v32.3.0-rc.0

* Maybe run complement-crypto

* Use existing checkout

* Test that things fail if crypto breaks

* Fix test; run only on merge queue

* Prettier

* Maybe get it working in a merge queue

.github/workflows/downstream-end-to-end-tests.yml

@@ -27,6 +27,7 @@ jobs:
             issues: read
             pull-requests: read
         with:
+            matrix-js-sdk-sha: ${{ github.sha }}
             react-sdk-repository: matrix-org/matrix-react-sdk
             # We only want to run the playwright tests on merge queue to prevent regressions
             # from creeping in. They take a long time to run and consume multiple concurrent runners.

.github/workflows/tests.yml

@@ -71,6 +71,24 @@ jobs:
             disable_coverage: true
             matrix-js-sdk-sha: ${{ github.sha }}
 
+    complement-crypto:
+        name: "Run Complement Crypto tests"
+        if: github.event_name == 'merge_group'
+        uses: matrix-org/complement-crypto/.github/workflows/single_sdk_tests.yml@main
+        with:
+            use_js_sdk: "."
+
+    # we need this so the job is reported properly when run in a merge queue
+    downstream-complement-crypto:
+        name: Downstream Complement Crypto tests
+        runs-on: ubuntu-latest
+        if: always()
+        needs:
+            - complement-crypto
+        steps:
+            - if: needs.complement-crypto.result != 'skipped' && needs.complement-crypto.result != 'success'
+              run: exit 1
+
     # Hook for branch protection to skip downstream testing outside of merge queues
     # and skip sonarcloud coverage within merge queues
     downstream:

README.md

@@ -21,6 +21,10 @@ endpoints from before Matrix 1.1, for example.
 
 # Quickstart
 
+> [!IMPORTANT]
+> Servers may require or use authenticated endpoints for media (images, files, avatars, etc). See the
+> [Authenticated Media](#authenticated-media) section for information on how to enable support for this.
+
 Using `yarn` instead of `npm` is recommended. Please see the Yarn [install guide](https://classic.yarnpkg.com/en/docs/install)
 if you do not have it already.
 
@@ -89,6 +93,34 @@ Object.keys(client.store.rooms).forEach((roomId) => {
 });
 ```
 
+## Authenticated media
+
+Servers supporting [MSC3916](https://github.com/matrix-org/matrix-spec-proposals/pull/3916) will require clients, like
+yours, to include an `Authorization` header when `/download`ing or `/thumbnail`ing media. For NodeJS environments this
+may be as easy as the following code snippet, though web browsers may need to use [Service Workers](https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API)
+to append the header when using the endpoints in `<img />` elements and similar.
+
+```javascript
+const downloadUrl = client.mxcUrlToHttp(
+    /*mxcUrl=*/ "mxc://example.org/abc123", // the MXC URI to download/thumbnail, typically from an event or profile
+    /*width=*/ undefined, // part of the thumbnail API. Use as required.
+    /*height=*/ undefined, // part of the thumbnail API. Use as required.
+    /*resizeMethod=*/ undefined, // part of the thumbnail API. Use as required.
+    /*allowDirectLinks=*/ false, // should generally be left `false`.
+    /*allowRedirects=*/ true, // implied supported with authentication
+    /*useAuthentication=*/ true, // the flag we're after in this example
+);
+const img = await fetch(downloadUrl, {
+    headers: {
+        Authorization: `Bearer ${client.getAccessToken()}`,
+    },
+});
+// Do something with `img`.
+```
+
+> [!WARNING]
+> In future the js-sdk will _only_ return authentication-required URLs, mandating population of the `Authorization` header.
+
 ## What does this SDK do?
 
 This SDK provides a full object model around the Matrix Client-Server API and emits

package.json

@@ -1,6 +1,6 @@
 {
     "name": "matrix-js-sdk",
-    "version": "32.2.0",
+    "version": "32.3.0-rc.0",
     "description": "Matrix Client-Server SDK for Javascript",
     "engines": {
         "node": ">=18.0.0"

spec/unit/content-repo.spec.ts

@@ -76,5 +76,29 @@ describe("ContentRepo", function () {
                 baseUrl + "/_matrix/media/v3/download/server.name/resourceid#automade",
             );
         });
+
+        it("should return an authenticated URL when requested", function () {
+            const mxcUri = "mxc://server.name/resourceid";
+            expect(getHttpUriForMxc(baseUrl, mxcUri, undefined, undefined, undefined, undefined, true, true)).toEqual(
+                baseUrl +
+                    "/_matrix/client/unstable/org.matrix.msc3916/media/download/server.name/resourceid?allow_redirect=true",
+            );
+            expect(getHttpUriForMxc(baseUrl, mxcUri, 64, 64, "scale", undefined, true, true)).toEqual(
+                baseUrl +
+                    "/_matrix/client/unstable/org.matrix.msc3916/media/thumbnail/server.name/resourceid?width=64&height=64&method=scale&allow_redirect=true",
+            );
+        });
+
+        it("should force-enable allow_redirects when useAuthentication is set true", function () {
+            const mxcUri = "mxc://server.name/resourceid";
+            expect(getHttpUriForMxc(baseUrl, mxcUri, undefined, undefined, undefined, undefined, false, true)).toEqual(
+                baseUrl +
+                    "/_matrix/client/unstable/org.matrix.msc3916/media/download/server.name/resourceid?allow_redirect=true",
+            );
+            expect(getHttpUriForMxc(baseUrl, mxcUri, 64, 64, "scale", undefined, false, true)).toEqual(
+                baseUrl +
+                    "/_matrix/client/unstable/org.matrix.msc3916/media/thumbnail/server.name/resourceid?width=64&height=64&method=scale&allow_redirect=true",
+            );
+        });
     });
 });

spec/unit/matrix-client.spec.ts

@@ -386,6 +386,9 @@ describe("MatrixClient", function () {
             expect(client.mxcUrlToHttp(mxc, 32, 46, "scale", false, true)).toBe(
                 getHttpUriForMxc(client.baseUrl, mxc, 32, 46, "scale", false, true),
             );
+            expect(client.mxcUrlToHttp(mxc, 32, 46, "scale", false, true, true)).toBe(
+                getHttpUriForMxc(client.baseUrl, mxc, 32, 46, "scale", false, true, true),
+            );
         });
     });
 

src/@types/partials.ts

@@ -45,14 +45,6 @@ export enum RestrictedAllowType {
     RoomMembership = "m.room_membership",
 }
 
-export interface IJoinRuleEventContent {
-    join_rule: JoinRule; // eslint-disable-line camelcase
-    allow?: {
-        type: RestrictedAllowType;
-        room_id: string; // eslint-disable-line camelcase
-    }[];
-}
-
 export enum GuestAccess {
     CanJoin = "can_join",
     Forbidden = "forbidden",

src/@types/state_events.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import { RoomType } from "./event";
-import { GuestAccess, HistoryVisibility, RestrictedAllowType } from "./partials";
+import { GuestAccess, HistoryVisibility, JoinRule, RestrictedAllowType } from "./partials";
 import { ImageInfo } from "./media";
 import { PolicyRecommendation } from "../models/invites-ignorer";
 
@@ -36,6 +36,7 @@ export interface RoomCreateEventContent {
 }
 
 export interface RoomJoinRulesEventContent {
+    join_rule: JoinRule;
     allow?: {
         room_id: string;
         type: RestrictedAllowType;

src/client.ts

@@ -4876,10 +4876,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                 pathTemplate = "/rooms/$roomId/state/$eventType/$stateKey";
             }
             path = utils.encodeUri(pathTemplate, pathParams);
-        } else if (event.isRedaction()) {
+        } else if (event.isRedaction() && event.event.redacts) {
             const pathTemplate = `/rooms/$roomId/redact/$redactsEventId/$txnId`;
             path = utils.encodeUri(pathTemplate, {
-                $redactsEventId: event.event.redacts!,
+                $redactsEventId: event.event.redacts,
                 ...pathParams,
             });
         } else {
@@ -5775,7 +5775,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * anyone they share a room with. If false, will return null for such URLs.
      * @param allowRedirects - If true, the caller supports the URL being 307 or
      * 308 redirected to another resource upon request. If false, redirects
-     * are not expected.
+     * are not expected. Implied `true` when `useAuthentication` is `true`.
+     * @param useAuthentication - If true, the caller supports authenticated
+     * media and wants an authentication-required URL. Note that server support
+     * for authenticated media will *not* be checked - it is the caller's responsibility
+     * to do so before calling this function. Note also that `useAuthentication`
+     * implies `allowRedirects`. Defaults to false (unauthenticated endpoints).
      * @returns the avatar URL or null.
      */
     public mxcUrlToHttp(
@@ -5785,8 +5790,18 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         resizeMethod?: string,
         allowDirectLinks?: boolean,
         allowRedirects?: boolean,
+        useAuthentication?: boolean,
     ): string | null {
-        return getHttpUriForMxc(this.baseUrl, mxcUrl, width, height, resizeMethod, allowDirectLinks, allowRedirects);
+        return getHttpUriForMxc(
+            this.baseUrl,
+            mxcUrl,
+            width,
+            height,
+            resizeMethod,
+            allowDirectLinks,
+            allowRedirects,
+            useAuthentication,
+        );
     }
 
     /**

src/content-repo.ts

@@ -30,7 +30,12 @@ import { encodeParams } from "./utils";
  * for such URLs.
  * @param allowRedirects - If true, the caller supports the URL being 307 or
  * 308 redirected to another resource upon request. If false, redirects
- * are not expected.
+ * are not expected. Implied `true` when `useAuthentication` is `true`.
+ * @param useAuthentication - If true, the caller supports authenticated
+ * media and wants an authentication-required URL. Note that server support
+ * for authenticated media will *not* be checked - it is the caller's responsibility
+ * to do so before calling this function. Note also that `useAuthentication`
+ * implies `allowRedirects`. Defaults to false (unauthenticated endpoints).
  * @returns The complete URL to the content.
  */
 export function getHttpUriForMxc(
@@ -41,6 +46,7 @@ export function getHttpUriForMxc(
     resizeMethod?: string,
     allowDirectLinks = false,
     allowRedirects?: boolean,
+    useAuthentication?: boolean,
 ): string {
     if (typeof mxc !== "string" || !mxc) {
         return "";
@@ -52,8 +58,23 @@ export function getHttpUriForMxc(
             return "";
         }
     }
+
+    if (useAuthentication) {
+        allowRedirects = true; // per docs (MSC3916 always expects redirects)
+
+        // Dev note: MSC3916 (as of writing) removes `allow_redirect` entirely, but
+        // for explicitness we set it here. This makes it slightly more obvious to
+        // callers, hopefully.
+    }
+
     let serverAndMediaId = mxc.slice(6); // strips mxc://
-    let prefix = "/_matrix/media/v3/download/";
+    let prefix: string;
+    if (useAuthentication) {
+        // TODO: Use stable once available (requires FCP on MSC3916).
+        prefix = "/_matrix/client/unstable/org.matrix.msc3916/media/download/";
+    } else {
+        prefix = "/_matrix/media/v3/download/";
+    }
     const params: Record<string, string> = {};
 
     if (width) {
@@ -68,7 +89,12 @@ export function getHttpUriForMxc(
     if (Object.keys(params).length > 0) {
         // these are thumbnailing params so they probably want the
         // thumbnailing API...
-        prefix = "/_matrix/media/v3/thumbnail/";
+        if (useAuthentication) {
+            // TODO: Use stable once available (requires FCP on MSC3916).
+            prefix = "/_matrix/client/unstable/org.matrix.msc3916/media/thumbnail/";
+        } else {
+            prefix = "/_matrix/media/v3/thumbnail/";
+        }
     }
 
     if (typeof allowRedirects === "boolean") {

src/crypto/verification/QRCode.ts

@@ -74,7 +74,7 @@ export class ReciprocateQRCode extends Base {
         await new Promise<void>((resolve, reject) => {
             this.reciprocateQREvent = {
                 confirm: resolve,
-                cancel: () => reject(newUserCancelledError()),
+                cancel: (): void => reject(newUserCancelledError()),
             };
             this.emit(QrCodeEvent.ShowReciprocateQr, this.reciprocateQREvent);
         });

src/crypto/verification/SAS.ts

@@ -308,8 +308,8 @@ export class SAS extends Base {
                         reject(err);
                     }
                 },
-                cancel: () => reject(newUserCancelledError()),
-                mismatch: () => reject(newMismatchedSASError()),
+                cancel: (): void => reject(newUserCancelledError()),
+                mismatch: (): void => reject(newMismatchedSASError()),
             };
             this.emit(SasEvent.ShowSas, this.sasEvent);
         });

src/http-api/method.ts

@@ -19,4 +19,7 @@ export enum Method {
     Put = "PUT",
     Post = "POST",
     Delete = "DELETE",
+    Options = "OPTIONS",
+    Head = "HEAD",
+    Patch = "PATCH",
 }

src/matrix.ts

@@ -105,6 +105,10 @@ export { IdentityProviderBrand, SSOAction } from "./@types/auth";
 export type { ISSOFlow as SSOFlow, LoginFlow } from "./@types/auth";
 export type { IHierarchyRelation as HierarchyRelation, IHierarchyRoom as HierarchyRoom } from "./@types/spaces";
 export { LocationAssetType } from "./@types/location";
+/**
+ * @deprecated in favour of RoomJoinRulesEventContent on the types export
+ */
+export type { RoomJoinRulesEventContent as IJoinRuleEventContent } from "./@types/state_events";
 
 /**
  * Types supporting cryptography.

src/models/room-state.ts

@@ -20,12 +20,13 @@ import { isNumber, removeHiddenChars } from "../utils";
 import { EventType, UNSTABLE_MSC2716_MARKER } from "../@types/event";
 import { IEvent, MatrixEvent, MatrixEventEvent } from "./event";
 import { MatrixClient } from "../client";
-import { GuestAccess, HistoryVisibility, IJoinRuleEventContent, JoinRule } from "../@types/partials";
+import { GuestAccess, HistoryVisibility, JoinRule } from "../@types/partials";
 import { TypedEventEmitter } from "./typed-event-emitter";
 import { Beacon, BeaconEvent, BeaconEventHandlerMap, getBeaconInfoIdentifier, BeaconIdentifier } from "./beacon";
 import { TypedReEmitter } from "../ReEmitter";
 import { M_BEACON, M_BEACON_INFO } from "../@types/beacon";
 import { KnownMembership } from "../@types/membership";
+import { RoomJoinRulesEventContent } from "../@types/state_events";
 
 export interface IMarkerFoundOptions {
     /** Whether the timeline was empty before the marker event arrived in the
@@ -962,7 +963,7 @@ export class RoomState extends TypedEventEmitter<EmittedEvents, EventHandlerMap>
      */
     public getJoinRule(): JoinRule {
         const joinRuleEvent = this.getStateEvents(EventType.RoomJoinRules, "");
-        const joinRuleContent: Partial<IJoinRuleEventContent> = joinRuleEvent?.getContent() ?? {};
+        const joinRuleContent: Partial<RoomJoinRulesEventContent> = joinRuleEvent?.getContent() ?? {};
         return joinRuleContent["join_rule"] || JoinRule.Invite;
     }
 

src/oidc/validate.ts

@@ -15,7 +15,7 @@ limitations under the License.
 */
 
 import { jwtDecode } from "jwt-decode";
-import { OidcMetadata, SigninResponse } from "oidc-client-ts";
+import { IdTokenClaims, OidcMetadata, SigninResponse } from "oidc-client-ts";
 
 import { logger } from "../logger";
 import { OidcError } from "./error";
@@ -139,28 +139,7 @@ export function isValidatedIssuerMetadata(
     validateOIDCIssuerWellKnown(metadata);
 }
 
-/**
- * Standard JWT claims.
- *
- * @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1
- */
-interface JwtClaims {
-    [claim: string]: unknown;
-    /** The "iss" (issuer) claim identifies the principal that issued the JWT. */
-    iss?: string;
-    /** The "sub" (subject) claim identifies the principal that is the subject of the JWT. */
-    sub?: string;
-    /** The "aud" (audience) claim identifies the recipients that the JWT is intended for. */
-    aud?: string | string[];
-    /** The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. */
-    exp?: number;
-    // unused claims excluded
-}
-interface IdTokenClaims extends JwtClaims {
-    nonce?: string;
-}
-
-const decodeIdToken = (token: string): IdTokenClaims => {
+export const decodeIdToken = (token: string): IdTokenClaims => {
     try {
         return jwtDecode<IdTokenClaims>(token);
     } catch (error) {
@@ -276,7 +255,7 @@ export type BearerTokenResponse = {
     expires_in?: number;
     // from oidc-client-ts
     expires_at?: number;
-    id_token?: string;
+    id_token: string;
 };
 
 /**

src/rust-crypto/verification.ts

@@ -567,8 +567,10 @@ export class RustQrCodeVerifier extends BaseRustVerifer<RustSdkCryptoJs.Qr> impl
         // application to prompt the user to confirm their side.
         if (this.callbacks === null && this.inner.hasBeenScanned()) {
             this.callbacks = {
-                confirm: () => this.confirmScanning(),
-                cancel: () => this.cancel(),
+                confirm: (): void => {
+                    this.confirmScanning();
+                },
+                cancel: (): void => this.cancel(),
             };
         }