v31.4.0

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

.github/PULL_REQUEST_TEMPLATE.md

@@ -5,9 +5,3 @@
 -   [ ] Tests written for new code (and old code if feasible)
 -   [ ] Linter and other CI checks pass
 -   [ ] Sign-off given on the changes (see [CONTRIBUTING.md](https://github.com/matrix-org/matrix-js-sdk/blob/develop/CONTRIBUTING.md))
-
-<!--
-If you would like to specify text for the changelog entry other than your PR title, add the following:
-
-Notes: Add super cool feature
--->

.github/workflows/downstream-artifacts.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
     build-element-web:
         name: Build element-web
-        uses: matrix-org/matrix-react-sdk/.github/workflows/element-web.yaml@v3.90.0
+        uses: matrix-org/matrix-react-sdk/.github/workflows/element-web.yaml@v3.91.0
         with:
             matrix-js-sdk-sha: ${{ github.sha }}
             react-sdk-repository: matrix-org/matrix-react-sdk

.github/workflows/notify-downstream.yaml

@@ -20,7 +20,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Notify matrix-react-sdk repo that a new SDK build is on develop so it can CI against it
-              uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2
+              uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
               with:
                   token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                   repository: ${{ matrix.repo }}

.github/workflows/pull_request.yaml

@@ -14,11 +14,18 @@ jobs:
         name: Preview Changelog
         runs-on: ubuntu-latest
         steps:
-            - uses: matrix-org/allchange@main
+            - uses: mheap/github-action-required-labels@80a96a4863886addcbc9f681b5b295ba7f5424e1 # v5
               if: github.event_name != 'merge_group'
               with:
-                  ghToken: ${{ secrets.GITHUB_TOKEN }}
-                  requireLabel: true
+                  labels: |
+                      X-Breaking-Change
+                      T-Deprecation
+                      T-Enhancement
+                      T-Defect
+                      T-Task
+                      Dependencies
+                  mode: minimum
+                  count: 1
 
     prevent-blocked:
         name: Prevent Blocked

.github/workflows/release-drafter-workflow.yml

@@ -46,7 +46,8 @@ jobs:
               if: inputs.include-changes
               uses: actions/github-script@v7
               env:
-                  RELEASE_ID: ${{ steps.release.outputs.id }}
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  RELEASE_ID: ${{ steps.draft-release.outputs.id }}
                   DEPENDENCY: ${{ inputs.include-changes }}
                   VERSION: ${{ steps.draft-release.outputs.tag_name }}
               with:
@@ -60,7 +61,7 @@ jobs:
                       if (DEPENDENCY.includes("/")) {
                           deps.push(DEPENDENCY.replace("$VERSION", VERSION))
                       } else {
-                          const fromVersion = JSON.parse(await exec.exec("git show origin/master:package.json")).dependencies[DEPENDENCY];
+                          const fromVersion = JSON.parse((await github.request(`https://raw.githubusercontent.com/${owner}/${repo}/master/package.json`)).data).dependencies[DEPENDENCY];
                           const toVersion = require("./package.json").dependencies[DEPENDENCY];
 
                           if (toVersion.endsWith("#develop")) {
@@ -82,5 +83,6 @@ jobs:
                               repo,
                               release_id: releaseId,
                               body: notes,
+                              tag_name: VERSION,
                           });
                       }

.github/workflows/release-make.yml

@@ -58,7 +58,7 @@ jobs:
                   fingerprint: ${{ inputs.gpg-fingerprint }}
 
             - name: Get draft release
-              id: release
+              id: draft-release
               uses: cardinalby/git-get-release-action@cedef2faf69cb7c55b285bad07688d04430b7ada # v1
               env:
                   GITHUB_TOKEN: ${{ github.token }}
@@ -91,7 +91,7 @@ jobs:
                   jq -e .scripts.dist package.json >/dev/null 2>&1 && HAS_DIST=1
                   echo "has-dist-script=$HAS_DIST" >> $GITHUB_OUTPUT
               env:
-                  VERSION: ${{ steps.release.outputs.tag_name }}
+                  VERSION: ${{ steps.draft-release.outputs.tag_name }}
 
             - name: Finalise version
               if: inputs.final
@@ -159,7 +159,7 @@ jobs:
                   rm CHANGELOG.md.old
                   git add CHANGELOG.md
               env:
-                  RELEASE_NOTES: ${{ steps.release.outputs.body }}
+                  RELEASE_NOTES: ${{ steps.draft-release.outputs.body }}
 
             - name: Run pre-release script to update package.json fields
               run: |
@@ -178,7 +178,7 @@ jobs:
               uses: ./.action-repo/.github/actions/upload-release-assets
               with:
                   gpg-fingerprint: ${{ inputs.gpg-fingerprint }}
-                  upload-url: ${{ steps.release.outputs.upload_url }}
+                  upload-url: ${{ steps.draft-release.outputs.upload_url }}
                   asset-path: ${{ inputs.asset-path }}
 
             - name: Create signed tag
@@ -193,7 +193,7 @@ jobs:
               uses: ./.action-repo/.github/actions/sign-release-tarball
               with:
                   gpg-fingerprint: ${{ inputs.gpg-fingerprint }}
-                  upload-url: ${{ steps.release.outputs.upload_url }}
+                  upload-url: ${{ steps.draft-release.outputs.upload_url }}
 
             # We defer pushing changes until after the release assets are built,
             # signed & uploaded to improve the atomicity of this action.
@@ -214,7 +214,7 @@ jobs:
               if: inputs.expected-asset-count
               uses: actions/github-script@v7
               env:
-                  RELEASE_ID: ${{ steps.release.outputs.id }}
+                  RELEASE_ID: ${{ steps.draft-release.outputs.id }}
                   EXPECTED_ASSET_COUNT: ${{ inputs.expected-asset-count }}
               with:
                   retries: 3
@@ -242,7 +242,7 @@ jobs:
             - name: Publish release
               uses: actions/github-script@v7
               env:
-                  RELEASE_ID: ${{ steps.release.outputs.id }}
+                  RELEASE_ID: ${{ steps.draft-release.outputs.id }}
                   FINAL: ${{ inputs.final }}
               with:
                   retries: 3

.github/workflows/release-npm.yml

@@ -4,6 +4,10 @@ on:
         secrets:
             NPM_TOKEN:
                 required: true
+        outputs:
+            id:
+                description: "The npm package@version string we published"
+                value: ${{ jobs.npm.outputs.id }}
 jobs:
     npm:
         name: Publish to npm

CHANGELOG.md

@@ -1,3 +1,43 @@
+Changes in [31.4.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v31.4.0) (2024-02-27)
+==================================================================================================
+## ✨ Features
+
+* Validate `account_management_uri` and `account_management_actions_supported` from OIDC Issuer well-known ([#4074](https://github.com/matrix-org/matrix-js-sdk/pull/4074)). Contributed by @t3chguy.
+* Allow specifying OIDC url state parameter for passing data to callback ([#4068](https://github.com/matrix-org/matrix-js-sdk/pull/4068)). Contributed by @t3chguy.
+* Add getAuthIssuer method for MSC2965 ([#4071](https://github.com/matrix-org/matrix-js-sdk/pull/4071)). Contributed by @t3chguy.
+* Allow specifying more OIDC client metadata for dynamic registration ([#4070](https://github.com/matrix-org/matrix-js-sdk/pull/4070)). Contributed by @t3chguy.
+* Add unread marker event type ([#4069](https://github.com/matrix-org/matrix-js-sdk/pull/4069)). Contributed by @dbkr.
+* Add "AsJson" forms of the key import/export methods ([#4057](https://github.com/matrix-org/matrix-js-sdk/pull/4057)). Contributed by @andybalaam.
+
+## 🐛 Bug Fixes
+
+* Ignore memberships of users that are not in the call ([#4065](https://github.com/matrix-org/matrix-js-sdk/pull/4065)). Contributed by @toger5.
+* Await encrypted messages ([#4063](https://github.com/matrix-org/matrix-js-sdk/pull/4063)). Contributed by @toger5.
+* ElementR | Ensure own user and device trust are updated after migration before giving back control to the app. ([#4059](https://github.com/matrix-org/matrix-js-sdk/pull/4059)). Contributed by @BillCarsonFr.
+* Bump matrix-sdk-crypto-wasm to 4.5.0 ([#4060](https://github.com/matrix-org/matrix-js-sdk/pull/4060)). Contributed by @andybalaam.
+
+
+Changes in [31.3.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v31.3.0) (2024-02-13)
+==================================================================================================
+## ✨ Features
+
+* Add expire\_ts compatibility to matrixRTC ([#4032](https://github.com/matrix-org/matrix-js-sdk/pull/4032)). Contributed by @toger5.
+* Element-R: support for migration of the room list from legacy crypto ([#4036](https://github.com/matrix-org/matrix-js-sdk/pull/4036)). Contributed by @richvdh.
+* Element-R: check persistent room list for encryption config ([#4035](https://github.com/matrix-org/matrix-js-sdk/pull/4035)). Contributed by @richvdh.
+* Support optional MSC3860 redirects ([#4007](https://github.com/matrix-org/matrix-js-sdk/pull/4007)). Contributed by @turt2live.
+
+## 🐛 Bug Fixes
+
+* WebR: migrate the megolm session imported flag ([#4037](https://github.com/matrix-org/matrix-js-sdk/pull/4037)). Contributed by @BillCarsonFr.
+* ElementR: fix emoji verification stalling when both ends hit start at the same time ([#4004](https://github.com/matrix-org/matrix-js-sdk/pull/4004)). Contributed by @uhoreg.
+* Dependencies: Bump wasm bindings version to 4.3.0 ([#4042](https://github.com/matrix-org/matrix-js-sdk/pull/4042)). Contributed by @BillCarsonFr.
+* Element R: emit events when devices have changed ([#4019](https://github.com/matrix-org/matrix-js-sdk/pull/4019)). Contributed by @uhoreg.
+* ElementR: report invalid keys rather than failing to restore from backup ([#4006](https://github.com/matrix-org/matrix-js-sdk/pull/4006)). Contributed by @uhoreg.
+* Make `timeline` a getter ([#4022](https://github.com/matrix-org/matrix-js-sdk/pull/4022)). Contributed by @florianduros.
+* Implement getting verification cancellation info in Rust crypto ([#3947](https://github.com/matrix-org/matrix-js-sdk/pull/3947)). Contributed by @uhoreg.
+* Fix crypto migration for megolm sessions with no sender key ([#4024](https://github.com/matrix-org/matrix-js-sdk/pull/4024)). Contributed by @richvdh.
+
+
 Changes in [31.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v31.2.0) (2024-01-31)
 ==================================================================================================
 ## ✨ Features

package.json

@@ -1,6 +1,6 @@
 {
     "name": "matrix-js-sdk",
-    "version": "31.3.0-rc.3",
+    "version": "31.4.0",
     "description": "Matrix Client-Server SDK for Javascript",
     "engines": {
         "node": ">=18.0.0"
@@ -52,15 +52,15 @@
     ],
     "dependencies": {
         "@babel/runtime": "^7.12.5",
-        "@matrix-org/matrix-sdk-crypto-wasm": "^4.3.0",
+        "@matrix-org/matrix-sdk-crypto-wasm": "^4.5.0",
         "another-json": "^0.2.0",
         "bs58": "^5.0.0",
         "content-type": "^1.0.4",
-        "jwt-decode": "^3.1.2",
+        "jwt-decode": "^4.0.0",
         "loglevel": "^1.7.1",
         "matrix-events-sdk": "0.0.1",
         "matrix-widget-api": "^1.6.0",
-        "oidc-client-ts": "^2.2.4",
+        "oidc-client-ts": "^3.0.1",
         "p-retry": "4",
         "sdp-transform": "^2.14.1",
         "unhomoglyph": "^1.0.6",
@@ -83,6 +83,7 @@
         "@babel/register": "^7.12.10",
         "@casualbot/jest-sonar-reporter": "2.2.7",
         "@matrix-org/olm": "3.2.15",
+        "@peculiar/webcrypto": "^1.4.5",
         "@types/bs58": "^4.0.1",
         "@types/content-type": "^1.1.5",
         "@types/debug": "^4.1.7",
@@ -93,7 +94,6 @@
         "@types/uuid": "9",
         "@typescript-eslint/eslint-plugin": "^6.0.0",
         "@typescript-eslint/parser": "^6.0.0",
-        "allchange": "^1.3.0",
         "babel-jest": "^29.0.0",
         "debug": "^4.3.4",
         "domexception": "^4.0.0",
@@ -117,6 +117,7 @@
         "jest-mock": "^29.0.0",
         "lint-staged": "^15.0.2",
         "matrix-mock-request": "^2.5.0",
+        "node-fetch": "^2.7.0",
         "prettier": "3.2.4",
         "rimraf": "^5.0.0",
         "ts-node": "^10.9.1",

post-release.sh

@@ -1,15 +0,0 @@
-#!/bin/bash
-#
-# Script to perform a post-release steps of matrix-js-sdk.
-#
-# Requires:
-#   jq; install from your distribution's package manager (https://stedolan.github.io/jq/)
-
-set -e
-
-jq --version > /dev/null || (echo "jq is required: please install it"; kill $$)
-
-if [ "$(git branch -lr | grep origin/develop -c)" -ge 1 ]; then
-    "$(dirname "$0")/scripts/release/post-merge-master.sh"
-    git push origin develop
-fi

release.sh

@@ -1,346 +0,0 @@
-#!/bin/bash
-#
-# Script to perform a release of matrix-js-sdk and downstream projects.
-#
-# Requires:
-#   jq; install from your distribution's package manager (https://stedolan.github.io/jq/)
-#   hub; install via brew (macOS) or source/pre-compiled binaries (debian) (https://github.com/github/hub) - Tested on v2.2.9
-#   yarn; install via brew (macOS) or similar (https://yarnpkg.com/docs/install/)
-#
-# Note: this script is also used to release matrix-react-sdk, element-web, and element-desktop.
-
-set -e
-
-jq --version > /dev/null || (echo "jq is required: please install it"; kill $$)
-if [[ $(command -v hub) ]] && [[ $(hub --version) =~ hub[[:space:]]version[[:space:]]([0-9]*).([0-9]*) ]]; then
-    HUB_VERSION_MAJOR=${BASH_REMATCH[1]}
-    HUB_VERSION_MINOR=${BASH_REMATCH[2]}
-    if [[ $HUB_VERSION_MAJOR -lt 2 ]] || [[ $HUB_VERSION_MAJOR -eq 2 && $HUB_VERSION_MINOR -lt 5 ]]; then
-        echo "hub version 2.5 is required, you have $HUB_VERSION_MAJOR.$HUB_VERSION_MINOR installed"
-        exit
-    fi
-else
-    echo "hub is required: please install it"
-    exit
-fi
-yarn --version > /dev/null || (echo "yarn is required: please install it"; kill $$)
-
-USAGE="$0 [-x] [-c changelog_file] vX.Y.Z"
-
-help() {
-    cat <<EOF
-$USAGE
-
-    -c changelog_file:  specify name of file containing changelog
-    -x:                 skip updating the changelog
-EOF
-}
-
-if ! git diff-index --quiet --cached HEAD; then
-    echo "this git checkout has staged (uncommitted) changes. Refusing to release."
-    exit
-fi
-
-if ! git diff-files --quiet; then
-    echo "this git checkout has uncommitted changes. Refusing to release."
-    exit
-fi
-
-skip_changelog=
-changelog_file="CHANGELOG.md"
-while getopts hc:x f; do
-    case $f in
-        h)
-            help
-            exit 0
-            ;;
-        c)
-            changelog_file="$OPTARG"
-            ;;
-        x)
-            skip_changelog=1
-            ;;
-    esac
-done
-shift $(expr $OPTIND - 1)
-
-if [ $# -ne 1 ]; then
-    echo "Usage: $USAGE" >&2
-    exit 1
-fi
-
-function check_dependency {
-    local depver=$(cat package.json | jq -r .dependencies[\"$1\"])
-    if [ "$depver" == "null" ]; then return 0; fi
-
-    echo "Checking version of $1..."
-    local latestver=$(yarn info -s "$1" dist-tags.next)
-    if [ "$depver" != "$latestver" ]
-    then
-        echo "The latest version of $1 is $latestver but package.json depends on $depver."
-        echo -n "Type 'u' to auto-upgrade, 'c' to continue anyway, or 'a' to abort:"
-        read resp
-        if [ "$resp" != "u" ] && [ "$resp" != "c" ]
-        then
-            echo "Aborting."
-            exit 1
-        fi
-        if [ "$resp" == "u" ]
-        then
-            echo "Upgrading $1 to $latestver..."
-            yarn add -E "$1@$latestver"
-            git add -u
-            git commit -m "Upgrade $1 to $latestver"
-        fi
-    fi
-}
-
-function reset_dependency {
-    local depver=$(cat package.json | jq -r .dependencies[\"$1\"])
-    if [ "$depver" == "null" ]; then return 0; fi
-
-    echo "Resetting $1 to develop branch..."
-    yarn add "github:matrix-org/$1#develop"
-    git add -u
-    git commit -m "Reset $1 back to develop branch"
-}
-
-has_subprojects=0
-if [ -f release_config.yaml ]; then
-    subprojects=$(cat release_config.yaml | python -c "import yaml; import sys; print(' '.join(list(yaml.load(sys.stdin)['subprojects'].keys())))" 2> /dev/null)
-    if [ "$?" -eq 0 ]; then
-        has_subprojects=1
-        echo "Checking subprojects for upgrades"
-        for proj in $subprojects; do
-            check_dependency "$proj"
-        done
-    fi
-fi
-
-ret=0
-cat package.json | jq '.dependencies[]' | grep -q '#develop' || ret=$?
-if [ "$ret" -eq 0 ]; then
-    echo "package.json contains develop dependencies. Refusing to release."
-    exit
-fi
-
-# We use Git branch / commit dependencies for some packages, and Yarn seems
-# to have a hard time getting that right. See also
-# https://github.com/yarnpkg/yarn/issues/4734. As a workaround, we clean the
-# global cache here to ensure we get the right thing.
-yarn cache clean
-# Ensure all dependencies are updated
-yarn install --ignore-scripts --frozen-lockfile
-
-# ignore leading v on release
-release="${1#v}"
-tag="v${release}"
-
-prerelease=0
-# We check if this build is a prerelease by looking to
-# see if the version has a hyphen in it. Crude,
-# but semver doesn't support postreleases so anything
-# with a hyphen is a prerelease.
-echo $release | grep -q '-' && prerelease=1
-
-if [ $prerelease -eq 1 ]; then
-    echo Making a PRE-RELEASE
-else
-    read -p "Making a FINAL RELEASE, press enter to continue " REPLY
-fi
-
-rel_branch=$(git symbolic-ref --short HEAD)
-
-if [ -z "$skip_changelog" ]; then
-    echo "Generating changelog"
-    yarn run allchange "$release"
-    read -p "Edit $changelog_file manually, or press enter to continue " REPLY
-
-    if [ -n "$(git ls-files --modified $changelog_file)" ]; then
-        echo "Committing updated changelog"
-        git commit "$changelog_file" -m "Prepare changelog for $tag"
-    fi
-fi
-latest_changes=$(mktemp)
-cat "${changelog_file}" | "$(dirname "$0")/scripts/changelog_head.py" > "${latest_changes}"
-
-set -x
-
-# Bump package.json and build the dist
-echo "yarn version"
-# yarn version will automatically commit its modification
-# and make a release tag. We don't want it to create the tag
-# because it can only sign with the default key, but we can
-# only turn off both of these behaviours, so we have to
-# manually commit the result.
-yarn version --no-git-tag-version --new-version "$release"
-
-"$(dirname "$0")/scripts/release/pre-release.sh"
-
-# commit yarn.lock if it exists, is versioned, and is modified
-if [[ -f yarn.lock && $(git status --porcelain yarn.lock | grep '^ M') ]];
-then
-    pkglock='yarn.lock'
-else
-    pkglock=''
-fi
-git commit package.json $pkglock -m "$tag"
-
-
-# figure out if we should be signing this release
-signing_id=
-if [ -f release_config.yaml ]; then
-    result=$(cat release_config.yaml | python -c "import yaml; import sys; print(yaml.load(sys.stdin)['signing_id'])" 2> /dev/null || true)
-    if [ "$?" -eq 0 ]; then
-        signing_id=$result
-    fi
-fi
-
-
-# If there is a 'dist' script in the package.json,
-# run it in a separate checkout of the project, then
-# upload any files in the 'dist' directory as release
-# assets.
-# We make a completely separate checkout to be sure
-# we're using released versions of the dependencies
-# (rather than whatever we're pulling in from yarn link)
-assets=''
-dodist=0
-jq -e .scripts.dist package.json 2> /dev/null || dodist=$?
-if [ $dodist -eq 0 ]; then
-    projdir=$(pwd)
-    builddir=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
-    echo "Building distribution copy in $builddir"
-    pushd "$builddir"
-    git clone "$projdir" .
-    git checkout "$rel_branch"
-    yarn install --frozen-lockfile
-    # We haven't tagged yet, so tell the dist script what version
-    # it's building
-    DIST_VERSION="$tag" yarn dist
-
-    popd
-
-    for i in "$builddir"/dist/*; do
-        assets="$assets -a $i"
-        if [ -n "$signing_id" ]
-        then
-            gpg -u "$signing_id" --armor --output "$i".asc --detach-sig "$i"
-            assets="$assets -a $i.asc"
-        fi
-    done
-fi
-
-if [ -n "$signing_id" ]; then
-    # make a signed tag
-    # gnupg seems to fail to get the right tty device unless we set it here
-    GIT_COMMITTER_EMAIL="$signing_id" GPG_TTY=$(tty) git tag -u "$signing_id" -F "${latest_changes}" "$tag"
-else
-    git tag -a -F "${latest_changes}" "$tag"
-fi
-
-# push the tag and the release branch
-git push origin "$rel_branch" "$tag"
-
-if [ -n "$signing_id" ]; then
-    # make a signature for the source tarball.
-    #
-    # github will make us a tarball from the tag - we want to create a
-    # signature for it, which means that first of all we need to check that
-    # it's correct.
-    #
-    # we can't deterministically build exactly the same tarball, due to
-    # differences in gzip implementation - but we *can* build the same tar - so
-    # the easiest way to check the validity of the tarball from git is to unzip
-    # it and compare it with our own idea of what the tar should look like.
-
-    # This uses git archive which seems to be what github uses. Specifically,
-    # the header fields are set in the same way: same file mode, uid & gid
-    # both zero and mtime set to the timestamp of the commit that the tag
-    # references. Also note that this puts the commit into the tar headers
-    # and can be extracted with gunzip -c foo.tar.gz | git get-tar-commit-id
-
-    # the name of the sig file we want to create
-    source_sigfile="${tag}-src.tar.gz.asc"
-
-    tarfile="$tag.tar.gz"
-    gh_project_url=$(git remote get-url origin |
-                            sed -e 's#^git@github\.com:#https://github.com/#' \
-                                -e 's#^git\+ssh://git@github\.com/#https://github.com/#' \
-                                -e 's/\.git$//')
-    project_name="${gh_project_url##*/}"
-    curl -L "${gh_project_url}/archive/${tarfile}" -o "${tarfile}"
-
-    # unzip it and compare it with the tar we would generate
-    if ! cmp --silent <(gunzip -c $tarfile) \
-         <(git archive --format tar --prefix="${project_name}-${release}/" "$tag"); then
-
-        # we don't bail out here, because really it's more likely that our comparison
-        # screwed up and it's super annoying to abort the script at this point.
-        cat >&2 <<EOF
-!!!!!!!!!!!!!!!!!
-!!!! WARNING !!!!
-
-Mismatch between our own tarfile and that generated by github: not signing
-source tarball.
-
-To resolve, determine if $tarfile is correct, and if so sign it with gpg and
-attach it to the release as $source_sigfile.
-
-!!!!!!!!!!!!!!!!!
-EOF
-    else
-        gpg -u "$signing_id" --armor --output "$source_sigfile" --detach-sig "$tarfile"
-        assets="$assets -a $source_sigfile"
-    fi
-fi
-
-hubflags=''
-if [ $prerelease -eq 1 ]; then
-    hubflags='-p'
-fi
-
-release_text=$(mktemp)
-echo "$tag" > "${release_text}"
-echo >> "${release_text}"
-cat "${latest_changes}" >> "${release_text}"
-hub release create $hubflags $assets -F "${release_text}" "$tag"
-
-if [ $dodist -eq 0 ]; then
-    rm -rf "$builddir"
-fi
-rm "${release_text}"
-rm "${latest_changes}"
-
-# if it is a pre-release, leave it on the release branch for now.
-if [ $prerelease -eq 1 ]; then
-    git checkout "$rel_branch"
-    exit 0
-fi
-
-# merge release branch to master
-echo "updating master branch"
-git checkout master
-git pull
-git merge "$rel_branch" --no-edit
-
-# push master to github
-git push origin master
-
-# finally, merge master back onto develop (if it exists)
-if [ "$(git branch -lr | grep origin/develop -c)" -ge 1 ]; then
-    git checkout develop
-    git pull
-    git merge master --no-edit
-    git push origin develop
-fi
-
-[ -x ./post-release.sh ] && ./post-release.sh
-
-if [ $has_subprojects -eq 1 ] && [ $prerelease -eq 0 ]; then
-    echo "Resetting subprojects to develop"
-    for proj in $subprojects; do
-        reset_dependency "$proj"
-    done
-    git push origin develop
-fi

scripts/release/merge-release-notes.js

@@ -16,7 +16,10 @@ async function getReleases(github, dependency) {
             repo,
             per_page: 100,
         });
-        const releases = response.data.filter((release) => !release.draft && !release.prerelease);
+        // Only include non-draft & non-prerelease releases, unless the to-release is a pre-release, include that one
+        const releases = response.data.filter(
+            (release) => !release.draft && (!release.prerelease || release.tag_name === `v${toVersion}`),
+        );
 
         const fromVersionIndex = releases.findIndex((release) => release.tag_name === `v${fromVersion}`);
         const toVersionIndex = releases.findIndex((release) => release.tag_name === `v${toVersion}`);
@@ -126,7 +129,7 @@ if (require.main === module) {
         process.exit(1);
     }
     const [releaseId, ...dependencies] = process.argv.slice(2);
-    main({ github, releaseId, dependencies }).then((output) => {
+    main({ github, releaseId, dependencies: ["matrix-react-sdk"] }).then((output) => {
         // eslint-disable-next-line no-console
         console.log(output);
     });

spec/integ/crypto/crypto.spec.ts

@@ -1379,7 +1379,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
         });
         expect(decryptedEvent.getContent().body).toEqual("42");
 
-        const exported = await aliceClient.exportRoomKeys();
+        const exported = await aliceClient.getCrypto()!.exportRoomKeysAsJson();
 
         // start a new client
         await aliceClient.stopClient();
@@ -1395,7 +1395,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
         keyReceiver = new E2EKeyReceiver(homeserverUrl);
         syncResponder = new SyncResponder(homeserverUrl);
         await initCrypto(aliceClient);
-        await aliceClient.importRoomKeys(exported);
+        await aliceClient.getCrypto()!.importRoomKeysAsJson(exported);
         expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
         await startClientAndAwaitFirstSync();
 

spec/integ/crypto/rust-crypto.spec.ts

@@ -112,6 +112,78 @@ describe("MatrixClient.initRustCrypto", () => {
             count: 79,
         });
 
+        fetchMock.post("path:/_matrix/client/v3/keys/query", {
+            device_keys: {
+                "@vdhtest200713:matrix.org": {
+                    KMFSTJSMLB: {
+                        algorithms: ["m.olm.v1.curve25519-aes-sha2", "m.megolm.v1.aes-sha2"],
+                        device_id: "KMFSTJSMLB",
+                        keys: {
+                            "curve25519:KMFSTJSMLB": "LKv0bKbc0EC4h0jknbemv3QalEkeYvuNeUXVRgVVTTU",
+                            "ed25519:KMFSTJSMLB": "qK70DEqIXq7T+UU3v/al47Ab4JkMEBLpNrTBMbS5rrw",
+                        },
+                        user_id: "@vdhtest200713:matrix.org",
+                        signatures: {
+                            "@vdhtest200713:matrix.org": {
+                                "ed25519:KMFSTJSMLB":
+                                    "aE+PdxLAdwQ/xfJwLmqebvt/lrT97fZas2SQFFrM+dPmHxQtjyS8csm88BLfGRjJKK1B/vWev3AaKqQZwLTUAw",
+                                "ed25519:lDvg6vi3P80L9XFNpUSU+5Y87m3p6yHcC83jhSU4Q5k":
+                                    "lCd4SA/JT1nnxsgN9yQaLJQhH5hkLMVVx6ba5JAjL1wpWVqyPxzMJHImX6vTztk6S8rybcdfYkea5W/Ii+4HCQ",
+                            },
+                        },
+                    },
+                },
+            },
+            master_keys: {
+                "@vdhtest200713:matrix.org": {
+                    user_id: "@vdhtest200713:matrix.org",
+                    usage: ["master"],
+                    keys: {
+                        "ed25519:gh9fGr39eNZUdWynEMJ/q/WZq/Pk/foFxHXFBFm18ZI":
+                            "gh9fGr39eNZUdWynEMJ/q/WZq/Pk/foFxHXFBFm18ZI",
+                    },
+                    signatures: {
+                        "@vdhtest200713:matrix.org": {
+                            "ed25519:MWOGVUTXZN":
+                                "stOu1aHbhsWB/Aj5M/HqBR83QzME+682C995Uc8JxSmmyrlWmgG8QrnoUDG2OFR1t6zNQ+QLEilU4WNEOV73DQ",
+                        },
+                    },
+                },
+            },
+            self_signing_keys: {
+                "@vdhtest200713:matrix.org": {
+                    user_id: "@vdhtest200713:matrix.org",
+                    usage: ["self_signing"],
+                    keys: {
+                        "ed25519:lDvg6vi3P80L9XFNpUSU+5Y87m3p6yHcC83jhSU4Q5k":
+                            "lDvg6vi3P80L9XFNpUSU+5Y87m3p6yHcC83jhSU4Q5k",
+                    },
+                    signatures: {
+                        "@vdhtest200713:matrix.org": {
+                            "ed25519:gh9fGr39eNZUdWynEMJ/q/WZq/Pk/foFxHXFBFm18ZI":
+                                "HKTC7NoBhAkfJtmemmkn/HvCCgBQViWZ0uH7aGPRaWMDFgD8T7Q+y1j3FKZv4mhSopR85Fq3FRyXsG8OVvGeBA",
+                        },
+                    },
+                },
+            },
+            user_signing_keys: {
+                "@vdhtest200713:matrix.org": {
+                    user_id: "@vdhtest200713:matrix.org",
+                    usage: ["user_signing"],
+                    keys: {
+                        "ed25519:YShqO/3u5vQ0uucojraWrtoLrek0CYrurN/vH/YPMg8":
+                            "YShqO/3u5vQ0uucojraWrtoLrek0CYrurN/vH/YPMg8",
+                    },
+                    signatures: {
+                        "@vdhtest200713:matrix.org": {
+                            "ed25519:gh9fGr39eNZUdWynEMJ/q/WZq/Pk/foFxHXFBFm18ZI":
+                                "u8VOi4IaeRJwDgy2ftK02NJQPdBijy8f/0+WnHGG72yfOvMthwWzEw8SrRSNG8glBNrfHinKwCyJJzAJwyepCQ",
+                        },
+                    },
+                },
+            },
+        });
+
         const testStoreName = "test-store";
         await populateStore(testStoreName);
         const cryptoStore = new IndexedDBCryptoStore(indexedDB, testStoreName);
@@ -129,6 +201,15 @@ describe("MatrixClient.initRustCrypto", () => {
 
         await matrixClient.initRustCrypto();
 
+        const verificationStatus = await matrixClient
+            .getCrypto()!
+            .getDeviceVerificationStatus("@vdhtest200713:matrix.org", "KMFSTJSMLB");
+
+        // Check that the current device and identity trust is migrated correctly just after migration
+        expect(verificationStatus).toBeDefined();
+        expect(verificationStatus!.crossSigningVerified).toEqual(true);
+        expect(verificationStatus!.signedByOwner).toEqual(true);
+
         // Do some basic checks on the imported data
         const deviceKeys = await matrixClient.getCrypto()!.getOwnDeviceKeys();
         expect(deviceKeys.curve25519).toEqual("LKv0bKbc0EC4h0jknbemv3QalEkeYvuNeUXVRgVVTTU");

spec/unit/crypto/store/IndexedDBCryptoStore.spec.ts

@@ -0,0 +1,73 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import "fake-indexeddb/auto";
+import { IndexedDBCryptoStore } from "../../../../src";
+import { MigrationState } from "../../../../src/crypto/store/base";
+
+describe("IndexedDBCryptoStore", () => {
+    describe("Test `existsAndIsNotMigrated`", () => {
+        beforeEach(async () => {
+            // eslint-disable-next-line no-global-assign
+            indexedDB = new IDBFactory();
+        });
+
+        it("Should be true if there is a legacy database", async () => {
+            // should detect a store that is not migrated
+            const store = new IndexedDBCryptoStore(global.indexedDB, "tests");
+            await store.startup();
+
+            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+
+            expect(result).toBe(true);
+        });
+
+        it("Should be true if there is a legacy database in non migrated state", async () => {
+            // should detect a store that is not migrated
+            const store = new IndexedDBCryptoStore(global.indexedDB, "tests");
+            await store.startup();
+            await store.setMigrationState(MigrationState.NOT_STARTED);
+
+            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+
+            expect(result).toBe(true);
+        });
+
+        describe.each([
+            MigrationState.INITIAL_DATA_MIGRATED,
+            MigrationState.OLM_SESSIONS_MIGRATED,
+            MigrationState.MEGOLM_SESSIONS_MIGRATED,
+            MigrationState.ROOM_SETTINGS_MIGRATED,
+        ])("Exists and Migration state is %s", (migrationState) => {
+            it("Should be false if migration has started", async () => {
+                // should detect a store that is not migrated
+                const store = new IndexedDBCryptoStore(global.indexedDB, "tests");
+                await store.startup();
+                await store.setMigrationState(migrationState);
+
+                const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+
+                expect(result).toBe(false);
+            });
+        });
+
+        it("Should be false if there is no legacy database", async () => {
+            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+
+            expect(result).toBe(false);
+        });
+    });
+});

spec/unit/matrix-client.spec.ts

@@ -3012,4 +3012,22 @@ describe("MatrixClient", function () {
             expect(result).toEqual({});
         });
     });
+
+    describe("getAuthIssuer", () => {
+        it("should use unstable prefix", async () => {
+            httpLookups = [
+                {
+                    method: "GET",
+                    path: `/auth_issuer`,
+                    data: {
+                        issuer: "https://issuer/",
+                    },
+                    prefix: "/_matrix/client/unstable/org.matrix.msc2965",
+                },
+            ];
+
+            await expect(client.getAuthIssuer()).resolves.toEqual({ issuer: "https://issuer/" });
+            expect(httpLookups.length).toEqual(0);
+        });
+    });
 });

spec/unit/matrixrtc/MatrixRTCSession.spec.ts

@@ -74,6 +74,13 @@ describe("MatrixRTCSession", () => {
         expect(sess?.memberships[0].deviceId).toEqual("AAAAAAA");
     });
 
+    it("ignores memberships events of members not in the room", () => {
+        const mockRoom = makeMockRoom([membershipTemplate]);
+        mockRoom.hasMembershipState = (state) => state === "join";
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess?.memberships.length).toEqual(0);
+    });
+
     it("honours created_ts", () => {
         const expiredMembership = Object.assign({}, membershipTemplate);
         expiredMembership.created_ts = 500;
@@ -91,9 +98,12 @@ describe("MatrixRTCSession", () => {
 
     it("safely ignores events with no memberships section", () => {
         const mockRoom = {
+            ...makeMockRoom([]),
             roomId: randomString(8),
             getLiveTimeline: jest.fn().mockReturnValue({
                 getState: jest.fn().mockReturnValue({
+                    on: jest.fn(),
+                    off: jest.fn(),
                     getStateEvents: (_type: string, _stateKey: string) => [
                         {
                             getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
@@ -112,9 +122,12 @@ describe("MatrixRTCSession", () => {
 
     it("safely ignores events with junk memberships section", () => {
         const mockRoom = {
+            ...makeMockRoom([]),
             roomId: randomString(8),
             getLiveTimeline: jest.fn().mockReturnValue({
                 getState: jest.fn().mockReturnValue({
+                    on: jest.fn(),
+                    off: jest.fn(),
                     getStateEvents: (_type: string, _stateKey: string) => [
                         {
                             getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),

spec/unit/matrixrtc/MatrixRTCSessionManager.spec.ts

@@ -87,7 +87,7 @@ describe("MatrixRTCSessionManager", () => {
         expect(onEnded).toHaveBeenCalledWith(room1.roomId, client.matrixRTC.getActiveRoomSession(room1));
     });
 
-    it("Calls onCallEncryption on encryption keys event", () => {
+    it("Calls onCallEncryption on encryption keys event", async () => {
         const room1 = makeMockRoom([membershipTemplate]);
         jest.spyOn(client, "getRooms").mockReturnValue([room1]);
         jest.spyOn(client, "getRoom").mockReturnValue(room1);
@@ -95,7 +95,7 @@ describe("MatrixRTCSessionManager", () => {
         client.emit(ClientEvent.Room, room1);
         const onCallEncryptionMock = jest.fn();
         client.matrixRTC.getRoomSession(room1).onCallEncryption = onCallEncryptionMock;
-
+        client.decryptEventIfNeeded = () => Promise.resolve();
         const timelineEvent = {
             getType: jest.fn().mockReturnValue(EventType.CallEncryptionKeysPrefix),
             getContent: jest.fn().mockReturnValue({}),
@@ -106,6 +106,7 @@ describe("MatrixRTCSessionManager", () => {
             },
         } as unknown as MatrixEvent;
         client.emit(RoomEvent.Timeline, timelineEvent, undefined, undefined, false, {} as IRoomTimelineData);
+        await new Promise(process.nextTick);
         expect(onCallEncryptionMock).toHaveBeenCalled();
     });
 });

spec/unit/matrixrtc/mocks.ts

@@ -24,6 +24,7 @@ export function makeMockRoom(memberships: CallMembershipData[], localAge: number
     const roomState = makeMockRoomState(memberships, roomId, localAge);
     return {
         roomId: roomId,
+        hasMembershipState: jest.fn().mockReturnValue(true),
         getLiveTimeline: jest.fn().mockReturnValue({
             getState: jest.fn().mockReturnValue(roomState),
         }),
@@ -33,6 +34,8 @@ export function makeMockRoom(memberships: CallMembershipData[], localAge: number
 export function makeMockRoomState(memberships: CallMembershipData[], roomId: string, localAge: number | null = null) {
     const event = mockRTCEvent(memberships, roomId, localAge);
     return {
+        on: jest.fn(),
+        off: jest.fn(),
         getStateEvents: (_: string, stateKey: string) => {
             if (stateKey !== undefined) return event;
             return [event];

spec/unit/oidc/authorize.spec.ts

@@ -20,7 +20,10 @@ limitations under the License.
 
 import fetchMock from "fetch-mock-jest";
 import { mocked } from "jest-mock";
-import jwtDecode from "jwt-decode";
+import { jwtDecode } from "jwt-decode";
+import { Crypto } from "@peculiar/webcrypto";
+import { getRandomValues } from "node:crypto";
+import { TextEncoder } from "node:util";
 
 import { Method } from "../../../src";
 import * as crypto from "../../../src/crypto/crypto";
@@ -36,6 +39,8 @@ import { makeDelegatedAuthConfig, mockOpenIdConfiguration } from "../../test-uti
 
 jest.mock("jwt-decode");
 
+const webCrypto = new Crypto();
+
 // save for resetting mocks
 const realSubtleCrypto = crypto.subtleCrypto;
 
@@ -54,6 +59,15 @@ describe("oidc authorization", () => {
         jest.setSystemTime(now);
 
         fetchMock.get(delegatedAuthConfig.issuer + ".well-known/openid-configuration", mockOpenIdConfiguration());
+
+        Object.defineProperty(window, "crypto", {
+            value: {
+                getRandomValues,
+                randomUUID: jest.fn().mockReturnValue("not-random-uuid"),
+                subtle: webCrypto.subtle,
+            },
+        });
+        global.TextEncoder = TextEncoder;
     });
 
     afterEach(() => {
@@ -165,7 +179,8 @@ describe("oidc authorization", () => {
             token_type: "Bearer",
             access_token: "test_access_token",
             refresh_token: "test_refresh_token",
-            id_token: "valid.id.token",
+            id_token:
+                "eyJhbGciOiJSUzI1NiIsImtpZCI6Imh4ZEhXb0Y5bW4ifQ.eyJleHAiOjE3MDgzNTY3NjcsInN1YiI6IjAxSFBQMkZTQllERTlQOUVNTThERDdXWkhSIiwiYXVkIjoiMDFIUTBXSDUyV0paV1JSU1k5V0VFUTVUMlEiLCJub25jZSI6ImhScEI2cGtFMDYiLCJhdXRoX3RpbWUiOjE3MDc5OTAzMTIsImlhdCI6MTcwODM1MzE2NywiYXRfaGFzaCI6Il9HSEU4cDhocHFnMW1ac041YUlycVEiLCJpc3MiOiJodHRwczovL2F1dGgtb2lkYy5sYWIuZWxlbWVudC5kZXYvIiwiY19oYXNoIjoib2hJRmNuaUZWd3pGSzVJdXlsX1RlQSJ9.SGUG78dCC3sTWgQBDTicKwamKiPpb6REiz79CM2ml_kVJCoS7gT0TlztC4h25FKi3c9aB3XCVn9J8UzvJgvG8Rt_oS--FIuhK6oRm7NdcN0bCkbG7iZEWGxx-kQnifcCFHyZ6T1CxR8X00Uvc6_lRfBZVlTyuuQaJ_PHiiKMlV93FbxvQUIq6FTkQP2Z56p4JIXIzjOONzA91skTqQGycl5f9Vhp6cqXFzl6ARK30M7A-8UI5qCxClUJ7kD9KgN5YZ7uivLp1x01WBnik2DXH0eSwXcTX2WLkYtMXgMxylJhIiO586apIC5nr7sfip-Y_4PgBlSjRRgrmOGC-VUFCA",
             expires_in: 300,
         };
 

spec/unit/oidc/register.spec.ts

@@ -17,13 +17,22 @@ limitations under the License.
 import fetchMockJest from "fetch-mock-jest";
 
 import { OidcError } from "../../../src/oidc/error";
-import { registerOidcClient } from "../../../src/oidc/register";
+import { OidcRegistrationClientMetadata, registerOidcClient } from "../../../src/oidc/register";
 
 describe("registerOidcClient()", () => {
     const issuer = "https://auth.com/";
     const registrationEndpoint = "https://auth.com/register";
     const clientName = "Element";
     const baseUrl = "https://just.testing";
+    const metadata: OidcRegistrationClientMetadata = {
+        clientUri: baseUrl,
+        redirectUris: [baseUrl],
+        clientName,
+        applicationType: "web",
+        tosUri: "http://tos-uri",
+        policyUri: "http://policy-uri",
+        contacts: ["admin@example.com"],
+    };
     const dynamicClientId = "xyz789";
 
     const delegatedAuthConfig = {
@@ -42,14 +51,19 @@ describe("registerOidcClient()", () => {
             status: 200,
             body: JSON.stringify({ client_id: dynamicClientId }),
         });
-        expect(await registerOidcClient(delegatedAuthConfig, clientName, baseUrl)).toEqual(dynamicClientId);
-        expect(fetchMockJest).toHaveBeenCalledWith(registrationEndpoint, {
-            headers: {
-                "Accept": "application/json",
-                "Content-Type": "application/json",
-            },
-            method: "POST",
-            body: JSON.stringify({
+        expect(await registerOidcClient(delegatedAuthConfig, metadata)).toEqual(dynamicClientId);
+        expect(fetchMockJest).toHaveBeenCalledWith(
+            registrationEndpoint,
+            expect.objectContaining({
+                headers: {
+                    "Accept": "application/json",
+                    "Content-Type": "application/json",
+                },
+                method: "POST",
+            }),
+        );
+        expect(JSON.parse(fetchMockJest.mock.calls[0][1]!.body as string)).toEqual(
+            expect.objectContaining({
                 client_name: clientName,
                 client_uri: baseUrl,
                 response_types: ["code"],
@@ -59,14 +73,14 @@ describe("registerOidcClient()", () => {
                 token_endpoint_auth_method: "none",
                 application_type: "web",
             }),
-        });
+        );
     });
 
     it("should throw when registration request fails", async () => {
         fetchMockJest.post(registrationEndpoint, {
             status: 500,
         });
-        await expect(() => registerOidcClient(delegatedAuthConfig, clientName, baseUrl)).rejects.toThrow(
+        await expect(() => registerOidcClient(delegatedAuthConfig, metadata)).rejects.toThrow(
             OidcError.DynamicRegistrationFailed,
         );
     });
@@ -77,7 +91,7 @@ describe("registerOidcClient()", () => {
             // no clientId in response
             body: "{}",
         });
-        await expect(() => registerOidcClient(delegatedAuthConfig, clientName, baseUrl)).rejects.toThrow(
+        await expect(() => registerOidcClient(delegatedAuthConfig, metadata)).rejects.toThrow(
             OidcError.DynamicRegistrationInvalid,
         );
     });

spec/unit/oidc/validate.spec.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import { mocked } from "jest-mock";
-import jwtDecode from "jwt-decode";
+import { jwtDecode } from "jwt-decode";
 
 import { M_AUTHENTICATION } from "../../../src";
 import { logger } from "../../../src/logger";
@@ -125,6 +125,8 @@ describe("validateOIDCIssuerWellKnown", () => {
         response_types_supported: ["code"],
         grant_types_supported: ["authorization_code"],
         code_challenge_methods_supported: ["S256"],
+        account_management_uri: "https://authorize.org/account",
+        account_management_actions_supported: ["org.matrix.cross_signing_reset"],
     };
     beforeEach(() => {
         // stub to avoid console litter
@@ -157,6 +159,8 @@ describe("validateOIDCIssuerWellKnown", () => {
             authorizationEndpoint: validWk.authorization_endpoint,
             tokenEndpoint: validWk.token_endpoint,
             registrationEndpoint: validWk.registration_endpoint,
+            accountManagementActionsSupported: ["org.matrix.cross_signing_reset"],
+            accountManagementEndpoint: "https://authorize.org/account",
         });
     });
 
@@ -167,6 +171,8 @@ describe("validateOIDCIssuerWellKnown", () => {
             authorizationEndpoint: validWk.authorization_endpoint,
             tokenEndpoint: validWk.token_endpoint,
             registrationEndpoint: undefined,
+            accountManagementActionsSupported: ["org.matrix.cross_signing_reset"],
+            accountManagementEndpoint: "https://authorize.org/account",
         });
     });
 
@@ -186,6 +192,8 @@ describe("validateOIDCIssuerWellKnown", () => {
         ["code_challenge_methods_supported", undefined],
         ["code_challenge_methods_supported", "not an array"],
         ["code_challenge_methods_supported", ["doesnt include S256"]],
+        ["account_management_uri", { not: "a string" }],
+        ["account_management_actions_supported", { not: "an array" }],
     ])("should throw OP support error when %s is %s", (key, value) => {
         const wk = {
             ...validWk,

spec/unit/rust-crypto/rust-crypto.spec.ts

@@ -383,7 +383,7 @@ describe("RustCrypto", () => {
         );
     });
 
-    describe(".importRoomKeys and .exportRoomKeys", () => {
+    describe("importing and exporting room keys", () => {
         let rustCrypto: RustCrypto;
 
         beforeEach(
@@ -416,6 +416,29 @@ describe("RustCrypto", () => {
 
             expect(aSession).toStrictEqual(exportedKey);
         });
+
+        it("should import and export keys as JSON", async () => {
+            const someRoomKeys = testData.MEGOLM_SESSION_DATA_ARRAY;
+            let importTotal = 0;
+            const opt: ImportRoomKeysOpts = {
+                progressCallback: (stage) => {
+                    importTotal = stage.total ?? 0;
+                },
+            };
+            await rustCrypto.importRoomKeysAsJson(JSON.stringify(someRoomKeys), opt);
+
+            expect(importTotal).toBe(someRoomKeys.length);
+
+            const keys: Array<IMegolmSessionData> = JSON.parse(await rustCrypto.exportRoomKeysAsJson());
+            expect(Array.isArray(keys)).toBeTruthy();
+            expect(keys.length).toBe(someRoomKeys.length);
+
+            const aSession = someRoomKeys[0];
+
+            const exportedKey = keys.find((k) => k.session_id == aSession.session_id);
+
+            expect(aSession).toStrictEqual(exportedKey);
+        });
     });
 
     describe("call preprocess methods", () => {

src/@types/common.ts

@@ -0,0 +1,17 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+export type NonEmptyArray<T> = [T, ...T[]];

src/client.ts

@@ -9974,6 +9974,20 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             throw err;
         }
     }
+
+    /**
+     * Get the OIDC issuer responsible for authentication on this server, if any
+     * @returns Resolves: A promise of an object containing the OIDC issuer if configured
+     * @returns Rejects: when the request fails (module:http-api.MatrixError)
+     * @experimental - part of MSC2965
+     */
+    public async getAuthIssuer(): Promise<{
+        issuer: string;
+    }> {
+        return this.http.request(Method.Get, "/auth_issuer", undefined, undefined, {
+            prefix: ClientPrefix.Unstable + "/org.matrix.msc2965",
+        });
+    }
 }
 
 /**

src/crypto-api.ts

@@ -96,6 +96,17 @@ export interface CryptoApi {
      */
     exportRoomKeys(): Promise<IMegolmSessionData[]>;
 
+    /**
+     * Get a JSON list containing all of the room keys
+     *
+     * This should be encrypted before returning it to the user.
+     *
+     * @returns a promise which resolves to a JSON string
+     *    encoding a list of session export objects,
+     *    each of which is an IMegolmSessionData
+     */
+    exportRoomKeysAsJson(): Promise<string>;
+
     /**
      * Import a list of room keys previously exported by exportRoomKeys
      *
@@ -105,6 +116,17 @@ export interface CryptoApi {
      */
     importRoomKeys(keys: IMegolmSessionData[], opts?: ImportRoomKeysOpts): Promise<void>;
 
+    /**
+     * Import a JSON string encoding a list of room keys previously
+     * exported by exportRoomKeysAsJson
+     *
+     * @param keys - a JSON string encoding a list of session export
+     *    objects, each of which is an IMegolmSessionData
+     * @param opts - options object
+     * @returns a promise which resolves once the keys have been imported
+     */
+    importRoomKeysAsJson(keys: string, opts?: ImportRoomKeysOpts): Promise<void>;
+
     /**
      * Check if the given user has published cross-signing keys.
      *
@@ -593,7 +615,8 @@ export class DeviceVerificationStatus {
 
 /**
  * Room key import progress report.
- * Used when calling {@link CryptoApi#importRoomKeys} as the parameter of
+ * Used when calling {@link CryptoApi#importRoomKeys} or
+ * {@link CryptoApi#importRoomKeysAsJson} as the parameter of
  * the progressCallback. Used to display feedback.
  */
 export interface ImportRoomKeyProgressData {
@@ -604,7 +627,8 @@ export interface ImportRoomKeyProgressData {
 }
 
 /**
- * Options object for {@link CryptoApi#importRoomKeys}.
+ * Options object for {@link CryptoApi#importRoomKeys} and
+ * {@link CryptoApi#importRoomKeysAsJson}.
  */
 export interface ImportRoomKeysOpts {
     /** Reports ongoing progress of the import process. Can be used for feedback. */

src/crypto/index.ts

@@ -3142,6 +3142,16 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
         return exportedSessions;
     }
 
+    /**
+     * Get a JSON list containing all of the room keys
+     *
+     * @returns a JSON string encoding a list of session
+     *    export objects, each of which is an IMegolmSessionData
+     */
+    public async exportRoomKeysAsJson(): Promise<string> {
+        return JSON.stringify(await this.exportRoomKeys());
+    }
+
     /**
      * Import a list of room keys previously exported by exportRoomKeys
      *
@@ -3184,6 +3194,19 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
         ).then();
     }
 
+    /**
+     * Import a JSON string encoding a list of room keys previously
+     * exported by exportRoomKeysAsJson
+     *
+     * @param keys - a JSON string encoding a list of session export
+     *    objects, each of which is an IMegolmSessionData
+     * @param opts - options object
+     * @returns a promise which resolves once the keys have been imported
+     */
+    public async importRoomKeysAsJson(keys: string, opts?: ImportRoomKeysOpts): Promise<void> {
+        return await this.importRoomKeys(JSON.parse(keys));
+    }
+
     /**
      * Counts the number of end to end session keys that are waiting to be backed up
      * @returns Promise which resolves to the number of sessions requiring backup

src/crypto/store/base.ts

@@ -306,6 +306,13 @@ export interface ParkedSharedHistory {
     forwardingCurve25519KeyChain: string[];
 }
 
+/**
+ * Keys for the `account` object store to store the migration state.
+ * Values are defined in `MigrationState`.
+ * @internal
+ */
+export const ACCOUNT_OBJECT_KEY_MIGRATION_STATE = "migrationState";
+
 /**
  * A record of which steps have been completed in the libolm to Rust Crypto migration.
  *
@@ -328,6 +335,10 @@ export enum MigrationState {
 
     /** MEGOLM_SESSIONS_MIGRATED, and in addition, we have migrated all the room settings. */
     ROOM_SETTINGS_MIGRATED,
+
+    /** ROOM_SETTINGS_MIGRATED, and in addition, we have done the first own keys query in order to
+     * load the public part of the keys that have been migrated */
+    INITIAL_OWN_KEY_QUERY_DONE,
 }
 
 /**

src/crypto/store/indexeddb-crypto-store-backend.ts

@@ -30,6 +30,7 @@ import {
     ParkedSharedHistory,
     SecretStorePrivateKeys,
     SESSION_BATCH_SIZE,
+    ACCOUNT_OBJECT_KEY_MIGRATION_STATE,
 } from "./base";
 import { IRoomKeyRequestBody, IRoomKeyRequestRecipient } from "../index";
 import { ICrossSigningKey } from "../../client";
@@ -40,9 +41,6 @@ import { IndexedDBCryptoStore } from "./indexeddb-crypto-store";
 
 const PROFILE_TRANSACTIONS = false;
 
-/* Keys for the `account` object store */
-const ACCOUNT_OBJECT_KEY_MIGRATION_STATE = "migrationState";
-
 /**
  * Implementation of a CryptoStore which is backed by an existing
  * IndexedDB connection. Generally you want IndexedDBCryptoStore

src/crypto/store/indexeddb-crypto-store.ts

@@ -33,6 +33,7 @@ import {
     OutgoingRoomKeyRequest,
     ParkedSharedHistory,
     SecretStorePrivateKeys,
+    ACCOUNT_OBJECT_KEY_MIGRATION_STATE,
 } from "./base";
 import { IRoomKeyRequestBody } from "../index";
 import { ICrossSigningKey } from "../../client";
@@ -63,6 +64,52 @@ export class IndexedDBCryptoStore implements CryptoStore {
         return IndexedDBHelpers.exists(indexedDB, dbName);
     }
 
+    /**
+     * Utility to check if a legacy crypto store exists and has not been migrated.
+     * Returns true if the store exists and has not been migrated, false otherwise.
+     */
+    public static existsAndIsNotMigrated(indexedDb: IDBFactory, dbName: string): Promise<boolean> {
+        return new Promise<boolean>((resolve, reject) => {
+            let exists = true;
+            const openDBRequest = indexedDb.open(dbName);
+            openDBRequest.onupgradeneeded = (): void => {
+                // Since we did not provide an explicit version when opening, this event
+                // should only fire if the DB did not exist before at any version.
+                exists = false;
+            };
+            openDBRequest.onblocked = (): void => reject(openDBRequest.error);
+            openDBRequest.onsuccess = (): void => {
+                const db = openDBRequest.result;
+                if (!exists) {
+                    db.close();
+                    // The DB did not exist before, but has been created as part of this
+                    // existence check. Delete it now to restore previous state. Delete can
+                    // actually take a while to complete in some browsers, so don't wait for
+                    // it. This won't block future open calls that a store might issue next to
+                    // properly set up the DB.
+                    indexedDb.deleteDatabase(dbName);
+                    resolve(false);
+                } else {
+                    const tx = db.transaction([IndexedDBCryptoStore.STORE_ACCOUNT], "readonly");
+                    const objectStore = tx.objectStore(IndexedDBCryptoStore.STORE_ACCOUNT);
+                    const getReq = objectStore.get(ACCOUNT_OBJECT_KEY_MIGRATION_STATE);
+
+                    getReq.onsuccess = (): void => {
+                        const migrationState = getReq.result ?? MigrationState.NOT_STARTED;
+                        resolve(migrationState === MigrationState.NOT_STARTED);
+                    };
+
+                    getReq.onerror = (): void => {
+                        reject(getReq.error);
+                    };
+
+                    db.close();
+                }
+            };
+            openDBRequest.onerror = (): void => reject(openDBRequest.error);
+        });
+    }
+
     private backendPromise?: Promise<CryptoStore>;
     private backend?: CryptoStore;
 

src/matrix.ts

@@ -56,6 +56,7 @@ export * from "./crypto/store/localStorage-crypto-store";
 export * from "./crypto/store/indexeddb-crypto-store";
 export type { OutgoingRoomKeyRequest } from "./crypto/store/base";
 export * from "./content-repo";
+export * from "./@types/common";
 export * from "./@types/uia";
 export * from "./@types/event";
 export * from "./@types/PushRules";

src/matrixrtc/MatrixRTCSession.ts

@@ -21,6 +21,7 @@ import { Room } from "../models/room";
 import { MatrixClient } from "../client";
 import { EventType } from "../@types/event";
 import { CallMembership, CallMembershipData } from "./CallMembership";
+import { RoomStateEvent } from "../models/room-state";
 import { Focus } from "./focus";
 import { MatrixError, MatrixEvent } from "../matrix";
 import { randomString, secureRandomBase64Url } from "../randomstring";
@@ -152,9 +153,11 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
                     }
 
                     if (membership.isExpired()) {
-                        logger.info(
-                            `Ignoring expired device membership ${memberEvent.getSender()}/${membership.deviceId}`,
-                        );
+                        logger.info(`Ignoring expired device membership ${membership.sender}/${membership.deviceId}`);
+                        continue;
+                    }
+                    if (!room.hasMembershipState(membership.sender ?? "", "join")) {
+                        logger.info(`Ignoring membership of user ${membership.sender} who is not in the room.`);
                         continue;
                     }
                     callMemberships.push(membership);
@@ -176,7 +179,7 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
     }
 
     /**
-     * Return a the MatrixRTC for the room, whether there are currently active members or not
+     * Return the MatrixRTC session for the room, whether there are currently active members or not
      */
     public static roomSessionForRoom(client: MatrixClient, room: Room): MatrixRTCSession {
         const callMemberships = MatrixRTCSession.callMembershipsForRoom(room);
@@ -191,6 +194,8 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
     ) {
         super();
         this._callId = memberships[0]?.callId;
+        const roomState = this.room.getLiveTimeline().getState(EventTimeline.FORWARDS);
+        roomState?.on(RoomStateEvent.Members, this.onMembershipUpdate);
         this.setExpiryTimer();
     }
 
@@ -214,6 +219,8 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
             clearTimeout(this.memberEventTimeout);
             this.memberEventTimeout = undefined;
         }
+        const roomState = this.room.getLiveTimeline().getState(EventTimeline.FORWARDS);
+        roomState?.off(RoomStateEvent.Members, this.onMembershipUpdate);
     }
 
     /**
@@ -506,7 +513,7 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
             return;
         }
 
-        // We currently only handle callId = ""
+        // We currently only handle callId = "" (which is the default for room scoped calls)
         if (callId !== "") {
             logger.warn(
                 `Received m.call.encryption_keys with unsupported callId: userId=${userId}, deviceId=${deviceId}, callId=${callId}`,

src/matrixrtc/MatrixRTCSessionManager.ts

@@ -98,16 +98,20 @@ export class MatrixRTCSessionManager extends TypedEventEmitter<MatrixRTCSessionM
         return this.roomSessions.get(room.roomId)!;
     }
 
-    private onTimeline = (event: MatrixEvent): void => {
-        if (event.getType() !== EventType.CallEncryptionKeysPrefix) return;
+    private async consumeCallEncryptionEvent(event: MatrixEvent): Promise<void> {
+        await this.client.decryptEventIfNeeded(event);
+        if (event.getType() !== EventType.CallEncryptionKeysPrefix) return Promise.resolve();
 
         const room = this.client.getRoom(event.getRoomId());
         if (!room) {
             logger.error(`Got room state event for unknown room ${event.getRoomId()}!`);
-            return;
+            return Promise.resolve();
         }
 
         this.getRoomSession(room).onCallEncryption(event);
+    }
+    private onTimeline = (event: MatrixEvent): void => {
+        this.consumeCallEncryptionEvent(event);
     };
 
     private onRoom = (room: Room): void => {

src/models/event.ts

@@ -163,6 +163,10 @@ export interface IVisibilityChange {
     reason: string | null;
 }
 
+export interface IMarkedUnreadEvent {
+    unread: boolean;
+}
+
 export interface IClearEvent {
     room_id?: string;
     type: string;

src/oidc/authorize.ts

@@ -129,6 +129,7 @@ export const generateAuthorizationUrl = async (
  * @param nonce - state
  * @param prompt - indicates to the OP which flow the user should see - eg login or registration
  *          See https://openid.net/specs/openid-connect-prompt-create-1_0.html#name-prompt-parameter
+ * @param urlState - value to append to the opaque state identifier to uniquely identify the callback
  * @returns a Promise with the url as a string
  */
 export const generateOidcAuthorizationUrl = async ({
@@ -139,6 +140,7 @@ export const generateOidcAuthorizationUrl = async ({
     identityServerUrl,
     nonce,
     prompt,
+    urlState,
 }: {
     clientId: string;
     metadata: ValidatedIssuerMetadata;
@@ -147,8 +149,9 @@ export const generateOidcAuthorizationUrl = async ({
     redirectUri: string;
     nonce: string;
     prompt?: string;
+    urlState?: string;
 }): Promise<string> => {
-    const scope = await generateScope();
+    const scope = generateScope();
     const oidcClient = new OidcClient({
         ...metadata,
         client_id: clientId,
@@ -164,6 +167,7 @@ export const generateOidcAuthorizationUrl = async ({
         state: userState,
         nonce,
         prompt,
+        url_state: urlState,
     });
 
     return request.url;
@@ -235,7 +239,7 @@ export const completeAuthorizationCodeGrant = async (
 
         // hydrate the sign in state and create a client
         // the stored sign in state includes oidc configuration we set at the start of the oidc login flow
-        const signInState = SigninState.fromStorageString(stateString);
+        const signInState = await SigninState.fromStorageString(stateString);
         const client = new OidcClient({ ...signInState, stateStore });
 
         // validate the code and state, and attempt to swap the code for tokens

src/oidc/register.ts

@@ -19,16 +19,37 @@ import { OidcError } from "./error";
 import { Method } from "../http-api";
 import { logger } from "../logger";
 import { ValidatedIssuerConfig } from "./validate";
+import { NonEmptyArray } from "../@types/common";
 
 /**
  * Client metadata passed to registration endpoint
  */
 export type OidcRegistrationClientMetadata = {
-    clientName: string;
-    clientUri: string;
-    redirectUris: string[];
+    clientName: OidcRegistrationRequestBody["client_name"];
+    clientUri: OidcRegistrationRequestBody["client_uri"];
+    logoUri?: OidcRegistrationRequestBody["logo_uri"];
+    applicationType: OidcRegistrationRequestBody["application_type"];
+    redirectUris: OidcRegistrationRequestBody["redirect_uris"];
+    contacts: OidcRegistrationRequestBody["contacts"];
+    tosUri: OidcRegistrationRequestBody["tos_uri"];
+    policyUri: OidcRegistrationRequestBody["policy_uri"];
 };
 
+interface OidcRegistrationRequestBody {
+    client_name: string;
+    client_uri: string;
+    logo_uri?: string;
+    contacts: NonEmptyArray<string>;
+    tos_uri: string;
+    policy_uri: string;
+    redirect_uris?: NonEmptyArray<string>;
+    response_types?: NonEmptyArray<string>;
+    grant_types?: NonEmptyArray<string>;
+    id_token_signed_response_alg: string;
+    token_endpoint_auth_method: string;
+    application_type: "web" | "native";
+}
+
 /**
  * Make the client registration request
  * @param registrationEndpoint - URL as returned from issuer ./well-known/openid-configuration
@@ -42,7 +63,7 @@ const doRegistration = async (
     clientMetadata: OidcRegistrationClientMetadata,
 ): Promise<string> => {
     // https://openid.net/specs/openid-connect-registration-1_0.html
-    const metadata = {
+    const metadata: OidcRegistrationRequestBody = {
         client_name: clientMetadata.clientName,
         client_uri: clientMetadata.clientUri,
         response_types: ["code"],
@@ -50,7 +71,11 @@ const doRegistration = async (
         redirect_uris: clientMetadata.redirectUris,
         id_token_signed_response_alg: "RS256",
         token_endpoint_auth_method: "none",
-        application_type: "web",
+        application_type: clientMetadata.applicationType,
+        logo_uri: clientMetadata.logoUri,
+        contacts: clientMetadata.contacts,
+        policy_uri: clientMetadata.policyUri,
+        tos_uri: clientMetadata.tosUri,
     };
     const headers = {
         "Accept": "application/json",
@@ -88,25 +113,16 @@ const doRegistration = async (
 /**
  * Attempts dynamic registration against the configured registration endpoint
  * @param delegatedAuthConfig - Auth config from ValidatedServerConfig
- * @param clientName - Client name to register with the OP, eg 'Element'
- * @param baseUrl - URL of the home page of the Client, eg 'https://app.element.io/'
+ * @param clientMetadata - The metadata for the client which to register
  * @returns Promise<string> resolved with registered clientId
  * @throws when registration is not supported, on failed request or invalid response
  */
 export const registerOidcClient = async (
     delegatedAuthConfig: IDelegatedAuthConfig & ValidatedIssuerConfig,
-    clientName: string,
-    baseUrl: string,
+    clientMetadata: OidcRegistrationClientMetadata,
 ): Promise<string> => {
-    const clientMetadata = {
-        clientName,
-        clientUri: baseUrl,
-        redirectUris: [baseUrl],
-    };
     if (!delegatedAuthConfig.registrationEndpoint) {
         throw new Error(OidcError.DynamicRegistrationNotSupported);
     }
-    const clientId = await doRegistration(delegatedAuthConfig.registrationEndpoint, clientMetadata);
-
-    return clientId;
+    return doRegistration(delegatedAuthConfig.registrationEndpoint, clientMetadata);
 };

src/oidc/validate.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import jwtDecode from "jwt-decode";
+import { jwtDecode } from "jwt-decode";
 import { OidcMetadata, SigninResponse } from "oidc-client-ts";
 
 import { IDelegatedAuthConfig } from "../client";
@@ -31,6 +31,8 @@ export type ValidatedIssuerConfig = {
     authorizationEndpoint: string;
     tokenEndpoint: string;
     registrationEndpoint?: string;
+    accountManagementEndpoint?: string;
+    accountManagementActionsSupported?: string[];
 };
 
 /**
@@ -74,6 +76,16 @@ const optionalStringProperty = (wellKnown: Record<string, unknown>, key: string)
     }
     return true;
 };
+const optionalStringArrayProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {
+    if (
+        !!wellKnown[key] &&
+        (!Array.isArray(wellKnown[key]) || !(<unknown[]>wellKnown[key]).every((v) => typeof v === "string"))
+    ) {
+        logger.error(`Invalid property: ${key}`);
+        return false;
+    }
+    return true;
+};
 const requiredArrayValue = (wellKnown: Record<string, unknown>, key: string, value: any): boolean => {
     const array = wellKnown[key];
     if (!array || !Array.isArray(array) || !array.includes(value)) {
@@ -102,6 +114,8 @@ export const validateOIDCIssuerWellKnown = (wellKnown: unknown): ValidatedIssuer
         requiredStringProperty(wellKnown, "token_endpoint"),
         requiredStringProperty(wellKnown, "revocation_endpoint"),
         optionalStringProperty(wellKnown, "registration_endpoint"),
+        optionalStringProperty(wellKnown, "account_management_uri"),
+        optionalStringArrayProperty(wellKnown, "account_management_actions_supported"),
         requiredArrayValue(wellKnown, "response_types_supported", "code"),
         requiredArrayValue(wellKnown, "grant_types_supported", "authorization_code"),
         requiredArrayValue(wellKnown, "code_challenge_methods_supported", "S256"),
@@ -109,10 +123,12 @@ export const validateOIDCIssuerWellKnown = (wellKnown: unknown): ValidatedIssuer
 
     if (!isInvalid) {
         return {
-            authorizationEndpoint: wellKnown["authorization_endpoint"],
-            tokenEndpoint: wellKnown["token_endpoint"],
-            registrationEndpoint: wellKnown["registration_endpoint"],
-        } as ValidatedIssuerConfig;
+            authorizationEndpoint: <string>wellKnown["authorization_endpoint"],
+            tokenEndpoint: <string>wellKnown["token_endpoint"],
+            registrationEndpoint: <string>wellKnown["registration_endpoint"],
+            accountManagementEndpoint: <string>wellKnown["account_management_uri"],
+            accountManagementActionsSupported: <string[]>wellKnown["account_management_actions_supported"],
+        };
     }
 
     logger.error("Issuer configuration not valid");

src/rust-crypto/backup.ts

@@ -188,7 +188,18 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
      * @returns a promise which resolves once the keys have been imported
      */
     public async importRoomKeys(keys: IMegolmSessionData[], opts?: ImportRoomKeysOpts): Promise<void> {
-        const jsonKeys = JSON.stringify(keys);
+        await this.importRoomKeysAsJson(JSON.stringify(keys), opts);
+    }
+
+    /**
+     * Import a list of room keys previously exported by exportRoomKeysAsJson
+     *
+     * @param keys - a JSON string encoding a list of session export objects,
+     *    each of which is an IMegolmSessionData
+     * @param opts - options object
+     * @returns a promise which resolves once the keys have been imported
+     */
+    public async importRoomKeysAsJson(jsonKeys: string, opts?: ImportRoomKeysOpts): Promise<void> {
         await this.olmMachine.importExportedRoomKeys(jsonKeys, (progress: BigInt, total: BigInt): void => {
             const importOpt: ImportRoomKeyProgressData = {
                 total: Number(total),

src/rust-crypto/index.ts

@@ -22,7 +22,7 @@ import { IHttpOpts, MatrixHttpApi } from "../http-api";
 import { ServerSideSecretStorage } from "../secret-storage";
 import { ICryptoCallbacks } from "../crypto";
 import { Logger } from "../logger";
-import { CryptoStore } from "../crypto/store/base";
+import { CryptoStore, MigrationState } from "../crypto/store/base";
 import { migrateFromLegacyCrypto, migrateRoomSettingsFromLegacyCrypto } from "./libolm_migration";
 
 /**
@@ -152,6 +152,7 @@ async function initOlmMachine(
     olmMachine.roomKeyRequestsEnabled = false;
 
     const rustCrypto = new RustCrypto(logger, olmMachine, http, userId, deviceId, secretStorage, cryptoCallbacks);
+
     await olmMachine.registerRoomKeyUpdatedCallback((sessions: RustSdkCryptoJs.RoomKeyInfo[]) =>
         rustCrypto.onRoomKeysUpdated(sessions),
     );
@@ -182,5 +183,23 @@ async function initOlmMachine(
     // XXX: find a less hacky way to do this.
     await olmMachine.outgoingRequests();
 
+    if (legacyCryptoStore && (await legacyCryptoStore.containsData())) {
+        const migrationState = await legacyCryptoStore.getMigrationState();
+        if (migrationState < MigrationState.INITIAL_OWN_KEY_QUERY_DONE) {
+            logger.debug(`Performing initial key query after migration`);
+            // We need to do an initial keys query so that the rust stack can properly update trust of
+            // the user device and identity from the migrated private keys.
+            // If not done, there is a short period where the own device/identity trust will be undefined after migration.
+            try {
+                await rustCrypto.userHasCrossSigningKeys(userId);
+            } catch (e) {
+                // We don't want to fail the startup if this fails, but we do want to log it.
+                // It will be retried by the sdk.
+                logger.error("Failed to check for cross-signing keys after migration", e);
+            }
+            await legacyCryptoStore.setMigrationState(MigrationState.INITIAL_OWN_KEY_QUERY_DONE);
+        }
+    }
+
     return rustCrypto;
 }

src/rust-crypto/rust-crypto.ts

@@ -346,10 +346,18 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
         return JSON.parse(raw);
     }
 
+    public async exportRoomKeysAsJson(): Promise<string> {
+        return await this.olmMachine.exportRoomKeys(() => true);
+    }
+
     public async importRoomKeys(keys: IMegolmSessionData[], opts?: ImportRoomKeysOpts): Promise<void> {
         return await this.backupManager.importRoomKeys(keys, opts);
     }
 
+    public async importRoomKeysAsJson(keys: string, opts?: ImportRoomKeysOpts): Promise<void> {
+        return await this.backupManager.importRoomKeysAsJson(keys, opts);
+    }
+
     /**
      * Implementation of {@link CryptoApi.userHasCrossSigningKeys}.
      */