Fix false positive GSE errors

Author: max-signal

SignalServiceKit/Messages/MessageSender+SenderKey.swift

@@ -70,7 +70,7 @@ extension MessageSender {
         senderCertificate: SenderCertificate,
         localIdentifiers: LocalIdentifiers,
         tx: DBWriteTransaction
-    ) -> (
+    ) throws(OWSAssertionError) -> (
         senderKeyRecipients: Set<ServiceId>,
         sendSenderKeyMessage: (@Sendable () async -> [(ServiceId, any Error)])?
     ) {
@@ -91,8 +91,7 @@ extension MessageSender {
             // them, but we MAY need any of them, so we must ensure they all exist
             // before starting. They SHOULD always exist; it's a bug if they don't.
             guard threadRecipients.allSatisfy({ endorsements.individual[$0] != nil }) else {
-                owsFailDebug("Can't use GSEs if some individual endorsements are missing.")
-                return ([], nil)
+                throw OWSAssertionError("Can't use GSEs if some individual endorsements are missing")
             }
             authBuilder = { readyRecipients in
                 var combined = endorsements.combined
@@ -108,8 +107,7 @@ extension MessageSender {
                 ).build())
             }
         } else {
-            owsFailDebug("Can't use Sender Key for a group message unless we have endorsements.")
-            return ([], nil)
+            throw OWSAssertionError("Can't use Sender Key for a group message unless we have endorsements")
         }
 
         var eligibleRecipients = Set(recipients.filter { serviceId in
@@ -218,7 +216,7 @@ extension MessageSender {
             // We should always be able to prepare SKDMs (sending them may fail though).
             // TODO: If we can't, the state is probably corrupt and should be reset.
             Logger.warn("Fanning out because we couldn't prepare SKDMs: \(error)")
-            return ([], nil)
+            throw OWSAssertionError("Fanning out because we couldn't prepare SKDMs")
         }
 
         return (

SignalServiceKit/Messages/MessageSender.swift

@@ -798,29 +798,32 @@ public class MessageSender {
 
             let senderKeyRecipients: Set<ServiceId>
             let sendViaSenderKey: (@Sendable () async -> [(ServiceId, any Error)])?
-            if recoveryState.canUseMultiRecipientSealedSender, thread.usesSenderKey {
-                (senderKeyRecipients, sendViaSenderKey) = self.prepareSenderKeyMessageSend(
-                    for: serviceIds,
-                    in: thread,
-                    message: message,
-                    serializedMessage: serializedMessage,
-                    endorsements: endorsements,
-                    udAccessMap: udAccessMap,
-                    senderCertificate: senderCertificate,
-                    localIdentifiers: localIdentifiers,
-                    tx: tx
-                )
-            } else {
-                senderKeyRecipients = []
-                sendViaSenderKey = nil
-            }
+            if thread.usesSenderKey {
+                do throws(OWSAssertionError) {
+                    guard recoveryState.canUseMultiRecipientSealedSender else {
+                        throw OWSAssertionError("Can't use Sender Key because of a prior failure.")
+                    }
+                    (senderKeyRecipients, sendViaSenderKey) = try self.prepareSenderKeyMessageSend(
+                        for: serviceIds,
+                        in: thread,
+                        message: message,
+                        serializedMessage: serializedMessage,
+                        endorsements: endorsements,
+                        udAccessMap: udAccessMap,
+                        senderCertificate: senderCertificate,
+                        localIdentifiers: localIdentifiers,
+                        tx: tx
+                    )
+                } catch {
+                    senderKeyRecipients = []
+                    sendViaSenderKey = nil
 
-            if let thread = thread as? TSGroupThread, sendViaSenderKey == nil {
-                let fullMembers = Set(thread.groupMembership.fullMembers.compactMap(\.serviceId))
-                if fullMembers.intersection(serviceIds).count >= 2 {
                     let notificationPresenter = SSKEnvironment.shared.notificationPresenterRef
-                    notificationPresenter.notifyTestPopulation(ofErrorMessage: "Couldn't send using GSEs.")
+                    notificationPresenter.notifyTestPopulation(ofErrorMessage: error.description)
                 }
+            } else {
+                senderKeyRecipients = []
+                sendViaSenderKey = nil
             }
 
             return .sendPreparedMessage(SendMessageNextAction.PreparedState(