v34.12.0

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

.eslintrc.cjs

@@ -1,5 +1,5 @@
 module.exports = {
-    plugins: ["matrix-org", "import", "jsdoc", "node"],
+    plugins: ["matrix-org", "import", "jsdoc", "n"],
     extends: ["plugin:matrix-org/babel", "plugin:matrix-org/jest", "plugin:import/typescript"],
     parserOptions: {
         project: ["./tsconfig.json"],
@@ -63,6 +63,10 @@ module.exports = {
                 name: "setImmediate",
                 message: "Use setTimeout instead.",
             },
+            {
+                name: "global",
+                message: "Use globalThis instead.",
+            },
         ],
 
         "import/no-restricted-paths": [
@@ -108,10 +112,8 @@ module.exports = {
                 "@typescript-eslint/ban-ts-comment": "off",
                 // We're okay with assertion errors when we ask for them
                 "@typescript-eslint/no-non-null-assertion": "off",
-
-                // The non-TypeScript rule produces false positives
-                "func-call-spacing": "off",
-                "@typescript-eslint/func-call-spacing": ["error"],
+                // We do this sometimes to brand interfaces
+                "@typescript-eslint/no-empty-object-type": "off",
 
                 "quotes": "off",
                 // We use a `logger` intermediary module
@@ -129,7 +131,7 @@ module.exports = {
                 // "jsdoc/check-param-names": "error",
                 // "jsdoc/check-indentation": "error",
                 // Ensure .ts extension on imports outside of tests
-                "node/file-extension-in-import": [
+                "n/file-extension-in-import": [
                     "error",
                     "always",
                     {

.github/CODEOWNERS

@@ -8,6 +8,7 @@
 /spec/*/webrtc            @matrix-org/element-call-reviewers
 /spec/*/matrixrtc            @matrix-org/element-call-reviewers
 
+/src/crypto-api           @matrix-org/element-crypto-web-reviewers
 /src/crypto               @matrix-org/element-crypto-web-reviewers
 /src/rust-crypto          @matrix-org/element-crypto-web-reviewers
 /spec/integ/crypto        @matrix-org/element-crypto-web-reviewers

.github/workflows/backport.yml

@@ -10,7 +10,7 @@ on:
 jobs:
     backport:
         name: Backport
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         # Only react to merged PRs for security reasons.
         # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
         if: >

.github/workflows/docs-pr-netlify.yaml

@@ -9,7 +9,7 @@ on:
 jobs:
     netlify:
         if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - name: 📥 Download artifact
               uses: actions/download-artifact@v4

.github/workflows/downstream-end-to-end-tests.yml

@@ -21,14 +21,13 @@ concurrency:
 jobs:
     playwright:
         name: Playwright
-        uses: element-hq/matrix-react-sdk/.github/workflows/end-to-end-tests.yaml@develop
+        uses: element-hq/element-web/.github/workflows/end-to-end-tests.yaml@develop
         permissions:
             actions: read
             issues: read
             pull-requests: read
         with:
             matrix-js-sdk-sha: ${{ github.sha }}
-            react-sdk-repository: element-hq/matrix-react-sdk
             # We only want to run the playwright tests on merge queue to prevent regressions
             # from creeping in. They take a long time to run and consume multiple concurrent runners.
             skip: ${{ github.event_name != 'merge_group' }}

.github/workflows/notify-downstream.yaml

@@ -14,10 +14,8 @@ jobs:
                 include:
                     - repo: element-hq/element-web
                       event: element-web-notify
-                    - repo: element-hq/matrix-react-sdk
-                      event: upstream-sdk-notify
 
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - name: Notify matrix-react-sdk repo that a new SDK build is on develop so it can CI against it
               uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3

.github/workflows/pull_request.yaml

@@ -12,7 +12,7 @@ concurrency: ${{ github.workflow }}-${{ github.event.pull_request.head.ref || gi
 jobs:
     changelog:
         name: Preview Changelog
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: mheap/github-action-required-labels@d25134c992b943fb6ad00c25ea00eb5988c0a9dd # v5
               if: github.event_name != 'merge_group'
@@ -29,7 +29,7 @@ jobs:
 
     prevent-blocked:
         name: Prevent Blocked
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         permissions:
             pull-requests: read
         steps:
@@ -42,7 +42,7 @@ jobs:
 
     community-prs:
         name: Label Community PRs
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         if: github.event.action == 'opened'
         steps:
             - name: Check membership
@@ -69,7 +69,7 @@ jobs:
 
     close-if-fork-develop:
         name: Forbid develop branch fork contributions
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         if: >
             github.event.action == 'opened' &&
             github.event.pull_request.head.ref == 'develop' &&

.github/workflows/release-drafter-workflow.yml

@@ -10,7 +10,7 @@ on:
 concurrency: release-drafter-action
 jobs:
     draft:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - name: 🧮 Checkout code
               uses: actions/checkout@v4

.github/workflows/release-gitflow.yml

@@ -15,7 +15,7 @@ on:
 concurrency: ${{ github.workflow }}
 jobs:
     merge:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@v4
               with:
@@ -49,9 +49,6 @@ jobs:
                   git checkout develop
                   git merge -X ours master
 
-            - name: Run post-merge-master script to revert package.json fields
-              run: ./.action-repo/scripts/release/post-merge-master.sh
-
             - name: Reset dependencies
               if: inputs.dependencies
               run: |
@@ -61,26 +58,25 @@ jobs:
                       CURRENT_VERSION=$(cat package.json | jq -r .dependencies[\"$PACKAGE\"])
                       echo "Current $PACKAGE version is $CURRENT_VERSION"
 
-                      if [ "$CURRENT_VERSION" == "null" ]
+                      if [[ "$CURRENT_VERSION" == "null" ]]
                       then
                           echo "Unable to find $PACKAGE in package.json"
                           exit 1
                       fi
 
-                      if [ "$CURRENT_VERSION" == "develop" ]
+                      if [[ "$CURRENT_VERSION" == *"#develop" ]]
                       then
                           echo "Not updating dependency $PACKAGE"
                           continue
                       fi
 
-                      echo "Resetting $1 to develop branch..."
+                      echo "Resetting $PACKAGE to develop branch..."
                       yarn add "github:matrix-org/$PACKAGE#develop"
                       git add -u
                       git commit -m "Reset $PACKAGE back to develop branch"
                   done <<< "$DEPENDENCIES"
               env:
                   DEPENDENCIES: ${{ inputs.dependencies }}
-                  FINAL: ${{ inputs.final }}
 
             - name: Push changes
               run: git push origin develop

.github/workflows/release-make.yml

@@ -41,7 +41,7 @@ on:
 jobs:
     release:
         name: Release
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         environment: Release
         steps:
             - name: Load GPG key
@@ -136,7 +136,9 @@ jobs:
                   done
 
             - name: Bump package.json version
-              run: yarn version --no-git-tag-version --new-version "${VERSION#v}"
+              run: |
+                  yarn version --no-git-tag-version --new-version "${VERSION#v}"
+                  git add package.json
 
             - name: Add to CHANGELOG.md
               if: inputs.final
@@ -158,11 +160,6 @@ jobs:
               env:
                   RELEASE_NOTES: ${{ steps.draft-release.outputs.body }}
 
-            - name: Run pre-release script to update package.json fields
-              run: |
-                  ./.action-repo/scripts/release/pre-release.sh
-                  git add package.json
-
             - name: Commit changes
               run: git commit -m "$VERSION"
 
@@ -276,7 +273,7 @@ jobs:
     post-release:
         name: Post release steps
         needs: release
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - id: repository
               run: echo "REPO=${GITHUB_REPOSITORY#*/}" >> $GITHUB_OUTPUT
@@ -304,7 +301,7 @@ jobs:
     bump-downstreams:
         name: Update npm dependency in downstream projects
         needs: npm
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         if: inputs.downstreams
         strategy:
             matrix:

.github/workflows/release-npm.yml

@@ -11,7 +11,7 @@ on:
 jobs:
     npm:
         name: Publish to npm
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         outputs:
             id: ${{ steps.npm-publish.outputs.id }}
         steps:
@@ -39,6 +39,10 @@ jobs:
                   tag: next
                   ignore-scripts: false
 
+            - name: Check npm package was published
+              if: steps.npm-publish.outputs.id == ''
+              run: exit 1
+
             - name: 🎖️ Add `latest` dist-tag to final releases
               if: steps.npm-publish.outputs.id && !contains(steps.npm-publish.outputs.id, '-rc.')
               run: npm dist-tag add "$release" latest

.github/workflows/release.yml

@@ -28,13 +28,13 @@ jobs:
         with:
             final: ${{ inputs.mode == 'final' }}
             npm: ${{ inputs.npm }}
-            downstreams: '["element-hq/matrix-react-sdk", "element-hq/element-web"]'
+            downstreams: '["element-hq/element-web"]'
 
     docs:
         name: Publish Documentation
         needs: release
         if: inputs.docs
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - name: 🧮 Checkout code
               uses: actions/checkout@v4
@@ -60,7 +60,7 @@ jobs:
         environment:
             name: github-pages
             url: ${{ steps.deployment.outputs.page_url }}
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         needs: docs
         # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
         permissions:

.github/workflows/sonarcloud.yml

@@ -14,7 +14,7 @@ on:
                 description: "Whether to combine multiple LCOV and jest-sonar-report files in coverage artifact"
 jobs:
     sonarqube:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         if: |
             github.event.workflow_run.conclusion == 'success' &&
             github.event.workflow_run.event != 'merge_group'
@@ -30,7 +30,7 @@ jobs:
                   target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
             - name: "🧮 Checkout code"
-              uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+              uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
               with:
                   repository: ${{ github.event.workflow_run.head_repository.full_name }}
                   ref: ${{ github.event.workflow_run.head_branch }} # checkout commit that triggered this workflow

.github/workflows/static_analysis.yml

@@ -11,7 +11,7 @@ concurrency:
 jobs:
     ts_lint:
         name: "Typescript Syntax Check"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@v4
 
@@ -26,19 +26,9 @@ jobs:
             - name: Typecheck
               run: "yarn run lint:types"
 
-            - name: Switch js-sdk to release mode
-              run: |
-                  scripts/switch_package_to_release.js
-                  yarn install
-                  yarn run build:compile
-                  yarn run build:types
-
-            - name: Typecheck (release mode)
-              run: "yarn run lint:types"
-
     js_lint:
         name: "ESLint"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@v4
 
@@ -55,7 +45,7 @@ jobs:
 
     workflow_lint:
         name: "Workflow Lint"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@v4
 
@@ -72,7 +62,7 @@ jobs:
 
     docs:
         name: "JSDoc Checker"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@v4
 
@@ -97,7 +87,7 @@ jobs:
 
     analyse_dead_code:
         name: "Analyse Dead Code"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@v4
 

.github/workflows/tests.yml

@@ -13,7 +13,7 @@ env:
 jobs:
     jest:
         name: "Jest [${{ matrix.specs }}] (Node ${{ matrix.node == '*' && 'latest' || matrix.node }})"
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         timeout-minutes: 10
         strategy:
             matrix:
@@ -68,15 +68,15 @@ jobs:
         name: Jest tests
         needs: jest
         if: always()
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - if: needs.jest.result != 'skipped' && needs.jest.result != 'success'
               run: exit 1
 
-    matrix-react-sdk:
-        name: Downstream test matrix-react-sdk
+    element-web:
+        name: Downstream test element-web
         if: github.event_name == 'merge_group'
-        uses: element-hq/matrix-react-sdk/.github/workflows/tests.yml@develop
+        uses: element-hq/element-web/.github/workflows/tests.yml@develop
         with:
             disable_coverage: true
             matrix-js-sdk-sha: ${{ github.sha }}
@@ -91,7 +91,7 @@ jobs:
     # we need this so the job is reported properly when run in a merge queue
     downstream-complement-crypto:
         name: Downstream Complement Crypto tests
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         if: always()
         needs:
             - complement-crypto
@@ -103,10 +103,10 @@ jobs:
     # and skip sonarcloud coverage within merge queues
     downstream:
         name: Downstream tests
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         if: always()
         needs:
-            - matrix-react-sdk
+            - element-web
         steps:
             - name: Skip SonarCloud on merge queues
               if: env.ENABLE_COVERAGE == 'false'
@@ -119,5 +119,5 @@ jobs:
                   sha: ${{ github.sha }}
                   target_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
-            - if: needs.matrix-react-sdk.result != 'skipped' && needs.matrix-react-sdk.result != 'success'
+            - if: needs.element-web.result != 'skipped' && needs.element-web.result != 'success'
               run: exit 1

.github/workflows/triage-incoming.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
     automate-project-columns-next:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/add-to-project@main
               with:

CHANGELOG.md

@@ -1,3 +1,86 @@
+Changes in [34.12.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.12.0) (2024-11-19)
+====================================================================================================
+## 🦖 Deprecations
+
+* Deprecate `MatrixClient.getKeyBackupVersion` ([#4505](https://github.com/matrix-org/matrix-js-sdk/pull/4505)). Contributed by @florianduros.
+* Deprecate unused callbacks in `CryptoCallbacks` ([#4501](https://github.com/matrix-org/matrix-js-sdk/pull/4501)). Contributed by @florianduros.
+
+## ✨ Features
+
+* Handle M\_MAX\_DELAY\_EXCEEDED errors ([#4511](https://github.com/matrix-org/matrix-js-sdk/pull/4511)). Contributed by @AndrewFerr.
+* Allow configuration of MatrixRTC timers when calling joinRoomSession() ([#4510](https://github.com/matrix-org/matrix-js-sdk/pull/4510)). Contributed by @hughns.
+* When state says you've left ongoing call, rejoin ([#4342](https://github.com/matrix-org/matrix-js-sdk/pull/4342)). Contributed by @AndrewFerr.
+* Remove redundant type arguments in function call ([#4507](https://github.com/matrix-org/matrix-js-sdk/pull/4507)). Contributed by @AndrewFerr.
+* MatrixRTCSession: handle rate limit errors ([#4494](https://github.com/matrix-org/matrix-js-sdk/pull/4494)). Contributed by @AndrewFerr.
+* Send/receive error details with widgets ([#4492](https://github.com/matrix-org/matrix-js-sdk/pull/4492)). Contributed by @AndrewFerr.
+* Capture HTTP error response headers \& handle Retry-After header (MSC4041) ([#4471](https://github.com/matrix-org/matrix-js-sdk/pull/4471)). Contributed by @AndrewFerr.
+* Add RoomWidgetClient.sendToDeviceViaWidgetApi() ([#4475](https://github.com/matrix-org/matrix-js-sdk/pull/4475)). Contributed by @hughns.
+
+
+Changes in [34.11.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.11.1) (2024-11-12)
+====================================================================================================
+# Security
+- Fixes for [CVE-2024-50336](https://nvd.nist.gov/vuln/detail/CVE-2024-50336) / [GHSA-xvg8-m4x3-w6xr](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr).
+
+Changes in [34.11.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.11.0) (2024-11-12)
+====================================================================================================
+# Security
+- Fixes for [CVE-2024-50336](https://nvd.nist.gov/vuln/detail/CVE-2024-50336) / [GHSA-xvg8-m4x3-w6xr](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr).
+
+Changes in [34.10.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.10.0) (2024-11-05)
+====================================================================================================
+## 🦖 Deprecations
+
+* Deprecate `CreateSecretStorageOpts.keyBackupInfo` used in `CryptoApi.bootstrapSecretStorage.` ([#4474](https://github.com/matrix-org/matrix-js-sdk/pull/4474)). Contributed by @florianduros.
+* Add CryptoApi.encryptToDeviceMessages() and deprecate Crypto.encryptAndSendToDevices() ([#4380](https://github.com/matrix-org/matrix-js-sdk/pull/4380)). Contributed by @hughns.
+* Remove abandoned MSC3886, MSC3903, MSC3906 experimental implementations ([#4469](https://github.com/matrix-org/matrix-js-sdk/pull/4469)). Contributed by @t3chguy.
+* Deprecate `MatrixClient.getDehydratedDevice` ([#4467](https://github.com/matrix-org/matrix-js-sdk/pull/4467)). Contributed by @florianduros.
+* Deprecate top level crypto events re-export ([#4444](https://github.com/matrix-org/matrix-js-sdk/pull/4444)). Contributed by @florianduros.
+
+## ✨ Features
+
+* Add CryptoApi.encryptToDeviceMessages() and deprecate Crypto.encryptAndSendToDevices() ([#4380](https://github.com/matrix-org/matrix-js-sdk/pull/4380)). Contributed by @hughns.
+* Do not rotate MatrixRTC media encryption key when a new member joins a session ([#4472](https://github.com/matrix-org/matrix-js-sdk/pull/4472)). Contributed by @hughns.
+* Avoid `<sender>|<session>` notation in log messages ([#4473](https://github.com/matrix-org/matrix-js-sdk/pull/4473)). Contributed by @richvdh.
+* Refactor/simplify Promises in MatrixRTCSession ([#4466](https://github.com/matrix-org/matrix-js-sdk/pull/4466)). Contributed by @AndrewFerr.
+* Prepare delayed call leave events more reliably ([#4447](https://github.com/matrix-org/matrix-js-sdk/pull/4447)). Contributed by @AndrewFerr.
+
+## 🐛 Bug Fixes
+
+* Fix DelayedEventInfo type ([#4446](https://github.com/matrix-org/matrix-js-sdk/pull/4446)). Contributed by @AndrewFerr.
+
+
+Changes in [34.9.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.9.0) (2024-10-22)
+==================================================================================================
+## 🦖 Deprecations
+
+* Deprecate the crypto events which are not used by the rust-crypto ([#4442](https://github.com/matrix-org/matrix-js-sdk/pull/4442)). Contributed by @florianduros.
+
+## 🐛 Bug Fixes
+
+* Fix the rust crypto import in esm environments. ([#4445](https://github.com/matrix-org/matrix-js-sdk/pull/4445)). Contributed by @saul-jb.
+* Fix MatrixRTC sender key wrapping ([#4441](https://github.com/matrix-org/matrix-js-sdk/pull/4441)). Contributed by @hughns.
+
+
+Changes in [34.8.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.8.0) (2024-10-15)
+==================================================================================================
+This release removes insecure functionality, resolving CVE-2024-47080 / GHSA-4jf8-g8wp-cx7c.
+
+Changes in [34.7.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.7.0) (2024-10-08)
+==================================================================================================
+## 🦖 Deprecations
+
+* RTCSession cleanup: deprecate getKeysForParticipant() and getEncryption(); add emitEncryptionKeys() ([#4427](https://github.com/matrix-org/matrix-js-sdk/pull/4427)). Contributed by @hughns.
+
+## ✨ Features
+
+* Bump matrix-rust-sdk to 9.1.0 ([#4435](https://github.com/matrix-org/matrix-js-sdk/pull/4435)). Contributed by @richvdh.
+* Rotate Matrix RTC media encryption key when a new member joins a call for Post Compromise Security ([#4422](https://github.com/matrix-org/matrix-js-sdk/pull/4422)). Contributed by @hughns.
+* Update media event content types to include captions ([#4403](https://github.com/matrix-org/matrix-js-sdk/pull/4403)). Contributed by @tulir.
+* Update OIDC registration types to match latest MSC2966 state ([#4432](https://github.com/matrix-org/matrix-js-sdk/pull/4432)). Contributed by @t3chguy.
+* Add `CryptoApi.pinCurrentUserIdentity` and `UserIdentity.needsUserApproval` ([#4415](https://github.com/matrix-org/matrix-js-sdk/pull/4415)). Contributed by @richvdh.
+
+
 Changes in [34.6.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v34.6.0) (2024-09-24)
 ==================================================================================================
 ## 🦖 Deprecations

babel.config.cjs

@@ -31,5 +31,22 @@ module.exports = {
         "@babel/plugin-transform-object-rest-spread",
         "@babel/plugin-syntax-dynamic-import",
         "@babel/plugin-transform-runtime",
+        [
+            "search-and-replace",
+            {
+                // Since rewriteImportExtensions doesn't work on dynamic imports (yet), we need to manually replace
+                // the dynamic rust-crypto import.
+                // (see https://github.com/babel/babel/issues/16750)
+                rules:
+                    process.env.NODE_ENV !== "test"
+                        ? [
+                              {
+                                  search: "./rust-crypto/index.ts",
+                                  replace: "./rust-crypto/index.js",
+                              },
+                          ]
+                        : [],
+            },
+        ],
     ],
 };

package.json

@@ -1,6 +1,6 @@
 {
     "name": "matrix-js-sdk",
-    "version": "34.7.0-rc.0",
+    "version": "34.12.0",
     "description": "Matrix Client-Server SDK for Javascript",
     "engines": {
         "node": ">=20.0.0"
@@ -58,12 +58,12 @@
         "jwt-decode": "^4.0.0",
         "loglevel": "^1.7.1",
         "matrix-events-sdk": "0.0.1",
-        "matrix-widget-api": "^1.8.2",
+        "matrix-widget-api": "^1.10.0",
         "oidc-client-ts": "^3.0.1",
         "p-retry": "4",
         "sdp-transform": "^2.14.1",
         "unhomoglyph": "^1.0.6",
-        "uuid": "10"
+        "uuid": "11"
     },
     "devDependencies": {
         "@action-validator/cli": "^0.6.0",
@@ -81,6 +81,7 @@
         "@babel/preset-typescript": "^7.12.7",
         "@casualbot/jest-sonar-reporter": "2.2.7",
         "@peculiar/webcrypto": "^1.4.5",
+        "@stylistic/eslint-plugin": "^2.9.0",
         "@types/bs58": "^4.0.1",
         "@types/content-type": "^1.1.5",
         "@types/debug": "^4.1.7",
@@ -88,23 +89,24 @@
         "@types/node": "18",
         "@types/sdp-transform": "^2.4.5",
         "@types/uuid": "10",
-        "@typescript-eslint/eslint-plugin": "^7.0.0",
-        "@typescript-eslint/parser": "^7.0.0",
+        "@typescript-eslint/eslint-plugin": "^8.0.0",
+        "@typescript-eslint/parser": "^8.0.0",
         "babel-jest": "^29.0.0",
+        "babel-plugin-search-and-replace": "^1.1.1",
         "debug": "^4.3.4",
-        "eslint": "8.57.0",
+        "eslint": "8.57.1",
         "eslint-config-google": "^0.14.0",
         "eslint-config-prettier": "^9.0.0",
         "eslint-import-resolver-typescript": "^3.5.1",
         "eslint-plugin-import": "^2.26.0",
         "eslint-plugin-jest": "^28.0.0",
         "eslint-plugin-jsdoc": "^50.0.0",
-        "eslint-plugin-matrix-org": "^1.0.0",
-        "eslint-plugin-node": "^11.1.0",
+        "eslint-plugin-matrix-org": "^2.0.1",
+        "eslint-plugin-n": "^14.0.0",
         "eslint-plugin-tsdoc": "^0.3.0",
-        "eslint-plugin-unicorn": "^55.0.0",
+        "eslint-plugin-unicorn": "^56.0.0",
         "fake-indexeddb": "^5.0.2",
-        "fetch-mock": "11.1.3",
+        "fetch-mock": "11.1.5",
         "fetch-mock-jest": "^1.5.1",
         "husky": "^9.0.0",
         "jest": "^29.0.0",

scripts/release/post-merge-master.sh

@@ -1,22 +0,0 @@
-#!/bin/bash
-
-# When merging to develop, we need revert the `main` and `typings` fields if we adjusted them previously.
-for i in main typings browser
-do
-    # If a `lib` prefixed value is present, it means we adjusted the field earlier at publish time, so we should revert it now.
-    if [ "$(jq -r ".matrix_lib_$i" package.json)" != "null" ]; then
-        # If there's a `src` prefixed value, use that, otherwise delete.
-        # This is used to delete the `typings` field and reset `main` back to the TypeScript source.
-        src_value=$(jq -r ".matrix_src_$i" package.json)
-        if [ "$src_value" != "null" ]; then
-            jq ".$i = .matrix_src_$i" package.json > package.json.new && mv package.json.new package.json && yarn prettier --write package.json
-        else
-            jq "del(.$i)" package.json > package.json.new && mv package.json.new package.json && yarn prettier --write package.json
-        fi
-    fi
-done
-
-if [ -n "$(git ls-files --modified package.json)" ]; then
-    echo "Committing develop package.json"
-    git commit package.json -m "Resetting package fields for development"
-fi

scripts/release/pre-release.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-
-# For the published and dist versions of the package,
-# we copy the `matrix_lib_main` and `matrix_lib_typings` fields to `main` and `typings` (if they exist).
-# This small bit of gymnastics allows us to use the TypeScript source directly for development without
-# needing to build before linting or testing.
-
-for i in main typings browser
-do
-    lib_value=$(jq -r ".matrix_lib_$i" package.json)
-    if [ "$lib_value" != "null" ]; then
-        jq ".$i = .matrix_lib_$i" package.json > package.json.new && mv package.json.new package.json && yarn prettier --write package.json
-    fi
-done

scripts/switch_package_to_release.cjs

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-
-const fsProm = require("fs/promises");
-
-const PKGJSON = "package.json";
-
-async function main() {
-    const pkgJson = JSON.parse(await fsProm.readFile(PKGJSON, "utf8"));
-    for (const field of ["main", "typings"]) {
-        if (pkgJson["matrix_lib_" + field] !== undefined) {
-            pkgJson[field] = pkgJson["matrix_lib_" + field];
-        }
-    }
-
-    await fsProm.writeFile(PKGJSON, JSON.stringify(pkgJson, null, 2));
-}
-
-main();

scripts/switch_package_to_release.js

@@ -1 +0,0 @@
-switch_package_to_release.cjs

spec/TestClient.ts

@@ -66,7 +66,7 @@ export class TestClient implements IE2EKeyReceiver, ISyncResponder {
             userId: userId,
             accessToken: accessToken,
             deviceId: deviceId,
-            fetchFn: this.httpBackend.fetchFn as typeof global.fetch,
+            fetchFn: this.httpBackend.fetchFn as typeof globalThis.fetch,
             ...options,
         };
         if (!fullOptions.cryptoStore) {

spec/integ/crypto/crypto.spec.ts

@@ -91,7 +91,6 @@ import {
     OnlySignedDevicesIsolationMode,
 } from "../../../src/crypto-api";
 import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";
-import { IKeyBackup } from "../../../src/crypto/backup";
 import {
     createOlmAccount,
     createOlmSession,
@@ -106,6 +105,7 @@ import { ToDevicePayload } from "../../../src/models/ToDeviceMessage";
 import { AccountDataAccumulator } from "../../test-utils/AccountDataAccumulator";
 import { UNSIGNED_MEMBERSHIP_FIELD } from "../../../src/@types/event";
 import { KnownMembership } from "../../../src/@types/membership";
+import { KeyBackup } from "../../../src/rust-crypto/backup.ts";
 
 afterEach(() => {
     // reset fake-indexeddb after each test, to make sure we don't leak connections
@@ -136,7 +136,7 @@ async function expectSendRoomKey(
     recipientOlmAccount: Olm.Account,
     recipientOlmSession: Olm.Session | null = null,
 ): Promise<Olm.InboundGroupSession> {
-    const Olm = global.Olm;
+    const Olm = globalThis.Olm;
     const testRecipientKey = JSON.parse(recipientOlmAccount.identity_keys())["curve25519"];
 
     function onSendRoomKey(content: any): Olm.InboundGroupSession {
@@ -219,7 +219,7 @@ async function expectSendMegolmMessage(
 }
 
 describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string, initCrypto: InitCrypto) => {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         // currently we use libolm to implement the crypto in the tests, so need it to be present.
         logger.warn("not running megolm tests: Olm not present");
         return;
@@ -230,7 +230,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
     const oldBackendOnly = backend === "rust-sdk" ? test.skip : test;
     const newBackendOnly = backend !== "rust-sdk" ? test.skip : test;
 
-    const Olm = global.Olm;
+    const Olm = globalThis.Olm;
 
     let testOlmAccount = {} as unknown as Olm.Account;
     let testSenderKey = "";
@@ -1897,13 +1897,13 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
         const aliceOtks = await keyReceiver.awaitOneTimeKeyUpload();
         const aliceOtkId = Object.keys(aliceOtks)[0];
         const aliceOtk = aliceOtks[aliceOtkId];
-        const p2pSession = new global.Olm.Session();
+        const p2pSession = new globalThis.Olm.Session();
         await beccaTestClient.client.crypto!.cryptoStore.doTxn(
             "readonly",
             [IndexedDBCryptoStore.STORE_ACCOUNT],
             (txn) => {
                 beccaTestClient.client.crypto!.cryptoStore.getAccount(txn, (pickledAccount: string | null) => {
-                    const account = new global.Olm.Account();
+                    const account = new globalThis.Olm.Account();
                     try {
                         account.unpickle(beccaTestClient.client.crypto!.olmDevice.pickleKey, pickledAccount!);
                         p2pSession.create_outbound(account, keyReceiver.getDeviceKey(), aliceOtk.key);
@@ -2045,13 +2045,13 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
         const aliceOtks = await keyReceiver.awaitOneTimeKeyUpload();
         const aliceOtkId = Object.keys(aliceOtks)[0];
         const aliceOtk = aliceOtks[aliceOtkId];
-        const p2pSession = new global.Olm.Session();
+        const p2pSession = new globalThis.Olm.Session();
         await beccaTestClient.client.crypto!.cryptoStore.doTxn(
             "readonly",
             [IndexedDBCryptoStore.STORE_ACCOUNT],
             (txn) => {
                 beccaTestClient.client.crypto!.cryptoStore.getAccount(txn, (pickledAccount: string | null) => {
-                    const account = new global.Olm.Account();
+                    const account = new globalThis.Olm.Account();
                     try {
                         account.unpickle(beccaTestClient.client.crypto!.olmDevice.pickleKey, pickledAccount!);
                         p2pSession.create_outbound(account, keyReceiver.getDeviceKey(), aliceOtk.key);
@@ -3138,11 +3138,11 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                 // Import a new key that should be uploaded
                 const newKey = testData.MEGOLM_SESSION_DATA;
 
-                const awaitKeyUploaded = new Promise<IKeyBackup>((resolve) => {
+                const awaitKeyUploaded = new Promise<KeyBackup>((resolve) => {
                     fetchMock.put(
                         "path:/_matrix/client/v3/room_keys/keys",
                         (url, request) => {
-                            const uploadPayload: IKeyBackup = JSON.parse(request.body?.toString() ?? "{}");
+                            const uploadPayload: KeyBackup = JSON.parse(request.body?.toString() ?? "{}");
                             resolve(uploadPayload);
                             return {
                                 status: 200,
@@ -3499,7 +3499,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
             return client;
         }
 
-        function mkEncryptionEvent(content: Object) {
+        function mkEncryptionEvent(content: object) {
             return mkEventCustom({
                 sender: persistentStoreClient.getSafeUserId(),
                 type: "m.room.encryption",
@@ -3512,7 +3512,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
          *
          * @param stateEvents - Additional state events for the test room
          */
-        function getSyncResponseWithState(stateEvents: Array<Object>) {
+        function getSyncResponseWithState(stateEvents: Array<object>) {
             const roomResponse = {
                 state: {
                     events: [

spec/integ/crypto/megolm-backup.spec.ts

@@ -42,10 +42,10 @@ import {
 } from "../../test-utils/test-utils";
 import * as testData from "../../test-utils/test-data";
 import { KeyBackupInfo, KeyBackupSession } from "../../../src/crypto-api/keybackup";
-import { IKeyBackup } from "../../../src/crypto/backup";
 import { flushPromises } from "../../test-utils/flushPromises";
 import { defer, IDeferred } from "../../../src/utils";
 import { DecryptionFailureCode } from "../../../src/crypto-api";
+import { KeyBackup } from "../../../src/rust-crypto/backup.ts";
 
 const ROOM_ID = testData.TEST_ROOM_ID;
 
@@ -91,7 +91,7 @@ function mockUploadEmitter(
                     },
                 };
             }
-            const uploadPayload: IKeyBackup = JSON.parse(request.body?.toString() ?? "{}");
+            const uploadPayload: KeyBackup = JSON.parse(request.body?.toString() ?? "{}");
             let count = 0;
             for (const [roomId, value] of Object.entries(uploadPayload.rooms)) {
                 for (const sessionId of Object.keys(value.sessions)) {

spec/integ/crypto/olm-utils.ts

@@ -85,15 +85,15 @@ export function bootstrapCrossSigningTestOlmAccount(
     deviceId: string,
     keyBackupInfo: KeyBackupInfo[] = [],
 ): Partial<IDownloadKeyResult> {
-    const olmAliceMSK = new global.Olm.PkSigning();
+    const olmAliceMSK = new globalThis.Olm.PkSigning();
     const masterPrivkey = olmAliceMSK.generate_seed();
     const masterPubkey = olmAliceMSK.init_with_seed(masterPrivkey);
 
-    const olmAliceUSK = new global.Olm.PkSigning();
+    const olmAliceUSK = new globalThis.Olm.PkSigning();
     const userPrivkey = olmAliceUSK.generate_seed();
     const userPubkey = olmAliceUSK.init_with_seed(userPrivkey);
 
-    const olmAliceSSK = new global.Olm.PkSigning();
+    const olmAliceSSK = new globalThis.Olm.PkSigning();
     const sskPrivkey = olmAliceSSK.generate_seed();
     const sskPubkey = olmAliceSSK.init_with_seed(sskPrivkey);
 
@@ -181,7 +181,7 @@ export async function createOlmSession(
     const otkId = Object.keys(keys)[0];
     const otk = keys[otkId];
 
-    const session = new global.Olm.Session();
+    const session = new globalThis.Olm.Session();
     session.create_outbound(olmAccount, recipientTestClient.getDeviceKey(), otk.key);
     return session;
 }

spec/integ/crypto/to-device-messages.spec.ts

@@ -0,0 +1,152 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import fetchMock from "fetch-mock-jest";
+import "fake-indexeddb/auto";
+import { IDBFactory } from "fake-indexeddb";
+
+import { CRYPTO_BACKENDS, getSyncResponse, InitCrypto, syncPromise } from "../../test-utils/test-utils";
+import { createClient, MatrixClient } from "../../../src";
+import * as testData from "../../test-utils/test-data";
+import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";
+import { SyncResponder } from "../../test-utils/SyncResponder";
+import { E2EKeyReceiver } from "../../test-utils/E2EKeyReceiver";
+
+afterEach(() => {
+    // reset fake-indexeddb after each test, to make sure we don't leak connections
+    // cf https://github.com/dumbmatter/fakeIndexedDB#wipingresetting-the-indexeddb-for-a-fresh-state
+    // eslint-disable-next-line no-global-assign
+    indexedDB = new IDBFactory();
+});
+
+/**
+ * Integration tests for to-device messages functionality.
+ *
+ * These tests work by intercepting HTTP requests via fetch-mock rather than mocking out bits of the client, so as
+ * to provide the most effective integration tests possible.
+ */
+describe.each(Object.entries(CRYPTO_BACKENDS))("to-device-messages (%s)", (backend: string, initCrypto: InitCrypto) => {
+    let aliceClient: MatrixClient;
+
+    /** an object which intercepts `/keys/query` requests on the test homeserver */
+    let e2eKeyResponder: E2EKeyResponder;
+
+    beforeEach(
+        async () => {
+            // anything that we don't have a specific matcher for silently returns a 404
+            fetchMock.catch(404);
+            fetchMock.config.warnOnFallback = false;
+
+            const homeserverUrl = "https://server.com";
+            aliceClient = createClient({
+                baseUrl: homeserverUrl,
+                userId: testData.TEST_USER_ID,
+                accessToken: "akjgkrgjsalice",
+                deviceId: testData.TEST_DEVICE_ID,
+            });
+
+            e2eKeyResponder = new E2EKeyResponder(homeserverUrl);
+            new E2EKeyReceiver(homeserverUrl);
+            const syncResponder = new SyncResponder(homeserverUrl);
+
+            // add bob as known user
+            syncResponder.sendOrQueueSyncResponse(getSyncResponse([testData.BOB_TEST_USER_ID]));
+
+            // Silence warnings from the backup manager
+            fetchMock.getOnce(new URL("/_matrix/client/v3/room_keys/version", homeserverUrl).toString(), {
+                status: 404,
+                body: { errcode: "M_NOT_FOUND" },
+            });
+
+            fetchMock.get(new URL("/_matrix/client/v3/pushrules/", homeserverUrl).toString(), {});
+            fetchMock.get(new URL("/_matrix/client/versions/", homeserverUrl).toString(), {});
+            fetchMock.post(
+                new URL(
+                    `/_matrix/client/v3/user/${encodeURIComponent(testData.TEST_USER_ID)}/filter`,
+                    homeserverUrl,
+                ).toString(),
+                { filter_id: "fid" },
+            );
+
+            await initCrypto(aliceClient);
+        },
+        /* it can take a while to initialise the crypto library on the first pass, so bump up the timeout. */
+        10000,
+    );
+
+    afterEach(async () => {
+        aliceClient.stopClient();
+        fetchMock.mockReset();
+    });
+
+    describe("encryptToDeviceMessages", () => {
+        it("returns empty batch for device that is not known", async () => {
+            await aliceClient.startClient();
+
+            const toDeviceBatch = await aliceClient
+                .getCrypto()
+                ?.encryptToDeviceMessages(
+                    "m.test.event",
+                    [{ userId: testData.BOB_TEST_USER_ID, deviceId: testData.BOB_TEST_DEVICE_ID }],
+                    {
+                        some: "content",
+                    },
+                );
+
+            expect(toDeviceBatch).toBeDefined();
+            const { batch, eventType } = toDeviceBatch!;
+            expect(eventType).toBe("m.room.encrypted");
+            expect(batch.length).toBe(0);
+        });
+
+        it("returns encrypted batch for known device", async () => {
+            await aliceClient.startClient();
+            e2eKeyResponder.addDeviceKeys(testData.BOB_SIGNED_TEST_DEVICE_DATA);
+            fetchMock.post("express:/_matrix/client/v3/keys/claim", () => ({
+                one_time_keys: testData.BOB_ONE_TIME_KEYS,
+            }));
+            await syncPromise(aliceClient);
+
+            const toDeviceBatch = await aliceClient
+                .getCrypto()
+                ?.encryptToDeviceMessages(
+                    "m.test.event",
+                    [{ userId: testData.BOB_TEST_USER_ID, deviceId: testData.BOB_TEST_DEVICE_ID }],
+                    {
+                        some: "content",
+                    },
+                );
+
+            expect(toDeviceBatch?.batch.length).toBe(1);
+            expect(toDeviceBatch?.eventType).toBe("m.room.encrypted");
+            const { deviceId, payload, userId } = toDeviceBatch!.batch[0];
+            expect(deviceId).toBe(testData.BOB_TEST_DEVICE_ID);
+            expect(userId).toBe(testData.BOB_TEST_USER_ID);
+            expect(payload.algorithm).toBe("m.olm.v1.curve25519-aes-sha2");
+            expect(payload.sender_key).toEqual(expect.any(String));
+            expect(payload.ciphertext).toEqual(
+                expect.objectContaining({
+                    [testData.BOB_SIGNED_TEST_DEVICE_DATA.keys[`curve25519:${testData.BOB_TEST_DEVICE_ID}`]]: {
+                        body: expect.any(String),
+                        type: 0,
+                    },
+                }),
+            );
+
+            // for future: check that bob's device can decrypt the ciphertext?
+        });
+    });
+});

spec/integ/crypto/verification.spec.ts

@@ -90,11 +90,12 @@ jest.useFakeTimers({ doNotFake: ["queueMicrotask"] });
 
 beforeAll(async () => {
     // we use the libolm primitives in the test, so init the Olm library
-    await global.Olm.init();
+    await globalThis.Olm.init();
 });
 
 // load the rust library. This can take a few seconds on a slow GH worker.
 beforeAll(async () => {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
     const RustSdkCryptoJs = await require("@matrix-org/matrix-sdk-crypto-wasm");
     await RustSdkCryptoJs.initAsync();
 }, 10000);
@@ -263,7 +264,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
 
             // The dummy device makes up a curve25519 keypair and sends the public bit back in an `m.key.verification.key'
             // We use the Curve25519, HMAC and HKDF implementations in libolm, for now
-            const olmSAS = new global.Olm.SAS();
+            const olmSAS = new globalThis.Olm.SAS();
             returnToDeviceMessageFromSync(buildSasKeyMessage(transactionId, olmSAS.get_pubkey()));
 
             // alice responds with a 'key' ...
@@ -357,7 +358,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
 
             // The dummy device makes up a curve25519 keypair and uses the hash in an 'm.key.verification.accept'
             // We use the Curve25519, HMAC and HKDF implementations in libolm, for now
-            const olmSAS = new global.Olm.SAS();
+            const olmSAS = new globalThis.Olm.SAS();
             const commitmentStr = olmSAS.get_pubkey() + anotherjson.stringify(toDeviceMessage);
 
             sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.key");

spec/integ/devicelist-integ.spec.ts

@@ -67,7 +67,7 @@ function getSyncResponse(roomMembers: string[]) {
 }
 
 describe("DeviceList management:", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("not running deviceList tests: Olm not present");
         return;
     }

spec/integ/matrix-client-opts.spec.ts

@@ -80,7 +80,7 @@ describe("MatrixClient opts", function () {
         let client: MatrixClient;
         beforeEach(function () {
             client = new MatrixClient({
-                fetchFn: httpBackend.fetchFn as typeof global.fetch,
+                fetchFn: httpBackend.fetchFn as typeof globalThis.fetch,
                 store: undefined,
                 baseUrl: baseUrl,
                 userId: userId,
@@ -135,7 +135,7 @@ describe("MatrixClient opts", function () {
         let client: MatrixClient;
         beforeEach(function () {
             client = new MatrixClient({
-                fetchFn: httpBackend.fetchFn as typeof global.fetch,
+                fetchFn: httpBackend.fetchFn as typeof globalThis.fetch,
                 store: new MemoryStore() as IStore,
                 baseUrl: baseUrl,
                 userId: userId,

spec/integ/matrix-client-syncing.spec.ts

@@ -577,7 +577,7 @@ describe("MatrixClient syncing", () => {
             return Promise.all([httpBackend!.flushAllExpected(), awaitSyncEvent()]).then(() => {
                 const member = client!.getRoom(roomOne)!.getMember(userC)!;
                 expect(member.name).toEqual("The Boss");
-                expect(member.getAvatarUrl("home.server.url", 1, 1, "", false, false)).toBeTruthy();
+                expect(member.getAvatarUrl("https://home.server.url", 1, 1, "", false, false)).toBeTruthy();
             });
         });
 
@@ -2406,7 +2406,7 @@ describe("MatrixClient syncing (IndexedDB version)", () => {
 
     it("should emit ClientEvent.Room when invited while using indexeddb crypto store", async () => {
         const idbTestClient = new TestClient(selfUserId, "DEVICE", selfAccessToken, undefined, {
-            cryptoStore: new IndexedDBCryptoStore(global.indexedDB, "tests"),
+            cryptoStore: new IndexedDBCryptoStore(globalThis.indexedDB, "tests"),
         });
         const idbHttpBackend = idbTestClient.httpBackend;
         const idbClient = idbTestClient.client;
@@ -2486,7 +2486,7 @@ describe("MatrixClient syncing (IndexedDB version)", () => {
 
         let idbTestClient = new TestClient(selfUserId, "DEVICE", selfAccessToken, undefined, {
             store: new IndexedDBStore({
-                indexedDB: global.indexedDB,
+                indexedDB: globalThis.indexedDB,
                 dbName: "test",
             }),
         });
@@ -2558,7 +2558,7 @@ describe("MatrixClient syncing (IndexedDB version)", () => {
 
         idbTestClient = new TestClient(selfUserId, "DEVICE", selfAccessToken, undefined, {
             store: new IndexedDBStore({
-                indexedDB: global.indexedDB,
+                indexedDB: globalThis.indexedDB,
                 dbName: "test",
             }),
         });

spec/integ/rendezvous/MSC4108SignInWithQR.spec.ts

@@ -266,8 +266,8 @@ describe("MSC4108SignInWithQR", () => {
         });
 
         it("should abort if device doesn't come up by timeout", async () => {
-            jest.spyOn(global, "setTimeout").mockImplementation((fn) => {
-                (<Function>fn)();
+            jest.spyOn(globalThis, "setTimeout").mockImplementation((fn) => {
+                fn();
                 // TODO: mock timers properly
                 return -1 as any;
             });
@@ -319,8 +319,8 @@ describe("MSC4108SignInWithQR", () => {
         });
 
         it("should not send secrets if user cancels", async () => {
-            jest.spyOn(global, "setTimeout").mockImplementation((fn) => {
-                (<Function>fn)();
+            jest.spyOn(globalThis, "setTimeout").mockImplementation((fn) => {
+                fn();
                 // TODO: mock timers properly
                 return -1 as any;
             });

spec/olm-loader.ts

@@ -19,7 +19,7 @@ import { logger } from "../src/logger";
 
 // try to load the olm library.
 try {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
     globalThis.Olm = require("@matrix-org/olm");
     logger.log("loaded libolm");
 } catch (e) {

spec/test-utils/AccountDataAccumulator.ts

@@ -27,7 +27,7 @@ export class AccountDataAccumulator {
      * Will be updated when fetchMock intercepts calls to PUT `/_matrix/client/v3/user/:userId/account_data/`.
      * Will be used by `sendSyncResponseWithUpdatedAccountData`
      */
-    public accountDataEvents: Map<String, any> = new Map();
+    public accountDataEvents: Map<string, any> = new Map();
 
     /**
      * Intercept requests to set a particular type of account data.
@@ -101,7 +101,7 @@ export class AccountDataAccumulator {
                     })),
                 },
             });
-        } catch (err) {
+        } catch {
             // Might fail with "Cannot queue more than one /sync response" if called too often.
             // It's ok if it fails here, the sync response is cumulative and will contain
             // the latest account data.

spec/test-utils/test-utils.ts

@@ -127,7 +127,7 @@ export function mock<T>(constr: { new (...args: any[]): T }, name: string): T {
             if (constr.prototype[key] instanceof Function) {
                 result[key] = jest.fn();
             }
-        } catch (ex) {
+        } catch {
             // Direct access to some non-function fields of DOM prototypes may
             // cause exceptions.
             // Overwriting will not work either in that case.
@@ -560,7 +560,7 @@ export const CRYPTO_BACKENDS: Record<string, InitCrypto> = {};
 export type InitCrypto = (_: MatrixClient) => Promise<void>;
 
 CRYPTO_BACKENDS["rust-sdk"] = (client: MatrixClient) => client.initRustCrypto();
-if (global.Olm) {
+if (globalThis.Olm) {
     CRYPTO_BACKENDS["libolm"] = (client: MatrixClient) => client.initCrypto();
 }
 

spec/test-utils/webrtc.ts

@@ -582,11 +582,11 @@ export class MockCallFeed {
 }
 
 export function installWebRTCMocks() {
-    global.navigator = {
+    globalThis.navigator = {
         mediaDevices: new MockMediaDevices().typed(),
     } as unknown as Navigator;
 
-    global.window = {
+    globalThis.window = {
         // @ts-ignore Mock
         RTCPeerConnection: MockRTCPeerConnection,
         // @ts-ignore Mock
@@ -596,13 +596,13 @@ export function installWebRTCMocks() {
         getUserMedia: () => new MockMediaStream("local_stream"),
     };
     // @ts-ignore Mock
-    global.document = {};
+    globalThis.document = {};
 
     // @ts-ignore Mock
-    global.AudioContext = MockAudioContext;
+    globalThis.AudioContext = MockAudioContext;
 
     // @ts-ignore Mock
-    global.RTCRtpReceiver = {
+    globalThis.RTCRtpReceiver = {
         getCapabilities: jest.fn<RTCRtpCapabilities, [string]>().mockReturnValue({
             codecs: [],
             headerExtensions: [],
@@ -610,7 +610,7 @@ export function installWebRTCMocks() {
     };
 
     // @ts-ignore Mock
-    global.RTCRtpSender = {
+    globalThis.RTCRtpSender = {
         getCapabilities: jest.fn<RTCRtpCapabilities, [string]>().mockReturnValue({
             codecs: [],
             headerExtensions: [],

spec/unit/ToDeviceMessageQueue.spec.ts

@@ -9,7 +9,7 @@ import { defer } from "../../src/utils";
 
 describe("onResumedSync", () => {
     let batch: IndexedToDeviceBatch | null;
-    let shouldFailSendToDevice: Boolean;
+    let shouldFailSendToDevice: boolean;
     let onSendToDeviceFailure: () => void;
     let onSendToDeviceSuccess: () => void;
     let resumeSync: (newState: SyncState, oldState: SyncState) => void;

spec/unit/autodiscovery.spec.ts

@@ -22,12 +22,12 @@ import { AutoDiscovery } from "../../src/autodiscovery";
 
 // keep to reset the fetch function after using MockHttpBackend
 // @ts-ignore private property
-const realAutoDiscoveryFetch: typeof global.fetch = AutoDiscovery.fetchFn;
+const realAutoDiscoveryFetch: typeof globalThis.fetch = AutoDiscovery.fetchFn;
 
 describe("AutoDiscovery", function () {
     const getHttpBackend = (): MockHttpBackend => {
         const httpBackend = new MockHttpBackend();
-        AutoDiscovery.setFetchFn(httpBackend.fetchFn as typeof global.fetch);
+        AutoDiscovery.setFetchFn(httpBackend.fetchFn as typeof globalThis.fetch);
         return httpBackend;
     };
 

spec/unit/base64.spec.ts

@@ -29,8 +29,8 @@ describe.each(["browser", "node"])("Base64 encoding (%s)", (env) => {
             // eslint-disable-next-line no-global-assign
             Buffer = undefined;
 
-            global.atob = NodeBuffer.atob;
-            global.btoa = NodeBuffer.btoa;
+            globalThis.atob = NodeBuffer.atob;
+            globalThis.btoa = NodeBuffer.btoa;
         }
     });
 
@@ -38,9 +38,9 @@ describe.each(["browser", "node"])("Base64 encoding (%s)", (env) => {
         // eslint-disable-next-line no-global-assign
         Buffer = origBuffer;
         // @ts-ignore
-        global.atob = undefined;
+        globalThis.atob = undefined;
         // @ts-ignore
-        global.btoa = undefined;
+        globalThis.btoa = undefined;
     });
 
     it("Should decode properly encoded data", () => {

spec/unit/content-helpers.spec.ts

@@ -29,10 +29,10 @@ describe("Beacon content helpers", () => {
     describe("makeBeaconInfoContent()", () => {
         const mockDateNow = 123456789;
         beforeEach(() => {
-            jest.spyOn(global.Date, "now").mockReturnValue(mockDateNow);
+            jest.spyOn(globalThis.Date, "now").mockReturnValue(mockDateNow);
         });
         afterAll(() => {
-            jest.spyOn(global.Date, "now").mockRestore();
+            jest.spyOn(globalThis.Date, "now").mockRestore();
         });
         it("create fully defined event content", () => {
             expect(makeBeaconInfoContent(1234, true, "nice beacon_info", LocationAssetType.Pin)).toEqual({

spec/unit/content-repo.spec.ts

@@ -63,20 +63,6 @@ describe("ContentRepo", function () {
             );
         });
 
-        it("should put fragments from mxc:// URIs after any query parameters", function () {
-            const mxcUri = "mxc://server.name/resourceid#automade";
-            expect(getHttpUriForMxc(baseUrl, mxcUri, 32)).toEqual(
-                baseUrl + "/_matrix/media/v3/thumbnail/server.name/resourceid" + "?width=32#automade",
-            );
-        });
-
-        it("should put fragments from mxc:// URIs at the end of the HTTP URI", function () {
-            const mxcUri = "mxc://server.name/resourceid#automade";
-            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual(
-                baseUrl + "/_matrix/media/v3/download/server.name/resourceid#automade",
-            );
-        });
-
         it("should return an authenticated URL when requested", function () {
             const mxcUri = "mxc://server.name/resourceid";
             expect(getHttpUriForMxc(baseUrl, mxcUri, undefined, undefined, undefined, undefined, true, true)).toEqual(
@@ -98,5 +84,30 @@ describe("ContentRepo", function () {
                     "/_matrix/client/v1/media/thumbnail/server.name/resourceid?width=64&height=64&method=scale&allow_redirect=true",
             );
         });
+
+        it("should drop mxc urls with invalid server_name", () => {
+            const mxcUri = "mxc://server.name:test/foobar";
+            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual("");
+        });
+
+        it("should drop mxc urls with invalid media_id", () => {
+            const mxcUri = "mxc://server.name/foobar:test";
+            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual("");
+        });
+
+        it("should drop mxc urls attempting a path traversal attack", () => {
+            const mxcUri = "mxc://../../../../foo";
+            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual("");
+        });
+
+        it("should drop mxc urls attempting to pass query parameters", () => {
+            const mxcUri = "mxc://server.name/foobar?bar=baz";
+            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual("");
+        });
+
+        it("should drop mxc urls with too many parts", () => {
+            const mxcUri = "mxc://server.name/foo//bar";
+            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual("");
+        });
     });
 });

spec/unit/crypto.spec.ts

@@ -26,8 +26,9 @@ import { CryptoBackend } from "../../src/common-crypto/CryptoBackend";
 import { EventDecryptionResult } from "../../src/common-crypto/CryptoBackend";
 import * as testData from "../test-utils/test-data";
 import { KnownMembership } from "../../src/@types/membership";
+import type { DeviceInfoMap } from "../../src/crypto/DeviceList";
 
-const Olm = global.Olm;
+const Olm = globalThis.Olm;
 
 function awaitEvent(emitter: EventEmitter, event: string): Promise<void> {
     return new Promise((resolve) => {
@@ -607,7 +608,7 @@ describe("Crypto", function () {
             event.claimedEd25519Key = null;
             try {
                 await bobClient.crypto!.decryptEvent(event);
-            } catch (e) {
+            } catch {
                 // we expect this to fail because we don't have the
                 // decryption keys yet
             }
@@ -1245,6 +1246,117 @@ describe("Crypto", function () {
         });
     });
 
+    describe("encryptToDeviceMessages", () => {
+        let client: TestClient;
+        let ensureOlmSessionsForDevices: jest.SpiedFunction<typeof olmlib.ensureOlmSessionsForDevices>;
+        let encryptMessageForDevice: jest.SpiedFunction<typeof olmlib.encryptMessageForDevice>;
+        const payload = { hello: "world" };
+        let encryptedPayload: object;
+        let crypto: Crypto;
+
+        beforeEach(async () => {
+            ensureOlmSessionsForDevices = jest.spyOn(olmlib, "ensureOlmSessionsForDevices");
+            ensureOlmSessionsForDevices.mockResolvedValue(new Map());
+            encryptMessageForDevice = jest.spyOn(olmlib, "encryptMessageForDevice");
+            encryptMessageForDevice.mockImplementation(async (...[result, , , , , , payload]) => {
+                result.plaintext = { type: 0, body: JSON.stringify(payload) };
+            });
+
+            client = new TestClient("@alice:example.org", "aliceweb");
+
+            // running initCrypto should trigger a key upload
+            client.httpBackend.when("POST", "/keys/upload").respond(200, {});
+            await Promise.all([client.client.initCrypto(), client.httpBackend.flush("/keys/upload", 1)]);
+
+            encryptedPayload = {
+                algorithm: "m.olm.v1.curve25519-aes-sha2",
+                sender_key: client.client.crypto!.olmDevice.deviceCurve25519Key,
+                ciphertext: { plaintext: { type: 0, body: JSON.stringify(payload) } },
+            };
+
+            crypto = client.client.getCrypto() as Crypto;
+        });
+
+        afterEach(async () => {
+            ensureOlmSessionsForDevices.mockRestore();
+            encryptMessageForDevice.mockRestore();
+            await client.stop();
+        });
+
+        it("returns encrypted batch where devices known", async () => {
+            const deviceInfoMap: DeviceInfoMap = new Map([
+                [
+                    "@bob:example.org",
+                    new Map([
+                        ["bobweb", new DeviceInfo("bobweb")],
+                        ["bobmobile", new DeviceInfo("bobmobile")],
+                    ]),
+                ],
+                ["@carol:example.org", new Map([["caroldesktop", new DeviceInfo("caroldesktop")]])],
+            ]);
+            jest.spyOn(crypto.deviceList, "downloadKeys").mockResolvedValue(deviceInfoMap);
+            // const deviceInfoMap = await this.downloadKeys(Array.from(userIds), false);
+
+            const batch = await client.client.getCrypto()?.encryptToDeviceMessages(
+                "m.test.type",
+                [
+                    { userId: "@bob:example.org", deviceId: "bobweb" },
+                    { userId: "@bob:example.org", deviceId: "bobmobile" },
+                    { userId: "@carol:example.org", deviceId: "caroldesktop" },
+                    { userId: "@carol:example.org", deviceId: "carolmobile" }, // not known
+                ],
+                payload,
+            );
+            expect(crypto.deviceList.downloadKeys).toHaveBeenCalledWith(
+                ["@bob:example.org", "@carol:example.org"],
+                false,
+            );
+            expect(encryptMessageForDevice).toHaveBeenCalledTimes(3);
+            const expectedPayload = expect.objectContaining({
+                ...encryptedPayload,
+                "org.matrix.msgid": expect.any(String),
+                "sender_key": expect.any(String),
+            });
+            expect(batch?.eventType).toEqual("m.room.encrypted");
+            expect(batch?.batch.length).toEqual(3);
+            expect(batch).toEqual({
+                eventType: "m.room.encrypted",
+                batch: expect.arrayContaining([
+                    {
+                        userId: "@bob:example.org",
+                        deviceId: "bobweb",
+                        payload: expectedPayload,
+                    },
+                    {
+                        userId: "@bob:example.org",
+                        deviceId: "bobmobile",
+                        payload: expectedPayload,
+                    },
+                    {
+                        userId: "@carol:example.org",
+                        deviceId: "caroldesktop",
+                        payload: expectedPayload,
+                    },
+                ]),
+            });
+        });
+
+        it("returns empty batch if no devices known", async () => {
+            jest.spyOn(crypto.deviceList, "downloadKeys").mockResolvedValue(new Map());
+            const batch = await crypto.encryptToDeviceMessages(
+                "m.test.type",
+                [
+                    { deviceId: "AAA", userId: "@user1:domain" },
+                    { deviceId: "BBB", userId: "@user1:domain" },
+                    { deviceId: "CCC", userId: "@user2:domain" },
+                ],
+                payload,
+            );
+            expect(batch?.eventType).toEqual("m.room.encrypted");
+            expect(batch?.batch).toEqual([]);
+        });
+    });
+
     describe("checkSecretStoragePrivateKey", () => {
         let client: TestClient;
 

spec/unit/crypto/CrossSigningInfo.spec.ts

@@ -44,13 +44,13 @@ badKey[0] ^= 1;
 const masterKeyPub = "nqOvzeuGWT/sRx3h7+MHoInYj3Uk2LD/unI9kDYcHwk";
 
 describe("CrossSigningInfo.getCrossSigningKey", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running megolm backup unit tests: libolm not present");
         return;
     }
 
     beforeAll(function () {
-        return global.Olm.init();
+        return globalThis.Olm.init();
     });
 
     it("should throw if no callback is provided", async () => {
@@ -80,7 +80,7 @@ describe("CrossSigningInfo.getCrossSigningKey", function () {
         expect(pubKey).toEqual(masterKeyPub);
         // check that the pkSigning object corresponds to the pubKey
         const signature = pkSigning.sign("message");
-        const util = new global.Olm.Utility();
+        const util = new globalThis.Olm.Utility();
         try {
             util.ed25519_verify(pubKey, "message", signature);
         } finally {
@@ -199,7 +199,7 @@ describe("CrossSigningInfo.getCrossSigningKey", function () {
  * it's not possible to get one in normal execution unless you hack as we do here.
  */
 describe.each([
-    ["IndexedDBCryptoStore", () => new IndexedDBCryptoStore(global.indexedDB, "tests")],
+    ["IndexedDBCryptoStore", () => new IndexedDBCryptoStore(globalThis.indexedDB, "tests")],
     ["LocalStorageCryptoStore", () => new IndexedDBCryptoStore(undefined!, "tests")],
     [
         "MemoryCryptoStore",

spec/unit/crypto/algorithms/megolm.spec.ts

@@ -43,10 +43,10 @@ const MegolmEncryption = algorithms.ENCRYPTION_CLASSES.get("m.megolm.v1.aes-sha2
 
 const ROOM_ID = "!ROOM:ID";
 
-const Olm = global.Olm;
+const Olm = globalThis.Olm;
 
 describe("MegolmDecryption", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running megolm unit tests: libolm not present");
         return;
     }
@@ -101,7 +101,7 @@ describe("MegolmDecryption", function () {
     describe("receives some keys:", function () {
         let groupSession: OutboundGroupSession;
         beforeEach(async function () {
-            groupSession = new global.Olm.OutboundGroupSession();
+            groupSession = new globalThis.Olm.OutboundGroupSession();
             groupSession.create();
 
             // construct a fake decrypted key event via the use of a mocked

spec/unit/crypto/algorithms/olm.spec.ts

@@ -47,13 +47,13 @@ function alwaysSucceed<T>(promise: Promise<T>): Promise<T | void> {
 }
 
 describe("OlmDevice", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running megolm unit tests: libolm not present");
         return;
     }
 
     beforeAll(function () {
-        return global.Olm.init();
+        return globalThis.Olm.init();
     });
 
     let aliceOlmDevice: OlmDevice;

spec/unit/crypto/backup.spec.ts

@@ -33,7 +33,7 @@ import { CryptoStore } from "../../../src/crypto/store/base";
 import { MegolmDecryption as MegolmDecryptionClass } from "../../../src/crypto/algorithms/megolm";
 import { IKeyBackupInfo } from "../../../src/crypto/keybackup";
 
-const Olm = global.Olm;
+const Olm = globalThis.Olm;
 
 const MegolmDecryption = algorithms.DECRYPTION_CLASSES.get("m.megolm.v1.aes-sha2")!;
 
@@ -155,7 +155,7 @@ function makeTestClient(cryptoStore: CryptoStore) {
 }
 
 describe("MegolmBackup", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running megolm backup unit tests: libolm not present");
         return;
     }
@@ -205,14 +205,14 @@ describe("MegolmBackup", function () {
             // clobber the setTimeout function to run 100x faster.
             // ideally we would use lolex, but we have no oportunity
             // to tick the clock between the first try and the retry.
-            const realSetTimeout = global.setTimeout;
-            jest.spyOn(global, "setTimeout").mockImplementation(function (f, n) {
+            const realSetTimeout = globalThis.setTimeout;
+            jest.spyOn(globalThis, "setTimeout").mockImplementation(function (f, n) {
                 return realSetTimeout(f!, n! / 100);
             });
         });
 
         afterEach(function () {
-            jest.spyOn(global, "setTimeout").mockRestore();
+            jest.spyOn(globalThis, "setTimeout").mockRestore();
         });
 
         test("fail if crypto not enabled", async () => {

spec/unit/crypto/cross-signing.spec.ts

@@ -84,13 +84,13 @@ async function makeTestClient(
 }
 
 describe("Cross Signing", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running megolm backup unit tests: libolm not present");
         return;
     }
 
     beforeAll(function () {
-        return global.Olm.init();
+        return globalThis.Olm.init();
     });
 
     it("should sign the master key with the device key", async function () {
@@ -140,9 +140,7 @@ describe("Cross Signing", function () {
                 });
             }
 
-            const error = new MatrixError(errorResponse);
-            error.httpStatus == 401;
-            throw error;
+            throw new MatrixError(errorResponse, 401);
         };
         alice.uploadKeySignatures = async () => ({ failures: {} });
         alice.setAccountData = async () => ({});
@@ -371,10 +369,10 @@ describe("Cross Signing", function () {
         // set Alice's cross-signing key
         await resetCrossSigningKeys(alice);
         // Alice downloads Bob's ssk and device key
-        const bobMasterSigning = new global.Olm.PkSigning();
+        const bobMasterSigning = new globalThis.Olm.PkSigning();
         const bobMasterPrivkey = bobMasterSigning.generate_seed();
         const bobMasterPubkey = bobMasterSigning.init_with_seed(bobMasterPrivkey);
-        const bobSigning = new global.Olm.PkSigning();
+        const bobSigning = new globalThis.Olm.PkSigning();
         const bobPrivkey = bobSigning.generate_seed();
         const bobPubkey = bobSigning.init_with_seed(bobPrivkey);
         const bobSSK: CrossSigningKeyInfo = {
@@ -490,7 +488,7 @@ describe("Cross Signing", function () {
         };
         await alice.crypto!.signObject(aliceDevice);
 
-        const bobOlmAccount = new global.Olm.Account();
+        const bobOlmAccount = new globalThis.Olm.Account();
         bobOlmAccount.create();
         const bobKeys = JSON.parse(bobOlmAccount.identity_keys());
         const bobDeviceUnsigned = {
@@ -624,10 +622,10 @@ describe("Cross Signing", function () {
         await resetCrossSigningKeys(alice);
         // Alice downloads Bob's ssk and device key
         // (NOTE: device key is not signed by ssk)
-        const bobMasterSigning = new global.Olm.PkSigning();
+        const bobMasterSigning = new globalThis.Olm.PkSigning();
         const bobMasterPrivkey = bobMasterSigning.generate_seed();
         const bobMasterPubkey = bobMasterSigning.init_with_seed(bobMasterPrivkey);
-        const bobSigning = new global.Olm.PkSigning();
+        const bobSigning = new globalThis.Olm.PkSigning();
         const bobPrivkey = bobSigning.generate_seed();
         const bobPubkey = bobSigning.init_with_seed(bobPrivkey);
         const bobSSK: CrossSigningKeyInfo = {
@@ -690,10 +688,10 @@ describe("Cross Signing", function () {
         alice.uploadKeySignatures = async () => ({ failures: {} });
         await resetCrossSigningKeys(alice);
         // Alice downloads Bob's keys
-        const bobMasterSigning = new global.Olm.PkSigning();
+        const bobMasterSigning = new globalThis.Olm.PkSigning();
         const bobMasterPrivkey = bobMasterSigning.generate_seed();
         const bobMasterPubkey = bobMasterSigning.init_with_seed(bobMasterPrivkey);
-        const bobSigning = new global.Olm.PkSigning();
+        const bobSigning = new globalThis.Olm.PkSigning();
         const bobPrivkey = bobSigning.generate_seed();
         const bobPubkey = bobSigning.init_with_seed(bobPrivkey);
         const bobSSK: CrossSigningKeyInfo = {
@@ -757,10 +755,10 @@ describe("Cross Signing", function () {
         expect(bobDeviceTrust.isTofu()).toBeTruthy();
 
         // Alice downloads new SSK for Bob
-        const bobMasterSigning2 = new global.Olm.PkSigning();
+        const bobMasterSigning2 = new globalThis.Olm.PkSigning();
         const bobMasterPrivkey2 = bobMasterSigning2.generate_seed();
         const bobMasterPubkey2 = bobMasterSigning2.init_with_seed(bobMasterPrivkey2);
-        const bobSigning2 = new global.Olm.PkSigning();
+        const bobSigning2 = new globalThis.Olm.PkSigning();
         const bobPrivkey2 = bobSigning2.generate_seed();
         const bobPubkey2 = bobSigning2.init_with_seed(bobPrivkey2);
         const bobSSK2: CrossSigningKeyInfo = {
@@ -827,7 +825,7 @@ describe("Cross Signing", function () {
     });
 
     it("should offer to upgrade device verifications to cross-signing", async function () {
-        let upgradeResolveFunc: Function;
+        let upgradeResolveFunc: () => void;
 
         const { client: alice } = await makeTestClient(
             { userId: "@alice:example.com", deviceId: "Osborne2" },
@@ -866,7 +864,7 @@ describe("Cross Signing", function () {
         // cross-signing key is signed by his Dynabook, which alice has
         // verified, and ask if the device verification should be upgraded to a
         // cross-signing verification
-        let upgradePromise = new Promise((resolve) => {
+        let upgradePromise = new Promise<void>((resolve) => {
             upgradeResolveFunc = resolve;
         });
         await resetCrossSigningKeys(alice);
@@ -885,7 +883,7 @@ describe("Cross Signing", function () {
         expect(bobTrust2.isCrossSigningVerified()).toBeFalsy();
         expect(bobTrust2.isTofu()).toBeTruthy();
 
-        upgradePromise = new Promise((resolve) => {
+        upgradePromise = new Promise<void>((resolve) => {
             upgradeResolveFunc = resolve;
         });
         alice.crypto!.deviceList.emit(CryptoEvent.UserCrossSigningUpdated, "@bob:example.com");
@@ -907,10 +905,10 @@ describe("Cross Signing", function () {
         alice.uploadKeySignatures = async () => ({ failures: {} });
 
         // Generate Alice's SSK etc
-        const aliceMasterSigning = new global.Olm.PkSigning();
+        const aliceMasterSigning = new globalThis.Olm.PkSigning();
         const aliceMasterPrivkey = aliceMasterSigning.generate_seed();
         const aliceMasterPubkey = aliceMasterSigning.init_with_seed(aliceMasterPrivkey);
-        const aliceSigning = new global.Olm.PkSigning();
+        const aliceSigning = new globalThis.Olm.PkSigning();
         const alicePrivkey = aliceSigning.generate_seed();
         const alicePubkey = aliceSigning.init_with_seed(alicePrivkey);
         const aliceSSK: CrossSigningKeyInfo = {
@@ -982,10 +980,10 @@ describe("Cross Signing", function () {
         alice.uploadKeySignatures = async () => ({ failures: {} });
 
         // Generate Alice's SSK etc
-        const aliceMasterSigning = new global.Olm.PkSigning();
+        const aliceMasterSigning = new globalThis.Olm.PkSigning();
         const aliceMasterPrivkey = aliceMasterSigning.generate_seed();
         const aliceMasterPubkey = aliceMasterSigning.init_with_seed(aliceMasterPrivkey);
-        const aliceSigning = new global.Olm.PkSigning();
+        const aliceSigning = new globalThis.Olm.PkSigning();
         const alicePrivkey = aliceSigning.generate_seed();
         const alicePubkey = aliceSigning.init_with_seed(alicePrivkey);
         const aliceSSK: CrossSigningKeyInfo = {
@@ -1042,10 +1040,10 @@ describe("Cross Signing", function () {
         alice.uploadKeySignatures = async () => ({ failures: {} });
 
         // Generate Alice's SSK etc
-        const aliceMasterSigning = new global.Olm.PkSigning();
+        const aliceMasterSigning = new globalThis.Olm.PkSigning();
         const aliceMasterPrivkey = aliceMasterSigning.generate_seed();
         const aliceMasterPubkey = aliceMasterSigning.init_with_seed(aliceMasterPrivkey);
-        const aliceSigning = new global.Olm.PkSigning();
+        const aliceSigning = new globalThis.Olm.PkSigning();
         const alicePrivkey = aliceSigning.generate_seed();
         const alicePubkey = aliceSigning.init_with_seed(alicePrivkey);
         const aliceSSK: CrossSigningKeyInfo = {
@@ -1090,12 +1088,12 @@ describe("Cross Signing", function () {
 });
 
 describe("userHasCrossSigningKeys", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         return;
     }
 
     beforeAll(() => {
-        return global.Olm.init();
+        return globalThis.Olm.init();
     });
 
     let aliceClient: MatrixClient;

spec/unit/crypto/crypto-utils.ts

@@ -32,7 +32,7 @@ export async function resetCrossSigningKeys(
 }
 
 export async function createSecretStorageKey(): Promise<IRecoveryKey> {
-    const decryption = new global.Olm.PkDecryption();
+    const decryption = new globalThis.Olm.PkDecryption();
     decryption.generate_key();
     const storagePrivateKey = decryption.get_private_key();
     decryption.free();

spec/unit/crypto/dehydration.spec.ts

@@ -19,16 +19,16 @@ import { TestClient } from "../../TestClient";
 import { logger } from "../../../src/logger";
 import { DEHYDRATION_ALGORITHM } from "../../../src/crypto/dehydration";
 
-const Olm = global.Olm;
+const Olm = globalThis.Olm;
 
 describe("Dehydration", () => {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running dehydration unit tests: libolm not present");
         return;
     }
 
     beforeAll(function () {
-        return global.Olm.init();
+        return globalThis.Olm.init();
     });
 
     it("should rehydrate a dehydrated device", async () => {

spec/unit/crypto/outgoing-room-key-requests.spec.ts

@@ -51,7 +51,7 @@ const requests = [
 ];
 
 describe.each([
-    ["IndexedDBCryptoStore", () => new IndexedDBCryptoStore(global.indexedDB, "tests")],
+    ["IndexedDBCryptoStore", () => new IndexedDBCryptoStore(globalThis.indexedDB, "tests")],
     ["LocalStorageCryptoStore", () => new LocalStorageCryptoStore(localStorage)],
     ["MemoryCryptoStore", () => new MemoryCryptoStore()],
 ])("Outgoing room key requests [%s]", function (name, dbFactory) {

spec/unit/crypto/secrets.spec.ts

@@ -69,20 +69,20 @@ function sign<T extends IObject | ICurve25519AuthData>(
 }
 
 describe("Secrets", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running megolm backup unit tests: libolm not present");
         return;
     }
 
     beforeAll(function () {
-        return global.Olm.init();
+        return globalThis.Olm.init();
     });
 
     it("should store and retrieve a secret", async function () {
         const key = new Uint8Array(16);
         for (let i = 0; i < 16; i++) key[i] = i;
 
-        const signing = new global.Olm.PkSigning();
+        const signing = new globalThis.Olm.PkSigning();
         const signingKey = signing.generate_seed();
         const signingPubKey = signing.init_with_seed(signingKey);
 
@@ -332,7 +332,7 @@ describe("Secrets", function () {
         });
 
         it("bootstraps when cross-signing keys in secret storage", async function () {
-            const decryption = new global.Olm.PkDecryption();
+            const decryption = new globalThis.Olm.PkDecryption();
             const storagePrivateKey = decryption.get_private_key();
 
             const bob: MatrixClient = await makeTestClient(

spec/unit/crypto/store/CryptoStore.spec.ts

@@ -20,7 +20,7 @@ import { IndexedDBCryptoStore, LocalStorageCryptoStore, MemoryCryptoStore } from
 import { CryptoStore, MigrationState, SESSION_BATCH_SIZE } from "../../../../src/crypto/store/base";
 
 describe.each([
-    ["IndexedDBCryptoStore", () => new IndexedDBCryptoStore(global.indexedDB, "tests")],
+    ["IndexedDBCryptoStore", () => new IndexedDBCryptoStore(globalThis.indexedDB, "tests")],
     ["LocalStorageCryptoStore", () => new LocalStorageCryptoStore(localStorage)],
     ["MemoryCryptoStore", () => new MemoryCryptoStore()],
 ])("CryptoStore tests for %s", function (name, dbFactory) {

spec/unit/crypto/store/IndexedDBCryptoStore.spec.ts

@@ -27,21 +27,21 @@ describe("IndexedDBCryptoStore", () => {
 
         it("Should be true if there is a legacy database", async () => {
             // should detect a store that is not migrated
-            const store = new IndexedDBCryptoStore(global.indexedDB, "tests");
+            const store = new IndexedDBCryptoStore(globalThis.indexedDB, "tests");
             await store.startup();
 
-            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(globalThis.indexedDB, "tests");
 
             expect(result).toBe(true);
         });
 
         it("Should be true if there is a legacy database in non migrated state", async () => {
             // should detect a store that is not migrated
-            const store = new IndexedDBCryptoStore(global.indexedDB, "tests");
+            const store = new IndexedDBCryptoStore(globalThis.indexedDB, "tests");
             await store.startup();
             await store.setMigrationState(MigrationState.NOT_STARTED);
 
-            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(globalThis.indexedDB, "tests");
 
             expect(result).toBe(true);
         });
@@ -54,18 +54,18 @@ describe("IndexedDBCryptoStore", () => {
         ])("Exists and Migration state is %s", (migrationState) => {
             it("Should be false if migration has started", async () => {
                 // should detect a store that is not migrated
-                const store = new IndexedDBCryptoStore(global.indexedDB, "tests");
+                const store = new IndexedDBCryptoStore(globalThis.indexedDB, "tests");
                 await store.startup();
                 await store.setMigrationState(migrationState);
 
-                const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+                const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(globalThis.indexedDB, "tests");
 
                 expect(result).toBe(false);
             });
         });
 
         it("Should be false if there is no legacy database", async () => {
-            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(global.indexedDB, "tests");
+            const result = await IndexedDBCryptoStore.existsAndIsNotMigrated(globalThis.indexedDB, "tests");
 
             expect(result).toBe(false);
         });

spec/unit/crypto/verification/qr_code.spec.ts

@@ -17,10 +17,10 @@ limitations under the License.
 import "../../../olm-loader";
 import { logger } from "../../../../src/logger";
 
-const Olm = global.Olm;
+const Olm = globalThis.Olm;
 
 describe("QR code verification", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running device verification tests: libolm not present");
         return;
     }

spec/unit/crypto/verification/request.spec.ts

@@ -20,12 +20,12 @@ import { logger } from "../../../../src/logger";
 import { SAS } from "../../../../src/crypto/verification/SAS";
 import { makeTestClients } from "./util";
 
-const Olm = global.Olm;
+const Olm = globalThis.Olm;
 
 jest.useFakeTimers();
 
 describe("verification request integration tests with crypto layer", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running device verification unit tests: libolm not present");
         return;
     }

spec/unit/crypto/verification/sas.spec.ts

@@ -29,13 +29,13 @@ import { MatrixClient } from "../../../../src";
 import { VerificationRequest } from "../../../../src/crypto/verification/request/VerificationRequest";
 import { TestClient } from "../../../TestClient";
 
-const Olm = global.Olm;
+const Olm = globalThis.Olm;
 
 let ALICE_DEVICES: Record<string, IDevice>;
 let BOB_DEVICES: Record<string, IDevice>;
 
 describe("SAS verification", function () {
-    if (!global.Olm) {
+    if (!globalThis.Olm) {
         logger.warn("Not running device verification unit tests: libolm not present");
         return;
     }
@@ -454,7 +454,7 @@ describe("SAS verification", function () {
         let bobSasEvent: ISasEvent | null;
         let aliceVerifier: SAS;
         let bobPromise: Promise<void>;
-        let clearTestClientTimeouts: Function;
+        let clearTestClientTimeouts: () => void;
 
         beforeEach(async function () {
             [[alice, bob], clearTestClientTimeouts] = await makeTestClients(

spec/unit/crypto/verification/secret_request.spec.ts

@@ -34,7 +34,7 @@ const testKeyPub = "nqOvzeuGWT/sRx3h7+MHoInYj3Uk2LD/unI9kDYcHwk";
 
 describe("self-verifications", () => {
     beforeAll(function () {
-        return global.Olm.init();
+        return globalThis.Olm.init();
     });
 
     it("triggers a request for key sharing upon completion", async () => {

spec/unit/digest.spec.ts

@@ -29,12 +29,12 @@ describe("sha256", () => {
     });
 
     it("throws if webcrypto is not available", async () => {
-        const oldCrypto = global.crypto;
+        const oldCrypto = globalThis.crypto;
         try {
-            global.crypto = {} as any;
+            globalThis.crypto = {} as any;
             await expect(sha256("test")).rejects.toThrow();
         } finally {
-            global.crypto = oldCrypto;
+            globalThis.crypto = oldCrypto;
         }
     });
 });

spec/unit/embedded.spec.ts

@@ -30,12 +30,13 @@ import {
     ITurnServer,
     IRoomEvent,
     IOpenIDCredentials,
+    WidgetApiResponseError,
 } from "matrix-widget-api";
 
-import { createRoomWidgetClient, MsgType, UpdateDelayedEventAction } from "../../src/matrix";
+import { createRoomWidgetClient, MatrixError, MsgType, UpdateDelayedEventAction } from "../../src/matrix";
 import { MatrixClient, ClientEvent, ITurnServer as IClientTurnServer } from "../../src/client";
 import { SyncState } from "../../src/sync";
-import { ICapabilities } from "../../src/embedded";
+import { ICapabilities, RoomWidgetClient } from "../../src/embedded";
 import { MatrixEvent } from "../../src/models/event";
 import { ToDeviceBatch } from "../../src/models/ToDeviceMessage";
 import { DeviceInfo } from "../../src/crypto/deviceinfo";
@@ -90,7 +91,11 @@ class MockWidgetApi extends EventEmitter {
     public getTurnServers = jest.fn(() => []);
     public sendContentLoaded = jest.fn();
 
-    public transport = { reply: jest.fn() };
+    public transport = {
+        reply: jest.fn(),
+        send: jest.fn(),
+        sendComplete: jest.fn(),
+    };
 }
 
 declare module "../../src/types" {
@@ -187,6 +192,46 @@ describe("RoomWidgetClient", () => {
                     .map((e) => e.getEffectiveEvent()),
             ).toEqual([event]);
         });
+
+        it("handles widget errors with generic error data", async () => {
+            const error = new Error("failed to send");
+            widgetApi.transport.send.mockRejectedValue(error);
+
+            await makeClient({ sendEvent: ["org.matrix.rageshake_request"] });
+            widgetApi.sendRoomEvent.mockImplementation(widgetApi.transport.send);
+
+            await expect(
+                client.sendEvent("!1:example.org", "org.matrix.rageshake_request", { request_id: 123 }),
+            ).rejects.toThrow(error);
+        });
+
+        it("handles widget errors with Matrix API error response data", async () => {
+            const errorStatusCode = 400;
+            const errorUrl = "http://example.org";
+            const errorData = {
+                errcode: "M_BAD_JSON",
+                error: "Invalid body",
+            };
+
+            const widgetError = new WidgetApiResponseError("failed to send", {
+                matrix_api_error: {
+                    http_status: errorStatusCode,
+                    http_headers: {},
+                    url: errorUrl,
+                    response: errorData,
+                },
+            });
+            const matrixError = new MatrixError(errorData, errorStatusCode, errorUrl);
+
+            widgetApi.transport.send.mockRejectedValue(widgetError);
+
+            await makeClient({ sendEvent: ["org.matrix.rageshake_request"] });
+            widgetApi.sendRoomEvent.mockImplementation(widgetApi.transport.send);
+
+            await expect(
+                client.sendEvent("!1:example.org", "org.matrix.rageshake_request", { request_id: 123 }),
+            ).rejects.toThrow(matrixError);
+        });
     });
 
     describe("delayed events", () => {
@@ -493,6 +538,23 @@ describe("RoomWidgetClient", () => {
             ["@bob:example.org"]: { ["bobDesktop"]: { hello: "bob!" } },
         };
 
+        const encryptedContentMap = new Map<string, Map<string, object>>([
+            ["@alice:example.org", new Map([["aliceMobile", { hello: "alice!" }]])],
+            ["@bob:example.org", new Map([["bobDesktop", { hello: "bob!" }]])],
+        ]);
+
+        it("sends unencrypted (sendToDeviceViaWidgetApi)", async () => {
+            await makeClient({ sendToDevice: ["org.example.foo"] });
+            expect(widgetApi.requestCapabilityToSendToDevice).toHaveBeenCalledWith("org.example.foo");
+
+            await (client as RoomWidgetClient).sendToDeviceViaWidgetApi(
+                "org.example.foo",
+                false,
+                unencryptedContentMap,
+            );
+            expect(widgetApi.sendToDevice).toHaveBeenCalledWith("org.example.foo", false, expectedRequestData);
+        });
+
         it("sends unencrypted (sendToDevice)", async () => {
             await makeClient({ sendToDevice: ["org.example.foo"] });
             expect(widgetApi.requestCapabilityToSendToDevice).toHaveBeenCalledWith("org.example.foo");
@@ -534,6 +596,17 @@ describe("RoomWidgetClient", () => {
             });
         });
 
+        it("sends encrypted (sendToDeviceViaWidgetApi)", async () => {
+            await makeClient({ sendToDevice: ["org.example.foo"] });
+            expect(widgetApi.requestCapabilityToSendToDevice).toHaveBeenCalledWith("org.example.foo");
+
+            await (client as RoomWidgetClient).sendToDeviceViaWidgetApi("org.example.foo", true, encryptedContentMap);
+            expect(widgetApi.sendToDevice).toHaveBeenCalledWith("org.example.foo", true, {
+                "@alice:example.org": { aliceMobile: { hello: "alice!" } },
+                "@bob:example.org": { bobDesktop: { hello: "bob!" } },
+            });
+        });
+
         it.each([
             { encrypted: false, title: "unencrypted" },
             { encrypted: true, title: "encrypted" },
@@ -570,6 +643,42 @@ describe("RoomWidgetClient", () => {
             await makeClient({});
             expect(await client.getOpenIdToken()).toStrictEqual(testOIDCToken);
         });
+
+        it("handles widget errors with generic error data", async () => {
+            const error = new Error("failed to get token");
+            widgetApi.transport.sendComplete.mockRejectedValue(error);
+
+            await makeClient({});
+            widgetApi.requestOpenIDConnectToken.mockImplementation(widgetApi.transport.sendComplete as any);
+
+            await expect(client.getOpenIdToken()).rejects.toThrow(error);
+        });
+
+        it("handles widget errors with Matrix API error response data", async () => {
+            const errorStatusCode = 400;
+            const errorUrl = "http://example.org";
+            const errorData = {
+                errcode: "M_UNKNOWN",
+                error: "Bad request",
+            };
+
+            const widgetError = new WidgetApiResponseError("failed to get token", {
+                matrix_api_error: {
+                    http_status: errorStatusCode,
+                    http_headers: {},
+                    url: errorUrl,
+                    response: errorData,
+                },
+            });
+            const matrixError = new MatrixError(errorData, errorStatusCode, errorUrl);
+
+            widgetApi.transport.sendComplete.mockRejectedValue(widgetError);
+
+            await makeClient({});
+            widgetApi.requestOpenIDConnectToken.mockImplementation(widgetApi.transport.sendComplete as any);
+
+            await expect(client.getOpenIdToken()).rejects.toThrow(matrixError);
+        });
     });
 
     it("gets TURN servers", async () => {

spec/unit/http-api/errors.spec.ts

@@ -0,0 +1,189 @@
+/*
+Copyright 2024 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { MatrixError } from "../../../src";
+
+type IErrorJson = MatrixError["data"];
+
+describe("MatrixError", () => {
+    let headers: Headers;
+
+    beforeEach(() => {
+        headers = new Headers({ "Content-Type": "application/json" });
+    });
+
+    function makeMatrixError(httpStatus: number, data: IErrorJson, url?: string): MatrixError {
+        return new MatrixError(data, httpStatus, url, undefined, headers);
+    }
+
+    it("should accept absent retry time from rate-limit error", () => {
+        const err = makeMatrixError(429, { errcode: "M_LIMIT_EXCEEDED" });
+        expect(err.isRateLimitError()).toBe(true);
+        expect(err.getRetryAfterMs()).toEqual(null);
+    });
+
+    it("should retrieve retry_after_ms from rate-limit error", () => {
+        const err = makeMatrixError(429, { errcode: "M_LIMIT_EXCEEDED", retry_after_ms: 150000 });
+        expect(err.isRateLimitError()).toBe(true);
+        expect(err.getRetryAfterMs()).toEqual(150000);
+    });
+
+    it("should ignore retry_after_ms if errcode is not M_LIMIT_EXCEEDED", () => {
+        const err = makeMatrixError(429, { errcode: "M_UNKNOWN", retry_after_ms: 150000 });
+        expect(err.isRateLimitError()).toBe(true);
+        expect(err.getRetryAfterMs()).toEqual(null);
+    });
+
+    it("should retrieve numeric Retry-After header from rate-limit error", () => {
+        headers.set("Retry-After", "120");
+        const err = makeMatrixError(429, { errcode: "M_LIMIT_EXCEEDED", retry_after_ms: 150000 });
+        expect(err.isRateLimitError()).toBe(true);
+        // prefer Retry-After header over retry_after_ms
+        expect(err.getRetryAfterMs()).toEqual(120000);
+    });
+
+    it("should retrieve Date Retry-After header from rate-limit error", () => {
+        headers.set("Retry-After", `${new Date(160000).toUTCString()}`);
+        jest.spyOn(globalThis.Date, "now").mockImplementationOnce(() => 100000);
+        const err = makeMatrixError(429, { errcode: "M_LIMIT_EXCEEDED", retry_after_ms: 150000 });
+        expect(err.isRateLimitError()).toBe(true);
+        // prefer Retry-After header over retry_after_ms
+        expect(err.getRetryAfterMs()).toEqual(60000);
+    });
+
+    it("should prefer M_FORBIDDEN errcode over HTTP status code 429", () => {
+        headers.set("Retry-After", "120");
+        const err = makeMatrixError(429, { errcode: "M_FORBIDDEN" });
+        expect(err.isRateLimitError()).toBe(false);
+        // retrieve Retry-After header even for non-M_LIMIT_EXCEEDED errors
+        expect(err.getRetryAfterMs()).toEqual(120000);
+    });
+
+    it("should prefer M_LIMIT_EXCEEDED errcode over HTTP status code 400", () => {
+        headers.set("Retry-After", "120");
+        const err = makeMatrixError(400, { errcode: "M_LIMIT_EXCEEDED" });
+        expect(err.isRateLimitError()).toBe(true);
+        // retrieve Retry-After header even for non-429 errors
+        expect(err.getRetryAfterMs()).toEqual(120000);
+    });
+
+    it("should reject invalid Retry-After header", () => {
+        for (const invalidValue of ["-1", "1.23", new Date(0).toString()]) {
+            headers.set("Retry-After", invalidValue);
+            const err = makeMatrixError(429, { errcode: "M_LIMIT_EXCEEDED" });
+            expect(() => err.getRetryAfterMs()).toThrow(
+                "value is not a valid HTTP-date or non-negative decimal integer",
+            );
+        }
+    });
+
+    it("should reject too-large Retry-After header", () => {
+        headers.set("Retry-After", "1" + Array(500).fill("0").join(""));
+        const err = makeMatrixError(429, { errcode: "M_LIMIT_EXCEEDED" });
+        expect(() => err.getRetryAfterMs()).toThrow("integer value is too large");
+    });
+
+    describe("can be converted to data compatible with the widget api", () => {
+        it("from default values", () => {
+            const matrixError = new MatrixError();
+
+            const widgetApiErrorData = {
+                http_status: 400,
+                http_headers: {},
+                url: "",
+                response: {
+                    errcode: "M_UNKNOWN",
+                    error: "Unknown message",
+                },
+            };
+
+            expect(matrixError.asWidgetApiErrorData()).toEqual(widgetApiErrorData);
+        });
+
+        it("from non-default values", () => {
+            headers.set("Retry-After", "120");
+            const statusCode = 429;
+            const data = {
+                errcode: "M_LIMIT_EXCEEDED",
+                error: "Request is rate-limited.",
+                retry_after_ms: 120000,
+            };
+            const url = "http://example.net";
+
+            const matrixError = makeMatrixError(statusCode, data, url);
+
+            const widgetApiErrorData = {
+                http_status: statusCode,
+                http_headers: {
+                    "content-type": "application/json",
+                    "retry-after": "120",
+                },
+                url,
+                response: data,
+            };
+
+            expect(matrixError.asWidgetApiErrorData()).toEqual(widgetApiErrorData);
+        });
+    });
+
+    describe("can be created from data received from the widget api", () => {
+        it("from minimal data", () => {
+            const statusCode = 400;
+            const data = {
+                errcode: "M_UNKNOWN",
+                error: "Something went wrong.",
+            };
+            const url = "";
+
+            const widgetApiErrorData = {
+                http_status: statusCode,
+                http_headers: {},
+                url,
+                response: data,
+            };
+
+            headers.delete("Content-Type");
+            const matrixError = makeMatrixError(statusCode, data, url);
+
+            expect(MatrixError.fromWidgetApiErrorData(widgetApiErrorData)).toEqual(matrixError);
+        });
+
+        it("from more data", () => {
+            const statusCode = 429;
+            const data = {
+                errcode: "M_LIMIT_EXCEEDED",
+                error: "Request is rate-limited.",
+                retry_after_ms: 120000,
+            };
+            const url = "http://example.net";
+
+            const widgetApiErrorData = {
+                http_status: statusCode,
+                http_headers: {
+                    "content-type": "application/json",
+                    "retry-after": "120",
+                },
+                url,
+                response: data,
+            };
+
+            headers.set("Retry-After", "120");
+            const matrixError = makeMatrixError(statusCode, data, url);
+
+            expect(MatrixError.fromWidgetApiErrorData(widgetApiErrorData)).toEqual(matrixError);
+        });
+    });
+});

spec/unit/http-api/fetch.spec.ts

@@ -60,11 +60,11 @@ describe("FetchHttpApi", () => {
     });
 
     it("should fall back to global fetch if fetchFn not provided", () => {
-        global.fetch = jest.fn();
-        expect(global.fetch).not.toHaveBeenCalled();
+        globalThis.fetch = jest.fn();
+        expect(globalThis.fetch).not.toHaveBeenCalled();
         const api = new FetchHttpApi(new TypedEventEmitter<any, any>(), { baseUrl, prefix });
         api.fetch("test");
-        expect(global.fetch).toHaveBeenCalled();
+        expect(globalThis.fetch).toHaveBeenCalled();
     });
 
     it("should update identity server base url", () => {

spec/unit/http-api/index.spec.ts

@@ -1,5 +1,5 @@
 /*
-Copyright 2022 The Matrix.org Foundation C.I.C.
+Copyright 2022 - 2024 The Matrix.org Foundation C.I.C.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -41,12 +41,13 @@ describe("MatrixHttpApi", () => {
             setRequestHeader: jest.fn(),
             onreadystatechange: undefined,
             getResponseHeader: jest.fn(),
+            getAllResponseHeaders: jest.fn(),
         } as unknown as XMLHttpRequest;
         // We stub out XHR here as it is not available in JSDOM
         // @ts-ignore
-        global.XMLHttpRequest = jest.fn().mockReturnValue(xhr);
+        globalThis.XMLHttpRequest = jest.fn().mockReturnValue(xhr);
         // @ts-ignore
-        global.XMLHttpRequest.DONE = DONE;
+        globalThis.XMLHttpRequest.DONE = DONE;
     });
 
     afterEach(() => {
@@ -59,7 +60,7 @@ describe("MatrixHttpApi", () => {
     });
 
     it("should fall back to `fetch` where xhr is unavailable", () => {
-        global.XMLHttpRequest = undefined!;
+        globalThis.XMLHttpRequest = undefined!;
         const fetchFn = jest.fn().mockResolvedValue({ ok: true, json: jest.fn().mockResolvedValue({}) });
         const api = new MatrixHttpApi(new TypedEventEmitter<any, any>(), { baseUrl, prefix, fetchFn });
         upload = api.uploadContent({} as File);
@@ -171,7 +172,10 @@ describe("MatrixHttpApi", () => {
         xhr.readyState = DONE;
         xhr.responseText = '{"errcode": "M_NOT_FOUND", "error": "Not found"}';
         xhr.status = 404;
-        mocked(xhr.getResponseHeader).mockReturnValue("application/json");
+        mocked(xhr.getResponseHeader).mockImplementation((name) =>
+            name.toLowerCase() === "content-type" ? "application/json" : null,
+        );
+        mocked(xhr.getAllResponseHeaders).mockReturnValue("content-type: application/json\r\n");
         // @ts-ignore
         xhr.onreadystatechange?.(new Event("test"));
 

spec/unit/http-api/utils.spec.ts

@@ -1,5 +1,5 @@
 /*
-Copyright 2022 The Matrix.org Foundation C.I.C.
+Copyright 2022 - 2024 The Matrix.org Foundation C.I.C.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -86,13 +86,28 @@ describe("anySignal", () => {
 });
 
 describe("parseErrorResponse", () => {
+    let headers: Headers;
+    const xhrHeaderMethods = {
+        getResponseHeader: (name: string) => headers.get(name),
+        getAllResponseHeaders: () => {
+            let allHeaders = "";
+            headers.forEach((value, key) => {
+                allHeaders += `${key.toLowerCase()}: ${value}\r\n`;
+            });
+            return allHeaders;
+        },
+    };
+
+    beforeEach(() => {
+        headers = new Headers();
+    });
+
     it("should resolve Matrix Errors from XHR", () => {
+        headers.set("Content-Type", "application/json");
         expect(
             parseErrorResponse(
                 {
-                    getResponseHeader(name: string): string | null {
-                        return name === "Content-Type" ? "application/json" : null;
-                    },
+                    ...xhrHeaderMethods,
                     status: 500,
                 } as XMLHttpRequest,
                 '{"errcode": "TEST"}',
@@ -108,14 +123,11 @@ describe("parseErrorResponse", () => {
     });
 
     it("should resolve Matrix Errors from fetch", () => {
+        headers.set("Content-Type", "application/json");
         expect(
             parseErrorResponse(
                 {
-                    headers: {
-                        get(name: string): string | null {
-                            return name === "Content-Type" ? "application/json" : null;
-                        },
-                    },
+                    headers,
                     status: 500,
                 } as Response,
                 '{"errcode": "TEST"}',
@@ -131,13 +143,12 @@ describe("parseErrorResponse", () => {
     });
 
     it("should resolve Matrix Errors from XHR with urls", () => {
+        headers.set("Content-Type", "application/json");
         expect(
             parseErrorResponse(
                 {
                     responseURL: "https://example.com",
-                    getResponseHeader(name: string): string | null {
-                        return name === "Content-Type" ? "application/json" : null;
-                    },
+                    ...xhrHeaderMethods,
                     status: 500,
                 } as XMLHttpRequest,
                 '{"errcode": "TEST"}',
@@ -154,15 +165,12 @@ describe("parseErrorResponse", () => {
     });
 
     it("should resolve Matrix Errors from fetch with urls", () => {
+        headers.set("Content-Type", "application/json");
         expect(
             parseErrorResponse(
                 {
                     url: "https://example.com",
-                    headers: {
-                        get(name: string): string | null {
-                            return name === "Content-Type" ? "application/json" : null;
-                        },
-                    },
+                    headers,
                     status: 500,
                 } as Response,
                 '{"errcode": "TEST"}',
@@ -178,6 +186,66 @@ describe("parseErrorResponse", () => {
         );
     });
 
+    describe("with HTTP headers", () => {
+        function addHeaders(headers: Headers) {
+            headers.set("Age", "0");
+            headers.set("Date", "Thu, 01 Jan 1970 00:00:00 GMT"); // value contains colons
+            headers.set("x-empty", "");
+            headers.set("x-multi", "1");
+            headers.append("x-multi", "2");
+        }
+
+        function compareHeaders(expectedHeaders: Headers, otherHeaders: Headers | undefined) {
+            expect(new Map(otherHeaders)).toEqual(new Map(expectedHeaders));
+        }
+
+        it("should resolve HTTP Errors from XHR with headers", () => {
+            headers.set("Content-Type", "text/plain");
+            addHeaders(headers);
+            const err = parseErrorResponse({
+                ...xhrHeaderMethods,
+                status: 500,
+            } as XMLHttpRequest) as HTTPError;
+            compareHeaders(headers, err.httpHeaders);
+        });
+
+        it("should resolve HTTP Errors from fetch with headers", () => {
+            headers.set("Content-Type", "text/plain");
+            addHeaders(headers);
+            const err = parseErrorResponse({
+                headers,
+                status: 500,
+            } as Response) as HTTPError;
+            compareHeaders(headers, err.httpHeaders);
+        });
+
+        it("should resolve Matrix Errors from XHR with headers", () => {
+            headers.set("Content-Type", "application/json");
+            addHeaders(headers);
+            const err = parseErrorResponse(
+                {
+                    ...xhrHeaderMethods,
+                    status: 500,
+                } as XMLHttpRequest,
+                '{"errcode": "TEST"}',
+            ) as MatrixError;
+            compareHeaders(headers, err.httpHeaders);
+        });
+
+        it("should resolve Matrix Errors from fetch with headers", () => {
+            headers.set("Content-Type", "application/json");
+            addHeaders(headers);
+            const err = parseErrorResponse(
+                {
+                    headers,
+                    status: 500,
+                } as Response,
+                '{"errcode": "TEST"}',
+            ) as MatrixError;
+            compareHeaders(headers, err.httpHeaders);
+        });
+    });
+
     it("should set a sensible default error message on MatrixError", () => {
         let err = new MatrixError();
         expect(err.message).toEqual("MatrixError: Unknown message");
@@ -188,14 +256,11 @@ describe("parseErrorResponse", () => {
     });
 
     it("should handle no type gracefully", () => {
+        // No Content-Type header
         expect(
             parseErrorResponse(
                 {
-                    headers: {
-                        get(name: string): string | null {
-                            return null;
-                        },
-                    },
+                    headers,
                     status: 500,
                 } as Response,
                 '{"errcode": "TEST"}',
@@ -203,31 +268,38 @@ describe("parseErrorResponse", () => {
         ).toStrictEqual(new HTTPError("Server returned 500 error", 500));
     });
 
-    it("should handle invalid type gracefully", () => {
+    it("should handle empty type gracefully", () => {
+        headers.set("Content-Type", " ");
         expect(
             parseErrorResponse(
                 {
-                    headers: {
-                        get(name: string): string | null {
-                            return name === "Content-Type" ? " " : null;
-                        },
-                    },
+                    headers,
                     status: 500,
                 } as Response,
                 '{"errcode": "TEST"}',
             ),
-        ).toStrictEqual(new Error("Error parsing Content-Type ' ': TypeError: invalid media type"));
+        ).toStrictEqual(new Error("Error parsing Content-Type '': TypeError: argument string is required"));
     });
 
-    it("should handle plaintext errors", () => {
+    it("should handle invalid type gracefully", () => {
+        headers.set("Content-Type", "unknown");
         expect(
             parseErrorResponse(
                 {
-                    headers: {
-                        get(name: string): string | null {
-                            return name === "Content-Type" ? "text/plain" : null;
-                        },
-                    },
+                    headers,
+                    status: 500,
+                } as Response,
+                '{"errcode": "TEST"}',
+            ),
+        ).toStrictEqual(new Error("Error parsing Content-Type 'unknown': TypeError: invalid media type"));
+    });
+
+    it("should handle plaintext errors", () => {
+        headers.set("Content-Type", "text/plain");
+        expect(
+            parseErrorResponse(
+                {
+                    headers,
                     status: 418,
                 } as Response,
                 "I'm a teapot",

spec/unit/matrix-client.spec.ts

@@ -102,7 +102,7 @@ type HttpLookup = {
     error?: object;
     expectBody?: Record<string, any>;
     expectQueryParams?: QueryDict;
-    thenCall?: Function;
+    thenCall?: () => void;
 };
 
 interface Options extends ICreateRoomOpts {
@@ -403,7 +403,7 @@ describe("MatrixClient", function () {
         async function assertRequestsMade(
             responses: {
                 prefix?: string;
-                error?: { httpStatus: Number; errcode: string };
+                error?: { httpStatus: number; errcode: string };
                 data?: { event_id: string };
             }[],
             expectRejects = false,
@@ -1515,7 +1515,7 @@ describe("MatrixClient", function () {
     });
 
     describe("emitted sync events", function () {
-        function syncChecker(expectedStates: [string, string | null][], done: Function) {
+        function syncChecker(expectedStates: [string, string | null][], done: () => void) {
             return function syncListener(state: SyncState, old: SyncState | null) {
                 const expected = expectedStates.shift();
                 logger.log("'sync' curr=%s old=%s EXPECT=%s", state, old, expected);
@@ -1537,7 +1537,7 @@ describe("MatrixClient", function () {
         it("should transition null -> PREPARED after the first /sync", async () => {
             const expectedStates: [string, string | null][] = [];
             expectedStates.push(["PREPARED", null]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();
@@ -1554,7 +1554,7 @@ describe("MatrixClient", function () {
                 error: { errcode: "NOPE_NOPE_NOPE" },
             });
             expectedStates.push(["ERROR", null]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();
@@ -1594,7 +1594,7 @@ describe("MatrixClient", function () {
             expectedStates.push(["RECONNECTING", null]);
             expectedStates.push(["ERROR", "RECONNECTING"]);
             expectedStates.push(["CATCHUP", "ERROR"]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();
@@ -1605,7 +1605,7 @@ describe("MatrixClient", function () {
             const expectedStates: [string, string | null][] = [];
             expectedStates.push(["PREPARED", null]);
             expectedStates.push(["SYNCING", "PREPARED"]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();
@@ -1630,7 +1630,7 @@ describe("MatrixClient", function () {
             expectedStates.push(["SYNCING", "PREPARED"]);
             expectedStates.push(["RECONNECTING", "SYNCING"]);
             expectedStates.push(["ERROR", "RECONNECTING"]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();
@@ -1649,7 +1649,7 @@ describe("MatrixClient", function () {
             expectedStates.push(["PREPARED", null]);
             expectedStates.push(["SYNCING", "PREPARED"]);
             expectedStates.push(["ERROR", "SYNCING"]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();
@@ -1664,7 +1664,7 @@ describe("MatrixClient", function () {
             expectedStates.push(["PREPARED", null]);
             expectedStates.push(["SYNCING", "PREPARED"]);
             expectedStates.push(["SYNCING", "SYNCING"]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();
@@ -1695,7 +1695,7 @@ describe("MatrixClient", function () {
             expectedStates.push(["RECONNECTING", "SYNCING"]);
             expectedStates.push(["ERROR", "RECONNECTING"]);
             expectedStates.push(["ERROR", "ERROR"]);
-            const didSyncPromise = new Promise((resolve) => {
+            const didSyncPromise = new Promise<void>((resolve) => {
                 client.on(ClientEvent.Sync, syncChecker(expectedStates, resolve));
             });
             await client.startClient();

spec/unit/models/MSC3089TreeSpace.spec.ts

@@ -107,7 +107,7 @@ describe("MSC3089TreeSpace", () => {
             return Promise.resolve();
         });
         client.invite = fn;
-        await tree.invite(target, false, false);
+        await tree.invite(target, false);
         expect(fn).toHaveBeenCalledTimes(1);
     });
 
@@ -120,7 +120,7 @@ describe("MSC3089TreeSpace", () => {
             return Promise.resolve();
         });
         client.invite = fn;
-        await tree.invite(target, false, false);
+        await tree.invite(target, false);
         expect(fn).toHaveBeenCalledTimes(2);
     });
 
@@ -133,7 +133,7 @@ describe("MSC3089TreeSpace", () => {
         });
         client.invite = fn;
 
-        await expect(tree.invite(target, false, false)).rejects.toThrow("MatrixError: Sample Failure");
+        await expect(tree.invite(target, false)).rejects.toThrow("MatrixError: Sample Failure");
 
         expect(fn).toHaveBeenCalledTimes(1);
     });
@@ -155,61 +155,10 @@ describe("MSC3089TreeSpace", () => {
             { invite: (userId) => fn(tree.roomId, userId) } as MSC3089TreeSpace,
         ];
 
-        await tree.invite(target, true, false);
+        await tree.invite(target, true);
         expect(fn).toHaveBeenCalledTimes(4);
     });
 
-    it("should share keys with invitees", async () => {
-        const target = targetUser;
-        const sendKeysFn = jest.fn().mockImplementation((inviteRoomId: string, userIds: string[]) => {
-            expect(inviteRoomId).toEqual(roomId);
-            expect(userIds).toMatchObject([target]);
-            return Promise.resolve();
-        });
-        client.invite = () => Promise.resolve({}); // we're not testing this here - see other tests
-        client.sendSharedHistoryKeys = sendKeysFn;
-
-        // Mock the history check as best as possible
-        const historyVis = "shared";
-        const historyFn = jest.fn().mockImplementation((eventType: string, stateKey?: string) => {
-            // We're not expecting a super rigid test: the function that calls this internally isn't
-            // really being tested here.
-            expect(eventType).toEqual(EventType.RoomHistoryVisibility);
-            expect(stateKey).toEqual("");
-            return { getContent: () => ({ history_visibility: historyVis }) }; // eslint-disable-line camelcase
-        });
-        room.currentState.getStateEvents = historyFn;
-
-        // Note: inverse test is implicit from other tests, which disable the call stack of this
-        // test in order to pass.
-        await tree.invite(target, false, true);
-        expect(sendKeysFn).toHaveBeenCalledTimes(1);
-        expect(historyFn).toHaveBeenCalledTimes(1);
-    });
-
-    it("should not share keys with invitees if inappropriate history visibility", async () => {
-        const target = targetUser;
-        const sendKeysFn = jest.fn().mockImplementation((inviteRoomId: string, userIds: string[]) => {
-            expect(inviteRoomId).toEqual(roomId);
-            expect(userIds).toMatchObject([target]);
-            return Promise.resolve();
-        });
-        client.invite = () => Promise.resolve({}); // we're not testing this here - see other tests
-        client.sendSharedHistoryKeys = sendKeysFn;
-
-        const historyVis = "joined"; // NOTE: Changed.
-        const historyFn = jest.fn().mockImplementation((eventType: string, stateKey?: string) => {
-            expect(eventType).toEqual(EventType.RoomHistoryVisibility);
-            expect(stateKey).toEqual("");
-            return { getContent: () => ({ history_visibility: historyVis }) }; // eslint-disable-line camelcase
-        });
-        room.currentState.getStateEvents = historyFn;
-
-        await tree.invite(target, false, true);
-        expect(sendKeysFn).toHaveBeenCalledTimes(0);
-        expect(historyFn).toHaveBeenCalledTimes(1);
-    });
-
     async function evaluatePowerLevels(pls: any, role: TreePermissions, expectedPl: number) {
         makePowerLevels(pls);
         const fn = jest

spec/unit/models/beacon.spec.ts

@@ -70,7 +70,7 @@ describe("Beacon", () => {
 
         const advanceDateAndTime = (ms: number) => {
             // bc liveness check uses Date.now we have to advance this mock
-            jest.spyOn(global.Date, "now").mockReturnValue(Date.now() + ms);
+            jest.spyOn(globalThis.Date, "now").mockReturnValue(Date.now() + ms);
             // then advance time for the interval by the same amount
             jest.advanceTimersByTime(ms);
         };
@@ -108,11 +108,11 @@ describe("Beacon", () => {
             );
 
             // back to 'now'
-            jest.spyOn(global.Date, "now").mockReturnValue(now);
+            jest.spyOn(globalThis.Date, "now").mockReturnValue(now);
         });
 
         afterAll(() => {
-            jest.spyOn(global.Date, "now").mockRestore();
+            jest.spyOn(globalThis.Date, "now").mockRestore();
         });
 
         it("creates beacon from event", () => {

spec/unit/oidc/authorize.spec.ts

@@ -56,7 +56,7 @@ describe("oidc authorization", () => {
             delegatedAuthConfig.metadata.issuer + ".well-known/openid-configuration",
             mockOpenIdConfiguration(),
         );
-        global.TextEncoder = TextEncoder;
+        globalThis.TextEncoder = TextEncoder;
     });
 
     beforeEach(() => {

spec/unit/pusher.spec.ts

@@ -35,7 +35,7 @@ describe("Pushers", () => {
         client = new MatrixClient({
             baseUrl: "https://my.home.server",
             accessToken: "my.access.token",
-            fetchFn: httpBackend.fetchFn as typeof global.fetch,
+            fetchFn: httpBackend.fetchFn as typeof globalThis.fetch,
         });
     });
 

spec/unit/queueToDevice.spec.ts

@@ -82,7 +82,7 @@ describe.each([[StoreType.Memory], [StoreType.IndexedDB]])("queueToDevice (%s st
             client = new MatrixClient({
                 baseUrl: "https://my.home.server",
                 accessToken: "my.access.token",
-                fetchFn: httpBackend.fetchFn as typeof global.fetch,
+                fetchFn: httpBackend.fetchFn as typeof globalThis.fetch,
                 store,
             });
         });
@@ -256,7 +256,7 @@ describe.each([[StoreType.Memory], [StoreType.IndexedDB]])("queueToDevice (%s st
             client = new MatrixClient({
                 baseUrl: "https://my.home.server",
                 accessToken: "my.access.token",
-                fetchFn: httpBackend.fetchFn as typeof global.fetch,
+                fetchFn: httpBackend.fetchFn as typeof globalThis.fetch,
                 store,
             });
         });

spec/unit/read-receipt.spec.ts

@@ -54,7 +54,7 @@ describe("Read receipt", () => {
             userId: "@user:server",
             baseUrl: "https://my.home.server",
             accessToken: "my.access.token",
-            fetchFn: httpBackend.fetchFn as typeof global.fetch,
+            fetchFn: httpBackend.fetchFn as typeof globalThis.fetch,
         });
         client.isGuest = () => false;
         client.supportsThreads = () => true;

spec/unit/realtime-callbacks.spec.ts

@@ -53,8 +53,8 @@ describe("realtime-callbacks", function () {
 
         it("should set 'this' to the global object", function () {
             let passed = false;
-            const callback = function (this: typeof global) {
-                expect(this).toBe(global); // eslint-disable-line @typescript-eslint/no-invalid-this
+            const callback = function (this: typeof globalThis) {
+                expect(this).toBe(globalThis); // eslint-disable-line @typescript-eslint/no-invalid-this
                 expect(this.console).toBeTruthy(); // eslint-disable-line @typescript-eslint/no-invalid-this
                 passed = true;
             };

spec/unit/rendezvous/ecdhv2.spec.ts

@@ -1,171 +0,0 @@
-/*
-Copyright 2022 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import "../../olm-loader";
-import { LegacyRendezvousFailureReason as RendezvousFailureReason, RendezvousIntent } from "../../../src/rendezvous";
-import { MSC3903ECDHPayload, MSC3903ECDHv2RendezvousChannel } from "../../../src/rendezvous/channels";
-import { decodeBase64 } from "../../../src/base64";
-import { DummyTransport } from "./DummyTransport";
-
-function makeTransport(name: string) {
-    return new DummyTransport<any, MSC3903ECDHPayload>(name, { type: "dummy" });
-}
-
-describe("ECDHv2", function () {
-    beforeAll(async function () {
-        await global.Olm.init();
-    });
-
-    describe("with crypto", () => {
-        it("initiator wants to sign in", async function () {
-            const aliceTransport = makeTransport("Alice");
-            const bobTransport = makeTransport("Bob");
-            aliceTransport.otherParty = bobTransport;
-            bobTransport.otherParty = aliceTransport;
-
-            // alice is signing in initiates and generates a code
-            const alice = new MSC3903ECDHv2RendezvousChannel(aliceTransport);
-            const aliceCode = await alice.generateCode(RendezvousIntent.LOGIN_ON_NEW_DEVICE);
-            const bob = new MSC3903ECDHv2RendezvousChannel(bobTransport, decodeBase64(aliceCode.rendezvous.key));
-
-            const bobChecksum = await bob.connect();
-            const aliceChecksum = await alice.connect();
-
-            expect(aliceChecksum).toEqual(bobChecksum);
-
-            const message = { key: "xxx" };
-            await alice.send(message);
-            const bobReceive = await bob.receive();
-            expect(bobReceive).toEqual(message);
-
-            await alice.cancel(RendezvousFailureReason.Unknown);
-            await bob.cancel(RendezvousFailureReason.Unknown);
-        });
-
-        it("initiator wants to reciprocate", async function () {
-            const aliceTransport = makeTransport("Alice");
-            const bobTransport = makeTransport("Bob");
-            aliceTransport.otherParty = bobTransport;
-            bobTransport.otherParty = aliceTransport;
-
-            // alice is signing in initiates and generates a code
-            const alice = new MSC3903ECDHv2RendezvousChannel(aliceTransport);
-            const aliceCode = await alice.generateCode(RendezvousIntent.LOGIN_ON_NEW_DEVICE);
-            const bob = new MSC3903ECDHv2RendezvousChannel(bobTransport, decodeBase64(aliceCode.rendezvous.key));
-
-            const bobChecksum = await bob.connect();
-            const aliceChecksum = await alice.connect();
-
-            expect(aliceChecksum).toEqual(bobChecksum);
-
-            const message = { key: "xxx" };
-            await bob.send(message);
-            const aliceReceive = await alice.receive();
-            expect(aliceReceive).toEqual(message);
-
-            await alice.cancel(RendezvousFailureReason.Unknown);
-            await bob.cancel(RendezvousFailureReason.Unknown);
-        });
-
-        it("double connect", async function () {
-            const aliceTransport = makeTransport("Alice");
-            const bobTransport = makeTransport("Bob");
-            aliceTransport.otherParty = bobTransport;
-            bobTransport.otherParty = aliceTransport;
-
-            // alice is signing in initiates and generates a code
-            const alice = new MSC3903ECDHv2RendezvousChannel(aliceTransport);
-            const aliceCode = await alice.generateCode(RendezvousIntent.LOGIN_ON_NEW_DEVICE);
-            const bob = new MSC3903ECDHv2RendezvousChannel(bobTransport, decodeBase64(aliceCode.rendezvous.key));
-
-            const bobChecksum = await bob.connect();
-            const aliceChecksum = await alice.connect();
-
-            expect(aliceChecksum).toEqual(bobChecksum);
-
-            await expect(alice.connect()).rejects.toThrow();
-
-            await alice.cancel(RendezvousFailureReason.Unknown);
-            await bob.cancel(RendezvousFailureReason.Unknown);
-        });
-
-        it("closed", async function () {
-            const aliceTransport = makeTransport("Alice");
-            const bobTransport = makeTransport("Bob");
-            aliceTransport.otherParty = bobTransport;
-            bobTransport.otherParty = aliceTransport;
-
-            // alice is signing in initiates and generates a code
-            const alice = new MSC3903ECDHv2RendezvousChannel(aliceTransport);
-            const aliceCode = await alice.generateCode(RendezvousIntent.LOGIN_ON_NEW_DEVICE);
-            const bob = new MSC3903ECDHv2RendezvousChannel(bobTransport, decodeBase64(aliceCode.rendezvous.key));
-
-            const bobChecksum = await bob.connect();
-            const aliceChecksum = await alice.connect();
-
-            expect(aliceChecksum).toEqual(bobChecksum);
-
-            alice.close();
-
-            await expect(alice.connect()).rejects.toThrow();
-            await expect(alice.send({})).rejects.toThrow();
-            await expect(alice.receive()).rejects.toThrow();
-
-            await alice.cancel(RendezvousFailureReason.Unknown);
-            await bob.cancel(RendezvousFailureReason.Unknown);
-        });
-
-        it("require ciphertext", async function () {
-            const aliceTransport = makeTransport("Alice");
-            const bobTransport = makeTransport("Bob");
-            aliceTransport.otherParty = bobTransport;
-            bobTransport.otherParty = aliceTransport;
-
-            // alice is signing in initiates and generates a code
-            const alice = new MSC3903ECDHv2RendezvousChannel(aliceTransport);
-            const aliceCode = await alice.generateCode(RendezvousIntent.LOGIN_ON_NEW_DEVICE);
-            const bob = new MSC3903ECDHv2RendezvousChannel(bobTransport, decodeBase64(aliceCode.rendezvous.key));
-
-            const bobChecksum = await bob.connect();
-            const aliceChecksum = await alice.connect();
-
-            expect(aliceChecksum).toEqual(bobChecksum);
-
-            // send a message without encryption
-            await aliceTransport.send({ iv: "dummy", ciphertext: "dummy" });
-
-            await alice.cancel(RendezvousFailureReason.Unknown);
-            await bob.cancel(RendezvousFailureReason.Unknown);
-            await expect(bob.receive()).rejects.toThrow();
-        });
-
-        it("ciphertext before set up", async function () {
-            const aliceTransport = makeTransport("Alice");
-            const bobTransport = makeTransport("Bob");
-            aliceTransport.otherParty = bobTransport;
-            bobTransport.otherParty = aliceTransport;
-
-            // alice is signing in initiates and generates a code
-            const alice = new MSC3903ECDHv2RendezvousChannel(aliceTransport);
-            await alice.generateCode(RendezvousIntent.LOGIN_ON_NEW_DEVICE);
-
-            await bobTransport.send({ iv: "dummy", ciphertext: "dummy" });
-
-            await alice.cancel(RendezvousFailureReason.Unknown);
-            await expect(alice.receive()).rejects.toThrow();
-        });
-    });
-});

spec/unit/rendezvous/rendezvous.spec.ts

@@ -1,712 +0,0 @@
-/*
-Copyright 2022 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import MockHttpBackend from "matrix-mock-request";
-
-import "../../olm-loader";
-import {
-    MSC3906Rendezvous,
-    RendezvousCode,
-    LegacyRendezvousFailureReason as RendezvousFailureReason,
-    RendezvousIntent,
-} from "../../../src/rendezvous";
-import {
-    ECDHv2RendezvousCode as ECDHRendezvousCode,
-    MSC3903ECDHPayload,
-    MSC3903ECDHv2RendezvousChannel as MSC3903ECDHRendezvousChannel,
-} from "../../../src/rendezvous/channels";
-import { Device, MatrixClient } from "../../../src";
-import {
-    MSC3886SimpleHttpRendezvousTransport,
-    MSC3886SimpleHttpRendezvousTransportDetails,
-} from "../../../src/rendezvous/transports";
-import { DummyTransport } from "./DummyTransport";
-import { decodeBase64 } from "../../../src/base64";
-import { logger } from "../../../src/logger";
-import { CrossSigningKey, OwnDeviceKeys } from "../../../src/crypto-api";
-
-type UserID = string;
-type DeviceID = string;
-type Fingerprint = string;
-type SimpleDeviceMap = Record<UserID, Record<DeviceID, Fingerprint>>;
-
-function mockDevice(userId: UserID, deviceId: DeviceID, fingerprint: Fingerprint): Device {
-    return {
-        deviceId,
-        userId,
-        getFingerprint: () => fingerprint,
-    } as unknown as Device;
-}
-
-function mockDeviceMap(
-    userId: UserID,
-    deviceId: DeviceID,
-    deviceKey?: Fingerprint,
-    otherDevices: SimpleDeviceMap = {},
-): Map<string, Map<string, Device>> {
-    const deviceMap: Map<string, Map<string, Device>> = new Map();
-
-    const myDevices: Map<string, Device> = new Map();
-    if (deviceKey) {
-        myDevices.set(deviceId, mockDevice(userId, deviceId, deviceKey));
-    }
-    deviceMap.set(userId, myDevices);
-
-    for (const u in otherDevices) {
-        let userDevices = deviceMap.get(u);
-        if (!userDevices) {
-            userDevices = new Map();
-            deviceMap.set(u, userDevices);
-        }
-        for (const d in otherDevices[u]) {
-            userDevices.set(d, mockDevice(u, d, otherDevices[u][d]));
-        }
-    }
-
-    return deviceMap;
-}
-
-function makeMockClient(opts: {
-    userId: UserID;
-    deviceId: DeviceID;
-    deviceKey?: Fingerprint;
-    getLoginTokenEnabled: boolean;
-    msc3882r0Only: boolean;
-    msc3886Enabled: boolean;
-    devices?: SimpleDeviceMap;
-    verificationFunction?: (
-        userId: string,
-        deviceId: string,
-        verified: boolean,
-        blocked: boolean,
-        known: boolean,
-    ) => void;
-    crossSigningIds?: Partial<Record<CrossSigningKey, string>>;
-}): [MatrixClient, Map<string, Map<string, Device>>] {
-    const deviceMap = mockDeviceMap(opts.userId, opts.deviceId, opts.deviceKey, opts.devices);
-    return [
-        {
-            doesServerSupportUnstableFeature: jest.fn().mockImplementation((feature) => {
-                if (feature === "org.matrix.msc3886") {
-                    return opts.msc3886Enabled;
-                } else if (feature === "org.matrix.msc3882") {
-                    return opts.getLoginTokenEnabled;
-                } else {
-                    return false;
-                }
-            }),
-            getVersions() {
-                return {
-                    unstable_features: {
-                        "org.matrix.msc3882": opts.getLoginTokenEnabled,
-                        "org.matrix.msc3886": opts.msc3886Enabled,
-                    },
-                };
-            },
-            getCachedCapabilities() {
-                return opts.msc3882r0Only
-                    ? {}
-                    : {
-                          capabilities: {
-                              "m.get_login_token": {
-                                  enabled: opts.getLoginTokenEnabled,
-                              },
-                          },
-                      };
-            },
-            getUserId() {
-                return opts.userId;
-            },
-            getSafeUserId() {
-                return opts.userId;
-            },
-            getDeviceId() {
-                return opts.deviceId;
-            },
-            baseUrl: "https://example.com",
-            getCrypto() {
-                return {
-                    getUserDeviceInfo(
-                        [userId]: string[],
-                        downloadUncached?: boolean,
-                    ): Promise<Map<string, Map<string, Device>>> {
-                        return Promise.resolve(deviceMap);
-                    },
-                    getCrossSigningKeyId(key: CrossSigningKey): string | null {
-                        return opts.crossSigningIds?.[key] ?? null;
-                    },
-                    setDeviceVerified(userId: string, deviceId: string, verified: boolean): Promise<void> {
-                        return Promise.resolve();
-                    },
-                    crossSignDevice(deviceId: string): Promise<void> {
-                        return Promise.resolve();
-                    },
-                    getOwnDeviceKeys(): Promise<OwnDeviceKeys> {
-                        return Promise.resolve({
-                            ed25519: opts.deviceKey!,
-                            curve25519: "aaaa",
-                        });
-                    },
-                };
-            },
-        } as unknown as MatrixClient,
-        deviceMap,
-    ];
-}
-
-function makeTransport(name: string, uri = "https://test.rz/123456") {
-    return new DummyTransport<any, MSC3903ECDHPayload>(name, { type: "http.v1", uri });
-}
-
-describe("Rendezvous", function () {
-    beforeAll(async function () {
-        await global.Olm.init();
-    });
-
-    let httpBackend: MockHttpBackend;
-    let fetchFn: typeof global.fetch;
-    let transports: DummyTransport<any, MSC3903ECDHPayload>[];
-    const userId: UserID = "@user:example.com";
-
-    beforeEach(function () {
-        httpBackend = new MockHttpBackend();
-        fetchFn = httpBackend.fetchFn as typeof global.fetch;
-        transports = [];
-    });
-
-    afterEach(function () {
-        transports.forEach((x) => x.cleanup());
-    });
-
-    it("generate and cancel", async function () {
-        const [alice] = makeMockClient({
-            userId,
-            deviceId: "ALICE",
-            msc3886Enabled: false,
-            getLoginTokenEnabled: true,
-            msc3882r0Only: true,
-        });
-        httpBackend.when("POST", "https://fallbackserver/rz").response = {
-            body: null,
-            response: {
-                statusCode: 201,
-                headers: {
-                    location: "https://fallbackserver/rz/123",
-                },
-            },
-        };
-        const aliceTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client: alice,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        const aliceEcdh = new MSC3903ECDHRendezvousChannel(aliceTransport);
-        const aliceRz = new MSC3906Rendezvous(aliceEcdh, alice);
-
-        expect(aliceRz.code).toBeUndefined();
-
-        const codePromise = aliceRz.generateCode();
-        await httpBackend.flush("");
-
-        await aliceRz.generateCode();
-
-        expect(typeof aliceRz.code).toBe("string");
-
-        await codePromise;
-
-        const code = JSON.parse(aliceRz.code!) as RendezvousCode;
-
-        expect(code.intent).toEqual(RendezvousIntent.RECIPROCATE_LOGIN_ON_EXISTING_DEVICE);
-        expect(code.rendezvous?.algorithm).toEqual("org.matrix.msc3903.rendezvous.v2.curve25519-aes-sha256");
-        expect(code.rendezvous?.transport.type).toEqual("org.matrix.msc3886.http.v1");
-        expect((code.rendezvous?.transport as MSC3886SimpleHttpRendezvousTransportDetails).uri).toEqual(
-            "https://fallbackserver/rz/123",
-        );
-
-        httpBackend.when("DELETE", "https://fallbackserver/rz").response = {
-            body: null,
-            response: {
-                statusCode: 204,
-                headers: {},
-            },
-        };
-
-        const cancelPromise = aliceRz.cancel(RendezvousFailureReason.UserDeclined);
-        await httpBackend.flush("");
-        await expect(cancelPromise).resolves.toBeUndefined();
-        httpBackend.verifyNoOutstandingExpectation();
-        httpBackend.verifyNoOutstandingRequests();
-
-        await aliceRz.close();
-    });
-
-    async function testNoProtocols({
-        getLoginTokenEnabled,
-        msc3882r0Only,
-    }: {
-        getLoginTokenEnabled: boolean;
-        msc3882r0Only: boolean;
-    }) {
-        const aliceTransport = makeTransport("Alice");
-        const bobTransport = makeTransport("Bob", "https://test.rz/999999");
-        transports.push(aliceTransport, bobTransport);
-        aliceTransport.otherParty = bobTransport;
-        bobTransport.otherParty = aliceTransport;
-
-        // alice is already signs in and generates a code
-        const aliceOnFailure = jest.fn();
-        const [alice] = makeMockClient({
-            userId,
-            deviceId: "ALICE",
-            msc3886Enabled: false,
-            getLoginTokenEnabled,
-            msc3882r0Only,
-        });
-        const aliceEcdh = new MSC3903ECDHRendezvousChannel(aliceTransport, undefined, aliceOnFailure);
-        const aliceRz = new MSC3906Rendezvous(aliceEcdh, alice);
-        aliceTransport.onCancelled = aliceOnFailure;
-        await aliceRz.generateCode();
-        const code = JSON.parse(aliceRz.code!) as ECDHRendezvousCode;
-
-        expect(code.rendezvous.key).toBeDefined();
-
-        const aliceStartProm = aliceRz.startAfterShowingCode();
-
-        // bob is try to sign in and scans the code
-        const bobOnFailure = jest.fn();
-        const bobEcdh = new MSC3903ECDHRendezvousChannel(
-            bobTransport,
-            decodeBase64(code.rendezvous.key), // alice's public key
-            bobOnFailure,
-        );
-
-        const bobStartPromise = (async () => {
-            const bobChecksum = await bobEcdh.connect();
-            logger.info(`Bob checksums is ${bobChecksum} now sending intent`);
-            // await bobEcdh.send({ type: 'm.login.progress', intent: RendezvousIntent.LOGIN_ON_NEW_DEVICE });
-
-            // wait for protocols
-            logger.info("Bob waiting for protocols");
-            const protocols = await bobEcdh.receive();
-
-            logger.info(`Bob protocols: ${JSON.stringify(protocols)}`);
-
-            expect(protocols).toEqual({
-                type: "m.login.finish",
-                outcome: "unsupported",
-            });
-        })();
-
-        await aliceStartProm;
-        await bobStartPromise;
-    }
-
-    it("no protocols - r0", async function () {
-        await testNoProtocols({ getLoginTokenEnabled: false, msc3882r0Only: true });
-    });
-
-    it("no protocols - stable", async function () {
-        await testNoProtocols({ getLoginTokenEnabled: false, msc3882r0Only: false });
-    });
-
-    it("new device declines protocol with outcome unsupported", async function () {
-        const aliceTransport = makeTransport("Alice", "https://test.rz/123456");
-        const bobTransport = makeTransport("Bob", "https://test.rz/999999");
-        transports.push(aliceTransport, bobTransport);
-        aliceTransport.otherParty = bobTransport;
-        bobTransport.otherParty = aliceTransport;
-
-        // alice is already signs in and generates a code
-        const aliceOnFailure = jest.fn();
-        const [alice] = makeMockClient({
-            userId,
-            deviceId: "ALICE",
-            getLoginTokenEnabled: true,
-            msc3882r0Only: false,
-            msc3886Enabled: false,
-        });
-        const aliceEcdh = new MSC3903ECDHRendezvousChannel(aliceTransport, undefined, aliceOnFailure);
-        const aliceRz = new MSC3906Rendezvous(aliceEcdh, alice);
-        aliceTransport.onCancelled = aliceOnFailure;
-        await aliceRz.generateCode();
-        const code = JSON.parse(aliceRz.code!) as ECDHRendezvousCode;
-
-        expect(code.rendezvous.key).toBeDefined();
-
-        const aliceStartProm = aliceRz.startAfterShowingCode();
-
-        // bob is try to sign in and scans the code
-        const bobOnFailure = jest.fn();
-        const bobEcdh = new MSC3903ECDHRendezvousChannel(
-            bobTransport,
-            decodeBase64(code.rendezvous.key), // alice's public key
-            bobOnFailure,
-        );
-
-        const bobStartPromise = (async () => {
-            const bobChecksum = await bobEcdh.connect();
-            logger.info(`Bob checksums is ${bobChecksum} now sending intent`);
-            // await bobEcdh.send({ type: 'm.login.progress', intent: RendezvousIntent.LOGIN_ON_NEW_DEVICE });
-
-            // wait for protocols
-            logger.info("Bob waiting for protocols");
-            const protocols = await bobEcdh.receive();
-
-            logger.info(`Bob protocols: ${JSON.stringify(protocols)}`);
-
-            expect(protocols).toEqual({
-                type: "m.login.progress",
-                protocols: ["org.matrix.msc3906.login_token"],
-            });
-
-            await bobEcdh.send({ type: "m.login.finish", outcome: "unsupported" });
-        })();
-
-        await aliceStartProm;
-        await bobStartPromise;
-
-        expect(aliceOnFailure).toHaveBeenCalledWith(RendezvousFailureReason.UnsupportedAlgorithm);
-    });
-
-    it("new device requests an invalid protocol", async function () {
-        const aliceTransport = makeTransport("Alice", "https://test.rz/123456");
-        const bobTransport = makeTransport("Bob", "https://test.rz/999999");
-        transports.push(aliceTransport, bobTransport);
-        aliceTransport.otherParty = bobTransport;
-        bobTransport.otherParty = aliceTransport;
-
-        // alice is already signs in and generates a code
-        const aliceOnFailure = jest.fn();
-        const [alice] = makeMockClient({
-            userId,
-            deviceId: "ALICE",
-            getLoginTokenEnabled: true,
-            msc3882r0Only: false,
-            msc3886Enabled: false,
-        });
-        const aliceEcdh = new MSC3903ECDHRendezvousChannel(aliceTransport, undefined, aliceOnFailure);
-        const aliceRz = new MSC3906Rendezvous(aliceEcdh, alice);
-        aliceTransport.onCancelled = aliceOnFailure;
-        await aliceRz.generateCode();
-        const code = JSON.parse(aliceRz.code!) as ECDHRendezvousCode;
-
-        expect(code.rendezvous.key).toBeDefined();
-
-        const aliceStartProm = aliceRz.startAfterShowingCode();
-
-        // bob is try to sign in and scans the code
-        const bobOnFailure = jest.fn();
-        const bobEcdh = new MSC3903ECDHRendezvousChannel(
-            bobTransport,
-            decodeBase64(code.rendezvous.key), // alice's public key
-            bobOnFailure,
-        );
-
-        const bobStartPromise = (async () => {
-            const bobChecksum = await bobEcdh.connect();
-            logger.info(`Bob checksums is ${bobChecksum} now sending intent`);
-            // await bobEcdh.send({ type: 'm.login.progress', intent: RendezvousIntent.LOGIN_ON_NEW_DEVICE });
-
-            // wait for protocols
-            logger.info("Bob waiting for protocols");
-            const protocols = await bobEcdh.receive();
-
-            logger.info(`Bob protocols: ${JSON.stringify(protocols)}`);
-
-            expect(protocols).toEqual({
-                type: "m.login.progress",
-                protocols: ["org.matrix.msc3906.login_token"],
-            });
-
-            await bobEcdh.send({ type: "m.login.progress", protocol: "bad protocol" });
-        })();
-
-        await aliceStartProm;
-        await bobStartPromise;
-
-        expect(aliceOnFailure).toHaveBeenCalledWith(RendezvousFailureReason.UnsupportedAlgorithm);
-    });
-
-    it("decline on existing device", async function () {
-        const aliceTransport = makeTransport("Alice", "https://test.rz/123456");
-        const bobTransport = makeTransport("Bob", "https://test.rz/999999");
-        transports.push(aliceTransport, bobTransport);
-        aliceTransport.otherParty = bobTransport;
-        bobTransport.otherParty = aliceTransport;
-
-        // alice is already signs in and generates a code
-        const aliceOnFailure = jest.fn();
-        const [alice] = makeMockClient({
-            userId: "alice",
-            deviceId: "ALICE",
-            getLoginTokenEnabled: true,
-            msc3882r0Only: false,
-            msc3886Enabled: false,
-        });
-        const aliceEcdh = new MSC3903ECDHRendezvousChannel(aliceTransport, undefined, aliceOnFailure);
-        const aliceRz = new MSC3906Rendezvous(aliceEcdh, alice);
-        aliceTransport.onCancelled = aliceOnFailure;
-        await aliceRz.generateCode();
-        const code = JSON.parse(aliceRz.code!) as ECDHRendezvousCode;
-
-        expect(code.rendezvous.key).toBeDefined();
-
-        const aliceStartProm = aliceRz.startAfterShowingCode();
-
-        // bob is try to sign in and scans the code
-        const bobOnFailure = jest.fn();
-        const bobEcdh = new MSC3903ECDHRendezvousChannel(
-            bobTransport,
-            decodeBase64(code.rendezvous.key), // alice's public key
-            bobOnFailure,
-        );
-
-        const bobStartPromise = (async () => {
-            const bobChecksum = await bobEcdh.connect();
-            logger.info(`Bob checksums is ${bobChecksum} now sending intent`);
-            // await bobEcdh.send({ type: 'm.login.progress', intent: RendezvousIntent.LOGIN_ON_NEW_DEVICE });
-
-            // wait for protocols
-            logger.info("Bob waiting for protocols");
-            const protocols = await bobEcdh.receive();
-
-            logger.info(`Bob protocols: ${JSON.stringify(protocols)}`);
-
-            expect(protocols).toEqual({
-                type: "m.login.progress",
-                protocols: ["org.matrix.msc3906.login_token"],
-            });
-
-            await bobEcdh.send({ type: "m.login.progress", protocol: "org.matrix.msc3906.login_token" });
-        })();
-
-        await aliceStartProm;
-        await bobStartPromise;
-
-        await aliceRz.declineLoginOnExistingDevice();
-        const loginToken = await bobEcdh.receive();
-        expect(loginToken).toEqual({ type: "m.login.finish", outcome: "declined" });
-    });
-
-    it("approve on existing device + no verification", async function () {
-        const aliceTransport = makeTransport("Alice", "https://test.rz/123456");
-        const bobTransport = makeTransport("Bob", "https://test.rz/999999");
-        transports.push(aliceTransport, bobTransport);
-        aliceTransport.otherParty = bobTransport;
-        bobTransport.otherParty = aliceTransport;
-
-        // alice is already signs in and generates a code
-        const aliceOnFailure = jest.fn();
-        const [alice] = makeMockClient({
-            userId: "alice",
-            deviceId: "ALICE",
-            getLoginTokenEnabled: true,
-            msc3882r0Only: false,
-            msc3886Enabled: false,
-        });
-        const aliceEcdh = new MSC3903ECDHRendezvousChannel(aliceTransport, undefined, aliceOnFailure);
-        const aliceRz = new MSC3906Rendezvous(aliceEcdh, alice);
-        aliceTransport.onCancelled = aliceOnFailure;
-        await aliceRz.generateCode();
-        const code = JSON.parse(aliceRz.code!) as ECDHRendezvousCode;
-
-        expect(code.rendezvous.key).toBeDefined();
-
-        const aliceStartProm = aliceRz.startAfterShowingCode();
-
-        // bob is try to sign in and scans the code
-        const bobOnFailure = jest.fn();
-        const bobEcdh = new MSC3903ECDHRendezvousChannel(
-            bobTransport,
-            decodeBase64(code.rendezvous.key), // alice's public key
-            bobOnFailure,
-        );
-
-        const bobStartPromise = (async () => {
-            const bobChecksum = await bobEcdh.connect();
-            logger.info(`Bob checksums is ${bobChecksum} now sending intent`);
-            // await bobEcdh.send({ type: 'm.login.progress', intent: RendezvousIntent.LOGIN_ON_NEW_DEVICE });
-
-            // wait for protocols
-            logger.info("Bob waiting for protocols");
-            const protocols = await bobEcdh.receive();
-
-            logger.info(`Bob protocols: ${JSON.stringify(protocols)}`);
-
-            expect(protocols).toEqual({
-                type: "m.login.progress",
-                protocols: ["org.matrix.msc3906.login_token"],
-            });
-
-            await bobEcdh.send({ type: "m.login.progress", protocol: "org.matrix.msc3906.login_token" });
-        })();
-
-        await aliceStartProm;
-        await bobStartPromise;
-
-        const confirmProm = aliceRz.approveLoginOnExistingDevice("token");
-
-        const bobCompleteProm = (async () => {
-            const loginToken = await bobEcdh.receive();
-            expect(loginToken).toEqual({ type: "m.login.progress", login_token: "token", homeserver: alice.baseUrl });
-            await bobEcdh.send({ type: "m.login.finish", outcome: "success" });
-        })();
-
-        await confirmProm;
-        await bobCompleteProm;
-    });
-
-    async function completeLogin(devices: SimpleDeviceMap) {
-        const aliceTransport = makeTransport("Alice", "https://test.rz/123456");
-        const bobTransport = makeTransport("Bob", "https://test.rz/999999");
-        transports.push(aliceTransport, bobTransport);
-        aliceTransport.otherParty = bobTransport;
-        bobTransport.otherParty = aliceTransport;
-
-        // alice is already signs in and generates a code
-        const aliceOnFailure = jest.fn();
-        const aliceVerification = jest.fn();
-        const [alice, deviceMap] = makeMockClient({
-            userId,
-            deviceId: "ALICE",
-            getLoginTokenEnabled: true,
-            msc3882r0Only: false,
-            msc3886Enabled: false,
-            devices,
-            deviceKey: "aaaa",
-            verificationFunction: aliceVerification,
-            crossSigningIds: {
-                master: "mmmmm",
-            },
-        });
-        const aliceEcdh = new MSC3903ECDHRendezvousChannel(aliceTransport, undefined, aliceOnFailure);
-        const aliceRz = new MSC3906Rendezvous(aliceEcdh, alice);
-        aliceTransport.onCancelled = aliceOnFailure;
-        await aliceRz.generateCode();
-        const code = JSON.parse(aliceRz.code!) as ECDHRendezvousCode;
-
-        expect(code.rendezvous.key).toBeDefined();
-
-        const aliceStartProm = aliceRz.startAfterShowingCode();
-
-        // bob is try to sign in and scans the code
-        const bobOnFailure = jest.fn();
-        const bobEcdh = new MSC3903ECDHRendezvousChannel(
-            bobTransport,
-            decodeBase64(code.rendezvous.key), // alice's public key
-            bobOnFailure,
-        );
-
-        const bobStartPromise = (async () => {
-            const bobChecksum = await bobEcdh.connect();
-            logger.info(`Bob checksums is ${bobChecksum} now sending intent`);
-            // await bobEcdh.send({ type: 'm.login.progress', intent: RendezvousIntent.LOGIN_ON_NEW_DEVICE });
-
-            // wait for protocols
-            logger.info("Bob waiting for protocols");
-            const protocols = await bobEcdh.receive();
-
-            logger.info(`Bob protocols: ${JSON.stringify(protocols)}`);
-
-            expect(protocols).toEqual({
-                type: "m.login.progress",
-                protocols: ["org.matrix.msc3906.login_token"],
-            });
-
-            await bobEcdh.send({ type: "m.login.progress", protocol: "org.matrix.msc3906.login_token" });
-        })();
-
-        await aliceStartProm;
-        await bobStartPromise;
-
-        const confirmProm = aliceRz.approveLoginOnExistingDevice("token");
-
-        const bobLoginProm = (async () => {
-            const loginToken = await bobEcdh.receive();
-            expect(loginToken).toEqual({ type: "m.login.progress", login_token: "token", homeserver: alice.baseUrl });
-            await bobEcdh.send({ type: "m.login.finish", outcome: "success", device_id: "BOB", device_key: "bbbb" });
-        })();
-
-        expect(await confirmProm).toEqual("BOB");
-        await bobLoginProm;
-
-        return {
-            aliceTransport,
-            aliceEcdh,
-            aliceRz,
-            bobTransport,
-            bobEcdh,
-            deviceMap,
-        };
-    }
-
-    it("approve on existing device + verification", async function () {
-        const { bobEcdh, aliceRz } = await completeLogin({
-            [userId]: {
-                BOB: "bbbb",
-            },
-        });
-        const verifyProm = aliceRz.verifyNewDeviceOnExistingDevice();
-
-        const bobVerifyProm = (async () => {
-            const verified = await bobEcdh.receive();
-            expect(verified).toEqual({
-                type: "m.login.finish",
-                outcome: "verified",
-                verifying_device_id: "ALICE",
-                verifying_device_key: "aaaa",
-                master_key: "mmmmm",
-            });
-        })();
-
-        await verifyProm;
-        await bobVerifyProm;
-    });
-
-    it("device not online within timeout", async function () {
-        const { aliceRz } = await completeLogin({});
-        await expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow();
-    });
-
-    it("device appears online within timeout", async function () {
-        const devices: SimpleDeviceMap = {};
-        const { aliceRz, deviceMap } = await completeLogin(devices);
-        // device appears before the timeout
-        setTimeout(() => {
-            deviceMap.get(userId)!.set("BOB", mockDevice(userId, "BOB", "bbbb"));
-        }, 1000);
-        await aliceRz.verifyNewDeviceOnExistingDevice(2000);
-    });
-
-    it("device appears online after timeout", async function () {
-        const devices: SimpleDeviceMap = {};
-        const { aliceRz, deviceMap } = await completeLogin(devices);
-        // device appears after the timeout
-        setTimeout(() => {
-            deviceMap.get(userId)!.set("BOB", mockDevice(userId, "BOB", "bbbb"));
-        }, 1500);
-        await expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow();
-    });
-
-    it("mismatched device key", async function () {
-        const { aliceRz } = await completeLogin({
-            [userId]: {
-                BOB: "XXXX",
-            },
-        });
-        await expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow(/different key/);
-    });
-});

spec/unit/rendezvous/simpleHttpTransport.spec.ts

@@ -1,453 +0,0 @@
-/*
-Copyright 2022 The Matrix.org Foundation C.I.C.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import MockHttpBackend from "matrix-mock-request";
-
-import type { MatrixClient } from "../../../src";
-import { LegacyRendezvousFailureReason as RendezvousFailureReason } from "../../../src/rendezvous";
-import { MSC3886SimpleHttpRendezvousTransport } from "../../../src/rendezvous/transports";
-
-function makeMockClient(opts: { userId: string; deviceId: string; msc3886Enabled: boolean }): MatrixClient {
-    return {
-        doesServerSupportUnstableFeature(feature: string) {
-            return Promise.resolve(opts.msc3886Enabled && feature === "org.matrix.msc3886");
-        },
-        getUserId() {
-            return opts.userId;
-        },
-        getDeviceId() {
-            return opts.deviceId;
-        },
-        requestLoginToken() {
-            return Promise.resolve({ login_token: "token" });
-        },
-        baseUrl: "https://example.com",
-    } as unknown as MatrixClient;
-}
-
-describe("SimpleHttpRendezvousTransport", function () {
-    let httpBackend: MockHttpBackend;
-    let fetchFn: typeof global.fetch;
-
-    beforeEach(function () {
-        httpBackend = new MockHttpBackend();
-        fetchFn = httpBackend.fetchFn as typeof global.fetch;
-    });
-
-    async function postAndCheckLocation(
-        msc3886Enabled: boolean,
-        fallbackRzServer: string,
-        locationResponse: string,
-        expectedFinalLocation: string,
-    ) {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({ client, fallbackRzServer, fetchFn });
-        {
-            // initial POST
-            const expectedPostLocation = msc3886Enabled
-                ? `${client.baseUrl}/_matrix/client/unstable/org.matrix.msc3886/rendezvous`
-                : fallbackRzServer;
-
-            const prom = simpleHttpTransport.send({});
-            httpBackend.when("POST", expectedPostLocation).response = {
-                body: null,
-                response: {
-                    statusCode: 201,
-                    headers: {
-                        location: locationResponse,
-                    },
-                },
-            };
-            await httpBackend.flush("");
-            await prom;
-        }
-        const details = await simpleHttpTransport.details();
-        expect(details.uri).toBe(expectedFinalLocation);
-
-        {
-            // first GET without etag
-            const prom = simpleHttpTransport.receive();
-            httpBackend.when("GET", expectedFinalLocation).response = {
-                body: {},
-                response: {
-                    statusCode: 200,
-                    headers: {
-                        "content-type": "application/json",
-                    },
-                },
-            };
-            await httpBackend.flush("");
-            expect(await prom).toEqual({});
-            httpBackend.verifyNoOutstandingRequests();
-            httpBackend.verifyNoOutstandingExpectation();
-        }
-    }
-    it("should throw an error when no server available", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({ client, fetchFn });
-        await expect(simpleHttpTransport.send({})).rejects.toThrow("Invalid rendezvous URI");
-    });
-
-    it("POST to fallback server", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        const prom = simpleHttpTransport.send({});
-        httpBackend.when("POST", "https://fallbackserver/rz").response = {
-            body: null,
-            response: {
-                statusCode: 201,
-                headers: {
-                    location: "https://fallbackserver/rz/123",
-                },
-            },
-        };
-        await httpBackend.flush("");
-        expect(await prom).toStrictEqual(undefined);
-    });
-
-    it("POST with no location", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        const prom = simpleHttpTransport.send({});
-        httpBackend.when("POST", "https://fallbackserver/rz").response = {
-            body: null,
-            response: {
-                statusCode: 201,
-                headers: {},
-            },
-        };
-        await Promise.all([expect(prom).rejects.toThrow(), httpBackend.flush("")]);
-    });
-
-    it("POST with absolute path response", async function () {
-        await postAndCheckLocation(false, "https://fallbackserver/rz", "/123", "https://fallbackserver/123");
-    });
-
-    it("POST to built-in MSC3886 implementation", async function () {
-        await postAndCheckLocation(
-            true,
-            "https://fallbackserver/rz",
-            "123",
-            "https://example.com/_matrix/client/unstable/org.matrix.msc3886/rendezvous/123",
-        );
-    });
-
-    it("POST with relative path response including parent", async function () {
-        await postAndCheckLocation(
-            false,
-            "https://fallbackserver/rz/abc",
-            "../xyz/123",
-            "https://fallbackserver/rz/xyz/123",
-        );
-    });
-
-    it("POST to follow 307 to other server", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        const prom = simpleHttpTransport.send({});
-        httpBackend.when("POST", "https://fallbackserver/rz").response = {
-            body: null,
-            response: {
-                statusCode: 307,
-                headers: {
-                    location: "https://redirected.fallbackserver/rz",
-                },
-            },
-        };
-        httpBackend.when("POST", "https://redirected.fallbackserver/rz").response = {
-            body: null,
-            response: {
-                statusCode: 201,
-                headers: {
-                    location: "https://redirected.fallbackserver/rz/123",
-                    etag: "aaa",
-                },
-            },
-        };
-        await httpBackend.flush("");
-        expect(await prom).toStrictEqual(undefined);
-    });
-
-    it("POST and GET", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        {
-            // initial POST
-            const prom = simpleHttpTransport.send({ foo: "baa" });
-            httpBackend.when("POST", "https://fallbackserver/rz").check(({ headers, data }) => {
-                expect(headers["content-type"]).toEqual("application/json");
-                expect(data).toEqual({ foo: "baa" });
-            }).response = {
-                body: null,
-                response: {
-                    statusCode: 201,
-                    headers: {
-                        location: "https://fallbackserver/rz/123",
-                    },
-                },
-            };
-            await httpBackend.flush("");
-            expect(await prom).toStrictEqual(undefined);
-        }
-        {
-            // first GET without etag
-            const prom = simpleHttpTransport.receive();
-            httpBackend.when("GET", "https://fallbackserver/rz/123").response = {
-                body: { foo: "baa" },
-                response: {
-                    statusCode: 200,
-                    headers: {
-                        "content-type": "application/json",
-                        "etag": "aaa",
-                    },
-                },
-            };
-            await httpBackend.flush("");
-            expect(await prom).toEqual({ foo: "baa" });
-        }
-        {
-            // subsequent GET which should have etag from previous request
-            const prom = simpleHttpTransport.receive();
-            httpBackend.when("GET", "https://fallbackserver/rz/123").check(({ headers }) => {
-                expect(headers["if-none-match"]).toEqual("aaa");
-            }).response = {
-                body: { foo: "baa" },
-                response: {
-                    statusCode: 200,
-                    headers: {
-                        "content-type": "application/json",
-                        "etag": "bbb",
-                    },
-                },
-            };
-            await httpBackend.flush("");
-            expect(await prom).toEqual({ foo: "baa" });
-        }
-    });
-
-    it("POST and PUTs", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        {
-            // initial POST
-            const prom = simpleHttpTransport.send({ foo: "baa" });
-            httpBackend.when("POST", "https://fallbackserver/rz").check(({ headers, data }) => {
-                expect(headers["content-type"]).toEqual("application/json");
-                expect(data).toEqual({ foo: "baa" });
-            }).response = {
-                body: null,
-                response: {
-                    statusCode: 201,
-                    headers: {
-                        location: "https://fallbackserver/rz/123",
-                    },
-                },
-            };
-            await httpBackend.flush("", 1);
-            await prom;
-        }
-        {
-            // first PUT without etag
-            const prom = simpleHttpTransport.send({ a: "b" });
-            httpBackend.when("PUT", "https://fallbackserver/rz/123").check(({ headers, data }) => {
-                expect(headers["if-match"]).toBeUndefined();
-                expect(data).toEqual({ a: "b" });
-            }).response = {
-                body: null,
-                response: {
-                    statusCode: 202,
-                    headers: {
-                        etag: "aaa",
-                    },
-                },
-            };
-            await httpBackend.flush("", 1);
-            await prom;
-        }
-        {
-            // subsequent PUT which should have etag from previous request
-            const prom = simpleHttpTransport.send({ c: "d" });
-            httpBackend.when("PUT", "https://fallbackserver/rz/123").check(({ headers }) => {
-                expect(headers["if-match"]).toEqual("aaa");
-            }).response = {
-                body: null,
-                response: {
-                    statusCode: 202,
-                    headers: {
-                        etag: "bbb",
-                    },
-                },
-            };
-            await httpBackend.flush("", 1);
-            await prom;
-        }
-    });
-
-    it("POST and DELETE", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        {
-            // Create
-            const prom = simpleHttpTransport.send({ foo: "baa" });
-            httpBackend.when("POST", "https://fallbackserver/rz").check(({ headers, data }) => {
-                expect(headers["content-type"]).toEqual("application/json");
-                expect(data).toEqual({ foo: "baa" });
-            }).response = {
-                body: null,
-                response: {
-                    statusCode: 201,
-                    headers: {
-                        location: "https://fallbackserver/rz/123",
-                    },
-                },
-            };
-            await httpBackend.flush("");
-            expect(await prom).toStrictEqual(undefined);
-        }
-        {
-            // Cancel
-            const prom = simpleHttpTransport.cancel(RendezvousFailureReason.UserDeclined);
-            httpBackend.when("DELETE", "https://fallbackserver/rz/123").response = {
-                body: null,
-                response: {
-                    statusCode: 204,
-                    headers: {},
-                },
-            };
-            await httpBackend.flush("");
-            await prom;
-        }
-    });
-
-    it("details before ready", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        await expect(simpleHttpTransport.details()).rejects.toThrow();
-    });
-
-    it("send after cancelled", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        await simpleHttpTransport.cancel(RendezvousFailureReason.UserDeclined);
-        await expect(simpleHttpTransport.send({})).resolves.toBeUndefined();
-    });
-
-    it("receive before ready", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-        });
-        await expect(simpleHttpTransport.receive()).rejects.toThrow();
-    });
-
-    it("404 failure callback", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const onFailure = jest.fn();
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-            onFailure,
-        });
-
-        httpBackend.when("POST", "https://fallbackserver/rz").response = {
-            body: null,
-            response: {
-                statusCode: 404,
-                headers: {},
-            },
-        };
-        await Promise.all([
-            expect(simpleHttpTransport.send({ foo: "baa" })).resolves.toBeUndefined(),
-            httpBackend.flush("", 1),
-        ]);
-        expect(onFailure).toHaveBeenCalledWith(RendezvousFailureReason.Unknown);
-    });
-
-    it("404 failure callback mapped to expired", async function () {
-        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
-        const onFailure = jest.fn();
-        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({
-            client,
-            fallbackRzServer: "https://fallbackserver/rz",
-            fetchFn,
-            onFailure,
-        });
-
-        {
-            // initial POST
-            const prom = simpleHttpTransport.send({ foo: "baa" });
-            httpBackend.when("POST", "https://fallbackserver/rz").response = {
-                body: null,
-                response: {
-                    statusCode: 201,
-                    headers: {
-                        location: "https://fallbackserver/rz/123",
-                        expires: "Thu, 01 Jan 1970 00:00:00 GMT",
-                    },
-                },
-            };
-            await httpBackend.flush("");
-            await prom;
-        }
-        {
-            // GET with 404 to simulate expiry
-            httpBackend.when("GET", "https://fallbackserver/rz/123").response = {
-                body: { foo: "baa" },
-                response: {
-                    statusCode: 404,
-                    headers: {},
-                },
-            };
-            await Promise.all([expect(simpleHttpTransport.receive()).resolves.toBeUndefined(), httpBackend.flush("")]);
-            expect(onFailure).toHaveBeenCalledWith(RendezvousFailureReason.Expired);
-        }
-    });
-});

spec/unit/rust-crypto/OutgoingRequestProcessor.spec.ts

@@ -61,7 +61,7 @@ describe("OutgoingRequestProcessor", () => {
         const httpApi = new MatrixHttpApi(dummyEventEmitter, {
             baseUrl: "https://example.com",
             prefix: "/_matrix",
-            fetchFn: httpBackend.fetchFn as typeof global.fetch,
+            fetchFn: httpBackend.fetchFn as typeof globalThis.fetch,
             onlyData: true,
         });
 
@@ -208,7 +208,7 @@ describe("OutgoingRequestProcessor", () => {
         const outgoingRequest = new UploadSigningKeysRequest(JSON.stringify(testReq));
 
         // also create a UIA callback
-        const authCallback: UIAuthCallback<Object> = async (makeRequest) => {
+        const authCallback: UIAuthCallback<object> = async (makeRequest) => {
             return await makeRequest({ type: "test" });
         };
 
@@ -458,7 +458,7 @@ describe("OutgoingRequestProcessor", () => {
                     throw new Error("Failed to fetch");
                 }
             });
-            const authCallback: UIAuthCallback<Object> = async (makeRequest) => {
+            const authCallback: UIAuthCallback<object> = async (makeRequest) => {
                 return await makeRequest({ type: "test" });
             };
             const requestPromise = processor.makeOutgoingRequest(outgoingRequest, authCallback);

spec/unit/rust-crypto/PerSessionKeyBackupDownloader.spec.ts

@@ -26,7 +26,6 @@ import { RustBackupCryptoEventMap, RustBackupCryptoEvents, RustBackupManager } f
 import * as TestData from "../../test-utils/test-data";
 import {
     ConnectionError,
-    CryptoEvent,
     HttpApiEvent,
     HttpApiEventHandlerMap,
     IHttpOpts,
@@ -37,6 +36,7 @@ import {
 import * as testData from "../../test-utils/test-data";
 import { BackupDecryptor } from "../../../src/common-crypto/CryptoBackend";
 import { KeyBackupSession } from "../../../src/crypto-api/keybackup";
+import { CryptoEvent } from "../../../src/crypto-api/index.ts";
 
 describe("PerSessionKeyBackupDownloader", () => {
     /** The downloader under test */

spec/unit/rust-crypto/backup.spec.ts

@@ -2,13 +2,12 @@ import { Mocked } from "jest-mock";
 import fetchMock from "fetch-mock-jest";
 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
 
-import { CryptoEvent, HttpApiEvent, HttpApiEventHandlerMap, MatrixHttpApi, TypedEventEmitter } from "../../../src";
+import { HttpApiEvent, HttpApiEventHandlerMap, MatrixHttpApi, TypedEventEmitter } from "../../../src";
+import { CryptoEvent, KeyBackupSession } from "../../../src/crypto-api/index.ts";
 import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
 import * as testData from "../../test-utils/test-data";
 import * as TestData from "../../test-utils/test-data";
-import { IKeyBackup } from "../../../src/crypto/backup";
-import { IKeyBackupSession } from "../../../src/crypto/keybackup";
-import { RustBackupManager } from "../../../src/rust-crypto/backup";
+import { RustBackupManager, KeyBackup } from "../../../src/rust-crypto/backup";
 
 describe("Upload keys to backup", () => {
     /** The backup manager under test */
@@ -26,7 +25,7 @@ describe("Upload keys to backup", () => {
 
     let idGenerator = 0;
     function mockBackupRequest(keyCount: number): RustSdkCryptoJs.KeysBackupRequest {
-        const requestBody: IKeyBackup = {
+        const requestBody: KeyBackup = {
             rooms: {
                 "!room1:server": {
                     sessions: {},
@@ -34,7 +33,7 @@ describe("Upload keys to backup", () => {
             },
         };
         for (let i = 0; i < keyCount; i++) {
-            requestBody.rooms["!room1:server"].sessions["session" + i] = {} as IKeyBackupSession;
+            requestBody.rooms["!room1:server"].sessions["session" + i] = {} as KeyBackupSession;
         }
         return {
             id: "id" + idGenerator++,

spec/unit/rust-crypto/rust-crypto.spec.ts

@@ -30,7 +30,6 @@ import fetchMock from "fetch-mock-jest";
 import { RustCrypto } from "../../../src/rust-crypto/rust-crypto";
 import { initRustCrypto } from "../../../src/rust-crypto";
 import {
-    CryptoEvent,
     Device,
     DeviceVerification,
     encodeBase64,
@@ -71,6 +70,7 @@ import { ClientEvent, ClientEventHandlerMap } from "../../../src/client";
 import { Curve25519AuthData } from "../../../src/crypto-api/keybackup";
 import encryptAESSecretStorageItem from "../../../src/utils/encryptAESSecretStorageItem.ts";
 import { CryptoStore, SecretStorePrivateKeys } from "../../../src/crypto/store/base";
+import { CryptoEvent } from "../../../src/crypto-api/index.ts";
 
 const TEST_USER = "@alice:example.com";
 const TEST_DEVICE_ID = "TEST_DEVICE";
@@ -1593,6 +1593,124 @@ describe("RustCrypto", () => {
             await expect(rustCrypto.exportSecretsBundle()).resolves.toEqual(expect.objectContaining(bundle));
         });
     });
+
+    describe("encryptToDeviceMessages", () => {
+        let rustCrypto: RustCrypto;
+        let testOlmMachine: RustSdkCryptoJs.OlmMachine;
+
+        beforeEach(async () => {
+            testOlmMachine = await OlmMachine.initialize(
+                new RustSdkCryptoJs.UserId(testData.TEST_USER_ID),
+                new RustSdkCryptoJs.DeviceId(testData.TEST_DEVICE_ID),
+            );
+            jest.spyOn(OlmMachine, "initFromStore").mockResolvedValue(testOlmMachine);
+            rustCrypto = await makeTestRustCrypto();
+            expect(OlmMachine.initFromStore).toHaveBeenCalled();
+        });
+
+        afterEach(() => {
+            testOlmMachine?.free();
+        });
+
+        const payload = { hello: "world" };
+
+        it("returns empty batch if devices not known", async () => {
+            const getMissingSessions = jest.spyOn(testOlmMachine, "getMissingSessions");
+            const getDevice = jest.spyOn(testOlmMachine, "getDevice");
+            const batch = await rustCrypto.encryptToDeviceMessages(
+                "m.test.type",
+                [
+                    { deviceId: "AAA", userId: "@user1:domain" },
+                    { deviceId: "BBB", userId: "@user1:domain" },
+                    { deviceId: "CCC", userId: "@user2:domain" },
+                ],
+                payload,
+            );
+            expect(getMissingSessions.mock.calls[0][0].length).toBe(2);
+            expect(getDevice).toHaveBeenCalledTimes(3);
+            expect(batch?.eventType).toEqual("m.room.encrypted");
+            expect(batch?.batch).toEqual([]);
+        });
+
+        it("returns encrypted batch for known devices", async () => {
+            // Make m aware of another device, and get some OTK to be able to establish a session.
+            await testOlmMachine.markRequestAsSent(
+                "foo",
+                RustSdkCryptoJs.RequestType.KeysQuery,
+                JSON.stringify({
+                    device_keys: {
+                        "@example:localhost": {
+                            AFGUOBTZWM: {
+                                algorithms: ["m.olm.v1.curve25519-aes-sha2", "m.megolm.v1.aes-sha2"],
+                                device_id: "AFGUOBTZWM",
+                                keys: {
+                                    "curve25519:AFGUOBTZWM": "boYjDpaC+7NkECQEeMh5dC+I1+AfriX0VXG2UV7EUQo",
+                                    "ed25519:AFGUOBTZWM": "NayrMQ33ObqMRqz6R9GosmHdT6HQ6b/RX/3QlZ2yiec",
+                                },
+                                signatures: {
+                                    "@example:localhost": {
+                                        "ed25519:AFGUOBTZWM":
+                                            "RoSWvru1jj6fs2arnTedWsyIyBmKHMdOu7r9gDi0BZ61h9SbCK2zLXzuJ9ZFLao2VvA0yEd7CASCmDHDLYpXCA",
+                                    },
+                                },
+                                user_id: "@example:localhost",
+                                unsigned: {
+                                    device_display_name: "rust-sdk",
+                                },
+                            },
+                        },
+                    },
+                    failures: {},
+                }),
+            );
+
+            await testOlmMachine.markRequestAsSent(
+                "bar",
+                RustSdkCryptoJs.RequestType.KeysClaim,
+                JSON.stringify({
+                    one_time_keys: {
+                        "@example:localhost": {
+                            AFGUOBTZWM: {
+                                "signed_curve25519:AAAABQ": {
+                                    key: "9IGouMnkB6c6HOd4xUsNv4i3Dulb4IS96TzDordzOws",
+                                    signatures: {
+                                        "@example:localhost": {
+                                            "ed25519:AFGUOBTZWM":
+                                                "2bvUbbmJegrV0eVP/vcJKuIWC3kud+V8+C0dZtg4dVovOSJdTP/iF36tQn2bh5+rb9xLlSeztXBdhy4c+LiOAg",
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                    failures: {},
+                }),
+            );
+
+            const batch = await rustCrypto.encryptToDeviceMessages(
+                "m.test.type",
+                [
+                    { deviceId: "AAA", userId: "@user1:domain" },
+                    { deviceId: "BBB", userId: "@user1:domain" },
+                    { deviceId: "CCC", userId: "@user2:domain" },
+                    { deviceId: "AFGUOBTZWM", userId: "@example:localhost" },
+                ],
+                payload,
+            );
+            expect(batch?.eventType).toEqual("m.room.encrypted");
+            expect(batch?.batch.length).toEqual(1);
+            expect(batch?.batch[0].deviceId).toEqual("AFGUOBTZWM");
+            expect(batch?.batch[0].userId).toEqual("@example:localhost");
+            expect(batch?.batch[0].payload).toEqual(
+                expect.objectContaining({
+                    "algorithm": "m.olm.v1.curve25519-aes-sha2",
+                    "ciphertext": expect.any(Object),
+                    "org.matrix.msgid": expect.any(String),
+                    "sender_key": expect.any(String),
+                }),
+            );
+        });
+    });
 });
 
 /** Build a MatrixHttpApi instance */

spec/unit/rust-crypto/secret-storage.spec.ts

@@ -98,7 +98,7 @@ describe("secret-storage", () => {
                 } else if (secretName == "secretE") {
                     return { aaaa: {}, bbbb: {} };
                 } else {
-                    null;
+                    return null;
                 }
             }),
             getDefaultKeyId: jest.fn().mockResolvedValue("aaaa"),

spec/unit/scheduler.spec.ts

@@ -12,7 +12,7 @@ jest.useFakeTimers();
 
 describe("MatrixScheduler", function () {
     let scheduler: MatrixScheduler<Record<string, boolean>>;
-    let retryFn: Function | null;
+    let retryFn: ((event: MatrixEvent | null, attempt: number, err: MatrixError) => number) | null;
     let queueFn: ((event: MatrixEvent) => string | null) | null;
     let deferred: IDeferred<Record<string, boolean>>;
     const roomId = "!foo:bar";

spec/unit/secret-storage.spec.ts

@@ -18,6 +18,7 @@ import { Mocked } from "jest-mock";
 
 import {
     AccountDataClient,
+    calculateKeyCheck,
     PassphraseInfo,
     SecretStorageCallbacks,
     SecretStorageKeyDescriptionAesV1,
@@ -26,7 +27,6 @@ import {
     trimTrailingEquals,
 } from "../../src/secret-storage";
 import { randomString } from "../../src/randomstring";
-import { calculateKeyCheck } from "../../src/calculateKeyCheck.ts";
 
 describe("ServerSideSecretStorageImpl", function () {
     describe(".addKey", function () {

spec/unit/sync-accumulator.spec.ts

@@ -794,7 +794,7 @@ describe("SyncAccumulator", function () {
         }
 
         afterEach(() => {
-            jest.spyOn(global.Date, "now").mockRestore();
+            jest.spyOn(globalThis.Date, "now").mockRestore();
         });
 
         it("should copy summary properties", function () {
@@ -851,11 +851,11 @@ describe("SyncAccumulator", function () {
             const delta = 1000;
             const startingTs = 1000;
 
-            jest.spyOn(global.Date, "now").mockReturnValue(startingTs);
+            jest.spyOn(globalThis.Date, "now").mockReturnValue(startingTs);
 
             sa.accumulate(RES_WITH_AGE);
 
-            jest.spyOn(global.Date, "now").mockReturnValue(startingTs + delta);
+            jest.spyOn(globalThis.Date, "now").mockReturnValue(startingTs + delta);
 
             const output = sa.getJSON();
             expect(output.roomsData.join["!foo:bar"].timeline.events[0].unsigned?.age).toEqual(

spec/unit/webrtc/call.spec.ts

@@ -119,9 +119,9 @@ describe("Call", function () {
     const errorListener = () => {};
 
     beforeEach(function () {
-        prevNavigator = global.navigator;
-        prevDocument = global.document;
-        prevWindow = global.window;
+        prevNavigator = globalThis.navigator;
+        prevDocument = globalThis.document;
+        prevWindow = globalThis.window;
 
         installWebRTCMocks();
 
@@ -159,9 +159,9 @@ describe("Call", function () {
         call.hangup(CallErrorCode.UserHangup, true);
 
         client.stop();
-        global.navigator = prevNavigator;
-        global.window = prevWindow;
-        global.document = prevDocument;
+        globalThis.navigator = prevNavigator;
+        globalThis.window = prevWindow;
+        globalThis.document = prevDocument;
 
         jest.useRealTimers();
     });
@@ -788,17 +788,17 @@ describe("Call", function () {
         });
 
         it("should return false if window or document are undefined", () => {
-            global.window = undefined!;
+            globalThis.window = undefined!;
             expect(supportsMatrixCall()).toBe(false);
-            global.window = prevWindow;
-            global.document = undefined!;
+            globalThis.window = prevWindow;
+            globalThis.document = undefined!;
             expect(supportsMatrixCall()).toBe(false);
         });
 
         it("should return false if RTCPeerConnection throws", () => {
             // @ts-ignore - writing to window as we are simulating browser edge-cases
-            global.window = {};
-            Object.defineProperty(global.window, "RTCPeerConnection", {
+            globalThis.window = {};
+            Object.defineProperty(globalThis.window, "RTCPeerConnection", {
                 get: () => {
                     throw Error("Secure mode, naaah!");
                 },
@@ -810,11 +810,11 @@ describe("Call", function () {
             "should return false if RTCPeerConnection & RTCSessionDescription " +
                 "& RTCIceCandidate & mediaDevices are unavailable",
             () => {
-                global.window.RTCPeerConnection = undefined!;
-                global.window.RTCSessionDescription = undefined!;
-                global.window.RTCIceCandidate = undefined!;
+                globalThis.window.RTCPeerConnection = undefined!;
+                globalThis.window.RTCSessionDescription = undefined!;
+                globalThis.window.RTCIceCandidate = undefined!;
                 // @ts-ignore - writing to a read-only property as we are simulating faulty browsers
-                global.navigator.mediaDevices = undefined;
+                globalThis.navigator.mediaDevices = undefined;
                 expect(supportsMatrixCall()).toBe(false);
             },
         );
@@ -1228,7 +1228,7 @@ describe("Call", function () {
     });
 
     describe("Screen sharing", () => {
-        const waitNegotiateFunc = (resolve: Function): void => {
+        const waitNegotiateFunc = (resolve: () => void): void => {
             mockSendEvent.mockImplementationOnce(() => {
                 // Note that the peer connection here is a dummy one and always returns
                 // dummy SDP, so there's not much point returning the content: the SDP will
@@ -1305,7 +1305,7 @@ describe("Call", function () {
         });
 
         it("removes RTX codec from screen sharing transcievers", async () => {
-            mocked(global.RTCRtpSender.getCapabilities).mockReturnValue({
+            mocked(globalThis.RTCRtpSender.getCapabilities).mockReturnValue({
                 codecs: [
                     { mimeType: "video/rtx", clockRate: 90000 },
                     { mimeType: "video/somethingelse", clockRate: 90000 },
@@ -1816,8 +1816,8 @@ describe("Call", function () {
 
     it("should emit IceFailed error on the successor call if RTCPeerConnection throws", async () => {
         // @ts-ignore - writing to window as we are simulating browser edge-cases
-        global.window = {};
-        Object.defineProperty(global.window, "RTCPeerConnection", {
+        globalThis.window = {};
+        Object.defineProperty(globalThis.window, "RTCPeerConnection", {
             get: () => {
                 throw Error("Secure mode, naaah!");
             },

spec/unit/webrtc/callFeed.spec.ts

@@ -101,7 +101,7 @@ describe("CallFeed", () => {
         it.each([
             [CallState.Connected, true],
             [CallState.Connecting, false],
-        ])("should react to call state, when !isLocal()", (state: CallState, expected: Boolean) => {
+        ])("should react to call state, when !isLocal()", (state: CallState, expected: boolean) => {
             call.emit(CallEvent.State, state, CallState.InviteSent, call.typed());
 
             expect(feed.connected).toBe(expected);

spec/unit/webrtc/mediaHandler.spec.ts

@@ -31,7 +31,7 @@ describe("Media Handler", function () {
     beforeEach(() => {
         mockMediaDevices = new MockMediaDevices();
 
-        global.navigator = {
+        globalThis.navigator = {
             mediaDevices: mockMediaDevices.typed(),
         } as unknown as Navigator;
 

spec/unit/webrtc/stats/groupCallStats.spec.ts

@@ -126,7 +126,7 @@ describe("GroupCallStats", () => {
 
         it("doing nothing if process already running", async () => {
             // @ts-ignore
-            jest.spyOn(global, "setInterval").mockReturnValue(22);
+            jest.spyOn(globalThis, "setInterval").mockReturnValue(22);
             stats.start();
             expect(setInterval).toHaveBeenCalledTimes(1);
             stats.start();
@@ -146,8 +146,8 @@ describe("GroupCallStats", () => {
         });
         it("finish stats process if was started", async () => {
             // @ts-ignore
-            jest.spyOn(global, "setInterval").mockReturnValue(22);
-            jest.spyOn(global, "clearInterval");
+            jest.spyOn(globalThis, "setInterval").mockReturnValue(22);
+            jest.spyOn(globalThis, "clearInterval");
             stats.start();
             expect(setInterval).toHaveBeenCalledTimes(1);
             stats.stop();
@@ -155,7 +155,7 @@ describe("GroupCallStats", () => {
         });
 
         it("do nothing if stats process was not started", async () => {
-            jest.spyOn(global, "clearInterval");
+            jest.spyOn(globalThis, "clearInterval");
             stats.stop();
             expect(clearInterval).not.toHaveBeenCalled();
         });

src/@types/global.d.ts

@@ -14,13 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// this is needed to tell TS about global.Olm
+// this is needed to tell TS about globalThis.Olm
 import "@matrix-org/olm";
 
 export {};
 
 declare global {
-    // use `number` as the return type in all cases for global.set{Interval,Timeout},
+    // use `number` as the return type in all cases for globalThis.set{Interval,Timeout},
     // so we don't accidentally use the methods on NodeJS.Timeout - they only exist in a subset of environments.
     // The overload for clear{Interval,Timeout} is resolved as expected.
     // We use `ReturnType<typeof setTimeout>` in the code to be agnostic of if this definition gets loaded.

src/@types/requests.ts

@@ -111,18 +111,16 @@ type DelayedPartialTimelineEvent = {
 
 type DelayedPartialStateEvent = DelayedPartialTimelineEvent & {
     state_key: string;
-    transaction_id: string;
 };
 
 type DelayedPartialEvent = DelayedPartialTimelineEvent | DelayedPartialStateEvent;
 
 export type DelayedEventInfo = {
-    delayed_events: DelayedPartialEvent &
+    delayed_events: (DelayedPartialEvent &
         SendDelayedEventResponse &
-        SendDelayedEventRequestOpts &
-        {
+        SendDelayedEventRequestOpts & {
             running_since: number;
-        }[];
+        })[];
     next_batch?: string;
 };
 

src/autodiscovery.ts

@@ -414,16 +414,16 @@ export class AutoDiscovery {
         }
     }
 
-    private static fetch(resource: URL | string, options?: RequestInit): ReturnType<typeof global.fetch> {
+    private static fetch(resource: URL | string, options?: RequestInit): ReturnType<typeof globalThis.fetch> {
         if (this.fetchFn) {
             return this.fetchFn(resource, options);
         }
-        return global.fetch(resource, options);
+        return globalThis.fetch(resource, options);
     }
 
-    private static fetchFn?: typeof global.fetch;
+    private static fetchFn?: typeof globalThis.fetch;
 
-    public static setFetchFn(fetchFn: typeof global.fetch): void {
+    public static setFetchFn(fetchFn: typeof globalThis.fetch): void {
         AutoDiscovery.fetchFn = fetchFn;
     }
 

src/browser-index.ts

@@ -33,7 +33,7 @@ globalThis.__js_sdk_entrypoint = true;
 let indexedDB: IDBFactory | undefined;
 try {
     indexedDB = globalThis.indexedDB;
-} catch (e) {}
+} catch {}
 
 // if our browser (appears to) support indexeddb, use an indexeddb crypto store.
 if (indexedDB) {

src/calculateKeyCheck.ts

@@ -1,34 +0,0 @@
-/*
- * Copyright 2024 The Matrix.org Foundation C.I.C.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-// string of zeroes, for calculating the key check
-import encryptAESSecretStorageItem from "./utils/encryptAESSecretStorageItem.ts";
-import { AESEncryptedSecretStoragePayload } from "./@types/AESEncryptedSecretStoragePayload.ts";
-
-const ZERO_STR = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
-
-/**
- * Calculate the MAC for checking the key.
- * See https://spec.matrix.org/v1.11/client-server-api/#msecret_storagev1aes-hmac-sha2, steps 3 and 4.
- *
- * @param key - the key to use
- * @param iv - The initialization vector as a base64-encoded string.
- *     If omitted, a random initialization vector will be created.
- * @returns An object that contains, `mac` and `iv` properties.
- */
-export function calculateKeyCheck(key: Uint8Array, iv?: string): Promise<AESEncryptedSecretStoragePayload> {
-    return encryptAESSecretStorageItem(ZERO_STR, key, "", iv);
-}

src/client.ts

@@ -76,8 +76,8 @@ import {
 } from "./http-api/index.ts";
 import {
     Crypto,
-    CryptoEvent,
-    CryptoEventHandlerMap,
+    CryptoEvent as LegacyCryptoEvent,
+    CryptoEventHandlerMap as LegacyCryptoEventHandlerMap,
     fixBackupKey,
     ICheckOwnCrossSigningTrustOpts,
     ICryptoCallbacks,
@@ -227,6 +227,8 @@ import {
     CryptoApi,
     decodeRecoveryKey,
     ImportRoomKeysOpts,
+    CryptoEvent,
+    CryptoEventHandlerMap,
 } from "./crypto-api/index.ts";
 import { DeviceInfoMap } from "./crypto/DeviceList.ts";
 import {
@@ -305,7 +307,7 @@ export interface ICreateClientOpts {
      * The function to invoke for HTTP requests.
      * Most supported environments have a global `fetch` registered to which this will fall back.
      */
-    fetchFn?: typeof global.fetch;
+    fetchFn?: typeof globalThis.fetch;
 
     userId?: string;
 
@@ -939,23 +941,25 @@ type RoomStateEvents =
     | RoomStateEvent.Update
     | RoomStateEvent.Marker;
 
-type CryptoEvents =
-    | CryptoEvent.KeySignatureUploadFailure
-    | CryptoEvent.KeyBackupStatus
-    | CryptoEvent.KeyBackupFailed
-    | CryptoEvent.KeyBackupSessionsRemaining
-    | CryptoEvent.KeyBackupDecryptionKeyCached
-    | CryptoEvent.RoomKeyRequest
-    | CryptoEvent.RoomKeyRequestCancellation
-    | CryptoEvent.VerificationRequest
-    | CryptoEvent.VerificationRequestReceived
-    | CryptoEvent.DeviceVerificationChanged
-    | CryptoEvent.UserTrustStatusChanged
-    | CryptoEvent.KeysChanged
-    | CryptoEvent.Warning
-    | CryptoEvent.DevicesUpdated
-    | CryptoEvent.WillUpdateDevices
-    | CryptoEvent.LegacyCryptoStoreMigrationProgress;
+type LegacyCryptoEvents =
+    | LegacyCryptoEvent.KeySignatureUploadFailure
+    | LegacyCryptoEvent.KeyBackupStatus
+    | LegacyCryptoEvent.KeyBackupFailed
+    | LegacyCryptoEvent.KeyBackupSessionsRemaining
+    | LegacyCryptoEvent.KeyBackupDecryptionKeyCached
+    | LegacyCryptoEvent.RoomKeyRequest
+    | LegacyCryptoEvent.RoomKeyRequestCancellation
+    | LegacyCryptoEvent.VerificationRequest
+    | LegacyCryptoEvent.VerificationRequestReceived
+    | LegacyCryptoEvent.DeviceVerificationChanged
+    | LegacyCryptoEvent.UserTrustStatusChanged
+    | LegacyCryptoEvent.KeysChanged
+    | LegacyCryptoEvent.Warning
+    | LegacyCryptoEvent.DevicesUpdated
+    | LegacyCryptoEvent.WillUpdateDevices
+    | LegacyCryptoEvent.LegacyCryptoStoreMigrationProgress;
+
+type CryptoEvents = (typeof CryptoEvent)[keyof typeof CryptoEvent];
 
 type MatrixEventEvents = MatrixEventEvent.Decrypted | MatrixEventEvent.Replaced | MatrixEventEvent.VisibilityChange;
 
@@ -976,6 +980,7 @@ export type EmittedEvents =
     | ClientEvent
     | RoomEvents
     | RoomStateEvents
+    | LegacyCryptoEvents
     | CryptoEvents
     | MatrixEventEvents
     | RoomMemberEvents
@@ -1187,6 +1192,7 @@ export type ClientEventHandlerMap = {
     [ClientEvent.TurnServersError]: (error: Error, fatal: boolean) => void;
 } & RoomEventHandlerMap &
     RoomStateEventHandlerMap &
+    LegacyCryptoEventHandlerMap &
     CryptoEventHandlerMap &
     MatrixEventHandlerMap &
     RoomMemberEventHandlerMap &
@@ -1575,11 +1581,11 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         this.callEventHandler = undefined;
         this.groupCallEventHandler = undefined;
 
-        global.clearInterval(this.checkTurnServersIntervalID);
+        globalThis.clearInterval(this.checkTurnServersIntervalID);
         this.checkTurnServersIntervalID = undefined;
 
         if (this.clientWellKnownIntervalID !== undefined) {
-            global.clearInterval(this.clientWellKnownIntervalID);
+            globalThis.clearInterval(this.clientWellKnownIntervalID);
         }
 
         this.toDeviceMessageQueue.stop();
@@ -1619,7 +1625,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             return;
         }
 
-        const account = new global.Olm.Account();
+        const account = new globalThis.Olm.Account();
         try {
             const deviceData = getDeviceResult.device_data;
             if (deviceData.algorithm !== DEHYDRATION_ALGORITHM) {
@@ -1671,6 +1677,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     /**
      * Get the current dehydrated device, if any
      * @returns A promise of an object containing the dehydrated device
+     *
+     * @deprecated MSC2697 device dehydration is not supported for rust cryptography.
      */
     public async getDehydratedDevice(): Promise<IDehydratedDevice | undefined> {
         try {
@@ -1773,9 +1781,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         const deleteRustSdkStore = async (): Promise<void> => {
             let indexedDB: IDBFactory;
             try {
-                indexedDB = global.indexedDB;
+                indexedDB = globalThis.indexedDB;
                 if (!indexedDB) return; // No indexedDB support
-            } catch (e) {
+            } catch {
                 // No indexedDB support
                 return;
             }
@@ -1791,7 +1799,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                         resolve(0);
                     };
                     req.onerror = (e): void => {
-                        // In private browsing, Firefox has a global.indexedDB, but attempts to delete an indexeddb
+                        // In private browsing, Firefox has a globalThis.indexedDB, but attempts to delete an indexeddb
                         // (even a non-existent one) fail with "DOMException: A mutation operation was attempted on a
                         // database that did not allow mutations."
                         //
@@ -2176,16 +2184,16 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         const crypto = new Crypto(this, userId, this.deviceId, this.store, this.cryptoStore, this.verificationMethods!);
 
         this.reEmitter.reEmit(crypto, [
-            CryptoEvent.KeyBackupFailed,
-            CryptoEvent.KeyBackupSessionsRemaining,
-            CryptoEvent.RoomKeyRequest,
-            CryptoEvent.RoomKeyRequestCancellation,
-            CryptoEvent.Warning,
-            CryptoEvent.DevicesUpdated,
-            CryptoEvent.WillUpdateDevices,
-            CryptoEvent.DeviceVerificationChanged,
-            CryptoEvent.UserTrustStatusChanged,
-            CryptoEvent.KeysChanged,
+            LegacyCryptoEvent.KeyBackupFailed,
+            LegacyCryptoEvent.KeyBackupSessionsRemaining,
+            LegacyCryptoEvent.RoomKeyRequest,
+            LegacyCryptoEvent.RoomKeyRequestCancellation,
+            LegacyCryptoEvent.Warning,
+            LegacyCryptoEvent.DevicesUpdated,
+            LegacyCryptoEvent.WillUpdateDevices,
+            LegacyCryptoEvent.DeviceVerificationChanged,
+            LegacyCryptoEvent.UserTrustStatusChanged,
+            LegacyCryptoEvent.KeysChanged,
         ]);
 
         this.logger.debug("Crypto: initialising crypto object...");
@@ -2254,9 +2262,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         // importing rust-crypto will download the webassembly, so we delay it until we know it will be
         // needed.
         this.logger.debug("Downloading Rust crypto library");
-        // blocked on https://github.com/matrix-org/matrix-js-sdk/issues/4392 / https://github.com/babel/babel/issues/16750
-        // eslint-disable-next-line node/file-extension-in-import
-        const RustCrypto = await import("./rust-crypto");
+        const RustCrypto = await import("./rust-crypto/index.ts");
 
         const rustCrypto = await RustCrypto.initRustCrypto({
             logger: this.logger,
@@ -2445,7 +2451,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns
      *
      * @remarks
-     * Fires {@link CryptoEvent.DeviceVerificationChanged}
+     * Fires {@link LegacyCryptoEvent.DeviceVerificationChanged}
      *
      * @deprecated Not supported for Rust Cryptography.
      */
@@ -3254,7 +3260,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      *     userDeviceMap, and returns the `{ contentMap, deviceInfoByDeviceId }`
      *     of the successfully sent messages.
      *
-     * @deprecated Not supported for Rust Cryptography.
+     * @deprecated Instead use {@link CryptoApi.encryptToDeviceMessages} followed by {@link queueToDevice}.
      */
     public encryptAndSendToDevices(userDeviceInfoArr: IOlmDevice<DeviceInfo>[], payload: object): Promise<void> {
         if (!this.crypto) {
@@ -3345,6 +3351,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * uploaded a key backup version using an algorithm I don't understand.
      *
      * @returns Information object from API, or null if no backup is present on the server.
+     *
+     * @deprecated Prefer {@link CryptoApi.getActiveSessionBackupVersion}.
      */
     public async getKeyBackupVersion(): Promise<IKeyBackupInfo | null> {
         let res: IKeyBackupInfo;
@@ -3644,7 +3652,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         try {
             decodeRecoveryKey(recoveryKey);
             return true;
-        } catch (e) {
+        } catch {
             return false;
         }
     }
@@ -4087,43 +4095,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         await this.http.authedRequest(Method.Delete, path.path, path.queryData, undefined, { prefix: ClientPrefix.V3 });
     }
 
-    /**
-     * Share shared-history decryption keys with the given users.
-     *
-     * @param roomId - the room for which keys should be shared.
-     * @param userIds - a list of users to share with.  The keys will be sent to
-     *     all of the user's current devices.
-     *
-     * @deprecated Do not use this method. It does not work with the Rust crypto stack, and even with the legacy
-     *     stack it introduces a security vulnerability.
-     */
-    public async sendSharedHistoryKeys(roomId: string, userIds: string[]): Promise<void> {
-        if (!this.crypto) {
-            throw new Error("End-to-end encryption disabled");
-        }
-
-        const roomEncryption = this.crypto?.getRoomEncryption(roomId);
-        if (!roomEncryption) {
-            // unknown room, or unencrypted room
-            this.logger.error("Unknown room.  Not sharing decryption keys");
-            return;
-        }
-
-        const deviceInfos = await this.crypto.downloadKeys(userIds);
-        const devicesByUser: Map<string, DeviceInfo[]> = new Map();
-        for (const [userId, devices] of deviceInfos) {
-            devicesByUser.set(userId, Array.from(devices.values()));
-        }
-
-        // XXX: Private member access
-        const alg = this.crypto.getRoomDecryptor(roomId, roomEncryption.algorithm);
-        if (alg.sendSharedHistoryInboundSessions) {
-            await alg.sendSharedHistoryInboundSessions(devicesByUser);
-        } else {
-            this.logger.warn("Algorithm does not support sharing previous keys", roomEncryption.algorithm);
-        }
-    }
-
     /**
      * Get the config for the media repository.
      * @returns Promise which resolves with an object containing the config.
@@ -5827,16 +5798,17 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns Promise which resolves: `{}` an empty object.
      * @returns Rejects: with an error response.
      */
-    public forget(roomId: string, deleteRoom = true): Promise<{}> {
-        const promise = this.membershipChange(roomId, undefined, "forget");
-        if (!deleteRoom) {
-            return promise;
-        }
-        return promise.then((response) => {
+    public async forget(roomId: string, deleteRoom = true): Promise<{}> {
+        // API returns an empty object
+        const path = utils.encodeUri("/rooms/$room_id/forget", {
+            $room_id: roomId,
+        });
+        const response = await this.http.authedRequest<{}>(Method.Post, path);
+        if (deleteRoom) {
             this.store.removeRoom(roomId);
             this.emit(ClientEvent.DeleteRoom, roomId);
-            return response;
-        });
+        }
+        return response;
     }
 
     /**
@@ -5877,7 +5849,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     private membershipChange(
         roomId: string,
         userId: string | undefined,
-        membership: Membership | "forget",
+        membership: Membership,
         reason?: string,
     ): Promise<{}> {
         // API returns an empty object
@@ -7579,7 +7551,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                 if ((<HTTPError>err).httpStatus === 403) {
                     // We got a 403, so there's no point in looping forever.
                     this.logger.info("TURN access unavailable for this account: stopping credentials checks");
-                    if (this.checkTurnServersIntervalID !== null) global.clearInterval(this.checkTurnServersIntervalID);
+                    if (this.checkTurnServersIntervalID !== null) {
+                        globalThis.clearInterval(this.checkTurnServersIntervalID);
+                    }
                     this.checkTurnServersIntervalID = undefined;
                     this.emit(ClientEvent.TurnServersError, <HTTPError>err, true); // fatal
                 } else {
@@ -7861,7 +7835,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                 list: determineFeatureSupport(listStable, listUnstable),
                 fwdPagination: determineFeatureSupport(fwdPaginationStable, fwdPaginationUnstable),
             };
-        } catch (e) {
+        } catch {
             return {
                 threads: FeatureSupport.None,
                 list: FeatureSupport.None,

src/content-repo.ts

@@ -1,5 +1,5 @@
 /*
-Copyright 2015 - 2021 The Matrix.org Foundation C.I.C.
+Copyright 2015 - 2024 The Matrix.org Foundation C.I.C.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,7 +14,22 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { encodeParams } from "./utils.ts";
+// Validation based on https://spec.matrix.org/v1.12/appendices/#server-name
+// We do not use the validation described in https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5
+// as it'd wrongly make all MXCs invalid due to not allowing `[].:` in server names.
+const serverNameRegex =
+    /^(?:(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(?:\[[\dA-Fa-f:.]{2,45}])|(?:[A-Za-z\d\-.]{1,255}))(?::\d{1,5})?$/;
+function validateServerName(serverName: string): boolean {
+    const matches = serverNameRegex.exec(serverName);
+    return matches?.[0] === serverName;
+}
+
+// Validation based on https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5
+const mediaIdRegex = /^[\w-]+$/;
+function validateMediaId(mediaId: string): boolean {
+    const matches = mediaIdRegex.exec(mediaId);
+    return matches?.[0] === mediaId;
+}
 
 /**
  * Get the HTTP URL for an MXC URI.
@@ -36,7 +51,7 @@ import { encodeParams } from "./utils.ts";
  * for authenticated media will *not* be checked - it is the caller's responsibility
  * to do so before calling this function. Note also that `useAuthentication`
  * implies `allowRedirects`. Defaults to false (unauthenticated endpoints).
- * @returns The complete URL to the content.
+ * @returns The complete URL to the content, may be an empty string if the provided mxc is not valid.
  */
 export function getHttpUriForMxc(
     baseUrl: string,
@@ -51,7 +66,7 @@ export function getHttpUriForMxc(
     if (typeof mxc !== "string" || !mxc) {
         return "";
     }
-    if (mxc.indexOf("mxc://") !== 0) {
+    if (!mxc.startsWith("mxc://")) {
         if (allowDirectLinks) {
             return mxc;
         } else {
@@ -59,6 +74,11 @@ export function getHttpUriForMxc(
         }
     }
 
+    const [serverName, mediaId, ...rest] = mxc.slice(6).split("/");
+    if (rest.length > 0 || !validateServerName(serverName) || !validateMediaId(mediaId)) {
+        return "";
+    }
+
     if (useAuthentication) {
         allowRedirects = true; // per docs (MSC3916 always expects redirects)
 
@@ -67,46 +87,31 @@ export function getHttpUriForMxc(
         // callers, hopefully.
     }
 
-    let serverAndMediaId = mxc.slice(6); // strips mxc://
     let prefix: string;
+    const isThumbnailRequest = !!width || !!height || !!resizeMethod;
+    const verb = isThumbnailRequest ? "thumbnail" : "download";
     if (useAuthentication) {
-        prefix = "/_matrix/client/v1/media/download/";
+        prefix = `/_matrix/client/v1/media/${verb}`;
     } else {
-        prefix = "/_matrix/media/v3/download/";
+        prefix = `/_matrix/media/v3/${verb}`;
     }
-    const params: Record<string, string> = {};
+
+    const url = new URL(`${prefix}/${serverName}/${mediaId}`, baseUrl);
 
     if (width) {
-        params["width"] = Math.round(width).toString();
+        url.searchParams.set("width", Math.round(width).toString());
     }
     if (height) {
-        params["height"] = Math.round(height).toString();
+        url.searchParams.set("height", Math.round(height).toString());
     }
     if (resizeMethod) {
-        params["method"] = resizeMethod;
-    }
-    if (Object.keys(params).length > 0) {
-        // these are thumbnailing params so they probably want the
-        // thumbnailing API...
-        if (useAuthentication) {
-            prefix = "/_matrix/client/v1/media/thumbnail/";
-        } else {
-            prefix = "/_matrix/media/v3/thumbnail/";
-        }
+        url.searchParams.set("method", resizeMethod);
     }
 
     if (typeof allowRedirects === "boolean") {
         // We add this after, so we don't convert everything to a thumbnail request.
-        params["allow_redirect"] = JSON.stringify(allowRedirects);
+        url.searchParams.set("allow_redirect", JSON.stringify(allowRedirects));
     }
 
-    const fragmentOffset = serverAndMediaId.indexOf("#");
-    let fragment = "";
-    if (fragmentOffset >= 0) {
-        fragment = serverAndMediaId.slice(fragmentOffset);
-        serverAndMediaId = serverAndMediaId.slice(0, fragmentOffset);
-    }
-
-    const urlParams = Object.keys(params).length === 0 ? "" : "?" + encodeParams(params);
-    return baseUrl + prefix + serverAndMediaId + urlParams + fragment;
+    return url.href;
 }

src/crypto-api/CryptoEvent.ts

@@ -0,0 +1,93 @@
+/*
+ * Copyright 2024 The Matrix.org Foundation C.I.C.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Events emitted by the {@link CryptoApi}
+ */
+export enum CryptoEvent {
+    /**
+     * Fires when the trust status of a user changes.
+     * The payload is a pair (userId, userTrustLevel). The trust level is one of the values from UserVerificationStatus.
+     */
+    UserTrustStatusChanged = "userTrustStatusChanged",
+
+    /**
+     * Fires when the key backup status changes.
+     * The payload is a boolean indicating whether the key backup is enabled.
+     */
+    KeyBackupStatus = "crypto.keyBackupStatus",
+
+    /**
+     * Fires when we failed to back up the keys
+     * The payload is the error code of the error that occurred.
+     */
+    KeyBackupFailed = "crypto.keyBackupFailed",
+
+    /**
+     * Fires when the number of sessions that can be backed up changes.
+     * The payload is the remaining number of sessions that can be backed up.
+     */
+    KeyBackupSessionsRemaining = "crypto.keyBackupSessionsRemaining",
+
+    /**
+     * Fires when a new valid backup decryption key is in cache.
+     * This will happen when a secret is received from another session, from secret storage,
+     * or when a new backup is created from this session.
+     *
+     * The payload is the version of the backup for which we have the key for.
+     *
+     * This event is only fired by the rust crypto backend.
+     */
+    KeyBackupDecryptionKeyCached = "crypto.keyBackupDecryptionKeyCached",
+
+    /**
+     * Fires when a key verification request is received.
+     * The payload is a VerificationRequest object representing the request.
+     */
+    VerificationRequestReceived = "crypto.verificationRequestReceived",
+
+    /** @deprecated Use {@link DevicesUpdated} instead when using rust crypto */
+    WillUpdateDevices = "crypto.willUpdateDevices",
+
+    /**
+     * Fires whenever the stored devices for a user have been updated
+     * The payload is a pair (userIds, initialFetch).
+     */
+    DevicesUpdated = "crypto.devicesUpdated",
+
+    /**
+     * Fires when the user's cross-signing keys have changed or cross-signing
+     * has been enabled/disabled. The client can use getStoredCrossSigningForUser
+     * with the user ID of the logged in user to check if cross-signing is
+     * enabled on the account. If enabled, it can test whether the current key
+     * is trusted using with checkUserTrust with the user ID of the logged
+     * in user. The checkOwnCrossSigningTrust function may be used to reconcile
+     * the trust in the account key.
+     *
+     * The cross-signing API is currently UNSTABLE and may change without notice.
+     * @experimental
+     */
+    KeysChanged = "crossSigning.keysChanged",
+
+    /**
+     * Fires when data is being migrated from legacy crypto to rust crypto.
+     *
+     * The payload is a pair `(progress, total)`, where `progress` is the number of steps completed so far, and
+     * `total` is the total number of steps. When migration is complete, a final instance of the event is emitted, with
+     * `progress === total === -1`.
+     */
+    LegacyCryptoStoreMigrationProgress = "crypto.legacyCryptoStoreMigrationProgress",
+}

src/crypto-api/CryptoEventHandlerMap.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright 2024 The Matrix.org Foundation C.I.C.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { CryptoEvent } from "./CryptoEvent.ts";
+import { VerificationRequest } from "./verification.ts";
+import { UserVerificationStatus } from "./index.ts";
+import { RustBackupCryptoEventMap } from "../rust-crypto/backup.ts";
+
+/**
+ * A map of the {@link CryptoEvent} fired by the {@link CryptoApi} and their payloads.
+ */
+export type CryptoEventHandlerMap = {
+    [CryptoEvent.VerificationRequestReceived]: (request: VerificationRequest) => void;
+    [CryptoEvent.UserTrustStatusChanged]: (userId: string, userTrustLevel: UserVerificationStatus) => void;
+    [CryptoEvent.KeyBackupDecryptionKeyCached]: (version: string) => void;
+    [CryptoEvent.KeysChanged]: (data: {}) => void;
+    [CryptoEvent.WillUpdateDevices]: (users: string[], initialFetch: boolean) => void;
+    [CryptoEvent.DevicesUpdated]: (users: string[], initialFetch: boolean) => void;
+} & RustBackupCryptoEventMap;

src/crypto-api/index.ts

@@ -16,6 +16,7 @@ limitations under the License.
 
 import type { SecretsBundle } from "@matrix-org/matrix-sdk-crypto-wasm";
 import type { IMegolmSessionData } from "../@types/crypto.ts";
+import type { ToDeviceBatch, ToDevicePayload } from "../models/ToDeviceMessage.ts";
 import { Room } from "../models/room.ts";
 import { DeviceMap } from "../models/device.ts";
 import { UIAuthCallback } from "../interactive-auth.ts";
@@ -25,6 +26,15 @@ import { BackupTrustInfo, KeyBackupCheck, KeyBackupInfo } from "./keybackup.ts";
 import { ISignatures } from "../@types/signed.ts";
 import { MatrixEvent } from "../models/event.ts";
 
+/**
+ * `matrix-js-sdk/lib/crypto-api`: End-to-end encryption support.
+ *
+ * The most important type is {@link CryptoApi}, an instance of which can be retrieved via
+ * {@link MatrixClient.getCrypto}.
+ *
+ * @packageDocumentation
+ */
+
 /**
  * Public interface to the cryptography parts of the js-sdk
  *
@@ -181,7 +191,7 @@ export interface CryptoApi {
     /**
      * Return whether we trust other user's signatures of their devices.
      *
-     * @see {@link Crypto.CryptoApi#setTrustCrossSignedDevices}
+     * @see {@link CryptoApi.setTrustCrossSignedDevices}
      *
      * @returns `true` if we trust cross-signed devices, otherwise `false`.
      */
@@ -228,7 +238,7 @@ export interface CryptoApi {
      *
      * @throws an error if the device is unknown, or has not published any encryption keys.
      *
-     * @remarks Fires {@link CryptoEvent#DeviceVerificationChanged}
+     * @remarks Fires {@link matrix.CryptoEvent.DeviceVerificationChanged}
      */
     setDeviceVerified(userId: string, deviceId: string, verified?: boolean): Promise<void>;
 
@@ -259,12 +269,18 @@ export interface CryptoApi {
      *
      * @returns True if cross-signing is ready to be used on this device
      *
-     * @throws May throw {@link ClientStoppedError} if the `MatrixClient` is stopped before or during the call.
+     * @throws May throw {@link matrix.ClientStoppedError} if the `MatrixClient` is stopped before or during the call.
      */
     isCrossSigningReady(): Promise<boolean>;
 
     /**
-     * Get the ID of one of the user's cross-signing keys.
+     * Get the ID of one of the user's cross-signing keys, if both private and matching
+     * public parts of that key are available (ie. cached in the local crypto store).
+     *
+     * The public part may not be available if a `/keys/query` request has not yet been
+     * performed, or if the device that created the keys failed to publish them.
+     *
+     * If either part of the keypair is not available, this will return `null`.
      *
      * @param type - The type of key to get the ID of.  One of `CrossSigningKey.Master`, `CrossSigningKey.SelfSigning`,
      *     or `CrossSigningKey.UserSigning`.  Defaults to `CrossSigningKey.Master`.
@@ -327,7 +343,7 @@ export interface CryptoApi {
      * @returns The current status of cross-signing keys: whether we have public and private keys cached locally, and
      * whether the private keys are in secret storage.
      *
-     * @throws May throw {@link ClientStoppedError} if the `MatrixClient` is stopped before or during the call.
+     * @throws May throw {@link matrix.ClientStoppedError} if the `MatrixClient` is stopped before or during the call.
      */
     getCrossSigningStatus(): Promise<CrossSigningStatus>;
 
@@ -355,6 +371,22 @@ export interface CryptoApi {
      */
     getEncryptionInfoForEvent(event: MatrixEvent): Promise<EventEncryptionInfo | null>;
 
+    /**
+     * Encrypts a given payload object via Olm to-device messages to a given
+     * set of devices.
+     *
+     * @param eventType - the type of the event to send.
+     * @param devices - an array of devices to encrypt the payload for.
+     * @param payload - the payload to encrypt.
+     *
+     * @returns the batch of encrypted payloads which can then be sent via {@link matrix.MatrixClient#queueToDevice}.
+     */
+    encryptToDeviceMessages(
+        eventType: string,
+        devices: { userId: string; deviceId: string }[],
+        payload: ToDevicePayload,
+    ): Promise<ToDeviceBatch>;
+
     ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
     //
     // Device/User verification
@@ -407,8 +439,8 @@ export interface CryptoApi {
      *
      * If an all-devices verification is already in flight, returns it. Otherwise, initiates a new one.
      *
-     * To control the methods offered, set {@link ICreateClientOpts.verificationMethods} when creating the
-     * MatrixClient.
+     * To control the methods offered, set {@link matrix.ICreateClientOpts.verificationMethods} when creating the
+     * `MatrixClient`.
      *
      * @returns a VerificationRequest when the request has been sent to the other party.
      */
@@ -422,8 +454,8 @@ export interface CryptoApi {
      *
      * If a verification for this user/device is already in flight, returns it. Otherwise, initiates a new one.
      *
-     * To control the methods offered, set {@link ICreateClientOpts.verificationMethods} when creating the
-     * MatrixClient.
+     * To control the methods offered, set {@link  matrix.ICreateClientOpts.verificationMethods} when creating the
+     * `MatrixClient`.
      *
      * @param userId - ID of the owner of the device to verify
      * @param deviceId - ID of the device to verify
@@ -480,7 +512,7 @@ export interface CryptoApi {
     /**
      * Determine if a key backup can be trusted.
      *
-     * @param info - key backup info dict from {@link MatrixClient#getKeyBackupVersion}.
+     * @param info - key backup info dict from {@link matrix.MatrixClient.getKeyBackupVersion}.
      */
     isKeyBackupTrusted(info: KeyBackupInfo): Promise<BackupTrustInfo>;
 
@@ -500,7 +532,7 @@ export interface CryptoApi {
      *
      * If there are existing backups they will be replaced.
      *
-     * The decryption key will be saved in Secret Storage (the {@link SecretStorageCallbacks.getSecretStorageKey} Crypto
+     * The decryption key will be saved in Secret Storage (the {@link matrix.SecretStorage.SecretStorageCallbacks.getSecretStorageKey} Crypto
      * callback will be called)
      * and the backup engine will be started.
      */
@@ -841,9 +873,9 @@ export class DeviceVerificationStatus {
      * Check if we should consider this device "verified".
      *
      * A device is "verified" if either:
-     *  * it has been manually marked as such via {@link MatrixClient#setDeviceVerified}.
+     *  * it has been manually marked as such via {@link matrix.MatrixClient.setDeviceVerified}.
      *  * it has been cross-signed with a verified signing key, **and** the client has been configured to trust
-     *    cross-signed devices via {@link Crypto.CryptoApi#setTrustCrossSignedDevices}.
+     *    cross-signed devices via {@link CryptoApi.setTrustCrossSignedDevices}.
      *
      * @returns true if this device is verified via any means.
      */
@@ -904,8 +936,11 @@ export interface CrossSigningStatus {
  * Crypto callbacks provided by the application
  */
 export interface CryptoCallbacks extends SecretStorageCallbacks {
+    /** @deprecated: unused with the Rust crypto stack. */
     getCrossSigningKey?: (keyType: string, pubKey: string) => Promise<Uint8Array | null>;
+    /** @deprecated: unused with the Rust crypto stack. */
     saveCrossSigningKeys?: (keys: Record<string, Uint8Array>) => void;
+    /** @deprecated: unused with the Rust crypto stack. */
     shouldUpgradeDeviceVerifications?: (users: Record<string, any>) => Promise<string[]>;
     /**
      * Called by {@link CryptoApi#bootstrapSecretStorage}
@@ -930,6 +965,7 @@ export interface CryptoCallbacks extends SecretStorageCallbacks {
         checkFunc: (key: Uint8Array) => void,
     ) => Promise<Uint8Array>;
 
+    /** @deprecated: unused with the Rust crypto stack. */
     getBackupKey?: () => Promise<Uint8Array>;
 }
 
@@ -948,6 +984,7 @@ export interface CreateSecretStorageOpts {
     /**
      * The current key backup object. If passed,
      * the passphrase and recovery key from this backup will be used.
+     * @deprecated Not used by the Rust crypto stack.
      */
     keyBackupInfo?: KeyBackupInfo;
 
@@ -1071,6 +1108,8 @@ export interface OwnDeviceKeys {
 }
 
 export * from "./verification.ts";
-export * from "./keybackup.ts";
+export type * from "./keybackup.ts";
 export * from "./recovery-key.ts";
 export * from "./key-passphrase.ts";
+export * from "./CryptoEvent.ts";
+export type * from "./CryptoEventHandlerMap.ts";

src/crypto-api/keybackup.ts

@@ -35,7 +35,7 @@ export interface Aes256AuthData {
  * Information about a server-side key backup.
  *
  * Returned by [`GET /_matrix/client/v3/room_keys/version`](https://spec.matrix.org/v1.7/client-server-api/#get_matrixclientv3room_keysversion)
- * and hence {@link MatrixClient#getKeyBackupVersion}.
+ * and hence {@link matrix.MatrixClient.getKeyBackupVersion}.
  */
 export interface KeyBackupInfo {
     algorithm: string;
@@ -63,7 +63,7 @@ export interface BackupTrustInfo {
 }
 
 /**
- * The result of {@link Crypto.CryptoApi.checkKeyBackupAndEnable}.
+ * The result of {@link CryptoApi.checkKeyBackupAndEnable}.
  */
 export interface KeyBackupCheck {
     backupInfo: KeyBackupInfo;

src/crypto-api/verification.ts

@@ -119,7 +119,7 @@ export interface VerificationRequest
      *
      * If a verifier has already been created for this request, returns that verifier.
      *
-     * This does *not* send the `m.key.verification.start` event - to do so, call {@link Crypto.Verifier#verify} on the
+     * This does *not* send the `m.key.verification.start` event - to do so, call {@link Verifier.verify} on the
      * returned verifier.
      *
      * If no previous events have been sent, pass in `targetDevice` to set who to direct this request to.
@@ -281,7 +281,7 @@ export interface Verifier extends TypedEventEmitter<VerifierEvent, VerifierEvent
      * Cancel a verification.
      *
      * We will send an `m.key.verification.cancel` if the verification is still in flight. The verification promise
-     * will reject, and a {@link Crypto.VerifierEvent#Cancel} will be emitted.
+     * will reject, and a {@link crypto-api.VerifierEvent.Cancel | VerifierEvent.Cancel} will be emitted.
      *
      * @param e - the reason for the cancellation.
      */