Merge branch 'develop' into florianduros/rip-out-legacy-crypto/aes

res/css/structures/_RoomSearch.pcss

@@ -35,7 +35,7 @@ Please see LICENSE files in the repository root for full details.
     }
 
     .mx_RoomSearch_spotlightTriggerText {
-        color: $tertiary-content;
+        color: var(--cpd-color-text-secondary);
         flex: 1;
         min-width: 0;
         /* the following rules are to match that of a real input field */

res/css/views/messages/_TimelineSeparator.pcss

@@ -12,7 +12,7 @@ Please see LICENSE files in the repository root for full details.
     display: flex;
     align-items: center;
     font: var(--cpd-font-body-md-regular);
-    color: var(--cpd-color-text-secondary);
+    color: var(--cpd-color-text-primary);
 }
 
 .mx_TimelineSeparator > hr {

res/themes/dark/css/_dark.pcss

@@ -250,7 +250,7 @@ $live-badge-color: #ffffff;
 $progressbar-bg-color: var(--cpd-color-gray-200);
 $kbd-border-color: $strong-input-border-color;
 $visual-bell-bg-color: #800;
-$event-timestamp-color: $text-secondary-color;
+$event-timestamp-color: var(--cpd-color-text-secondary);
 $composer-shadow-color: rgba(0, 0, 0, 0.28);
 $breadcrumb-placeholder-bg-color: #272c35;
 $theme-button-bg-color: #e3e8f0;

res/themes/light/css/_light.pcss

@@ -314,7 +314,7 @@ $call-light-quaternary-content: #c1c6cd;
 $progressbar-bg-color: var(--cpd-color-gray-200);
 $kbd-border-color: $strong-input-border-color;
 $visual-bell-bg-color: #faa;
-$event-timestamp-color: #acacac;
+$event-timestamp-color: var(--cpd-color-text-secondary);
 $composer-shadow-color: rgba(0, 0, 0, 0.04);
 $breadcrumb-placeholder-bg-color: #e8eef5;
 $theme-button-bg-color: $quinary-content;

src/MatrixClientPeg.ts

@@ -42,6 +42,7 @@ import PlatformPeg from "./PlatformPeg";
 import { formatList } from "./utils/FormattingUtils";
 import SdkConfig from "./SdkConfig";
 import { Features } from "./settings/Settings";
+import { setDeviceIsolationMode } from "./settings/controllers/DeviceIsolationModeController.ts";
 
 export interface IMatrixClientCreds {
     homeserverUrl: string;
@@ -343,6 +344,9 @@ class MatrixClientPegClass implements IMatrixClientPeg {
         });
 
         StorageManager.setCryptoInitialised(true);
+
+        setDeviceIsolationMode(this.matrixClient, SettingsStore.getValue("feature_exclude_insecure_devices"));
+
         // TODO: device dehydration and whathaveyou
         return;
     }

src/components/views/elements/AppTile.tsx

@@ -50,6 +50,8 @@ import { WidgetMessagingStore } from "../../../stores/widgets/WidgetMessagingSto
 import { SdkContextClass } from "../../../contexts/SDKContext";
 import { ModuleRunner } from "../../../modules/ModuleRunner";
 import { parseUrl } from "../../../utils/UrlUtils";
+import RightPanelStore from "../../../stores/right-panel/RightPanelStore.ts";
+import { RightPanelPhases } from "../../../stores/right-panel/RightPanelStorePhases.ts";
 
 interface IProps {
     app: IWidget | IApp;
@@ -576,6 +578,14 @@ export default class AppTile extends React.Component<IProps, IState> {
             ? Container.Top
             : Container.Center;
         WidgetLayoutStore.instance.moveToContainer(this.props.room, this.props.app, targetContainer);
+
+        // If the right panel has a timeline, but we're about to show the timeline in the main view, pop the right panel
+        if (
+            targetContainer === Container.Top &&
+            RightPanelStore.instance.currentCardForRoom(this.props.room.roomId).phase === RightPanelPhases.Timeline
+        ) {
+            RightPanelStore.instance.popCard(this.props.room.roomId);
+        }
     };
 
     private onMinimiseClicked = (): void => {

src/i18n/strings/en_EN.json

@@ -1427,6 +1427,8 @@
         "dynamic_room_predecessors": "Dynamic room predecessors",
         "dynamic_room_predecessors_description": "Enable MSC3946 (to support late-arriving room archives)",
         "element_call_video_rooms": "Element Call video rooms",
+        "exclude_insecure_devices": "Exclude insecure devices when sending/receiving messages",
+        "exclude_insecure_devices_description": "When this mode is enabled, encrypted messages will not be shared with unverified devices, and messages from unverified devices will be shown as an error. Note that if you enable this mode, you may be unable to communicate with users who have not verified their devices.",
         "experimental_description": "Feeling experimental? Try out our latest ideas in development. These features are not finalised; they may be unstable, may change, or may be dropped altogether. <a>Learn more</a>.",
         "experimental_section": "Early previews",
         "extended_profiles_msc_support": "Requires your server to support MSC4133",

src/settings/Settings.tsx

@@ -11,6 +11,7 @@ import React, { ReactNode } from "react";
 import { UNSTABLE_MSC4133_EXTENDED_PROFILES } from "matrix-js-sdk/src/matrix";
 
 import { _t, _td, TranslationKey } from "../languageHandler";
+import DeviceIsolationModeController from "./controllers/DeviceIsolationModeController.ts";
 import {
     NotificationBodyEnabledController,
     NotificationsEnabledController,
@@ -309,6 +310,16 @@ export const SETTINGS: { [setting: string]: ISetting } = {
         supportedLevelsAreOrdered: true,
         default: false,
     },
+    "feature_exclude_insecure_devices": {
+        isFeature: true,
+        labsGroup: LabGroup.Encryption,
+        controller: new DeviceIsolationModeController(),
+        displayName: _td("labs|exclude_insecure_devices"),
+        description: _td("labs|exclude_insecure_devices_description"),
+        supportedLevels: LEVELS_DEVICE_ONLY_SETTINGS_WITH_CONFIG_PRIORITISED,
+        supportedLevelsAreOrdered: true,
+        default: false,
+    },
     "useOnlyCurrentProfiles": {
         supportedLevels: LEVELS_ACCOUNT_SETTINGS,
         displayName: _td("settings|disable_historical_profile"),

src/settings/controllers/DeviceIsolationModeController.ts

@@ -0,0 +1,37 @@
+/*
+Copyright 2024 New Vector Ltd.
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { AllDevicesIsolationMode, OnlySignedDevicesIsolationMode } from "matrix-js-sdk/src/crypto-api";
+import { MatrixClient } from "matrix-js-sdk/src/matrix";
+
+import SettingController from "./SettingController";
+import { MatrixClientPeg } from "../../MatrixClientPeg";
+import { SettingLevel } from "../SettingLevel";
+
+/**
+ * A controller for the "exclude_insecure_devices" setting, which will
+ * update the crypto stack's device isolation mode on change.
+ */
+export default class DeviceIsolationModeController extends SettingController {
+    public onChange(level: SettingLevel, roomId: string, newValue: any): void {
+        setDeviceIsolationMode(MatrixClientPeg.safeGet(), newValue);
+    }
+}
+
+/**
+ * Set the crypto stack's device isolation mode based on the current value of the
+ * "exclude_insecure_devices" setting.
+ *
+ * @param client - MatrixClient to update to the new setting.
+ * @param settingValue - value of the "exclude_insecure_devices" setting.
+ */
+export function setDeviceIsolationMode(client: MatrixClient, settingValue: boolean): void {
+    client
+        .getCrypto()
+        ?.setDeviceIsolationMode(
+            settingValue ? new OnlySignedDevicesIsolationMode() : new AllDevicesIsolationMode(true),
+        );
+}

test/components/structures/MatrixChat-test.tsx

@@ -1002,6 +1002,7 @@ describe("<MatrixChat />", () => {
                     getUserVerificationStatus: jest
                         .fn()
                         .mockResolvedValue(new UserVerificationStatus(false, false, false)),
+                    setDeviceIsolationMode: jest.fn(),
                 };
                 loginClient.isCryptoEnabled.mockReturnValue(true);
                 loginClient.getCrypto.mockReturnValue(mockCrypto as any);

test/settings/controllers/DeviceIsolationModeController-test.ts

@@ -0,0 +1,33 @@
+/*
+Copyright 2024 New Vector Ltd.
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { AllDevicesIsolationMode, OnlySignedDevicesIsolationMode } from "matrix-js-sdk/src/crypto-api";
+
+import { stubClient } from "../../test-utils";
+import DeviceIsolationModeController from "../../../src/settings/controllers/DeviceIsolationModeController.ts";
+import { SettingLevel } from "../../../src/settings/SettingLevel";
+
+describe("DeviceIsolationModeController", () => {
+    afterEach(() => {
+        jest.resetAllMocks();
+    });
+
+    describe("tracks enabling and disabling", () => {
+        it("on sets signed device isolation mode", () => {
+            const cli = stubClient();
+            const controller = new DeviceIsolationModeController();
+            controller.onChange(SettingLevel.DEVICE, "", true);
+            expect(cli.getCrypto()?.setDeviceIsolationMode).toHaveBeenCalledWith(new OnlySignedDevicesIsolationMode());
+        });
+
+        it("off sets all device isolation mode", () => {
+            const cli = stubClient();
+            const controller = new DeviceIsolationModeController();
+            controller.onChange(SettingLevel.DEVICE, "", false);
+            expect(cli.getCrypto()?.setDeviceIsolationMode).toHaveBeenCalledWith(new AllDevicesIsolationMode(true));
+        });
+    });
+});

test/test-utils/test-utils.ts

@@ -131,6 +131,7 @@ export function createTestClient(): MatrixClient {
             resetKeyBackup: jest.fn(),
             isEncryptionEnabledInRoom: jest.fn(),
             getVerificationRequestsToDeviceInProgress: jest.fn().mockReturnValue([]),
+            setDeviceIsolationMode: jest.fn(),
         }),
 
         getPushActionsForEvent: jest.fn(),