matrix-js-sdk/src/crypto/algorithms/megolm.ts

Matrix Client-Server SDK for Javascript

/*
Copyright 2015 - 2021, 2023 The Matrix.org Foundation C.I.C.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

/**
 * Defines m.olm encryption/decryption
 */

import { v4 as uuidv4 } from "uuid";

import type { IEventDecryptionResult, IMegolmSessionData } from "../../@types/crypto";
import { logger, Logger } from "../../logger";
import * as olmlib from "../olmlib";
import {
    DecryptionAlgorithm,
    DecryptionClassParams,
    DecryptionError,
    EncryptionAlgorithm,
    IParams,
    registerAlgorithm,
    UnknownDeviceError,
} from "./base";
import { IDecryptedGroupMessage, WITHHELD_MESSAGES } from "../OlmDevice";
import { Room } from "../../models/room";
import { DeviceInfo } from "../deviceinfo";
import { IOlmSessionResult } from "../olmlib";
import { DeviceInfoMap } from "../DeviceList";
import { IContent, MatrixEvent } from "../../models/event";
import { EventType, MsgType, ToDeviceMessageId } from "../../@types/event";
import { IMegolmEncryptedContent, IncomingRoomKeyRequest, IEncryptedContent } from "../index";
import { RoomKeyRequestState } from "../OutgoingRoomKeyRequestManager";
import { OlmGroupSessionExtraData } from "../../@types/crypto";
import { MatrixError } from "../../http-api";
import { immediate, MapWithDefault } from "../../utils";

// determine whether the key can be shared with invitees
export function isRoomSharedHistory(room: Room): boolean {
    const visibilityEvent = room?.currentState?.getStateEvents("m.room.history_visibility", "");
    // NOTE: if the room visibility is unset, it would normally default to
    // "world_readable".
    // (https://spec.matrix.org/unstable/client-server-api/#server-behaviour-5)
    // But we will be paranoid here, and treat it as a situation where the room
    // is not shared-history
    const visibility = visibilityEvent?.getContent()?.history_visibility;
    return ["world_readable", "shared"].includes(visibility);
}

interface IBlockedDevice {
    code: string;
    reason: string;
    deviceInfo: DeviceInfo;
}

// map user Id → device Id → IBlockedDevice
type BlockedMap = Map<string, Map<string, IBlockedDevice>>;

export interface IOlmDevice<T = DeviceInfo> {
    userId: string;
    deviceInfo: T;
}

/**
 * Tests whether an encrypted content has a ciphertext.
 * Ciphertext can be a string or object depending on the content type {@link IEncryptedContent}.
 *
 * @param content - Encrypted content
 * @returns true: has ciphertext, else false
 */
const hasCiphertext = (content: IEncryptedContent): boolean => {
    return typeof content.ciphertext === "string"
        ? !!content.ciphertext.length
        : !!Object.keys(content.ciphertext).length;
};

/** The result of parsing the an `m.room_key` or `m.forwarded_room_key` to-device event */
interface RoomKey {
    /**
     * The Curve25519 key of the megolm session creator.
     *
     * For `m.room_key`, this is also the sender of the `m.room_key` to-device event.
     * For `m.forwarded_room_key`, the two are different (and the key of the sender of the
     * `m.forwarded_room_key` event is included in `forwardingKeyChain`)
     */
    senderKey: string;
    sessionId: string;
    sessionKey: string;
    exportFormat: boolean;
    roomId: string;
    algorithm: string;
    /**
     * A list of the curve25519 keys of the users involved in forwarding this key, most recent last.
     * For `m.room_key` events, this is empty.
     */
    forwardingKeyChain: string[];
    keysClaimed: Partial<Record<"ed25519", string>>;
    extraSessionData: OlmGroupSessionExtraData;
}

export interface IOutboundGroupSessionKey {
    chain_index: number;
    key: string;
}

interface IMessage {
    type: string;
    content: {
        "algorithm": string;
        "room_id": string;
        "sender_key"?: string;
        "sender_claimed_ed25519_key"?: string;
        "session_id": string;
        "session_key": string;
        "chain_index": number;
        "forwarding_curve25519_key_chain"?: string[];
        "org.matrix.msc3061.shared_history": boolean;
    };
}

interface IKeyForwardingMessage extends IMessage {
    type: "m.forwarded_room_key";
}

interface IPayload extends Partial<IMessage> {
    code?: string;
    reason?: string;
    room_id?: string;
    session_id?: string;
    algorithm?: string;
    sender_key?: string;
}

interface SharedWithData {
    // The identity key of the device we shared with
    deviceKey: string;
    // The message index of the ratchet we shared with that device
    messageIndex: number;
}

/**
 * @internal
 */
class OutboundSessionInfo {
    /** number of times this session has been used */
    public useCount = 0;
    /** when the session was created (ms since the epoch) */
    public creationTime: number;
    /** devices with which we have shared the session key `userId -> {deviceId -> SharedWithData}` */
    public sharedWithDevices: MapWithDefault<string, Map<string, SharedWithData>> = new MapWithDefault(() => new Map());
    public blockedDevicesNotified: MapWithDefault<string, Map<string, boolean>> = new MapWithDefault(() => new Map());

    /**
     * @param sharedHistory - whether the session can be freely shared with
     *    other group members, according to the room history visibility settings
     */
    public constructor(
        public readonly sessionId: string,
        public readonly sharedHistory = false,
    ) {
        this.creationTime = new Date().getTime();
    }

    /**
     * Check if it's time to rotate the session
     */
    public needsRotation(rotationPeriodMsgs: number, rotationPeriodMs: number): boolean {
        const sessionLifetime = new Date().getTime() - this.creationTime;

        if (this.useCount >= rotationPeriodMsgs || sessionLifetime >= rotationPeriodMs) {
            logger.log("Rotating megolm session after " + this.useCount + " messages, " + sessionLifetime + "ms");
            return true;
        }

        return false;
    }

    public markSharedWithDevice(userId: string, deviceId: string, deviceKey: string, chainIndex: number): void {
        this.sharedWithDevices.getOrCreate(userId).set(deviceId, { deviceKey, messageIndex: chainIndex });
    }

    public markNotifiedBlockedDevice(userId: string, deviceId: string): void {
        this.blockedDevicesNotified.getOrCreate(userId).set(deviceId, true);
    }

    /**
     * Determine if this session has been shared with devices which it shouldn't
     * have been.
     *
     * @param devicesInRoom - `userId -> {deviceId -> object}`
     *   devices we should shared the session with.
     *
     * @returns true if we have shared the session with devices which aren't
     * in devicesInRoom.
     */
    public sharedWithTooManyDevices(devicesInRoom: DeviceInfoMap): boolean {
        for (const [userId, devices] of this.sharedWithDevices) {
            if (!devicesInRoom.has(userId)) {
                logger.log("Starting new megolm session because we shared with " + userId);
                return true;
            }

            for (const [deviceId] of devices) {
                if (!devicesInRoom.get(userId)?.get(deviceId)) {
                    logger.log("Starting new megolm session because we shared with " + userId + ":" + deviceId);
                    return true;
                }
            }
        }

        return false;
    }
}

/**
 * Megolm encryption implementation
 *
 * @param params - parameters, as per {@link EncryptionAlgorithm}
 */
export class MegolmEncryption extends EncryptionAlgorithm {
    // the most recent attempt to set up a session. This is used to serialise
    // the session setups, so that we have a race-free view of which session we
    // are using, and which devices we have shared the keys with. It resolves
    // with an OutboundSessionInfo (or undefined, for the first message in the
    // room).
    private setupPromise = Promise.resolve<OutboundSessionInfo | null>(null);

    // Map of outbound sessions by sessions ID. Used if we need a particular
    // session (the session we're currently using to send is always obtained
    // using setupPromise).
    private outboundSessions: Record<string, OutboundSessionInfo> = {};

    private readonly sessionRotationPeriodMsgs: number;
    private readonly sessionRotationPeriodMs: number;
    private encryptionPreparation?: {
        promise: Promise<void>;
        startTime: number;
        cancel: () => void;
    };

    protected readonly roomId: string;
    private readonly prefixedLogger: Logger;

    public constructor(params: IParams & Required<Pick<IParams, "roomId">>) {
        super(params);
        this.roomId = params.roomId;
        this.prefixedLogger = logger.getChild(`[${this.roomId} encryption]`);

        this.sessionRotationPeriodMsgs = params.config?.rotation_period_msgs ?? 100;
        this.sessionRotationPeriodMs = params.config?.rotation_period_ms ?? 7 * 24 * 3600 * 1000;
    }

    /**
     * @internal
     *
     * @param devicesInRoom - The devices in this room, indexed by user ID
     * @param blocked - The devices that are blocked, indexed by user ID
     * @param singleOlmCreationPhase - Only perform one round of olm
     *     session creation
     *
     * This method updates the setupPromise field of the class by chaining a new
     * call on top of the existing promise, and then catching and discarding any
     * errors that might happen while setting up the outbound group session. This
     * is done to ensure that `setupPromise` always resolves to `null` or the
     * `OutboundSessionInfo`.
     *
     * Using `>>=` to represent the promise chaining operation, it does the
     * following:
     *
     * ```
     * setupPromise = previousSetupPromise >>= setup >>= discardErrors
     * ```
     *
     * The initial value for the `setupPromise` is a promise that resolves to
     * `null`. The forceDiscardSession() resets setupPromise to this initial
     * promise.
     *
     * @returns Promise which resolves to the
     *    OutboundSessionInfo when setup is complete.
     */
    private async ensureOutboundSession(
        room: Room,
        devicesInRoom: DeviceInfoMap,
        blocked: BlockedMap,
        singleOlmCreationPhase = false,
    ): Promise<OutboundSessionInfo> {
        // takes the previous OutboundSessionInfo, and considers whether to create
        // a new one. Also shares the key with any (new) devices in the room.
        //
        // returns a promise which resolves once the keyshare is successful.
        const setup = async (oldSession: OutboundSessionInfo | null): Promise<OutboundSessionInfo> => {
            const sharedHistory = isRoomSharedHistory(room);
            const session = await this.prepareSession(devicesInRoom, sharedHistory, oldSession);

            await this.shareSession(devicesInRoom, sharedHistory, singleOlmCreationPhase, blocked, session);

            return session;
        };

        // first wait for the previous share to complete
        const fallible = this.setupPromise.then(setup);

        // Ensure any failures are logged for debugging and make sure that the
        // promise chain remains unbroken
        //
        // setupPromise resolves to `null` or the `OutboundSessionInfo` whether
        // or not the share succeeds
        this.setupPromise = fallible.catch((e) => {
            this.prefixedLogger.error(`Failed to setup outbound session`, e);
            return null;
        });

        // but we return a promise which only resolves if the share was successful.
        return fallible;
    }

    private async prepareSession(
        devicesInRoom: DeviceInfoMap,
        sharedHistory: boolean,
        session: OutboundSessionInfo | null,
    ): Promise<OutboundSessionInfo> {
        // history visibility changed
        if (session && sharedHistory !== session.sharedHistory) {
            session = null;
        }

        // need to make a brand new session?
        if (session?.needsRotation(this.sessionRotationPeriodMsgs, this.sessionRotationPeriodMs)) {
            this.prefixedLogger.debug("Starting new megolm session because we need to rotate.");
            session = null;
        }

        // determine if we have shared with anyone we shouldn't have
        if (session?.sharedWithTooManyDevices(devicesInRoom)) {
            session = null;
        }

        if (!session) {
            this.prefixedLogger.debug("Starting new megolm session");
            session = await this.prepareNewSession(sharedHistory);
            this.prefixedLogger.debug(`Started new megolm session ${session.sessionId}`);
            this.outboundSessions[session.sessionId] = session;
        }

        return session;
    }

    private async shareSession(
        devicesInRoom: DeviceInfoMap,
        sharedHistory: boolean,
        singleOlmCreationPhase: boolean,
        blocked: BlockedMap,
        session: OutboundSessionInfo,
    ): Promise<void> {
        // now check if we need to share with any devices
        const shareMap: Record<string, DeviceInfo[]> = {};

        for (const [userId, userDevices] of devicesInRoom) {
            for (const [deviceId, deviceInfo] of userDevices) {
                const key = deviceInfo.getIdentityKey();
                if (key == this.olmDevice.deviceCurve25519Key) {
                    // don't bother sending to ourself
                    continue;
                }

                if (!session.sharedWithDevices.get(userId)?.get(deviceId)) {
                    shareMap[userId] = shareMap[userId] || [];
                    shareMap[userId].push(deviceInfo);
                }
            }
        }

        const key = this.olmDevice.getOutboundGroupSessionKey(session.sessionId);
        const payload: IPayload = {
            type: "m.room_key",
            content: {
                "algorithm": olmlib.MEGOLM_ALGORITHM,
                "room_id": this.roomId,
                "session_id": session.sessionId,
                "session_key": key.key,
                "chain_index": key.chain_index,
                "org.matrix.msc3061.shared_history": sharedHistory,
            },
        };
        const [devicesWithoutSession, olmSessions] = await olmlib.getExistingOlmSessions(
            this.olmDevice,
            this.baseApis,
            shareMap,
        );

        await Promise.all([
            (async (): Promise<void> => {
                // share keys with devices that we already have a session for
                const olmSessionList = Array.from(olmSessions.entries())
                    .map(([userId, sessionsByUser]) =>
                        Array.from(sessionsByUser.entries()).map(
                            ([deviceId, session]) => `${userId}/${deviceId}: ${session.sessionId}`,
                        ),
                    )
                    .flat(1);
                this.prefixedLogger.debug("Sharing keys with devices with existing Olm sessions:", olmSessionList);
                await this.shareKeyWithOlmSessions(session, key, payload, olmSessions);
                this.prefixedLogger.debug("Shared keys with existing Olm sessions");
            })(),
            (async (): Promise<void> => {
                const deviceList = Array.from(devicesWithoutSession.entries())
                    .map(([userId, devicesByUser]) => devicesByUser.map((device) => `${userId}/${device.deviceId}`))
                    .flat(1);
                this.prefixedLogger.debug(
                    "Sharing keys (start phase 1) with devices without existing Olm sessions:",
                    deviceList,
                );
                const errorDevices: IOlmDevice[] = [];

                // meanwhile, establish olm sessions for devices that we don't
                // already have a session for, and share keys with them.  If
                // we're doing two phases of olm session creation, use a
                // shorter timeout when fetching one-time keys for the first
                // phase.
                const start = Date.now();
                const failedServers: string[] = [];
                await this.shareKeyWithDevices(
                    session,
                    key,
                    payload,
                    devicesWithoutSession,
                    errorDevices,
                    singleOlmCreationPhase ? 10000 : 2000,
                    failedServers,
                );
                this.prefixedLogger.debug("Shared keys (end phase 1) with devices without existing Olm sessions");

                if (!singleOlmCreationPhase && Date.now() - start < 10000) {
                    // perform the second phase of olm session creation if requested,
                    // and if the first phase didn't take too long
                    (async (): Promise<void> => {
                        // Retry sending keys to devices that we were unable to establish
                        // an olm session for.  This time, we use a longer timeout, but we
                        // do this in the background and don't block anything else while we
                        // do this.  We only need to retry users from servers that didn't
                        // respond the first time.
                        const retryDevices: MapWithDefault<string, DeviceInfo[]> = new MapWithDefault(() => []);
                        const failedServerMap = new Set();
                        for (const server of failedServers) {
                            failedServerMap.add(server);
                        }
                        const failedDevices: IOlmDevice[] = [];
                        for (const { userId, deviceInfo } of errorDevices) {
                            const userHS = userId.slice(userId.indexOf(":") + 1);
                            if (failedServerMap.has(userHS)) {
                                retryDevices.getOrCreate(userId).push(deviceInfo);
                            } else {
                                // if we aren't going to retry, then handle it
                                // as a failed device
                                failedDevices.push({ userId, deviceInfo });
                            }
                        }

                        const retryDeviceList = Array.from(retryDevices.entries())
                            .map(([userId, devicesByUser]) =>
                                devicesByUser.map((device) => `${userId}/${device.deviceId}`),
                            )
                            .flat(1);

                        if (retryDeviceList.length > 0) {
                            this.prefixedLogger.debug(
                                "Sharing keys (start phase 2) with devices without existing Olm sessions:",
                                retryDeviceList,
                            );
                            await this.shareKeyWithDevices(session, key, payload, retryDevices, failedDevices, 30000);
                            this.prefixedLogger.debug(
                                "Shared keys (end phase 2) with devices without existing Olm sessions",
                            );
                        }

                        await this.notifyFailedOlmDevices(session, key, failedDevices);
                    })();
                } else {
                    await this.notifyFailedOlmDevices(session, key, errorDevices);
                }
            })(),
            (async (): Promise<void> => {
                this.prefixedLogger.debug(
                    `There are ${blocked.size} blocked devices:`,
                    Array.from(blocked.entries())
                        .map(([userId, blockedByUser]) =>
                            Array.from(blockedByUser.entries()).map(
                                ([deviceId, _deviceInfo]) => `${userId}/${deviceId}`,
                            ),
                        )
                        .flat(1),
                );

                // also, notify newly blocked devices that they're blocked
                const blockedMap: MapWithDefault<string, Map<string, { device: IBlockedDevice }>> = new MapWithDefault(
                    () => new Map(),
                );
                let blockedCount = 0;
                for (const [userId, userBlockedDevices] of blocked) {
                    for (const [deviceId, device] of userBlockedDevices) {
                        if (session.blockedDevicesNotified.get(userId)?.get(deviceId) === undefined) {
                            blockedMap.getOrCreate(userId).set(deviceId, { device });
                            blockedCount++;
                        }
                    }
                }

                if (blockedCount) {
                    this.prefixedLogger.debug(
                        `Notifying ${blockedCount} newly blocked devices:`,
                        Array.from(blockedMap.entries())
                            .map(([userId, blockedByUser]) =>
                                Object.entries(blockedByUser).map(([deviceId, _deviceInfo]) => `${userId}/${deviceId}`),
                            )
                            .flat(1),
                    );
                    await this.notifyBlockedDevices(session, blockedMap);
                    this.prefixedLogger.debug(`Notified ${blockedCount} newly blocked devices`);
                }
            })(),
        ]);
    }

    /**
     * @internal
     *
     *
     * @returns session
     */
    private async prepareNewSession(sharedHistory: boolean): Promise<OutboundSessionInfo> {
        const sessionId = this.olmDevice.createOutboundGroupSession();
        const key = this.olmDevice.getOutboundGroupSessionKey(sessionId);

        await this.olmDevice.addInboundGroupSession(
            this.roomId,
            this.olmDevice.deviceCurve25519Key!,
            [],
            sessionId,
            key.key,
            { ed25519: this.olmDevice.deviceEd25519Key! },
            false,
            { sharedHistory },
        );

        // don't wait for it to complete
        this.crypto.backupManager.backupGroupSession(this.olmDevice.deviceCurve25519Key!, sessionId);

        return new OutboundSessionInfo(sessionId, sharedHistory);
    }

    /**
     * Determines what devices in devicesByUser don't have an olm session as given
     * in devicemap.
     *
     * @internal
     *
     * @param deviceMap - the devices that have olm sessions, as returned by
     *     olmlib.ensureOlmSessionsForDevices.
     * @param devicesByUser - a map of user IDs to array of deviceInfo
     * @param noOlmDevices - an array to fill with devices that don't have
     *     olm sessions
     *
     * @returns an array of devices that don't have olm sessions.  If
     *     noOlmDevices is specified, then noOlmDevices will be returned.
     */
    private getDevicesWithoutSessions(
        deviceMap: Map<string, Map<string, IOlmSessionResult>>,
        devicesByUser: Map<string, DeviceInfo[]>,
        noOlmDevices: IOlmDevice[] = [],
    ): IOlmDevice[] {
        for (const [userId, devicesToShareWith] of devicesByUser) {
            const sessionResults = deviceMap.get(userId);

            for (const deviceInfo of devicesToShareWith) {
                const deviceId = deviceInfo.deviceId;

                const sessionResult = sessionResults?.get(deviceId);
                if (!sessionResult?.sessionId) {
                    // no session with this device, probably because there
                    // were no one-time keys.

                    noOlmDevices.push({ userId, deviceInfo });
                    sessionResults?.delete(deviceId);

                    // ensureOlmSessionsForUsers has already done the logging,
                    // so just skip it.
                    continue;
                }
            }
        }

        return noOlmDevices;
    }

    /**
     * Splits the user device map into multiple chunks to reduce the number of
     * devices we encrypt to per API call.
     *
     * @internal
     *
     * @param devicesByUser - map from userid to list of devices
     *
     * @returns the blocked devices, split into chunks
     */
    private splitDevices<T extends DeviceInfo | IBlockedDevice>(
        devicesByUser: Map<string, Map<string, { device: T }>>,
    ): IOlmDevice<T>[][] {
        const maxDevicesPerRequest = 20;

        // use an array where the slices of a content map gets stored
        let currentSlice: IOlmDevice<T>[] = [];
        const mapSlices = [currentSlice];

        for (const [userId, userDevices] of devicesByUser) {
            for (const deviceInfo of userDevices.values()) {
                currentSlice.push({
                    userId: userId,
                    deviceInfo: deviceInfo.device,
                });
            }

            // We do this in the per-user loop as we prefer that all messages to the
            // same user end up in the same API call to make it easier for the
            // server (e.g. only have to send one EDU if a remote user, etc). This
            // does mean that if a user has many devices we may go over the desired
            // limit, but its not a hard limit so that is fine.
            if (currentSlice.length > maxDevicesPerRequest) {
                // the current slice is filled up. Start inserting into the next slice
                currentSlice = [];
                mapSlices.push(currentSlice);
            }
        }
        if (currentSlice.length === 0) {
            mapSlices.pop();
        }
        return mapSlices;
    }

    /**
     * @internal
     *
     *
     * @param chainIndex - current chain index
     *
     * @param userDeviceMap - mapping from userId to deviceInfo
     *
     * @param payload - fields to include in the encrypted payload
     *
     * @returns Promise which resolves once the key sharing
     *     for the given userDeviceMap is generated and has been sent.
     */
    private encryptAndSendKeysToDevices(
        session: OutboundSessionInfo,
        chainIndex: number,
        devices: IOlmDevice[],
        payload: IPayload,
    ): Promise<void> {
        return this.crypto
            .encryptAndSendToDevices(devices, payload)
            .then(() => {
                // store that we successfully uploaded the keys of the current slice
                for (const device of devices) {
                    session.markSharedWithDevice(
                        device.userId,
                        device.deviceInfo.deviceId,
                        device.deviceInfo.getIdentityKey(),
                        chainIndex,
                    );
                }
            })
            .catch((error) => {
                this.prefixedLogger.error("failed to encryptAndSendToDevices", error);
                throw error;
            });
    }

    /**
     * @internal
     *
     *
     * @param userDeviceMap - list of blocked devices to notify
     *
     * @param payload - fields to include in the notification payload
     *
     * @returns Promise which resolves once the notifications
     *     for the given userDeviceMap is generated and has been sent.
     */
    private async sendBlockedNotificationsToDevices(
        session: OutboundSessionInfo,
        userDeviceMap: IOlmDevice<IBlockedDevice>[],
        payload: IPayload,
    ): Promise<void> {
        const contentMap: MapWithDefault<string, Map<string, IPayload>> = new MapWithDefault(() => new Map());

        for (const val of userDeviceMap) {
            const userId = val.userId;
            const blockedInfo = val.deviceInfo;
            const deviceInfo = blockedInfo.deviceInfo;
            const deviceId = deviceInfo.deviceId;

            const message = {
                ...payload,
                code: blockedInfo.code,
                reason: blockedInfo.reason,
                [ToDeviceMessageId]: uuidv4(),
            };

            if (message.code === "m.no_olm") {
                delete message.room_id;
                delete message.session_id;
            }

            contentMap.getOrCreate(userId).set(deviceId, message);
        }

        await this.baseApis.sendToDevice("m.room_key.withheld", contentMap);

        // record the fact that we notified these blocked devices
        for (const [userId, userDeviceMap] of contentMap) {
            for (const deviceId of userDeviceMap.keys()) {
                session.markNotifiedBlockedDevice(userId, deviceId);
            }
        }
    }

    /**
     * Re-shares a megolm session key with devices if the key has already been
     * sent to them.
     *
     * @param senderKey - The key of the originating device for the session
     * @param sessionId - ID of the outbound session to share
     * @param userId - ID of the user who owns the target device
     * @param device - The target device
     */
    public async reshareKeyWithDevice(
        senderKey: string,
        sessionId: string,
        userId: string,
        device: DeviceInfo,
    ): Promise<void> {
        const obSessionInfo = this.outboundSessions[sessionId];
        if (!obSessionInfo) {
            this.prefixedLogger.debug(`megolm session ${senderKey}|${sessionId} not found: not re-sharing keys`);
            return;
        }

        // The chain index of the key we previously sent this device
        if (!obSessionInfo.sharedWithDevices.has(userId)) {
            this.prefixedLogger.debug(`megolm session ${senderKey}|${sessionId} never shared with user ${userId}`);
            return;
        }
        const sessionSharedData = obSessionInfo.sharedWithDevices.get(userId)?.get(device.deviceId);
        if (sessionSharedData === undefined) {
            this.prefixedLogger.debug(
                `megolm session ${senderKey}|${sessionId} never shared with device ${userId}:${device.deviceId}`,
            );
            return;
        }

        if (sessionSharedData.deviceKey !== device.getIdentityKey()) {
            this.prefixedLogger.warn(
                `Megolm session ${senderKey}|${sessionId} has been shared with device ${device.deviceId} but ` +
                    `with identity key ${sessionSharedData.deviceKey}. Key is now ${device.getIdentityKey()}!`,
            );
            return;
        }

        // get the key from the inbound session: the outbound one will already
        // have been ratcheted to the next chain index.
        const key = await this.olmDevice.getInboundGroupSessionKey(
            this.roomId,
            senderKey,
            sessionId,
            sessionSharedData.messageIndex,
        );

        if (!key) {
            this.prefixedLogger.warn(
                `No inbound session key found for megolm session ${senderKey}|${sessionId}: not re-sharing keys`,
            );
            return;
        }

        await olmlib.ensureOlmSessionsForDevices(this.olmDevice, this.baseApis, new Map([[userId, [device]]]));

        const payload = {
            type: "m.forwarded_room_key",
            content: {
                "algorithm": olmlib.MEGOLM_ALGORITHM,
                "room_id": this.roomId,
                "session_id": sessionId,
                "session_key": key.key,
                "chain_index": key.chain_index,
                "sender_key": senderKey,
                "sender_claimed_ed25519_key": key.sender_claimed_ed25519_key,
                "forwarding_curve25519_key_chain": key.forwarding_curve25519_key_chain,
                "org.matrix.msc3061.shared_history": key.shared_history || false,
            },
        };

        const encryptedContent: IEncryptedContent = {
            algorithm: olmlib.OLM_ALGORITHM,
            sender_key: this.olmDevice.deviceCurve25519Key!,
            ciphertext: {},
            [ToDeviceMessageId]: uuidv4(),
        };
        await olmlib.encryptMessageForDevice(
            encryptedContent.ciphertext,
            this.userId,
            this.deviceId,
            this.olmDevice,
            userId,
            device,
            payload,
        );

        await this.baseApis.sendToDevice(
            "m.room.encrypted",
            new Map([[userId, new Map([[device.deviceId, encryptedContent]])]]),
        );
        this.prefixedLogger.debug(
            `Re-shared key for megolm session ${senderKey}|${sessionId} with ${userId}:${device.deviceId}`,
        );
    }

    /**
     * @internal
     *
     *
     * @param key - the session key as returned by
     *    OlmDevice.getOutboundGroupSessionKey
     *
     * @param payload - the base to-device message payload for sharing keys
     *
     * @param devicesByUser - map from userid to list of devices
     *
     * @param errorDevices - array that will be populated with the devices that we can't get an
     *    olm session for
     *
     * @param otkTimeout - The timeout in milliseconds when requesting
     *     one-time keys for establishing new olm sessions.
     *
     * @param failedServers - An array to fill with remote servers that
     *     failed to respond to one-time-key requests.
     */
    private async shareKeyWithDevices(
        session: OutboundSessionInfo,
        key: IOutboundGroupSessionKey,
        payload: IPayload,
        devicesByUser: Map<string, DeviceInfo[]>,
        errorDevices: IOlmDevice[],
        otkTimeout: number,
        failedServers?: string[],
    ): Promise<void> {
        const devicemap = await olmlib.ensureOlmSessionsForDevices(
            this.olmDevice,
            this.baseApis,
            devicesByUser,
            false,
            otkTimeout,
            failedServers,
            this.prefixedLogger,
        );
        this.getDevicesWithoutSessions(devicemap, devicesByUser, errorDevices);
        await this.shareKeyWithOlmSessions(session, key, payload, devicemap);
    }

    private async shareKeyWithOlmSessions(
        session: OutboundSessionInfo,
        key: IOutboundGroupSessionKey,
        payload: IPayload,
        deviceMap: Map<string, Map<string, IOlmSessionResult>>,
    ): Promise<void> {
        const userDeviceMaps = this.splitDevices(deviceMap);

        for (let i = 0; i < userDeviceMaps.length; i++) {
            const taskDetail = `megolm keys for ${session.sessionId} (slice ${i + 1}/${userDeviceMaps.length})`;
            try {
                this.prefixedLogger.debug(
                    `Sharing ${taskDetail}`,
                    userDeviceMaps[i].map((d) => `${d.userId}/${d.deviceInfo.deviceId}`),
                );
                await this.encryptAndSendKeysToDevices(session, key.chain_index, userDeviceMaps[i], payload);
                this.prefixedLogger.debug(`Shared ${taskDetail}`);
            } catch (e) {
                this.prefixedLogger.error(`Failed to share ${taskDetail}`);
                throw e;
            }
        }
    }

    /**
     * Notify devices that we weren't able to create olm sessions.
     *
     *
     *
     * @param failedDevices - the devices that we were unable to
     *     create olm sessions for, as returned by shareKeyWithDevices
     */
    private async notifyFailedOlmDevices(
        session: OutboundSessionInfo,
        key: IOutboundGroupSessionKey,
        failedDevices: IOlmDevice[],
    ): Promise<void> {
        this.prefixedLogger.debug(`Notifying ${failedDevices.length} devices we failed to create Olm sessions`);

        // mark the devices that failed as "handled" because we don't want to try
        // to claim a one-time-key for dead devices on every message.
        for (const { userId, deviceInfo } of failedDevices) {
            const deviceId = deviceInfo.deviceId;

            session.markSharedWithDevice(userId, deviceId, deviceInfo.getIdentityKey(), key.chain_index);
        }

        const unnotifiedFailedDevices = await this.olmDevice.filterOutNotifiedErrorDevices(failedDevices);
        this.prefixedLogger.debug(
            `Need to notify ${unnotifiedFailedDevices.length} failed devices which haven't been notified before`,
        );
        const blockedMap: MapWithDefault<string, Map<string, { device: IBlockedDevice }>> = new MapWithDefault(
            () => new Map(),
        );
        for (const { userId, deviceInfo } of unnotifiedFailedDevices) {
            // we use a similar format to what
            // olmlib.ensureOlmSessionsForDevices returns, so that
            // we can use the same function to split
            blockedMap.getOrCreate(userId).set(deviceInfo.deviceId, {
                device: {
                    code: "m.no_olm",
                    reason: WITHHELD_MESSAGES["m.no_olm"],
                    deviceInfo,
                },
            });
        }

        // send the notifications
        await this.notifyBlockedDevices(session, blockedMap);
        this.prefixedLogger.debug(
            `Notified ${unnotifiedFailedDevices.length} devices we failed to create Olm sessions`,
        );
    }

    /**
     * Notify blocked devices that they have been blocked.
     *
     *
     * @param devicesByUser - map from userid to device ID to blocked data
     */
    private async notifyBlockedDevices(
        session: OutboundSessionInfo,
        devicesByUser: Map<string, Map<string, { device: IBlockedDevice }>>,
    ): Promise<void> {
        const payload: IPayload = {
            room_id: this.roomId,
            session_id: session.sessionId,
            algorithm: olmlib.MEGOLM_ALGORITHM,
            sender_key: this.olmDevice.deviceCurve25519Key!,
        };

        const userDeviceMaps = this.splitDevices(devicesByUser);

        for (let i = 0; i < userDeviceMaps.length; i++) {
            try {
                await this.sendBlockedNotificationsToDevices(session, userDeviceMaps[i], payload);
                this.prefixedLogger.debug(
                    `Completed blacklist notification for ${session.sessionId} ` +
                        `(slice ${i + 1}/${userDeviceMaps.length})`,
                );
            } catch (e) {
                this.prefixedLogger.debug(
                    `blacklist notification for ${session.sessionId} ` +
                        `(slice ${i + 1}/${userDeviceMaps.length}) failed`,
                );

                throw e;
            }
        }
    }

    /**
     * Perform any background tasks that can be done before a message is ready to
     * send, in order to speed up sending of the message.
     *
     * @param room - the room the event is in
     * @returns A function that, when called, will stop the preparation
     */
    public prepareToEncrypt(room: Room): () => void {
        if (room.roomId !== this.roomId) {
            throw new Error("MegolmEncryption.prepareToEncrypt called on unexpected room");
        }

        if (this.encryptionPreparation != null) {
            // We're already preparing something, so don't do anything else.
            const elapsedTime = Date.now() - this.encryptionPreparation.startTime;
            this.prefixedLogger.debug(
                `Already started preparing to encrypt for this room ${elapsedTime}ms ago, skipping`,
            );
            return this.encryptionPreparation.cancel;
        }

        this.prefixedLogger.debug("Preparing to encrypt events");

        let cancelled = false;
        const isCancelled = (): boolean => cancelled;

        this.encryptionPreparation = {
            startTime: Date.now(),
            promise: (async (): Promise<void> => {
                try {
                    // Attempt to enumerate the devices in room, and gracefully
                    // handle cancellation if it occurs.
                    const getDevicesResult = await this.getDevicesInRoom(room, false, isCancelled);
                    if (getDevicesResult === null) return;
                    const [devicesInRoom, blocked] = getDevicesResult;

                    if (this.crypto.globalErrorOnUnknownDevices) {
                        // Drop unknown devices for now.  When the message gets sent, we'll
                        // throw an error, but we'll still be prepared to send to the known
                        // devices.
                        this.removeUnknownDevices(devicesInRoom);
                    }

                    this.prefixedLogger.debug("Ensuring outbound megolm session");
                    await this.ensureOutboundSession(room, devicesInRoom, blocked, true);

                    this.prefixedLogger.debug("Ready to encrypt events");
                } catch (e) {
                    this.prefixedLogger.error("Failed to prepare to encrypt events", e);
                } finally {
                    delete this.encryptionPreparation;
                }
            })(),

            cancel: (): void => {
                // The caller has indicated that the process should be cancelled,
                // so tell the promise that we'd like to halt, and reset the preparation state.
                cancelled = true;
                delete this.encryptionPreparation;
            },
        };

        return this.encryptionPreparation.cancel;
    }

    /**
     * @param content - plaintext event content
     *
     * @returns Promise which resolves to the new event body
     */
    public async encryptMessage(room: Room, eventType: string, content: IContent): Promise<IMegolmEncryptedContent> {
        this.prefixedLogger.debug("Starting to encrypt event");

        if (this.encryptionPreparation != null) {
            // If we started sending keys, wait for it to be done.
            // FIXME: check if we need to cancel
            // (https://github.com/matrix-org/matrix-js-sdk/issues/1255)
            try {
                await this.encryptionPreparation.promise;
            } catch (e) {
                // ignore any errors -- if the preparation failed, we'll just
                // restart everything here
            }
        }

        /**
         * When using in-room messages and the room has encryption enabled,
         * clients should ensure that encryption does not hinder the verification.
         */
        const forceDistributeToUnverified = this.isVerificationEvent(eventType, content);
        const [devicesInRoom, blocked] = await this.getDevicesInRoom(room, forceDistributeToUnverified);

        // check if any of these devices are not yet known to the user.
        // if so, warn the user so they can verify or ignore.
        if (this.crypto.globalErrorOnUnknownDevices) {
            this.checkForUnknownDevices(devicesInRoom);
        }

        const session = await this.ensureOutboundSession(room, devicesInRoom, blocked);
        const payloadJson = {
            room_id: this.roomId,
            type: eventType,
            content: content,
        };

        const ciphertext = this.olmDevice.encryptGroupMessage(session.sessionId, JSON.stringify(payloadJson));
        const encryptedContent: IEncryptedContent = {
            algorithm: olmlib.MEGOLM_ALGORITHM,
            sender_key: this.olmDevice.deviceCurve25519Key!,
            ciphertext: ciphertext,
            session_id: session.sessionId,
            // Include our device ID so that recipients can send us a
            // m.new_device message if they don't have our session key.
            // XXX: Do we still need this now that m.new_device messages
            // no longer exist since #483?
            device_id: this.deviceId,
        };

        session.useCount++;
        return encryptedContent;
    }

    private isVerificationEvent(eventType: string, content: IContent): boolean {
        switch (eventType) {
            case EventType.KeyVerificationCancel:
            case EventType.KeyVerificationDone:
            case EventType.KeyVerificationMac:
            case EventType.KeyVerificationStart:
            case EventType.KeyVerificationKey:
            case EventType.KeyVerificationReady:
            case EventType.KeyVerificationAccept: {
                return true;
            }
            case EventType.RoomMessage: {
                return content["msgtype"] === MsgType.KeyVerificationRequest;
            }
            default: {
                return false;
            }
        }
    }

    /**
     * Forces the current outbound group session to be discarded such
     * that another one will be created next time an event is sent.
     *
     * This should not normally be necessary.
     */
    public forceDiscardSession(): void {
        this.setupPromise = this.setupPromise.then(() => null);
    }

    /**
     * Checks the devices we're about to send to and see if any are entirely
     * unknown to the user.  If so, warn the user, and mark them as known to
     * give the user a chance to go verify them before re-sending this message.
     *
     * @param devicesInRoom - `userId -> {deviceId -> object}`
     *   devices we should shared the session with.
     */
    private checkForUnknownDevices(devicesInRoom: DeviceInfoMap): void {
        const unknownDevices: MapWithDefault<string, Map<string, DeviceInfo>> = new MapWithDefault(() => new Map());

        for (const [userId, userDevices] of devicesInRoom) {
            for (const [deviceId, device] of userDevices) {
                if (device.isUnverified() && !device.isKnown()) {
                    unknownDevices.getOrCreate(userId).set(deviceId, device);
                }
            }
        }

        if (unknownDevices.size) {
            // it'd be kind to pass unknownDevices up to the user in this error
            throw new UnknownDeviceError(
                "This room contains unknown devices which have not been verified. " +
                    "We strongly recommend you verify them before continuing.",
                unknownDevices,
            );
        }
    }

    /**
     * Remove unknown devices from a set of devices.  The devicesInRoom parameter
     * will be modified.
     *
     * @param devicesInRoom - `userId -> {deviceId -> object}`
     *   devices we should shared the session with.
     */
    private removeUnknownDevices(devicesInRoom: DeviceInfoMap): void {
        for (const [userId, userDevices] of devicesInRoom) {
            for (const [deviceId, device] of userDevices) {
                if (device.isUnverified() && !device.isKnown()) {
                    userDevices.delete(deviceId);
                }
            }

            if (userDevices.size === 0) {
                devicesInRoom.delete(userId);
            }
        }
    }

    /**
     * Get the list of unblocked devices for all users in the room
     *
     * @param forceDistributeToUnverified - if set to true will include the unverified devices
     * even if setting is set to block them (useful for verification)
     * @param isCancelled - will cause the procedure to abort early if and when it starts
     * returning `true`. If omitted, cancellation won't happen.
     *
     * @returns Promise which resolves to `null`, or an array whose
     *     first element is a {@link DeviceInfoMap} indicating
     *     the devices that messages should be encrypted to, and whose second
     *     element is a map from userId to deviceId to data indicating the devices
     *     that are in the room but that have been blocked.
     *     If `isCancelled` is provided and returns `true` while processing, `null`
     *     will be returned.
     *     If `isCancelled` is not provided, the Promise will never resolve to `null`.
     */
    private async getDevicesInRoom(
        room: Room,
        forceDistributeToUnverified?: boolean,
    ): Promise<[DeviceInfoMap, BlockedMap]>;
    private async getDevicesInRoom(
        room: Room,
        forceDistributeToUnverified?: boolean,
        isCancelled?: () => boolean,
    ): Promise<null | [DeviceInfoMap, BlockedMap]>;
    private async getDevicesInRoom(
        room: Room,
        forceDistributeToUnverified = false,
        isCancelled?: () => boolean,
    ): Promise<null | [DeviceInfoMap, BlockedMap]> {
        const members = await room.getEncryptionTargetMembers();
        this.prefixedLogger.debug(
            `Encrypting for users (shouldEncryptForInvitedMembers: ${room.shouldEncryptForInvitedMembers()}):`,
            members.map((u) => `${u.userId} (${u.membership})`),
        );

        const roomMembers = members.map(function (u) {
            return u.userId;
        });

        // The global value is treated as a default for when rooms don't specify a value.
        let isBlacklisting = this.crypto.globalBlacklistUnverifiedDevices;
        const isRoomBlacklisting = room.getBlacklistUnverifiedDevices();
        if (typeof isRoomBlacklisting === "boolean") {
            isBlacklisting = isRoomBlacklisting;
        }

        // We are happy to use a cached version here: we assume that if we already
        // have a list of the user's devices, then we already share an e2e room
        // with them, which means that they will have announced any new devices via
        // device_lists in their /sync response.  This cache should then be maintained
        // using all the device_lists changes and left fields.
        // See https://github.com/vector-im/element-web/issues/2305 for details.
        const devices = await this.crypto.downloadKeys(roomMembers, false);

        if (isCancelled?.() === true) {
            return null;
        }

        const blocked = new MapWithDefault<string, Map<string, IBlockedDevice>>(() => new Map());
        // remove any blocked devices
        for (const [userId, userDevices] of devices) {
            for (const [deviceId, userDe