app/lib/encryption/room.ts (2)

202-223: Add fallback for non-2048-bit RSA keys in legacy imports.

Past review identified that decodePrefixedBase64 enforces a fixed 256-byte ciphertext length (2048-bit RSA). Users with 4096-bit or other key sizes will encounter a RangeError and fail to import room keys, breaking their ability to decrypt messages.

Apply this diff to add a fallback:

  importRoomKey = async (
    E2EKey: string,
    privateKey: string
  ): Promise<{ sessionKeyExportedString: string; roomKey: ArrayBuffer; keyID: string; algorithm: TAlgorithm }> => {
    try {
-     // Parse the encrypted key using prefixed base64
-     const [kid, encryptedData] = decodePrefixedBase64(E2EKey);
+     // Try strict prefixed-base64 (v2/modern)
+     let kid: string;
+     let encryptedData: ArrayBuffer;
+     try {
+       [kid, encryptedData] = decodePrefixedBase64(E2EKey);
+     } catch (err) {
+       // Fallback: legacy v1 uses 12-char keyID prefix + base64 ciphertext of variable length
+       if (err instanceof RangeError) {
+         kid = E2EKey.slice(0, 12);
+         encryptedData = b64ToBuffer(E2EKey.slice(12));
+       } else {
+         throw err;
+       }
+     }

      // Decrypt the session key
      const decryptedKey = await rsaDecrypt(bufferToB64(encryptedData), privateKey);

---

353-362: Add fallback for >2048-bit RSA keys when exporting room keys.

Past review identified that encodePrefixedBase64 requires exactly 256-byte ciphertext (2048-bit RSA). Users with 4096-bit keys (512-byte ciphertext) will encounter a RangeError, preventing them from sharing room keys with others.

Apply this diff to add a fallback:

  encryptRoomKeyForUser = async (publicKey: string) => {
    try {
      const userKey = await rsaImportKey(EJSON.parse(publicKey));
      const encryptedUserKey = await rsaEncrypt(this.sessionKeyExportedString as string, userKey);
      const encryptedBuffer = b64ToBuffer(encryptedUserKey as string);
-     return encodePrefixedBase64(this.keyID, encryptedBuffer);
+     try {
+       return encodePrefixedBase64(this.keyID, encryptedBuffer);
+     } catch (error) {
+       if (error instanceof RangeError) {
+         // Fallback to legacy format for non-2048-bit keys
+         return `${this.keyID}${encryptedUserKey}`;
+       }
+       throw error;
+     }
    } catch (e) {
      log(e);
    }
  };

app/lib/encryption/encryption.ts (2)

219-219: Use JSON.stringify instead of EJSON.stringify for v2 encoding.

As per past feedback from cardoso, the v2 encoding should use JSON.stringify rather than EJSON.stringify, and any buffers should be base64 strings (which they already are here).

Based on past review comments

Apply this diff:

  if (isV2) {
    const ciphertextB64 = await aesGcmEncrypt(bufferToB64(utf8ToBuffer(privateKey)), keyHex, ivHex);
-   return EJSON.stringify({ iv: ivB64, ciphertext: ciphertextB64, salt: userId, iterations: 100000 });
+   return JSON.stringify({ iv: ivB64, ciphertext: ciphertextB64, salt: userId, iterations: 100000 });
  }

---

207-209: Add version guard before encryption level selection in encodePrivateKey and changePassword methods.

The code silently falls back to weaker v1 encryption if server.version is missing or empty. The compareServerVersion function returns false when given a falsy version value, causing unguarded usage to default to v1 encryption parameters (1000 iterations, 16-byte IV instead of 100000 iterations and 12-byte IV for v2).

This affects two locations:

1. Line 207-209 (encodePrivateKey): Called during initial key generation in handleEncryptionInit saga. If server.version hasn't been populated yet, encryption defaults to v1.

2. Line 279-282 (changePassword): Same issue when user changes password.

Add explicit version validation:

  encodePrivateKey = async (privateKey: string, password: string, userId: string) => {
-   // TODO: get the appropriate server version
    const { version } = store.getState().server;
+   if (!version) {
+     throw new Error('server.version not available: encryption requires server version');
+   }
    const isV2 = compareServerVersion(version, 'greaterThanOrEqualTo', '7.13.0');

Apply the same guard to changePassword method around line 279.

app/lib/encryption/room.ts (1)

448-475: Add validation to prevent silent fallback when algorithm is uninitialized.

While the algorithm is now set in createNewRoomKey (lines 246, 266), if encryptText is called before handshake() completes or if initialization fails, this.algorithm === '' will silently fall through to the v1 path at line 468.

Add explicit validation:

  encryptText = async (
    text: string
  ): Promise<
    | { algorithm: 'rc.v2.aes-sha2'; kid: string; iv: string; ciphertext: string }
    | { algorithm: 'rc.v1.aes-sha2'; ciphertext: string }
  > => {
    const textBuffer = utf8ToBuffer(text);
+   if (!this.algorithm) {
+     throw new Error('Encryption algorithm not initialized. Room handshake may not have completed.');
+   }
    if (this.algorithm === 'A256GCM') {

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

app/lib/encryption/room.ts (2)

196-222: Unresolved: Back-compat risk with fixed RSA ciphertext length.

Line 203's decodePrefixedBase64 call enforces a fixed 256-byte ciphertext length (2048-bit RSA). Different key sizes will throw RangeError and break room key imports.

Add fallback handling for legacy key formats:

 ): Promise<{ sessionKeyExportedString: string; roomKey: ArrayBuffer; keyID: string; algorithm: TAlgorithm }> => {
   try {
-    // Parse the encrypted key using prefixed base64
-    const [kid, encryptedData] = decodePrefixedBase64(E2EKey);
+    // Try strict prefixed-base64 (v2/modern)
+    let kid: string;
+    let encryptedData: Uint8Array;
+    try {
+      [kid, encryptedData] = decodePrefixedBase64(E2EKey);
+    } catch (err) {
+      // Fallback: legacy v1 uses 12-char keyID prefix + base64 ciphertext
+      kid = E2EKey.slice(0, 12);
+      encryptedData = new Uint8Array(b64ToBuffer(E2EKey.slice(12)));
+    }
 
     // Decrypt the session key
     const decryptedKey = await rsaDecrypt(bufferToB64(encryptedData.buffer), privateKey);

Based on learnings from past reviews.

---

352-361: Unresolved: Handle non-2048-bit RSA keys when sharing room keys.

Line 357's encodePrefixedBase64 requires exactly 256-byte ciphertext (2048-bit RSA). Users with 4096-bit or other key sizes will fail to receive room keys.

Add fallback handling:

     const encryptedUserKey = await rsaEncrypt(this.sessionKeyExportedString as string, userKey);
     const encryptedBuffer = b64ToBuffer(encryptedUserKey as string);
-    return encodePrefixedBase64(this.keyID, encryptedBuffer);
+    try {
+      return encodePrefixedBase64(this.keyID, encryptedBuffer);
+    } catch (error) {
+      if (error instanceof RangeError) {
+        // Fallback for non-2048-bit RSA keys
+        return `${this.keyID}${encryptedUserKey}`;
+      }
+      throw error;
+    }
   } catch (e) {

Based on learnings from past reviews.

app/lib/encryption/encryption.ts (1)

207-225: Address unresolved past review concerns: version validation and v2 serialization.

Two issues from previous reviews remain unaddressed:

1. Critical: Line 207 TODO and missing validation — if store.getState().server.version is undefined, compareServerVersion returns false and silently falls back to v1 (weaker encryption). Add an explicit null check before line 209:

   const { version } = store.getState().server;
   if (!version) {
     throw new Error('server.version not set: encryption requires server version');
   }
   const isV2 = compareServerVersion(version, 'greaterThanOrEqualTo', '7.13.0');

2. Recommended refactor: Line 219 uses EJSON.stringify for the v2 payload. Since the object contains only plain properties (base64 strings and numbers), use JSON.stringify instead to avoid unnecessary EJSON overhead.

Based on learnings from past reviews.

app/lib/encryption/room.ts (1)

447-474: Consider explicit algorithm validation to prevent silent v1 fallback.

When this.algorithm is uninitialized (empty string) or has an unexpected value, execution silently falls through to the v1 encryption path (line 467). While createNewRoomKey now properly initializes this.algorithm, explicit validation would prevent subtle edge cases:

 	): Promise<
 		| { algorithm: 'rc.v2.aes-sha2'; kid: string; iv: string; ciphertext: string }
 		| { algorithm: 'rc.v1.aes-sha2'; ciphertext: string }
 	> => {
 		const textBuffer = utf8ToBuffer(text);
+		if (!this.algorithm || (this.algorithm !== 'A256GCM' && this.algorithm !== 'A128CBC')) {
+			throw new Error(`Invalid encryption algorithm: ${this.algorithm}. Room encryption not properly initialized.`);
+		}
 		if (this.algorithm === 'A256GCM') {

Based on learnings from past reviews.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

app/lib/encryption/room.ts (2)

196-222: Back-compat risk: decodePrefixedBase64 assumes fixed RSA ciphertext length.

decodePrefixedBase64 at line 203 enforces a fixed 256-byte Base64 length (2048-bit RSA). Older v1 keys using 12-char prefix + variable-length base64, or users with 4096-bit RSA keys, will throw RangeError and break key imports.

Wrap the call in a try-catch with fallback to legacy parsing:

 	): Promise<{ sessionKeyExportedString: string; roomKey: ArrayBuffer; keyID: string; algorithm: TAlgorithm }> => {
 		try {
-			// Parse the encrypted key using prefixed base64
-			const [kid, encryptedData] = decodePrefixedBase64(E2EKey);
+			let kid: string;
+			let encryptedData: ArrayBuffer;
+			try {
+				[kid, encryptedData] = decodePrefixedBase64(E2EKey);
+			} catch (err) {
+				// Fallback: legacy v1 uses 12-char keyID prefix + base64 ciphertext of variable length
+				if (err instanceof RangeError) {
+					kid = E2EKey.slice(0, 12);
+					encryptedData = b64ToBuffer(E2EKey.slice(12));
+				} else {
+					throw err;
+				}
+			}
 
 			// Decrypt the session key
 			const decryptedKey = await rsaDecrypt(bufferToB64(encryptedData), privateKey);

---

352-361: Handle >2048-bit RSA ciphertext when exporting room keys.

encodePrefixedBase64 at line 357 requires exactly 256 bytes. If a recipient has a 4096-bit RSA key (or any non-2048-bit key), rsaEncrypt produces a different-sized ciphertext, encodePrefixedBase64 throws, and you cannot share the room key with that user.

Add fallback to legacy format on size mismatch:

 		const encryptedUserKey = await rsaEncrypt(this.sessionKeyExportedString as string, userKey);
 		const encryptedBuffer = b64ToBuffer(encryptedUserKey as string);
-		return encodePrefixedBase64(this.keyID, encryptedBuffer);
+		try {
+			return encodePrefixedBase64(this.keyID, encryptedBuffer);
+		} catch (error) {
+			if (error instanceof RangeError) {
+				// Fallback to legacy format for non-2048-bit keys
+				return `${this.keyID}${encryptedUserKey}`;
+			}
+			throw error;
+		}

app/lib/encryption/room.ts (2)

447-474: Consider explicit algorithm validation to prevent silent v1 fallback.

When this.algorithm === '' (uninitialized) or has an unexpected value, execution silently falls through to the v1 encryption path at line 467. While handshake() should set this.algorithm via createNewRoomKey or importRoomKey, explicit validation would catch edge cases where the room is not properly initialized.

Add validation before branching:

 	): Promise<
 		| { algorithm: 'rc.v2.aes-sha2'; kid: string; iv: string; ciphertext: string }
 		| { algorithm: 'rc.v1.aes-sha2'; ciphertext: string }
 	> => {
 		const textBuffer = utf8ToBuffer(text);
+		if (!this.algorithm) {
+			throw new Error('Encryption algorithm not initialized. Room handshake may have failed.');
+		}
 		if (this.algorithm === 'A256GCM') {

---

776-821: Well-structured subscription decryption with smart caching.

The method includes appropriate guard clauses for ready state, message type, and encryption status. The optimization at lines 803-814 avoids re-decrypting identical messages by comparing _updatedAt timestamps, which is a good performance enhancement for frequently accessed subscriptions.

Consider adding a type guard for lastMessage to improve type safety:

 	decryptSubscription = async (subscription: Partial<ISubscription>) => {
 		if (!this.ready) {
 			return subscription;
 		}
 
 		// If the subscription doesn't have a lastMessage just return
 		const { rid, lastMessage } = subscription;
-		if (!lastMessage) {
+		if (!lastMessage || typeof lastMessage !== 'object') {
 			return subscription;
 		}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.