483 lines
17 KiB
TypeScript
483 lines
17 KiB
TypeScript
import {
|
|
type Capability,
|
|
type ISendDelayedEventDetails,
|
|
type ISendEventDetails,
|
|
type IReadEventRelationsResult,
|
|
type IRoomEvent,
|
|
WidgetDriver,
|
|
type IWidgetApiErrorResponseDataDetails,
|
|
type ISearchUserDirectoryResult,
|
|
type IGetMediaConfigResult,
|
|
type UpdateDelayedEventAction,
|
|
OpenIDRequestState,
|
|
SimpleObservable,
|
|
IOpenIDUpdate,
|
|
} from 'matrix-widget-api';
|
|
import {
|
|
ClientPrefix,
|
|
EventType,
|
|
type IContent,
|
|
MatrixError,
|
|
type MatrixEvent,
|
|
Direction,
|
|
Method,
|
|
type SendDelayedEventResponse,
|
|
type StateEvents,
|
|
type TimelineEvents,
|
|
MatrixClient,
|
|
} from 'matrix-js-sdk';
|
|
import { getCallCapabilities } from './utils';
|
|
import { downloadMedia, mxcUrlToHttp } from '../../utils/matrix';
|
|
|
|
// Cleartext ring metadata for Android FCM classification — NOT "unencrypted calls".
|
|
//
|
|
// Why this exists. matrix-js-sdk encrypts every room event in an e2ee room before
|
|
// PUT /send. Server stores it as `m.room.encrypted`; Sygnal/HS push rules can only
|
|
// match outer cleartext fields, so an `EventMatch type=org.matrix.msc4075.rtc.notification`
|
|
// override never fires for encrypted DMs. Push falls back to the default message rule,
|
|
// FCM payload arrives with `type=m.room.encrypted, cn_type=null`, the Java classifier
|
|
// in `VojoFirebaseMessagingService.onMessageReceived` cannot recognise it as a ring,
|
|
// and the user sees a generic message banner instead of CallStyle. Element Web mitigates
|
|
// this by fetching+decrypting in the SW; Element X does it via native matrix-rust-sdk.
|
|
// Vojo Android has neither path, so the only short fix is to send the ring signal cleartext.
|
|
//
|
|
// Threat model. The signaling layer "an incoming ring exists in this room at time T"
|
|
// becomes server- and push-gateway-visible. Message bodies, LiveKit tokens, media
|
|
// encryption keys, SDP/session secrets, and call audio remain end-to-end encrypted —
|
|
// MSC4075 keeps those out of `m.rtc.notification` content by design. Equivalent to
|
|
// legacy `m.call.invite` cleartext signaling in WebRTC-over-Matrix. Stricter threat
|
|
// models that require hiding even the call-existence fact need the native-decrypt path
|
|
// tracked in `docs/plans/dm_calls_techdebt.md` §5.51.
|
|
//
|
|
// Reconstruct the ring payload field-by-field from validated primitives.
|
|
// We do NOT use a top-level allowlist + shallow copy: nested objects like
|
|
// `m.relates_to`, `m.mentions`, and a future opaque `m.call.intent` would
|
|
// then leak any sub-fields Element Call upstream might add. Each accepted
|
|
// field below is rebuilt from primitive-typed inputs only, so unknown
|
|
// sub-fields cannot ride along.
|
|
|
|
const RTC_RING_LIFETIME_MAX_MS = 5 * 60 * 1000;
|
|
const RTC_RING_MENTIONS_MAX_USERS = 64;
|
|
|
|
const isObject = (v: unknown): v is Record<string, unknown> =>
|
|
typeof v === 'object' && v !== null && !Array.isArray(v);
|
|
|
|
// Validate a widget-provided ring payload before we send it cleartext. Returns
|
|
// the sanitized object on a happy path or `null` if any required field is
|
|
// missing/malformed — caller then falls back to the encrypted send path so the
|
|
// in-app strip still gets the event via /sync, even if Android push misses.
|
|
// Prevents a hostile or buggy widget from leaking arbitrary cleartext under
|
|
// the guise of "ring metadata".
|
|
function sanitizeRingContent(content: IContent): IContent | null {
|
|
const relates = content['m.relates_to'];
|
|
if (!isObject(relates)) return null;
|
|
if (relates.rel_type !== 'm.reference') return null;
|
|
if (typeof relates.event_id !== 'string' || relates.event_id.length === 0) return null;
|
|
|
|
const { sender_ts: senderTs, lifetime } = content;
|
|
if (typeof senderTs !== 'number' || !Number.isFinite(senderTs) || senderTs <= 0) return null;
|
|
|
|
if (
|
|
typeof lifetime !== 'number' ||
|
|
!Number.isFinite(lifetime) ||
|
|
lifetime <= 0 ||
|
|
lifetime > RTC_RING_LIFETIME_MAX_MS
|
|
) {
|
|
return null;
|
|
}
|
|
|
|
const out: IContent = {
|
|
notification_type: 'ring',
|
|
'm.relates_to': {
|
|
rel_type: 'm.reference',
|
|
event_id: relates.event_id,
|
|
},
|
|
sender_ts: senderTs,
|
|
lifetime,
|
|
};
|
|
|
|
// m.mentions per Matrix spec: { user_ids?: string[]; room?: boolean }.
|
|
// Reconstruct from primitives so an upstream-added field can't leak.
|
|
const mentions = content['m.mentions'];
|
|
if (isObject(mentions)) {
|
|
const sanitizedMentions: { user_ids?: string[]; room?: boolean } = {};
|
|
if (Array.isArray(mentions.user_ids)) {
|
|
sanitizedMentions.user_ids = mentions.user_ids
|
|
.filter((u): u is string => typeof u === 'string')
|
|
.slice(0, RTC_RING_MENTIONS_MAX_USERS);
|
|
}
|
|
if (typeof mentions.room === 'boolean') {
|
|
sanitizedMentions.room = mentions.room;
|
|
}
|
|
out['m.mentions'] = sanitizedMentions;
|
|
}
|
|
|
|
// m.call.intent per MSC4310 is a free-form string hint ('audio' / 'video').
|
|
// Forward only if it's a primitive string.
|
|
const intent = content['m.call.intent'];
|
|
if (typeof intent === 'string' && intent.length > 0 && intent.length < 64) {
|
|
out['m.call.intent'] = intent;
|
|
}
|
|
|
|
return out;
|
|
}
|
|
|
|
export class CallWidgetDriver extends WidgetDriver {
|
|
private allowedCapabilities: Set<Capability>;
|
|
|
|
private readonly mx: MatrixClient;
|
|
|
|
public constructor(mx: MatrixClient, private inRoomId: string) {
|
|
super();
|
|
this.mx = mx;
|
|
|
|
const deviceId = mx.getDeviceId();
|
|
if (!deviceId) throw new Error('Failed to initialize CallWidgetDriver! Device ID not found.');
|
|
|
|
this.allowedCapabilities = getCallCapabilities(inRoomId, mx.getSafeUserId(), deviceId);
|
|
}
|
|
|
|
public async validateCapabilities(requested: Set<Capability>): Promise<Set<Capability>> {
|
|
const allow = Array.from(requested).filter((cap) => this.allowedCapabilities.has(cap));
|
|
return new Set(allow);
|
|
}
|
|
|
|
public async sendEvent(
|
|
eventType: string,
|
|
content: IContent,
|
|
stateKey: string | null = null,
|
|
targetRoomId: string | null = null
|
|
): Promise<ISendEventDetails> {
|
|
const client = this.mx;
|
|
const roomId = targetRoomId || this.inRoomId;
|
|
|
|
if (!client || !roomId) throw new Error('Not in a room or not attached to a client');
|
|
|
|
let r: { event_id: string } | null;
|
|
const sanitizedRing =
|
|
stateKey === null &&
|
|
eventType === EventType.RTCNotification &&
|
|
content.notification_type === 'ring'
|
|
? sanitizeRingContent(content)
|
|
: null;
|
|
|
|
// Defense-in-depth against the legacy `EventType.CallNotify`
|
|
// (`org.matrix.msc4075.call.notify`) sibling event that
|
|
// `MatrixRTCSession.sendCallNotify` upstream still emits in parallel
|
|
// with `m.rtc.notification`. `getCallCapabilities` already omits Send
|
|
// for it, so the widget capability check should reject the request
|
|
// before it reaches us — but if a future widget release bypasses
|
|
// capability validation, the encrypted send would surface as a
|
|
// default-rule message banner alongside the real ring (Vojo's ring
|
|
// listener watches RTCNotification, not CallNotify). A push-rule
|
|
// suppression cannot fix this: the homeserver only sees
|
|
// `type=m.room.encrypted` for encrypted DMs and `EventMatch` against
|
|
// the inner type silently no-ops. So we silently no-op the legacy send
|
|
// here, returning a sentinel event_id. Throwing is tempting but would
|
|
// poison `MatrixRTCSession.sendCallNotify`'s `Promise.all` umbrella —
|
|
// its `.then` doesn't fire on reject, `DidSendCallNotification` never
|
|
// emits, and an "Unhandled promise rejection" log flickers per ring.
|
|
// Vojo doesn't consume `DidSendCallNotification`, but a clean resolve
|
|
// keeps the sibling new-RTCNotification ack path identical to upstream.
|
|
if (stateKey === null && eventType === EventType.CallNotify) {
|
|
return { roomId, eventId: '$vojo:suppressed-legacy-call-notify' };
|
|
}
|
|
|
|
if (typeof stateKey === 'string') {
|
|
r = await client.sendStateEvent(
|
|
roomId,
|
|
eventType as keyof StateEvents,
|
|
content as StateEvents[keyof StateEvents],
|
|
stateKey
|
|
);
|
|
} else if (eventType === EventType.RoomRedaction) {
|
|
// special case: extract the `redacts` property and call redact
|
|
r = await client.redactEvent(roomId, content.redacts);
|
|
} else if (sanitizedRing) {
|
|
// Bypass the encryption pipeline for ring signaling. See the rationale block
|
|
// above the allowlist for full reasoning. Only `notification_type === 'ring'`
|
|
// is special-cased — group-call `notification_type === 'notification'` keeps
|
|
// the default encrypted path because it isn't routed through the Android
|
|
// CallStyle classifier. If the payload fails shape validation we fall through
|
|
// to the regular encrypted send below so the in-app strip still gets the
|
|
// event via /sync; only Android background CallStyle is lost on that branch.
|
|
const txnId = client.makeTxnId();
|
|
const path = `/rooms/${encodeURIComponent(roomId)}/send/${encodeURIComponent(
|
|
eventType
|
|
)}/${encodeURIComponent(txnId)}`;
|
|
r = await client.http.authedRequest<{ event_id: string }>(
|
|
Method.Put,
|
|
path,
|
|
undefined,
|
|
sanitizedRing,
|
|
{ prefix: ClientPrefix.V3 }
|
|
);
|
|
} else {
|
|
r = await client.sendEvent(
|
|
roomId,
|
|
eventType as keyof TimelineEvents,
|
|
content as TimelineEvents[keyof TimelineEvents]
|
|
);
|
|
}
|
|
|
|
return { roomId, eventId: r.event_id };
|
|
}
|
|
|
|
public async sendDelayedEvent(
|
|
delay: number | null,
|
|
parentDelayId: string | null,
|
|
eventType: string,
|
|
content: IContent,
|
|
stateKey: string | null = null,
|
|
targetRoomId: string | null = null
|
|
): Promise<ISendDelayedEventDetails> {
|
|
const client = this.mx;
|
|
const roomId = targetRoomId || this.inRoomId;
|
|
|
|
if (!client || !roomId) throw new Error('Not in a room or not attached to a client');
|
|
|
|
let delayOpts;
|
|
if (delay !== null) {
|
|
delayOpts = {
|
|
delay,
|
|
...(parentDelayId !== null && { parent_delay_id: parentDelayId }),
|
|
};
|
|
} else if (parentDelayId !== null) {
|
|
delayOpts = {
|
|
parent_delay_id: parentDelayId,
|
|
};
|
|
} else {
|
|
throw new Error('Must provide at least one of delay or parentDelayId');
|
|
}
|
|
|
|
let r: SendDelayedEventResponse | null;
|
|
if (stateKey !== null) {
|
|
// state event
|
|
r = await client._unstable_sendDelayedStateEvent(
|
|
roomId,
|
|
delayOpts,
|
|
eventType as keyof StateEvents,
|
|
content as StateEvents[keyof StateEvents],
|
|
stateKey
|
|
);
|
|
} else {
|
|
// message event
|
|
r = await client._unstable_sendDelayedEvent(
|
|
roomId,
|
|
delayOpts,
|
|
null,
|
|
eventType as keyof TimelineEvents,
|
|
content as TimelineEvents[keyof TimelineEvents]
|
|
);
|
|
}
|
|
|
|
return {
|
|
roomId,
|
|
delayId: r.delay_id,
|
|
};
|
|
}
|
|
|
|
public async updateDelayedEvent(
|
|
delayId: string,
|
|
action: UpdateDelayedEventAction
|
|
): Promise<void> {
|
|
const client = this.mx;
|
|
|
|
if (!client) throw new Error('Not in a room or not attached to a client');
|
|
|
|
await client._unstable_updateDelayedEvent(delayId, action);
|
|
}
|
|
|
|
public async sendToDevice(
|
|
eventType: string,
|
|
encrypted: boolean,
|
|
contentMap: { [userId: string]: { [deviceId: string]: object } }
|
|
): Promise<void> {
|
|
const client = this.mx;
|
|
|
|
if (encrypted) {
|
|
const crypto = client.getCrypto();
|
|
if (!crypto) throw new Error('E2EE not enabled');
|
|
|
|
// attempt to re-batch these up into a single request
|
|
const invertedContentMap: { [content: string]: { userId: string; deviceId: string }[] } = {};
|
|
|
|
// eslint-disable-next-line no-restricted-syntax
|
|
for (const userId of Object.keys(contentMap)) {
|
|
const userContentMap = contentMap[userId];
|
|
// eslint-disable-next-line no-restricted-syntax
|
|
for (const deviceId of Object.keys(userContentMap)) {
|
|
const content = userContentMap[deviceId];
|
|
const stringifiedContent = JSON.stringify(content);
|
|
invertedContentMap[stringifiedContent] = invertedContentMap[stringifiedContent] || [];
|
|
invertedContentMap[stringifiedContent].push({ userId, deviceId });
|
|
}
|
|
}
|
|
|
|
await Promise.all(
|
|
Object.entries(invertedContentMap).map(async ([stringifiedContent, recipients]) => {
|
|
const batch = await crypto.encryptToDeviceMessages(
|
|
eventType,
|
|
recipients,
|
|
JSON.parse(stringifiedContent)
|
|
);
|
|
|
|
await client.queueToDevice(batch);
|
|
})
|
|
);
|
|
} else {
|
|
await client.queueToDevice({
|
|
eventType,
|
|
batch: Object.entries(contentMap).flatMap(([userId, userContentMap]) =>
|
|
Object.entries(userContentMap).map(([deviceId, content]) => ({
|
|
userId,
|
|
deviceId,
|
|
payload: content,
|
|
}))
|
|
),
|
|
});
|
|
}
|
|
}
|
|
|
|
public async readRoomTimeline(
|
|
roomId: string,
|
|
eventType: string,
|
|
msgtype: string | undefined,
|
|
stateKey: string | undefined,
|
|
limit: number,
|
|
since: string | undefined
|
|
): Promise<IRoomEvent[]> {
|
|
const safeLimit =
|
|
limit > 0 ? Math.min(limit, Number.MAX_SAFE_INTEGER) : Number.MAX_SAFE_INTEGER; // relatively arbitrary
|
|
|
|
const room = this.mx.getRoom(roomId);
|
|
if (room === null) return [];
|
|
const results: MatrixEvent[] = [];
|
|
const events = room.getLiveTimeline().getEvents();
|
|
|
|
for (let i = events.length - 1; i >= 0; i -= 1) {
|
|
const ev = events[i];
|
|
if (results.length >= safeLimit) break;
|
|
if (since !== undefined && ev.getId() === since) break;
|
|
|
|
if (
|
|
ev.getType() === eventType &&
|
|
!ev.isState() &&
|
|
(eventType !== EventType.RoomMessage || !msgtype || msgtype === ev.getContent().msgtype) &&
|
|
(ev.getStateKey() === undefined || stateKey === undefined || ev.getStateKey() === stateKey)
|
|
) {
|
|
results.push(ev);
|
|
}
|
|
}
|
|
|
|
return results.map((e) => e.getEffectiveEvent() as IRoomEvent);
|
|
}
|
|
|
|
public async askOpenID(observer: SimpleObservable<IOpenIDUpdate>): Promise<void> {
|
|
return observer.update({
|
|
state: OpenIDRequestState.Allowed,
|
|
token: await this.mx.getOpenIdToken(),
|
|
});
|
|
}
|
|
|
|
public async readRoomState(
|
|
roomId: string,
|
|
eventType: string,
|
|
stateKey: string | undefined
|
|
): Promise<IRoomEvent[]> {
|
|
const room = this.mx.getRoom(roomId);
|
|
if (room === null) return [];
|
|
const state = room.getLiveTimeline().getState(Direction.Forward);
|
|
if (state === undefined) return [];
|
|
|
|
if (stateKey === undefined)
|
|
return state.getStateEvents(eventType).map((e) => e.getEffectiveEvent() as IRoomEvent);
|
|
const event = state.getStateEvents(eventType, stateKey);
|
|
return event === null ? [] : [event.getEffectiveEvent() as IRoomEvent];
|
|
}
|
|
|
|
public async readEventRelations(
|
|
eventId: string,
|
|
roomId?: string,
|
|
relationType?: string,
|
|
eventType?: string,
|
|
from?: string,
|
|
to?: string,
|
|
limit?: number,
|
|
direction?: 'f' | 'b'
|
|
): Promise<IReadEventRelationsResult> {
|
|
const client = this.mx;
|
|
const dir = direction as Direction;
|
|
const targetRoomId = roomId ?? this.inRoomId ?? undefined;
|
|
|
|
if (typeof targetRoomId !== 'string') {
|
|
throw new Error('Error while reading the current room');
|
|
}
|
|
|
|
const { events, nextBatch, prevBatch } = await client.relations(
|
|
targetRoomId,
|
|
eventId,
|
|
relationType ?? null,
|
|
eventType ?? null,
|
|
{ from, to, limit, dir }
|
|
);
|
|
|
|
return {
|
|
chunk: events.map((e) => e.getEffectiveEvent() as IRoomEvent),
|
|
nextBatch: nextBatch ?? undefined,
|
|
prevBatch: prevBatch ?? undefined,
|
|
};
|
|
}
|
|
|
|
public async searchUserDirectory(
|
|
searchTerm: string,
|
|
limit?: number
|
|
): Promise<ISearchUserDirectoryResult> {
|
|
const client = this.mx;
|
|
|
|
const { limited, results } = await client.searchUserDirectory({ term: searchTerm, limit });
|
|
|
|
return {
|
|
limited,
|
|
results: results.map((r) => ({
|
|
userId: r.user_id,
|
|
displayName: r.display_name,
|
|
avatarUrl: r.avatar_url,
|
|
})),
|
|
};
|
|
}
|
|
|
|
public async getMediaConfig(): Promise<IGetMediaConfigResult> {
|
|
const client = this.mx;
|
|
|
|
return client.getMediaConfig();
|
|
}
|
|
|
|
public async uploadFile(file: XMLHttpRequestBodyInit): Promise<{ contentUri: string }> {
|
|
const client = this.mx;
|
|
|
|
const uploadResult = await client.uploadContent(file);
|
|
|
|
return { contentUri: uploadResult.content_uri };
|
|
}
|
|
|
|
public async downloadFile(contentUri: string): Promise<{ file: XMLHttpRequestBodyInit }> {
|
|
const httpUrl = mxcUrlToHttp(this.mx, contentUri, true);
|
|
if (!httpUrl) {
|
|
throw new Error('Call widget failed to download file! No http url!');
|
|
}
|
|
const blob = await downloadMedia(httpUrl);
|
|
return { file: blob };
|
|
}
|
|
|
|
public getKnownRooms(): string[] {
|
|
return this.mx.getVisibleRooms().map((r) => r.roomId);
|
|
}
|
|
|
|
// eslint-disable-next-line class-methods-use-this
|
|
public processError(error: unknown): IWidgetApiErrorResponseDataDetails | undefined {
|
|
return error instanceof MatrixError
|
|
? { matrix_api_error: error.asWidgetApiErrorData() }
|
|
: undefined;
|
|
}
|
|
}
|