feat(ffi): Allow passing in a SecretsBundle after logging in by poljar · Pull Request #6212 · matrix-org/matrix-rust-sdk

poljar · 2026-02-25T13:22:18Z

This PR allows people to get a secrets bundle out of band and import it after logging in a new client.

Mainly targeted to support the Element Classic -> Element X migration.

This closes #6087.

I've documented the public API Changes in the appropriate CHANGELOG.md files.
I've read the CONTRIBUTING.md file, notably the sections about Pull requests, Commit message format, and AI policy.
This PR was made with the help of AI.

codspeed-hq · 2026-02-25T13:46:01Z

Merging this PR will not alter performance

✅ 50 untouched benchmarks

_{Comparing poljar/login/secret-bundle-import (0ec9338) with main (a65fec3)}

bmarty · 2026-02-25T14:26:14Z

Hello, thanks, I am testing the updated API using EXA.

poljar · 2026-02-25T14:31:59Z

Hello, thanks, I am testing the updated API using EXA.

Ah, thanks for testing.

bmarty · 2026-02-25T14:33:48Z

bindings/matrix-sdk-ffi/src/client.rs

+}
+
+impl SecretsBundle {
+    pub fn bundle_from_str(bundle: &str) -> Result<Arc<Self>, ClientError> {


it looks like the method bundle_from_str is not exposed in the FFI layer, can you double check @poljar ? Thanks! An alternative would be that the secrets parameter added to login_with_oidc_callback and login would be of type optional String.

Whoops, that's true.

An alternative would be that the secrets parameter added to login_with_oidc_callback and login would be of type optional String.

That would complicate things for the codepath where we want to get the secrets bundle from a database.

I exported the methods now.

bindings/matrix-sdk-ffi/src/client.rs

codecov · 2026-02-25T15:28:01Z

Codecov Report

❌ Patch coverage is 35.48387% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.85%. Comparing base (eb51c86) to head (0ec9338).
⚠️ Report is 12 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
crates/matrix-sdk/src/encryption/mod.rs	34.48%	16 Missing and 3 partials ⚠️
...atrix-sdk/src/authentication/oauth/qrcode/login.rs	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6212   +/-   ##
=======================================
  Coverage   89.84%   89.85%           
=======================================
  Files         378      378           
  Lines      103339   103366   +27     
  Branches   103339   103366   +27     
=======================================
+ Hits        92847    92879   +32     
- Misses       6915     6918    +3     
+ Partials     3577     3569    -8

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

bmarty · 2026-02-25T16:13:58Z

I am providing the secrets to the function with oidc, and at the end the session is not verified. I believe that this is supposed to be the case? Happy to provide some logs if it helps.

poljar · 2026-02-26T08:52:02Z

I am providing the secrets to the function with oidc, and at the end the session is not verified. I believe that this is supposed to be the case? Happy to provide some logs if it helps.

Hmm, I read through the code again, it should give you a verified device in the end.

If it's not too much trouble logs could help, though I think I'll need to make an integration test for this and move the logic into the SDK.

poljar · 2026-02-26T09:15:13Z

Oh wait, I did another mistake. Did you perhaps test this with an OIDC login?

If so I forgot to connect things for the OIDC login.

bmarty · 2026-02-26T09:23:03Z

Did you perhaps test this with an OIDC login?

Yes

poljar · 2026-02-26T09:39:41Z

Did you perhaps test this with an OIDC login?

Yes

Ok, my bad: 44a92c3 fixes this for the OIDC login.

bindings/matrix-sdk-ffi/src/client.rs

bmarty · 2026-02-26T10:50:57Z

Thanks @poljar, I confirm that the session is now verified when using MAS!

bmarty · 2026-02-26T15:46:01Z

bindings/matrix-sdk-ffi/src/client.rs

+            Err(ClientError::Generic {
+                msg: "Secrets bundle does not belong to the user which was logged in".to_owned(),
+                details: None,
+            })


IMO the SDK should not throw anything but just ignore the provided secrets if the userId does not match, so the application can just continue with the "manual" verification step. Do you agree?

CC @pixlwave

Personally I think I'd rather split this API into 2 calls if it doesn't throw.

client.login() client.importSecrets()

That way a client can tell whether or not that operation was successful or not and decide to act accordingly.

Or specifically make it throw some kind of ClientError::Secrets { msg } so that this specific error can be handled differently. It would be nice to start moving away from ClientError::Generic everywhere anyway 😇

That way a client can tell whether or not that operation was successful or not and decide to act accordingly.

We can do this, but you have to promise me to call this before you start a sync.

Or specifically make it throw some kind of ClientError::Secrets { msg } so that this specific error can be handled differently. It would be nice to start moving away from ClientError::Generic everywhere anyway 😇

Yeah, I skipped adding more specific errors for now, but we can obviously add them.

Let me know which way you prefer.

We can do this, but you have to promise me to call this before you start a sync.

I don't think it's even possible for us to start a sync at this stage in the flow anyway but, just in case…

Let me know which way you prefer.

Personally I think 2 calls makes more sense but I'm happy either way. Any preference @bmarty?

Alright, let's go with two separate calls then.

Maybe the login function (and the other of the same vein) can return an object which has an importSecrets method?

Maybe the login function (and the other of the same vein) can return an object which has an importSecrets method?

Hmm, that would again result in a breaking change and complicate the interface compared to the added error variant and argument.

(maybe just ignore my last comment)
With the double API approach, I guess the application can also check the userId, after the login call, and before providing the secret, using client.session().userId, so it's good.

I would leave the user ID check on the Rust side, so people don't forget about it.

poljar · 2026-03-11T14:26:43Z

The complement-crypto failure is due to mozilla/uniffi-rs#2775.

Other than that, this should now work for iOS as well. It should also have the two step interface people were requesting.

Still needs some tests before this is ready for review.

bmarty · 2026-03-11T16:23:39Z

Thanks, I can test the new API. Can I ask you to update the branch regarding develop, so that I will not have too many API breaks to manage?

poljar · 2026-03-11T16:37:01Z

Thanks, I can test the new API. Can I ask you to update the branch regarding develop, so that I will not have too many API breaks to manage?

Ah, you mean rebase on top of main? Sure, can do that.

poljar · 2026-03-11T16:59:34Z

Rebased now.

pixlwave · 2026-03-11T18:39:21Z

Thank you! Although unfortunately I bring bad news: It doesn't compile yet on iOS as both the generated matrix_sdk_crypto.swift and matrix_sdk_ffi.swift have a SecretsBundle (and SecretsBundleProtocol) definition so they conflict.

bmarty · 2026-03-12T06:43:51Z

I have no conflict on building the Android sdk, probably because SecretsBundle declaration are in 2 different package, but it seems that the method import_secrets_bundle is not exposed through the FFI layer, so the application cannot access it. I'll double check on my side.

EDIT: OK, my bad, I need to call client.encryption().importSecretsBundle now.

bindings/matrix-sdk-ffi/src/encryption.rs

bmarty · 2026-03-12T09:11:32Z

Tested on Android using b7e7412 and it's working as expected 🎉

poljar · 2026-03-12T11:37:19Z

Thank you! Although unfortunately I bring bad news: It doesn't compile yet on iOS as both the generated matrix_sdk_crypto.swift and matrix_sdk_ffi.swift have a SecretsBundle (and SecretsBundleProtocol) definition so they conflict.

Annoying, but ok, I renamed one of the types.

poljar · 2026-03-20T14:32:18Z

I added a method which allows you to check if the bundle contains the backup key as well, as this is the only optional secret in the bundle.

As for the complement-crypto problem, I opened matrix-org/complement-crypto#233 to get complement-crypto on the same uniffi version as the SDK uses.

Co-authored-by: Benoit Marty <benoitm@matrix.org> Signed-off-by: Damir Jelić <poljar@termina.org.uk>

This allows us to double check if the right user got logged in.

Since we already export a type with the same name and technically this type contains more than just the bundle.

Co-authored-by: Benoit Marty <benoitm@matrix.org> Signed-off-by: Damir Jelić <poljar@termina.org.uk>

… aren't enabled

…ets bundle

…ting a secrets bundle

poljar mentioned this pull request Feb 25, 2026

Let the application be able to login using a matrix id and secrets #6087

Open

bmarty reviewed Feb 25, 2026

View reviewed changes

poljar force-pushed the poljar/login/secret-bundle-import branch from 0f34947 to f75470e Compare February 25, 2026 15:08

bmarty reviewed Feb 25, 2026

View reviewed changes

bindings/matrix-sdk-ffi/src/client.rs Outdated Show resolved Hide resolved

pixlwave reviewed Feb 26, 2026

View reviewed changes

bindings/matrix-sdk-ffi/src/client.rs Outdated Show resolved Hide resolved

bmarty reviewed Feb 26, 2026

View reviewed changes

poljar force-pushed the poljar/login/secret-bundle-import branch from 5150bda to bef186d Compare February 27, 2026 13:53

poljar changed the title ~~feat(ffi): Allow passing in a SecretsBundle while logging in~~ feat(ffi): Allow passing in a SecretsBundle after logging in Mar 11, 2026

poljar force-pushed the poljar/login/secret-bundle-import branch from 36750c9 to b7e7412 Compare March 11, 2026 16:59

bmarty reviewed Mar 12, 2026

View reviewed changes

bindings/matrix-sdk-ffi/src/encryption.rs Outdated Show resolved Hide resolved

mgoldenberg mentioned this pull request Mar 13, 2026

Unable to restore a session or log in to a session on matrix.org #6279

Closed

poljar and others added 10 commits April 1, 2026 14:35

feat(ffi): Allow passing in a SecretsBundle while logging in

8d87d4e

Update bindings/matrix-sdk-ffi/src/client.rs

b099958

Co-authored-by: Benoit Marty <benoitm@matrix.org> Signed-off-by: Damir Jelić <poljar@termina.org.uk>

fix(bindings): Import the bundle in the OIDC login case as well

3fd92cc

feat(ffi): Include the user ID in the secrets bundle

c052009

This allows us to double check if the right user got logged in.

Improve the secret import/export interface

f71e328

chore(ffi): Rename the SecretsBundle

a31cb26

Since we already export a type with the same name and technically this type contains more than just the bundle.

Update bindings/matrix-sdk-ffi/src/encryption.rs

0dd1dcb

Co-authored-by: Benoit Marty <benoitm@matrix.org> Signed-off-by: Damir Jelić <poljar@termina.org.uk>

fix: Attempt to enable backups if we import a secrets bundle and they…

9aed1cd

… aren't enabled

test: Add an integration test for the secret import support

66c79ac

feat(ffi): Add a method to check if the backup key is inside the secr…

d039dad

…ets bundle

poljar force-pushed the poljar/login/secret-bundle-import branch from b00b3e4 to d039dad Compare April 1, 2026 13:01

feat(ffi): Add the ability to check if the backup is valid when expor…

0ec9338

…ting a secrets bundle

Conversation

poljar commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed-hq bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

bmarty commented Feb 25, 2026

Uh oh!

poljar commented Feb 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bmarty commented Feb 25, 2026

Uh oh!

poljar commented Feb 26, 2026

Uh oh!

poljar commented Feb 26, 2026

Uh oh!

bmarty commented Feb 26, 2026

Uh oh!

poljar commented Feb 26, 2026

Uh oh!

Uh oh!

bmarty commented Feb 26, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

poljar Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pixlwave Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

poljar commented Mar 11, 2026

Uh oh!

bmarty commented Mar 11, 2026

Uh oh!

poljar commented Mar 11, 2026

Uh oh!

poljar commented Mar 11, 2026

Uh oh!

pixlwave commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bmarty commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

bmarty commented Mar 12, 2026

Uh oh!

poljar commented Mar 12, 2026

Uh oh!

poljar commented Mar 20, 2026

Uh oh!

Reviewers

poljar commented Feb 25, 2026 •

edited

Loading

codspeed-hq bot commented Feb 25, 2026 •

edited

Loading

codecov bot commented Feb 25, 2026 •

edited

Loading

poljar Feb 27, 2026 •

edited

Loading

pixlwave Feb 27, 2026 •

edited

Loading

pixlwave commented Mar 11, 2026 •

edited

Loading

bmarty commented Mar 12, 2026 •

edited

Loading