sending device info is already in tracker.
	InTracker,
	/// The sending device info is not in tracker, but it is in the event
	/// and ready to be added to the tracker.
	InEvent,
	};
	std::pair<FindByOlmEventStatus, DeviceKeyInfo> findByOlmEvent(Event e) const;

	/// returns a list of users whose device list has changed
	immer::flex_vector<std::string> diff(DeviceListTracker that) const;
	};

	template<class Archive>
	void serialize(Archive &ar, DeviceListTracker &t, std::uint32_t const /version/)
	{
	ar
	& t.usersToTrackDeviceLists
	& t.deviceLists
	;
	}
	}

	-BOOST_CLASS_VERSION(Kazv::DeviceKeyInfo, 0)
	+BOOST_CLASS_VERSION(Kazv::DeviceKeyInfo, 1)
	BOOST_CLASS_VERSION(Kazv::DeviceListTracker, 0)
	diff --git a/src/tests/client/device-list-tracker-test.cpp b/src/tests/client/device-list-tracker-test.cpp
	index 7618847..b534ce4 100644
	--- a/src/tests/client/device-list-tracker-test.cpp
	+++ b/src/tests/client/device-list-tracker-test.cpp
	@@ -1,96 +1,328 @@
	/*
	* This file is part of libkazv.
	* SPDX-FileCopyrightText: 2024 tusooa <tusooa@kazv.moe>
	* SPDX-License-Identifier: AGPL-3.0-or-later
	*/

	#include <libkazv-config.hpp>
	#include "encryption-test-utils.hpp"
	#include <catch2/catch_test_macros.hpp>
	#include <client-model.hpp>
	#include <actions/encryption.hpp>
	#include <factory.hpp>
	#include <debug.hpp>

	using namespace Kazv;
	using namespace Kazv::Factory;

	+TEST_CASE("DeviceListTracker marks devices as deleted but keeps them", "[client][device-list-tracker]")
	+{
	+ DeviceListTracker tracker;
	+ auto info1 = makeDeviceKeyInfo(withDeviceId("device1") \| withDeviceTrustLevel(Verified));
	+ auto info2 = makeDeviceKeyInfo(withDeviceId("device2") \| withDeviceTrustLevel(Verified));
	+ auto userId = "@user:example.com";
	+
	+ tracker.addVerifiedDeviceKeyInfo(userId, "device1", info1);
	+ tracker.addVerifiedDeviceKeyInfo(userId, "device2", info2);
	+
	+ REQUIRE(tracker.devicesFor(userId).size() == 2);
	+
	+ // Mark device2 as deleted
	+ tracker.markDeviceAsDeleted(userId, "device2");
	+
	+ // The device is still in the tracker (for verifying past events)
	+ REQUIRE(tracker.devicesFor(userId).size() == 2);
	+ REQUIRE(tracker.get(userId, "device2").has_value());
	+
	+ // But it is marked as deleted
	+ REQUIRE(tracker.get(userId, "device2").value().deleted);
	+ REQUIRE(!tracker.get(userId, "device1").value().deleted);
	+
	+ // findByCurve25519Key still finds the deleted device
	+ REQUIRE(tracker.findByCurve25519Key(userId, info2.curve25519Key).has_value());
	+ REQUIRE(tracker.findByCurve25519Key(userId, info2.curve25519Key).value().deleted);
	+}
	+
	+TEST_CASE("devicesToSendKeys excludes deleted devices", "[client][device-list-tracker]")
	+{
	+ auto info1 = makeDeviceKeyInfo(withDeviceId("device1") \| withDeviceTrustLevel(Verified));
	+ auto info2 = makeDeviceKeyInfo(withDeviceId("device2") \| withDeviceTrustLevel(Verified));
	+ auto userId = "@user:example.com";
	+
	+ auto client = makeClient(
	+ withDevice(userId, info1)
	+ \| withDevice(userId, info2)
	+ );
	+ client.trustLevelNeededToSendKeys = Verified;
	+
	+ REQUIRE(client.deviceLists.devicesFor(userId).size() == 2);
	+ REQUIRE(client.devicesToSendKeys(userId).size() == 2);
	+
	+ // Mark device2 as deleted
	+ client.deviceLists.markDeviceAsDeleted(userId, "device2");
	+
	+ // devicesToSendKeys should now exclude the deleted device
	+ auto devices = client.devicesToSendKeys(userId);
	+ REQUIRE(devices.size() == 1);
	+ REQUIRE(devices[0] == "device1");
	+}
	+
	+static json makeSignedDeviceInfo(const ClientModel &client)
	+{
	+ auto [next, _] = updateClient(client, UploadIdentityKeysAction{});
	+ return json::parse(std::get<Bytes>(next.nextJobs[0].requestBody()))["device_keys"];
	+}
	+
	+TEST_CASE("processResponse(QueryKeysResponse) marks deleted devices on full query", "[client][device-list-tracker]")
	+{
	+ // Set up two device identity cryptos for the same user
	+ auto device1Crypto = makeCrypto();
	+ auto device1Client = makeClient(withCrypto(device1Crypto));
	+ device1Client.userId = "@alice:example.com";
	+ device1Client.deviceId = "device1";
	+
	+ auto device2Crypto = makeCrypto();
	+ auto device2Client = makeClient(withCrypto(device2Crypto));
	+ device2Client.userId = "@alice:example.com";
	+ device2Client.deviceId = "device2";
	+
	+ // Build a full key query response that contains BOTH devices
	+ auto bothDevicesRespJson = json{
	+ {"device_keys", {{"@alice:example.com", {
	+ {"device1", makeSignedDeviceInfo(device1Client)},
	+ {"device2", makeSignedDeviceInfo(device2Client)},
	+ }}}},
	+ };
	+
	+ // Our client tracking Alice's devices
	+ auto client = makeClient(withCrypto(makeCrypto()));
	+ client.userId = "@bob:example.com";
	+ client.deviceId = "bobdevice";
	+
	+ // Process the response with both devices
	+ std::tie(client, std::ignore) = processResponse(client, QueryKeysResponse(
	+ makeResponse("QueryKeys",
	+ withResponseJsonBody(bothDevicesRespJson)
	+ \| withResponseDataKV("deviceKeys",
	+ json::object({{"@alice:example.com", json::array()}})))));
	+
	+ REQUIRE(client.deviceLists.devicesFor("@alice:example.com").size() == 2);
	+ REQUIRE(client.deviceLists.get("@alice:example.com", "device1").has_value());
	+ REQUIRE(client.deviceLists.get("@alice:example.com", "device2").has_value());
	+ REQUIRE(!client.deviceLists.get("@alice:example.com", "device2").value().deleted);
	+
	+ // Now Alice deletes device2. We get a new full key query response
	+ // that only contains device1.
	+ auto onlyDevice1RespJson = json{
	+ {"device_keys", {{"@alice:example.com", {
	+ {"device1", makeSignedDeviceInfo(device1Client)},
	+ }}}},
	+ };
	+
	+ std::tie(client, std::ignore) = processResponse(client, QueryKeysResponse(
	+ makeResponse("QueryKeys2",
	+ withResponseJsonBody(onlyDevice1RespJson)
	+ \| withResponseDataKV("deviceKeys",
	+ json::object({{"@alice:example.com", json::array()}})))));
	+
	+ // device2 is kept in the tracker (for verifying past events) but marked deleted
	+ REQUIRE(client.deviceLists.devicesFor("@alice:example.com").size() == 2);
	+ REQUIRE(client.deviceLists.get("@alice:example.com", "device2").has_value());
	+ REQUIRE(client.deviceLists.get("@alice:example.com", "device2").value().deleted);
	+
	+ // device1 is not deleted
	+ REQUIRE(!client.deviceLists.get("@alice:example.com", "device1").value().deleted);
	+
	+ // devicesToSendKeys excludes the deleted device
	+ client.trustLevelNeededToSendKeys = Unseen;
	+ auto devices = client.devicesToSendKeys("@alice:example.com");
	+ REQUIRE(devices.size() == 1);
	+ REQUIRE(devices[0] == "device1");
	+}
	+
	+static ClientModel makeDeviceClient(std::string userId, std::string deviceId)
	+{
	+ auto client = makeClient(withCrypto(makeCrypto()));
	+ client.userId = userId;
	+ client.deviceId = deviceId;
	+ return client;
	+}
	+
	+TEST_CASE("mixed full and specific queries: full marks deleted, specific preserves unqueried", "[client][device-list-tracker]")
	+{
	+ // Create crypto identities for all devices of two users
	+ auto aliceDev1 = makeDeviceClient("@alice:example.com", "device1");
	+ auto aliceDev2 = makeDeviceClient("@alice:example.com", "device2");
	+ auto aliceDev3 = makeDeviceClient("@alice:example.com", "device3");
	+ auto bobDev1 = makeDeviceClient("@bob:example.com", "device1");
	+ auto bobDev2 = makeDeviceClient("@bob:example.com", "device2");
	+
	+ // Our client tracking both Alice and Bob
	+ auto client = makeClient(withCrypto(makeCrypto()));
	+ client.userId = "@carol:example.com";
	+ client.deviceId = "caroldevice";
	+
	+ // Process an initial full query that discovers all devices for both users
	+ auto initialRespJson = json{
	+ {"device_keys", {
	+ {"@alice:example.com", {
	+ {"device1", makeSignedDeviceInfo(aliceDev1)},
	+ {"device2", makeSignedDeviceInfo(aliceDev2)},
	+ {"device3", makeSignedDeviceInfo(aliceDev3)},
	+ }},
	+ {"@bob:example.com", {
	+ {"device1", makeSignedDeviceInfo(bobDev1)},
	+ {"device2", makeSignedDeviceInfo(bobDev2)},
	+ }},
	+ }},
	+ };
	+
	+ std::tie(client, std::ignore) = processResponse(client, QueryKeysResponse(
	+ makeResponse("QueryKeys",
	+ withResponseJsonBody(initialRespJson)
	+ \| withResponseDataKV("deviceKeys",
	+ json::object({
	+ {"@alice:example.com", json::array()},
	+ {"@bob:example.com", json::array()},
	+ })))));
	+
	+ // All devices are now tracked
	+ REQUIRE(client.deviceLists.devicesFor("@alice:example.com").size() == 3);
	+ REQUIRE(client.deviceLists.devicesFor("@bob:example.com").size() == 2);
	+
	+ // Now Alice deletes device3. We do a mixed query in a single request:
	+ // - Full query for Alice (empty list = all devices)
	+ // -> response has only device1, device2 (device3 was deleted)
	+ // - Specific query for Bob with ["device1"] only
	+ // -> response has only device1 (device2 was not queried)
	+ auto mixedRespJson = json{
	+ {"device_keys", {
	+ {"@alice:example.com", {
	+ {"device1", makeSignedDeviceInfo(aliceDev1)},
	+ {"device2", makeSignedDeviceInfo(aliceDev2)},
	+ // device3 deleted, not in response
	+ }},
	+ {"@bob:example.com", {
	+ {"device1", makeSignedDeviceInfo(bobDev1)},
	+ // device2 not queried, not in response
	+ }},
	+ }},
	+ };
	+
	+ std::tie(client, std::ignore) = processResponse(client, QueryKeysResponse(
	+ makeResponse("QueryKeys2",
	+ withResponseJsonBody(mixedRespJson)
	+ \| withResponseDataKV("deviceKeys",
	+ json::object({
	+ {"@alice:example.com", json::array()}, // full query: all devices
	+ {"@bob:example.com", json::array({"device1"})}, // specific query: device1 only
	+ })))));
	+
	+ // For Alice (full query): device3 was deleted and NOT in the response.
	+ // device3 is kept in the tracker (for verifying past events) but marked
	+ // as deleted.
	+ REQUIRE(client.deviceLists.devicesFor("@alice:example.com").size() == 3);
	+ REQUIRE(client.deviceLists.get("@alice:example.com", "device3").has_value());
	+ REQUIRE(client.deviceLists.get("@alice:example.com", "device3").value().deleted);
	+ REQUIRE(!client.deviceLists.get("@alice:example.com", "device1").value().deleted);
	+ REQUIRE(!client.deviceLists.get("@alice:example.com", "device2").value().deleted);
	+
	+ // For Bob (specific query for device1 only): device2 was NOT in the
	+ // request and NOT in the response. Since we did not query for all
	+ // of Bob's devices, absence from the response does not mean deletion.
	+ // device2 must be preserved and NOT marked as deleted.
	+ REQUIRE(client.deviceLists.devicesFor("@bob:example.com").size() == 2);
	+ REQUIRE(client.deviceLists.get("@bob:example.com", "device2").has_value());
	+ REQUIRE(!client.deviceLists.get("@bob:example.com", "device2").value().deleted);
	+ REQUIRE(client.deviceLists.get("@bob:example.com", "device1").has_value());
	+ REQUIRE(!client.deviceLists.get("@bob:example.com", "device1").value().deleted);
	+
	+ // devicesToSendKeys excludes Alice's deleted device3
	+ client.trustLevelNeededToSendKeys = Unseen;
	+ auto aliceDevices = client.devicesToSendKeys("@alice:example.com");
	+ REQUIRE(aliceDevices.size() == 2);
	+
	+ // Bob's devicesToSendKeys correctly includes both devices
	+ auto bobDevices = client.devicesToSendKeys("@bob:example.com");
	+ REQUIRE(bobDevices.size() == 2);
	+}
	+
	TEST_CASE("DeviceListTracker::findByCurve25519Key")
	{
	auto info = makeDeviceKeyInfo(withDeviceId("device1"));
	auto client = makeClient(withDevice("@example:example.com", info));

	REQUIRE(client.deviceLists.findByCurve25519Key("@example:example.com", info.curve25519Key) == info);
	REQUIRE(client.deviceLists.findByCurve25519Key("@someone:example.com", info.curve25519Key) == std::nullopt);
	}

	TEST_CASE("DeviceListTracker::findByOlmEvent")
	{
	auto s = OlmFirstTimeDecryptTestSetup();

	auto plainText = json{
	{"content", json::object()},
	{"type", "moe.kazv.mxc.xxx"},
	};

	SECTION("without sender_device_keys") {
	auto encrypted = s.encrypt(plainText);
	auto e = s.decryptOnly(encrypted);
	auto [st, ki] = s.clientWithDevice.deviceLists.findByOlmEvent(e);
	REQUIRE(st == DeviceListTracker::InTracker);
	REQUIRE(ki.deviceId == "device1");
	REQUIRE(ki.ed25519Key == s.clientA.constCrypto().ed25519IdentityKey());

	std::tie(st, ki) = s.clientNoDevice.deviceLists.findByOlmEvent(e);
	REQUIRE(st == DeviceListTracker::NotFound);
	}

	SECTION("with valid sender_device_keys") {
	auto encrypted = s.encrypt(plainText, /* attachSenderDeviceKeys = */ true);
	auto e = s.decryptOnly(encrypted);
	auto [st, ki] = s.clientWithDevice.deviceLists.findByOlmEvent(e);
	REQUIRE(st == DeviceListTracker::InTracker);
	REQUIRE(ki.deviceId == "device1");
	REQUIRE(ki.ed25519Key == s.clientA.constCrypto().ed25519IdentityKey());

	std::tie(st, ki) = s.clientNoDevice.deviceLists.findByOlmEvent(e);
	REQUIRE(st == DeviceListTracker::InEvent);
	REQUIRE(ki.deviceId == "device1");
	REQUIRE(ki.ed25519Key == s.clientA.constCrypto().ed25519IdentityKey());
	}

	SECTION("with invalid sender_device_keys (bad signature)") {
	// the following creates a bad signature
	auto fakeClientA = s.clientA;
	fakeClientA.deviceId = "device3";
	plainText["sender_device_keys"] = fakeClientA.makeSelfDeviceKeys();
	plainText["sender_device_keys"]["device_id"] = s.senderDeviceId;

	auto encrypted = s.encrypt(plainText);
	auto e = s.decryptOnly(encrypted);
	auto [st, ki] = s.clientWithDevice.deviceLists.findByOlmEvent(e);
	REQUIRE(st == DeviceListTracker::NotFound);

	std::tie(st, ki) = s.clientNoDevice.deviceLists.findByOlmEvent(e);
	REQUIRE(st == DeviceListTracker::NotFound);
	}

	SECTION("with invalid sender_device_keys (device id mismatch)") {
	// the following creates a good signature, but device id is fake
	// findByOlmEvent() does not rule out this, but it should be ruled out in
	// verifyEvent().
	auto fakeClientA = s.clientA;
	fakeClientA.deviceId = "device3";
	plainText["sender_device_keys"] = fakeClientA.makeSelfDeviceKeys();

	auto encrypted = s.encrypt(plainText);
	auto e = s.decryptOnly(encrypted);
	auto [st, ki] = s.clientWithDevice.deviceLists.findByOlmEvent(e);
	// It should reject because there is already another device with the same
	// key
	REQUIRE(st == DeviceListTracker::NotFound);

	std::tie(st, ki) = s.clientNoDevice.deviceLists.findByOlmEvent(e);
	REQUIRE(st == DeviceListTracker::InEvent);
	}
	}

File Metadata

Mime Type: text/x-diff
Expires: Sun, Oct 11, 12:54 PM (1 d, 8 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1785783
Default Alt Text: (83 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions