auto include pubkey based on rules discussed in #3445

extension/chrome/elements/compose-modules/compose-my-pubkey-module.ts

@@ -3,16 +3,17 @@
 'use strict';
 
 import { ApiErr } from '../../../js/common/api/shared/api-error.js';
-import { KeyInfo } from '../../../js/common/core/crypto/key.js';
+import { KeyInfo, KeyUtil } from '../../../js/common/core/crypto/key.js';
 import { Lang } from '../../../js/common/lang.js';
 import { Ui } from '../../../js/common/browser/ui.js';
 import { ViewModule } from '../../../js/common/view-module.js';
 import { ComposeView } from '../compose.js';
-import { ContactStore } from '../../../js/common/platform/store/contact-store.js';
+import { Str } from '../../../js/common/core/common.js';
 
 export class ComposeMyPubkeyModule extends ViewModule<ComposeView> {
 
   private toggledManually = false;
+  private wkdFingerprints: { [acctEmail: string]: string[] } = {};
 
   public setHandlers = () => {
     this.view.S.cached('icon_pubkey').attr('title', Lang.compose.includePubkeyIconTitle);
@@ -44,18 +45,40 @@ export class ComposeMyPubkeyModule extends ViewModule<ComposeView> {
       return;
     }
     (async () => {
-      const contacts = await ContactStore.get(undefined, this.view.recipientsModule.getRecipients().map(r => r.email));
-      for (const contact of contacts) {
-        if (contact?.has_pgp && contact.client !== 'cryptup') {
+      const senderEmail = this.view.senderModule.getSender();
+      const senderKi = await this.view.storageModule.getKey(senderEmail);
+      const primaryFingerprint = (await KeyUtil.parse(senderKi.private)).id;
+      // if we have cashed this fingerprint, setAttachPreference(false) rightaway and return
+      const cached = this.wkdFingerprints[senderEmail];
+      if (Array.isArray(cached) && cached.includes(primaryFingerprint)) {
+        this.setAttachPreference(false);
+        return;
+      }
+      const myDomain = Str.getDomainFromEmailAddress(senderEmail);
+      const foreignRecipients = this.view.recipientsModule.getRecipients().map(r => r.email)
+        .filter(Boolean)
+        .filter(email => myDomain !== Str.getDomainFromEmailAddress(email));
+      if (foreignRecipients.length > 0) {
+        if (!Array.isArray(cached)) {
+          // slow operation -- test WKD for our own key and cache the result
+          const { keys } = await this.view.pubLookup.wkd.rawLookupEmail(senderEmail);
+          const fingerprints = keys.map(key => key.id);
+          this.wkdFingerprints[senderEmail] = fingerprints;
+          if (fingerprints.includes(primaryFingerprint)) {
+            this.setAttachPreference(false);
+            return;
+          }
+        }
+        for (const recipient of foreignRecipients) {
           // new message, and my key is not uploaded where the recipient would look for it
-          if (! await this.view.recipientsModule.doesRecipientHaveMyPubkey(contact.email)) {
-            // either don't know if they need pubkey (can_read_emails false), or they do need pubkey
+          if (! await this.view.recipientsModule.doesRecipientHaveMyPubkey(recipient)) {
+            // they do need pubkey
             this.setAttachPreference(true);
             return;
           }
         }
+        this.setAttachPreference(false);
       }
-      this.setAttachPreference(false);
     })().catch(ApiErr.reportIfSignificant);
   }
 

extension/chrome/elements/compose-modules/compose-recipients-module.ts

@@ -7,7 +7,7 @@ import { Contact } from '../../../js/common/core/crypto/key.js';
 import { PUBKEY_LOOKUP_RESULT_FAIL, PUBKEY_LOOKUP_RESULT_WRONG } from './compose-err-module.js';
 import { ProviderContactsQuery, Recipients } from '../../../js/common/api/email-provider/email-provider-api.js';
 import { RecipientElement, RecipientStatus } from './compose-types.js';
-import { Str, Value } from '../../../js/common/core/common.js';
+import { Str } from '../../../js/common/core/common.js';
 import { ApiErr } from '../../../js/common/api/shared/api-error.js';
 import { Bm, BrowserMsg } from '../../../js/common/browser/browser-msg.js';
 import { Catch } from '../../../js/common/platform/catch.js';
@@ -38,8 +38,6 @@ export class ComposeRecipientsModule extends ViewModule<ComposeView> {
   private contactSearchInProgress = false;
   private addedPubkeyDbLookupInterval?: number;
 
-  private recipientsMissingMyKey: string[] = [];
-
   private onRecipientAddedCallbacks: ((rec: RecipientElement[]) => void)[] = [];
 
   private dragged: Element | undefined = undefined;
@@ -300,6 +298,7 @@ export class ComposeRecipientsModule extends ViewModule<ComposeView> {
     this.onRecipientAddedCallbacks.push(callback);
   }
 
+  // todo: shouldn't we check longid?
   public doesRecipientHaveMyPubkey = async (theirEmailUnchecked: string): Promise<boolean | undefined> => {
     const theirEmail = Str.parseEmail(theirEmailUnchecked).email;
     if (!theirEmail) {
@@ -316,7 +315,7 @@ export class ComposeRecipientsModule extends ViewModule<ComposeView> {
     const qReceivedMsg = `from:${theirEmail} "BEGIN PGP MESSAGE" "END PGP MESSAGE"`;
     try {
       const response = await this.view.emailProvider.msgList(`(${qSentPubkey}) OR (${qReceivedMsg})`, true);
-      if (response.messages) {
+      if (response.messages && response.messages.length > 0) {
         await AcctStore.set(this.view.acctEmail, { pubkey_sent_to: (storage.pubkey_sent_to || []).concat(theirEmail) });
         return true;
       } else {
@@ -857,7 +856,6 @@ export class ComposeRecipientsModule extends ViewModule<ComposeView> {
   }
 
   private removeRecipient = (element: HTMLElement) => {
-    this.recipientsMissingMyKey = Value.arr.withoutVal(this.recipientsMissingMyKey, $(element).parent().text());
     const index = this.addedRecipients.findIndex(r => r.element.isEqualNode(element));
     this.addedRecipients[index].element.remove();
     const container = element.parentElement?.parentElement; // Get Container, e.g. '.input-container-cc'

extension/chrome/elements/compose.htm

@@ -153,7 +153,7 @@ <h1 id="header_title" data-test="header-title">New Secure Message</h1>
           <div id="send_btn_note" data-test="send-btn-note"></div>
           <button class="icon right delete_draft" tabindex="11" title="Delete draft"><img src="/img/svgs/trash-can-icon.svg"
               class="delete-draft" alt="Delete Email"></button>
-          <button class="icon right action_include_pubkey" tabindex="10" title="Include your Public Key"><i
+          <button class="icon right action_include_pubkey" data-test="action-include-pubkey" tabindex="10" title="Include your Public Key"><i
               alt="pubkey"></i></button>
         </td>
       </tr>

extension/js/common/api/email-provider/gmail/google-auth.ts

@@ -6,7 +6,7 @@
 // tslint:disable:oneliner-object-literal
 
 import { GOOGLE_API_HOST, GOOGLE_OAUTH_SCREEN_HOST, FLAVOR } from '../../../core/const.js';
-import { Url, Value } from '../../../core/common.js';
+import { Str, Url, Value } from '../../../core/common.js';
 import { tabsQuery, windowsCreate } from '../../../browser/chrome.js';
 import { Api } from './../../shared/api.js';
 import { ApiErr } from '../../shared/api-error.js';
@@ -158,7 +158,7 @@ export class GoogleAuth {
    * Happens on enterprise builds
    */
   public static isFesUnreachableErr = (e: any, email: string): boolean => {
-    const domain = email.split('@')[1].toLowerCase();
+    const domain = Str.getDomainFromEmailAddress(email);
     const errString = String(e);
     if (errString.includes(`-1 when GET-ing https://${domain}/.well-known/host-meta.json`)) {
       return true; // err trying to get FES url from .well-known

extension/js/common/api/key-server/wkd.ts

@@ -7,7 +7,8 @@ import { ApiErr } from '../shared/api-error.js';
 import { opgp } from '../../core/crypto/pgp/openpgpjs-custom.js';
 import { Buf } from '../../core/buf.js';
 import { PubkeySearchResult } from './../pub-lookup.js';
-import { KeyUtil } from '../../core/crypto/key.js';
+import { Key, KeyUtil } from '../../core/crypto/key.js';
+import { Str } from '../../core/common.js';
 
 // tslint:disable:no-null-keyword
 // tslint:disable:no-direct-ajax
@@ -24,21 +25,23 @@ export class Wkd extends Api {
     super();
   }
 
-  public lookupEmail = async (email: string): Promise<PubkeySearchResult> => {
+  // returns all the received keys
+  public rawLookupEmail = async (email: string): Promise<{ keys: Key[], errs: Error[] }> => {
+    // todo: should we return errs on network failures etc.?
     const parts = email.split('@');
     if (parts.length !== 2) {
-      return { pubkey: null, pgpClient: null };
+      return { keys: [], errs: [] };
     }
     const [user, recipientDomain] = parts;
     if (!user || !recipientDomain) {
-      return { pubkey: null, pgpClient: null };
+      return { keys: [], errs: [] };
     }
     if (!opgp) {
       // pgp_block.htm does not have openpgp loaded
       // the particular usecase (auto-loading pubkeys to verify signatures) is not that important,
       //    the user typically gets the key loaded from composing anyway
       // the proper fix would be to run encodeZBase32 through background scripts
-      return { pubkey: null, pgpClient: null };
+      return { keys: [], errs: [] };
     }
     const directDomain = recipientDomain.toLowerCase();
     const advancedDomainPrefix = (directDomain === 'localhost') ? '' : 'openpgpkey.';
@@ -50,15 +53,19 @@ export class Wkd extends Api {
     const directUrl = `https://${directHost}/.well-known/openpgpkey`;
     let response = await this.urlLookup(advancedUrl, userPart);
     if (!response.buf && response.hasPolicy) {
-      return { pubkey: null, pgpClient: null }; // do not retry direct if advanced had a policy file
+      return { keys: [], errs: [] }; // do not retry direct if advanced had a policy file
     }
     if (!response.buf) {
       response = await this.urlLookup(directUrl, userPart);
     }
     if (!response.buf) {
-      return { pubkey: null, pgpClient: null }; // do not retry direct if advanced had a policy file
+      return { keys: [], errs: [] }; // do not retry direct if advanced had a policy file
     }
-    const { keys, errs } = await KeyUtil.readMany(response.buf);
+    return await KeyUtil.readMany(response.buf);
+  }
+
+  public lookupEmail = async (email: string): Promise<PubkeySearchResult> => {
+    const { keys, errs } = await this.rawLookupEmail(email);
     if (errs.length) {
       return { pubkey: null, pgpClient: null };
     }
@@ -67,7 +74,7 @@ export class Wkd extends Api {
       return { pubkey: null, pgpClient: null };
     }
     // if recipient uses same domain, we assume they use flowcrypt
-    const pgpClient = this.myOwnDomain === recipientDomain ? 'flowcrypt' : 'pgp-other';
+    const pgpClient = this.myOwnDomain === Str.getDomainFromEmailAddress(email) ? 'flowcrypt' : 'pgp-other';
     try {
       const pubkey = KeyUtil.armor(key);
       return { pubkey, pgpClient };

extension/js/common/core/common.ts

@@ -33,6 +33,11 @@ export class Str {
     return { email, name, full };
   }
 
+  public static getDomainFromEmailAddress = (emailAddr: string) => {
+    // todo: parseEmail()?
+    return emailAddr.toLowerCase().split('@')[1];
+  }
+
   public static rmSpecialCharsKeepUtf = (str: string, mode: 'ALLOW-SOME' | 'ALLOW-NONE'): string => {
     // not a whitelist because we still want utf chars
     str = str.replace(/[@&#`();:'",<>\{\}\[\]\\\/\n\t\r]/gi, '');

extension/js/common/org-rules.ts

@@ -33,7 +33,7 @@ export class OrgRules {
       throw new Error(`Not a valid email`);
     }
     const storage = await AcctStore.get(email, ['rules']);
-    return new OrgRules(storage.rules || OrgRules.default, acctEmail.split('@')[1]);
+    return new OrgRules(storage.rules || OrgRules.default, Str.getDomainFromEmailAddress(acctEmail));
   }
 
   public static isPublicEmailProviderDomain = (emailAddrOrDomain: string) => {
@@ -173,7 +173,7 @@ export class OrgRules {
    * This is because they already have other means to obtain public keys for these domains, such as from their own internal keyserver
    */
   public canLookupThisRecipientOnAttester = (emailAddr: string): boolean => {
-    return !(this.domainRules.disallow_attester_search_for_domains || []).includes(emailAddr.split('@')[1] || 'NONE');
+    return !(this.domainRules.disallow_attester_search_for_domains || []).includes(Str.getDomainFromEmailAddress(emailAddr) || 'NONE');
   }
 
   /**

test/source/mock/backend/backend-data.ts

@@ -87,6 +87,9 @@ export class BackendData {
       "enforce_keygen_algo": "rsa2048",
       "disallow_attester_search_for_domains": []
     };
+    if (domain === 'google.mock.flowcryptlocal.com:8001') {
+      return { ...keyManagerAutogenRules, flags: [...keyManagerAutogenRules.flags, 'NO_ATTESTER_SUBMIT'] };
+    }
     if (domain === 'key-manager-autogen.flowcrypt.com') {
       return keyManagerAutogenRules;
     }

test/source/mock/key-manager/key-manager-endpoints.ts

@@ -7,6 +7,7 @@ import { oauth } from '../lib/oauth';
 import { Dict } from '../../core/common';
 import { expect } from 'chai';
 import { KeyUtil } from '../../core/crypto/key';
+import { wkdAtgooglemockflowcryptlocalcom8001Private } from '../../tests/tooling/consts';
 
 // tslint:disable:max-line-length
 /* eslint-disable max-len */
@@ -193,6 +194,9 @@ export const mockKeyManagerEndpoints: HandlersDefinition = {
   '/flowcrypt-email-key-manager/keys/private': async ({ body }, req) => {
     const acctEmail = oauth.checkAuthorizationHeaderWithIdToken(req.headers.authorization);
     if (isGet(req)) {
+      if (acctEmail === 'wkd@google.mock.flowcryptlocal.com:8001') {
+        return { privateKeys: [{ decryptedPrivateKey: wkdAtgooglemockflowcryptlocalcom8001Private }] };
+      }
       if (acctEmail === 'get.key@key-manager-autogen.flowcrypt.com') {
         return { privateKeys: [{ decryptedPrivateKey: existingPrv }] };
       }

test/source/mock/wkd/wkd-endpoints.ts

@@ -1,6 +1,8 @@
 /* ©️ 2016 - present FlowCrypt a.s. Limitations apply. Contact human@flowcrypt.com */
 
+import { KeyUtil } from '../../core/crypto/key.js';
 import { PgpArmor } from '../../core/crypto/pgp/pgp-armor.js';
+import { wkdAtgooglemockflowcryptlocalcom8001Private } from '../../tests/tooling/consts.js';
 import { HandlersDefinition } from '../all-apis-mock';
 
 const alice = `-----BEGIN PGP PUBLIC KEY BLOCK-----
@@ -190,6 +192,11 @@ ctnWuBzRDeI0n6XDaPv5TpKpS7uqy/fTlJLGE9vZTFUKzeGkQFomBoXNVWs=
 // todo - add a not found test with: throw new HttpClientErr('Pubkey not found', 404);
 
 export const mockWkdEndpoints: HandlersDefinition = {
+  '/.well-known/openpgpkey/hu/st5or5guodbnsiqbzp6i34xw59h1sgmw?l=wkd': async () => {
+    // direct for wkd@google.mock.flowcryptlocal.com:8001
+    const pub = await KeyUtil.asPublicKey(await KeyUtil.parse(wkdAtgooglemockflowcryptlocalcom8001Private));
+    return Buffer.from((await PgpArmor.dearmor(KeyUtil.armor(pub))).data);
+  },
   '/.well-known/openpgpkey/hu/ihyath4noz8dsckzjbuyqnh4kbup6h4i?l=john.doe': async () => {
     return Buffer.from((await PgpArmor.dearmor(johnDoe1)).data); // direct for john.doe@localhost
   },
@@ -219,6 +226,6 @@ export const mockWkdEndpoints: HandlersDefinition = {
     return ''; // allow advanced for localhost
   },
   '/.well-known/openpgpkey/policy': async () => {
-    return ''; // allow direct for localhost
+    return ''; // allow direct for all
   },
 };

test/source/tests/compose.ts

@@ -120,6 +120,37 @@ export const defineComposeTests = (testVariant: TestVariant, testWithBrowser: Te
       expect(recipients).to.eq(['recip1@corp.co', 'recip2@corp.co', 'сс1@corp.co', 'bсс1@corp.co', '1 more'].join(''));
     }));
 
+    ava.default(`compose - auto include pubkey when our key is not available on Wkd`, testWithBrowser('ci.tests.gmail', async (t, browser) => {
+      const composePage = await ComposePageRecipe.openStandalone(t, browser, 'compose');
+      await composePage.page.setViewport({ width: 540, height: 606 });
+      await ComposePageRecipe.fillMsg(composePage, { to: 'flowcrypt.compatibility@gmail.com' }, 'testing auto include pubkey');
+      await composePage.waitTillGone('@spinner');
+      await Util.sleep(3); // wait for the Wkd lookup to complete
+      expect(await composePage.hasClass('@action-include-pubkey', 'active')).to.be.false;
+      await composePage.waitAndType(`@input-to`, 'some.unknown@unknown.com');
+      await composePage.waitAndFocus('@input-body');
+      await composePage.waitTillGone('@spinner');
+      await Util.sleep(3); // allow some time to search for messages
+      expect(await composePage.hasClass('@action-include-pubkey', 'active')).to.be.true;
+    }));
+
+    ava.default(`compose - auto include pubkey is inactive when our key is available on Wkd`, testWithBrowser(undefined, async (t, browser) => {
+      const acct = 'wkd@google.mock.flowcryptlocal.com:8001';
+      const settingsPage = await BrowserRecipe.openSettingsLoginApprove(t, browser, acct);
+      await SetupPageRecipe.autoKeygen(settingsPage);
+      const composePage = await ComposePageRecipe.openStandalone(t, browser, acct);
+      await composePage.page.setViewport({ width: 540, height: 606 });
+      await ComposePageRecipe.fillMsg(composePage, { to: 'ci.tests.gmail@flowcrypt.dev' }, 'testing auto include pubkey');
+      await composePage.waitTillGone('@spinner');
+      await Util.sleep(3); // wait for the Wkd lookup to complete
+      expect(await composePage.hasClass('@action-include-pubkey', 'active')).to.be.false;
+      await composePage.waitAndType('@input-to', 'some.unknown@unknown.com');
+      await composePage.waitAndFocus('@input-body');
+      await composePage.waitTillGone('@spinner');
+      await Util.sleep(3); // allow some time to search for messages
+      expect(await composePage.hasClass('@action-include-pubkey', 'active')).to.be.false;
+    }));
+
     ava.default(`compose - freshly loaded pubkey`, testWithBrowser('ci.tests.gmail', async (t, browser) => {
       const composePage = await ComposePageRecipe.openStandalone(t, browser, 'compose');
       await ComposePageRecipe.fillMsg(composePage, { to: 'human@flowcrypt.com' }, 'freshly loaded pubkey');