feat: support EAR with incremental sync - WPB-17302 by David-Henner · Pull Request #4310 · wireapp/wire-ios

David-Henner · 2026-02-13T14:44:12Z

Issue

This PR add support for EAR with the incremental sync. This means we encrypt the update events when saving them in the events database, and decrypt them when fetching them for processing.

Most of the events can be accessible only when the app is unlocked. However, calling events need to be processed while in the background, so their access level is less restrictive and can be encrypted / decrypted without the app being unlocked. This is why we have primary and secondary encryption keys.

Changes

IncrementalSync

Added earService and notificationContext dependencies
~~New: waitForDatabaseUnlock() method with 3-second timeout~~
Key Flow Changes:
- If we're in foreground and database is locked, abort sync
- Fetch public / private keys before syncing
- Pass public keys when pulling events
- Pass private keys when processing stored events
- Pass backgroundAccessibleOnly to live & stored event processing

UpdateEventsLocalStore

Encryption on Write (persistEventEnvelope):
- Accepts optional publicKeys parameter
- Encrypts event data with primary or secondary key based on event type
- Sets isEncrypted and isBackgroundAccessible properties
Decryption on Read (fetchStoredEventEnvelopes):
- Accepts optional privateKeys and backgroundAccessibleOnly parameters
- Filters events based on background accessibility (for processing of calling events in NSE)
- Decrypts encrypted events with appropriate private key - primary vs secondary

Core Data

StoredUpdateEventEnvelope entity now includes:

isEncrypted: indicates if event data is encrypted
isBackgroundAccessible: indicates if the event should be accessible in the background (for calling events)

New Files Added

EAREncryptionHelper.swift - Encryption/decryption utilities for event data
ProtobufMessageDecoder.swift - Helper for decoding protobuf messages
UpdateEventEnvelope+BackgroundAccessible.swift - Extension determining if events are calling-related
DatabaseEncryptionLockNotification.swift - Notification type for database lock/unlock events (moved from sync-engine)

Testing

Log in
Go to Settings > Account > Encrypt messages at rest - enable
Background the app
Receive messages or other events
Open the app
Verify the messages / events are processed

Checklist

Title contains a reference JIRA issue number like [WPB-XXX].
Description is filled and free of optional paragraphs.
Adds/updates automated tests.

github-actions · 2026-02-17T16:03:08Z

Test Results

2 tests 2 ✅ 0s ⏱️
2 suites 0 💤
1 files 0 ❌

Results for commit e0296f0.

♻️ This comment has been updated with latest results.

Summary: workflow run #22235654623
Allure report (download zip): html-report-28050-feat_ear-with-new-sync

Copilot

Pull request overview

This pull request adds comprehensive support for Encryption at Rest (EAR) with incremental synchronization. The implementation encrypts update events when storing them in the events database and decrypts them when fetching for processing. The key innovation is using dual encryption keys (primary and secondary) to enable background processing of calling events while maintaining security for other event types.

Changes:

Core Data schema upgraded to v7.0 with isEncrypted and isBackgroundAccessible flags for event envelopes
IncrementalSync enhanced with database unlock waiting mechanism and encryption key management
UpdateEventsLocalStore modified to encrypt events on write and decrypt on read using appropriate keys
New helper files for encryption operations and protobuf message decoding
SelfPostingNotification protocol and DatabaseEncryptionLockNotification moved to WireDataModel for shared access

Reviewed changes

Copilot reviewed 39 out of 41 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
IncrementalSync.swift	Added database unlock waiting logic, key fetching, and passing encryption keys through sync pipeline
UpdateEventsLocalStore.swift	Implemented encryption on persist and decryption on fetch with primary/secondary key selection
UpdateEventEnvelope+BackgroundAccessible.swift	Logic to determine if events contain calling content for secondary key usage
EAREncryptionHelper.swift	Wrapper functions for SecKey encryption/decryption operations
ProtobufMessageDecoder.swift	Helper to decode and validate protobuf messages for event type detection
StoredUpdateEventEnvelope.swift	Added isEncrypted and isBackgroundAccessible Core Data attributes
ZMEventModel7.0	New Core Data schema version with encryption-related attributes
UpdateEventMigrator.swift	Updated to fetch and use private keys during legacy event migration
NSEClientScope.swift	Modified to fetch public keys for encrypting events pulled in NSE
Multiple test files	Updated mocks and added comprehensive tests for encryption/decryption scenarios

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

WireDomain/Sources/WireDomain/Repositories/UpdateEvents/UpdateEventsLocalStore.swift

.../Sources/WireDomain/Repositories/UpdateEvents/UpdateEventEnvelope+BackgroundAccessible.swift

wire-ios-data-model/Source/Authentication/EAR/EARPublicKeys.swift

wire-ios-data-model/Source/Authentication/EAR/EARPrivateKeys.swift

WireDomain/Sources/WireDomain/Synchronization/IncrementalSync.swift

WireDomain/Sources/WireDomain/Helpers/ProtobufMessageDecoder.swift

wire-ios-sync-engine/Source/SessionManager/UpdateEventMigrator.swift

WireDomain/Sources/WireDomain/Notifications/Components/NSEClientScope.swift

WireDomain/Sources/WireDomain/Helpers/EAREncryptionHelper.swift

netbe

left some comments, the main point I am a bit fuzzy about is when DatabaseEncryptionLockNotification is posted, and if we could use publisher instead of notification

netbe · 2026-02-17T16:05:36Z

WireDomain/Sources/WireDomain/Notifications/Components/NSEUserScope.swift

+            accountID: accountID,
+            coreDataStack: coreDataStack,
+            sharedUserDefaults: dependency.sharedUserDefaults,
+            authenticationContext: AuthenticationContext(storage: LAContextStorage())


question: isn't the LAContextStorage() requiring a biometric prompt?

it's LAContext() that does IIRC

netbe · 2026-02-17T16:07:16Z

WireDomain/Sources/WireDomain/Repositories/UpdateEvents/UpdateEventsLocalStore.swift

    enum Error: Swift.Error {
        case failedToFetchStoredEvents(Swift.Error)
        case failedToDeleteStoredEvents(Swift.Error)
+        case failedToEncryptEventData


suggestion: add associated error?

netbe · 2026-02-17T16:10:40Z

WireDomain/Sources/WireDomain/Repositories/UpdateEvents/UpdateEventsLocalStore.swift

+                            data: data,
+                            privateKey: key
+                        ) else {
+                            WireLogger.ear.error("failed to decrypt stored event", attributes: .safePublic)


question: can we log the eventId as envelope_event_id attribute?

not available on the stored event

netbe · 2026-02-17T16:11:20Z

WireDomain/Sources/WireDomain/Repositories/UpdateEvents/UpdateEventsLocalStore.swift

+                storedEventEnvelope.isEncrypted = true
+                storedEventEnvelope.isBackgroundAccessible = isBackgroundAccessible
+            } else {
+                WireLogger.ear.error("failed to encrypt event", attributes: .safePublic)


suggestion: add event id in attributes if possible

added 2ea7235

netbe · 2026-02-17T16:13:47Z

WireDomain/Sources/WireDomain/Synchronization/IncrementalSync.swift

+                        "timed out waiting for database unlock, cancelling sync",
+                        attributes: .incrementalSyncV2, .safePublic
+                    )
+                    throw Failure.databaseUnlockTimeout


question: is the failure propagated?
does it mean that if it timesout? the incremental sync is cancelled?
why would it timeout?

outdated b04d292

WireDomain/Sources/WireDomain/Synchronization/IncrementalSyncV2.swift

datadog-wireapp · 2026-02-18T14:50:46Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: e0296f0 | Docs | Was this helpful? Give us feedback!}

…ew-sync # Conflicts: # wire-ios-data-model/Source/Authentication/EAR/EARService.swift

johnxnguyen · 2026-02-20T09:20:32Z

WireDomain/Sources/WireDomain/Helpers/ProtobufMessageDecoder.swift

+import Foundation
+import GenericMessageProtocol
+
+struct ProtobufMessageDecoder {


question: it looks like this was restored to its original implementation, but changes were made recently to throw errors. I think we should preserve these changes.

johnxnguyen · 2026-02-20T09:26:16Z

WireDomain/Sources/WireDomain/Repositories/UpdateEvents/UpdateEventsLocalStore.swift

+                                "failed to decrypt stored event: no private keys",
+                                attributes: .safePublic
+                            )
+                            return nil


issue: returning nil here means we just skip over this event and will proceed to process the rest. This could lead to some unexpected issues given the assumption that events are processed in order. What do you think about throwing an error and aborting? Perhaps this comes with other issues. what do you think @netbe ?

added critical logs and threw errors 6a2e408

johnxnguyen · 2026-02-20T09:28:53Z

WireDomain/Sources/WireDomain/Synchronization/IncrementalSync.swift

+    }
+
+    func perform(appState: UIApplication.State) async throws -> Token {
+        let inBackground = appState == .background


question: why do we need to check if we're in the BG?

made an attempt to update the flow as discussed 65fd560

johnxnguyen · 2026-02-20T09:33:52Z

WireDomain/Sources/WireDomain/Synchronization/IncrementalSync.swift

+        publicKeys: EARPublicKeys?,
+        backgroundAccessibleOnly: Bool
+    ) async {
+        guard !backgroundAccessibleOnly || (backgroundAccessibleOnly && envelope.isBackgroundAccessible) else {


question: why do we abort if we get a live event that is not background accessible? To avoid processing it before we processed earlier stored events?

added comment 927a65c

WireDomain/Sources/WireDomain/Synchronization/IncrementalSync.swift

johnxnguyen · 2026-02-20T09:40:59Z

WireDomain/Sources/WireDomain/Synchronization/IncrementalSync.swift

+        let isLocked = earService.isLocked
+        let privateKeys = try earService.fetchPrivateKeys(includingPrimary: !isLocked)


question: so we will attempt to migrate event if the database is locked? I would expect that a prerequisite would be to have an unlocked database.

fixed here c192c71

WireDomain/Tests/WireDomainTests/LocalStores/UpdateEventsLocalStoreTests.swift

…ounding with an active call

sonarqubecloud · 2026-02-20T18:22:38Z

Quality Gate passed

Issues
53 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.7% Duplication on New Code

See analysis details on SonarQube Cloud

David-Henner added 8 commits February 13, 2026 13:45

add properties to event model for EAR

b8eaa53

inject EARService

efabd78

add protobuf message decoder

113f121

add encryption helper

e0d40b3

event envelope background accessible helper

986d2d4

sendable keys

7a4e6f5

sendable update event coder

0e0c7c5

WIP

7889005

github-actions bot assigned David-Henner Feb 13, 2026

github-actions bot added the Fix PR Title 🤦‍♂️ label Feb 13, 2026

David-Henner added 18 commits February 13, 2026 16:21

disable support for sync v2

e8f2f24

update checking isLocked

3405047

update predicate; throw errors; logs

f289f9e

fix; update logs

1f896ee

fix sync vs database unlock timing issue

2701c91

support decrypting legacy events when migrating to sync v2

2529cf3

format

df66095

fix tests build

38b668f

add check of isLocked after timeout

7689b41

mocks

d1ae697

set properties even when not encrypted

ae38662

tests for events store

7b487c5

fix typo

c43dc40

check lock status before resuming continuation

0242f6d

fix database unlock timeout task

af717ce

add incremental sync tests

d5a0821

cleanup

93052a3

format

1326a1b

David-Henner changed the title ~~feat: ear with new sync - WIP~~ feat: support EAR with incremental sync - WPB-17302 Feb 17, 2026

github-actions bot removed the Fix PR Title 🤦‍♂️ label Feb 17, 2026

David-Henner requested review from Copilot, johnxnguyen and netbe February 17, 2026 15:47

Copilot started reviewing on behalf of David-Henner February 17, 2026 15:56 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

netbe reviewed Feb 17, 2026

View reviewed changes

David-Henner added 5 commits February 18, 2026 12:43

update sync behaviour when in background

b04d292

fix live event processing while in background

18f1687

update tests

f526676

format

bbf10c7

update backgroundAccessibleOnly to account for EAR status

a6dc55f

David-Henner added 2 commits February 18, 2026 16:03

revert changes to database notification

7293043

Merge branch 'feat/ear-support-without-new-sync' into feat/ear-with-n…

fbb565b

…ew-sync # Conflicts: # wire-ios-data-model/Source/Authentication/EAR/EARService.swift

johnxnguyen reviewed Feb 20, 2026

View reviewed changes

netbe added the release label Feb 20, 2026

David-Henner added 10 commits February 20, 2026 16:13

update logs

2ea7235

throw encryption errors and treat missing private keys as critical

6a2e408

add comments for unchecked sendables

34f71b9

update migration path

c192c71

add descriptive comment

927a65c

handle database locked error in syncAgent

dc10036

properly set isBackgroundAccessible

87b3a0a

log error

e82398e

add a trigger for incremental sync specific for call events

65fd560

use isLocked instead of backgroundAccessibleOnly to handle backgr…

e0296f0

…ounding with an active call

David-Henner requested review from johnxnguyen and netbe February 21, 2026 17:09

		let isLocked = earService.isLocked
		let privateKeys = try earService.fetchPrivateKeys(includingPrimary: !isLocked)

Comments

Conversation

David-Henner commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue

Changes

Testing

Checklist

Uh oh!

github-actions bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

netbe left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

datadog-wireapp bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud bot commented Feb 20, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

David-Henner commented Feb 13, 2026 •

edited

Loading

github-actions bot commented Feb 17, 2026 •

edited

Loading

datadog-wireapp bot commented Feb 18, 2026 •

edited

Loading