Skip to content

Auto-setup cross-signing for new accounts and invite to encrypted rooms - #52

Merged
KallynGowdy merged 2 commits into
devfrom
claude/admiring-fermat-qwt1cr
Sep 25, 2026
Merged

KallynGowdy merged 2 commits into
devfrom
claude/admiring-fermat-qwt1cr

Conversation

@KallynGowdy

Copy link
Copy Markdown
Contributor

Description

This PR adds automatic cross-signing setup for newly registered accounts and improves community invitations to include encrypted rooms with readable history.

New account cross-signing:

  • Adds newAccountCrossSigning.ts utilities to automatically bootstrap cross-signing for accounts registered on the current device
  • Marks new accounts for cross-signing during registration, storing the password in memory to handle auth prompts when uploading signing keys
  • Integrates cross-signing setup into ClientNonUIFeatures so it runs automatically when the client loads
  • Handles auth failures gracefully: stops retrying on 401/403 (user can set up verification from Settings) but retries on other errors
  • Includes comprehensive unit tests covering all scenarios

Community invitations:

  • Adds inviteToCommunity() function that invites users to a community space and automatically invites them to encrypted child rooms with readable history (shared/world_readable)
  • This ensures new members receive room history keys via the invite, allowing them to decrypt messages sent before they joined
  • Adds shouldInviteToChildRoom() logic to determine which rooms should receive invites based on encryption, history visibility, and permissions
  • Updates the community settings UI to show when room invitations fail
  • Includes unit tests for the invitation logic

Why this matters:

  • New accounts without cross-signing can't read encrypted room history when joining via space (restricted join), and clients exclude them from key sharing
  • Automatically setting up cross-signing on first login solves this for the device that registered the account
  • Inviting to encrypted rooms with readable history ensures new community members can access past messages

Fixes #

Checklist:

  • I have read and understood the Contribution policy.
  • Added unit tests for new utilities (newAccountCrossSigning.test.ts, communitySettings.test.ts)
  • Tests pass (npm test)

https://claude.ai/code/session_01HozsUkW1DXEwYsQybGemSH

People who registered and then joined a community's rooms couldn't read
messages sent before they joined, and others couldn't read theirs.

- matrix-js-sdk only shares room history (MSC4268 key bundles) when the
  user is invited to the room itself, and only with devices cross-signed
  by their owner. Community rooms are joined through the space, and new
  accounts never had cross-signing, so no history keys were ever shared.
- Clients that exclude insecure devices won't exchange room keys with a
  device that isn't cross-signed.

Set up cross-signing for the new device right after registering, using
the registration password (kept in memory only) if the server asks for
auth. When inviting someone to a community, also invite them to its
encrypted rooms with shared history, so the history keys are shared.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HozsUkW1DXEwYsQybGemSH
…-qwt1cr

# Conflicts:
#	src/app/pages/client/ClientNonUIFeatures.tsx
@KallynGowdy
KallynGowdy merged commit 81fdd12 into dev Sep 25, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants