feat: implement new keypackage api [WPB-19574]

crypto-ffi/bindings/js/src/CoreCrypto.ts

@@ -129,6 +129,11 @@ export {
     type AcmeDirectory,
     ProteusAutoPrekeyBundle,
     BufferedDecryptedMessage,
+    Keypackage,
+    KeypackageRef,
+    type KeypackageInterface,
+    type KeypackageRefInterface,
+    SignatureScheme,
 } from "./autogenerated/core_crypto_ffi";
 
 import * as core_crypto_ffi from "./autogenerated/core_crypto_ffi";

crypto-ffi/bindings/js/src/CoreCryptoContext.ts

@@ -5,7 +5,7 @@ import {
     CustomConfiguration,
     WireIdentity,
     ConversationId,
-    KeyPackage,
+    Keypackage,
     Welcome,
     type SecretKeyInterface,
     type ExternalSenderKeyInterface,
@@ -14,6 +14,8 @@ import {
     DecryptedMessage,
     type CredentialRefInterface,
     type CredentialInterface,
+    type KeypackageInterface,
+    type KeypackageRefInterface,
 } from "./autogenerated/core_crypto_ffi";
 import * as CoreCryptoFfiTypes from "./autogenerated/core_crypto_ffi";
 
@@ -280,45 +282,6 @@ export class CoreCryptoContext {
         );
     }
 
-    /**
-     *
-     * @param ciphersuite - of the KeyPackages to count
-     * @param credentialType - of the KeyPackages to count
-     * @returns The amount of valid, non-expired KeyPackages that are persisted in the backing storage
-     */
-    async clientValidKeypackagesCount(
-        ciphersuite: Ciphersuite,
-        credentialType: CredentialType
-    ): Promise<number> {
-        const kpCount = await CoreCryptoError.asyncMapErr(
-            this.#ctx.clientValidKeypackagesCount(ciphersuite, credentialType)
-        );
-        return safeBigintToNumber(kpCount);
-    }
-
-    /**
-     * Fetches a requested amount of keypackages
-     *
-     * @param ciphersuite - of the KeyPackages to generate
-     * @param credentialType - of the KeyPackages to generate
-     * @param amountRequested - The amount of keypackages requested
-     * @returns An array of length `amountRequested` containing TLS-serialized KeyPackages
-     */
-    async clientKeypackages(
-        ciphersuite: Ciphersuite,
-        credentialType: CredentialType,
-        amountRequested: number
-    ): Promise<Array<ArrayBuffer>> {
-        const kps = await CoreCryptoError.asyncMapErr(
-            this.#ctx.clientKeypackages(
-                ciphersuite,
-                credentialType,
-                amountRequested
-            )
-        );
-        return kps.map((kp) => kp.copyBytes());
-    }
-
     /**
      * Adds new clients to a conversation, assuming the current client has the right to add new clients to the conversation.
      *
@@ -333,7 +296,7 @@ export class CoreCryptoContext {
         conversationId: ConversationId,
         keyPackages: ArrayBuffer[]
     ): Promise<NewCrlDistributionPoints> {
-        const kps = keyPackages.map((bytes) => new KeyPackage(bytes));
+        const kps = keyPackages.map((bytes) => new Keypackage(bytes));
         return await CoreCryptoError.asyncMapErr(
             this.#ctx.addClientsToConversation(conversationId, kps)
         );
@@ -878,9 +841,9 @@ export class CoreCryptoContext {
      *
      * # Expected actions to perform after this function (in this order)
      * 1. Rotate credentials for each conversation using {@link CoreCryptoContext.e2eiRotate}
-     * 2. Generate new key packages with {@link CoreCryptoContext.clientKeypackages}
+     * 2. Generate new key packages with {@link CoreCryptoContext.generateKeypackage}
      * 3. Use these to replace the stale ones the in the backend
-     * 4. Delete the stale ones locally using {@link CoreCryptoContext.deleteStaleKeyPackages}
+     * 4. Delete the stale ones locally.
      *      * This is the last step because you might still need the old key packages to avoid
      *        an orphan welcome message
      *
@@ -897,17 +860,6 @@ export class CoreCryptoContext {
         );
     }
 
-    /**
-     * Deletes all key packages whose credential does not match the most recently
-     * saved x509 credential and the provided signature scheme.
-     * @param ciphersuite
-     */
-    async deleteStaleKeyPackages(ciphersuite: Ciphersuite): Promise<void> {
-        return await CoreCryptoError.asyncMapErr(
-            this.#ctx.deleteStaleKeyPackages(ciphersuite)
-        );
-    }
-
     /**
      * Allows persisting an active enrollment (for example while redirecting the user during OAuth) in order to resume
      * it later with {@link e2eiEnrollmentStashPop}
@@ -1050,4 +1002,53 @@ export class CoreCryptoContext {
             )
         );
     }
+
+    /**
+     * Generate a `KeyPackage` from the referenced credential.
+     *
+     * Makes no attempt to look up or prune existing keypackges.
+     *
+     * @param credentialRef references the credential to be used as the foundation for this keypackage
+     * @param lifetime how long this keypackage is valid for. If unset, approx 3 months. Expressed in milliseconds.
+     */
+    async generateKeypackage(
+        credentialRef: CredentialRefInterface,
+        lifetime?: number
+    ): Promise<KeypackageInterface> {
+        const mappedLifetime = lifetime !== null ? lifetime : undefined;
+        return await CoreCryptoError.asyncMapErr(
+            this.#ctx.generateKeypackage(credentialRef, mappedLifetime)
+        );
+    }
+
+    /**
+     * Get a reference to each `KeyPackage` in the database.
+     */
+    async getKeypackages(): Promise<Array<KeypackageRefInterface>> {
+        return await CoreCryptoError.asyncMapErr(this.#ctx.getKeypackages());
+    }
+
+    /**
+     * Remove a `KeyPackage` from the database.
+     *
+     * @param kpRef references the keypackage to be removed.
+     */
+    async removeKeypackage(kpRef: KeypackageRefInterface): Promise<void> {
+        return await CoreCryptoError.asyncMapErr(
+            this.#ctx.removeKeypackage(kpRef)
+        );
+    }
+
+    /**
+     * Remove all `KeyPackage`s associated with this credential ref.
+     *
+     * @param credentialRef references the credential for which all keypackages should be removed.
+     */
+    async removeKeypackagesFor(
+        credentialRef: CredentialRefInterface
+    ): Promise<void> {
+        return await CoreCryptoError.asyncMapErr(
+            this.#ctx.removeKeypackagesFor(credentialRef)
+        );
+    }
 }

crypto-ffi/bindings/js/test/bun/keyPackage.test.ts

@@ -0,0 +1,166 @@
+import { ccInit, setup, teardown } from "./utils";
+import { afterEach, test, beforeEach, describe, expect } from "bun:test";
+import { ciphersuiteDefault, ClientId } from "../../src/CoreCrypto";
+import {
+    Ciphersuite,
+    credentialBasic,
+    Keypackage,
+} from "../../src/autogenerated/core_crypto_ffi";
+
+beforeEach(async () => {
+    await setup();
+});
+
+afterEach(async () => {
+    await teardown();
+});
+
+describe("key package", () => {
+    test("can be created", async () => {
+        const clientId = new ClientId(
+            Buffer.from("any random client id here").buffer
+        );
+        const credential = credentialBasic(ciphersuiteDefault(), clientId);
+
+        const cc = await ccInit(clientId);
+
+        const credentialRef = await cc.transaction(async (ctx) => {
+            return await ctx.addCredential(credential);
+        });
+
+        const keyPackage = await cc.transaction(async (ctx) => {
+            return await ctx.generateKeypackage(credentialRef);
+        });
+
+        expect(keyPackage).toBeDefined();
+    });
+
+    test("can be serialized", async () => {
+        const clientId = new ClientId(
+            Buffer.from("any random client id here").buffer
+        );
+        const credential = credentialBasic(ciphersuiteDefault(), clientId);
+
+        const cc = await ccInit(clientId);
+
+        const credentialRef = await cc.transaction(async (ctx) => {
+            return await ctx.addCredential(credential);
+        });
+
+        const keyPackage = await cc.transaction(async (ctx) => {
+            return await ctx.generateKeypackage(credentialRef);
+        });
+
+        const bytes = new Uint8Array(keyPackage.serialize());
+
+        expect(bytes).toBeDefined();
+        expect(bytes).not.toBeEmpty();
+
+        // roundtrip
+        const kp2 = new Keypackage(bytes.buffer);
+        const bytes2 = new Uint8Array(kp2.serialize());
+
+        expect(bytes2).toEqual(bytes);
+    });
+
+    test("can be retrieved in bulk", async () => {
+        const clientId = new ClientId(
+            Buffer.from("any random client id here").buffer
+        );
+        const credential = credentialBasic(ciphersuiteDefault(), clientId);
+
+        const cc = await ccInit(clientId);
+
+        const credentialRef = await cc.transaction(async (ctx) => {
+            return await ctx.addCredential(credential);
+        });
+
+        await cc.transaction(async (ctx) => {
+            await ctx.generateKeypackage(credentialRef);
+        });
+
+        const keyPackages = await cc.transaction(async (ctx) => {
+            return await ctx.getKeypackages();
+        });
+
+        expect(keyPackages).toBeDefined();
+        expect(keyPackages).toBeArrayOfSize(1);
+        expect(keyPackages[0]).toBeDefined();
+    });
+
+    test("can be removed", async () => {
+        const clientId = new ClientId(
+            Buffer.from("any random client id here").buffer
+        );
+        const credential = credentialBasic(ciphersuiteDefault(), clientId);
+
+        const cc = await ccInit(clientId);
+
+        const credentialRef = await cc.transaction(async (ctx) => {
+            return await ctx.addCredential(credential);
+        });
+
+        // add a kp which will not be removed, so we have one left over
+        await cc.transaction(async (ctx) => {
+            await ctx.generateKeypackage(credentialRef);
+        });
+
+        // add a kp which will be removed
+        const keyPackage = await cc.transaction(async (ctx) => {
+            return await ctx.generateKeypackage(credentialRef);
+        });
+
+        // now remove the keypackage
+        await cc.transaction(async (ctx) => {
+            await ctx.removeKeypackage(keyPackage.ref());
+        });
+
+        const keyPackages = await cc.transaction(async (ctx) => {
+            return await ctx.getKeypackages();
+        });
+
+        expect(keyPackages).toBeDefined();
+        expect(keyPackages).toBeArrayOfSize(1);
+    });
+
+    test("can be removed by credentialref", async () => {
+        const clientId = new ClientId(
+            Buffer.from("any random client id here").buffer
+        );
+        const credential1 = credentialBasic(
+            Ciphersuite.Mls128Dhkemx25519Aes128gcmSha256Ed25519,
+            clientId
+        );
+        const credential2 = credentialBasic(
+            Ciphersuite.Mls128Dhkemp256Aes128gcmSha256P256,
+            clientId
+        );
+        const cc = await ccInit(clientId);
+
+        await cc.transaction(async (ctx) => {
+            const cref1 = await ctx.addCredential(credential1);
+            const cref2 = await ctx.addCredential(credential2);
+
+            // we're going to generate keypackages for both credentials,
+            // then remove those packages for credential 2, leaving behind those for credential 1
+            const KEYPACKAGES_PER_CREDENTIAL = 2;
+            for (const cref of [cref1, cref2]) {
+                for (let i = 0; i < KEYPACKAGES_PER_CREDENTIAL; i++) {
+                    await ctx.generateKeypackage(cref);
+                }
+            }
+
+            const kpsBeforeRemoval = await ctx.getKeypackages();
+            // 2 credentials with the same n keypackages each
+            expect(kpsBeforeRemoval).toBeArrayOfSize(
+                KEYPACKAGES_PER_CREDENTIAL * 2
+            );
+
+            // now remove all keypackages for one of the credentials
+            await ctx.removeKeypackagesFor(cref1);
+
+            const kps = await ctx.getKeypackages();
+            expect(kps).toBeArrayOfSize(KEYPACKAGES_PER_CREDENTIAL);
+        });
+    });
+});

crypto-ffi/bindings/js/test/bun/utils.ts

@@ -153,11 +153,15 @@ export async function invite(
     cc2: CoreCrypto,
     conversationId: ConversationId
 ): Promise<GroupInfoBundle> {
-    const [kp] = await cc2.transaction((ctx) =>
-        ctx.clientKeypackages(DEFAULT_CIPHERSUITE, CredentialType.Basic, 1)
-    );
+    const kp = await cc2.transaction(async (ctx) => {
+        const [credentialRef] = await ctx.findCredentials({
+            ciphersuite: DEFAULT_CIPHERSUITE,
+            credentialType: CredentialType.Basic,
+        });
+        return await ctx.generateKeypackage(credentialRef!);
+    });
     await cc1.transaction((ctx) =>
-        ctx.addClientsToConversation(conversationId, [kp!])
+        ctx.addClientsToConversation(conversationId, [kp.serialize()])
     );
     const { groupInfo, welcome } =
         await DELIVERY_SERVICE.getLatestCommitBundle();