Add new encryption settings for mautrix-go

config/bridge.go

@@ -17,6 +17,7 @@
 package config
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 	"text/template"
@@ -31,8 +32,10 @@ type BridgeConfig struct {
 	DisplaynameTemplate string `yaml:"displayname_template"`
 	ChannelnameTemplate string `yaml:"channelname_template"`
 
-	DeliveryReceipts bool `yaml:"delivery_receipts"`
+	DeliveryReceipts    bool `yaml:"delivery_receipts"`
-	RestrictedRooms  bool `yaml:"restricted_rooms"`
+	MessageStatusEvents bool `yaml:"message_status_events"`
+	MessageErrorNotices bool `yaml:"message_error_notices"`
+	RestrictedRooms     bool `yaml:"restricted_rooms"`
 
 	CommandPrefix string `yaml:"command_prefix"`
 
@@ -62,6 +65,32 @@ type BridgeConfig struct {
 	channelnameTemplate *template.Template `yaml:"-"`
 }
 
+func (bc *BridgeConfig) EnableMessageStatusEvents() bool {
+	return bc.MessageStatusEvents
+}
+
+func (bc *BridgeConfig) EnableMessageErrorNotices() bool {
+	return bc.MessageErrorNotices
+}
+
+func boolToInt(val bool) int {
+	if val {
+		return 1
+	}
+	return 0
+}
+
+func (bc *BridgeConfig) Validate() error {
+	_, hasWildcard := bc.Permissions["*"]
+	_, hasExampleDomain := bc.Permissions["example.com"]
+	_, hasExampleUser := bc.Permissions["@admin:example.com"]
+	exampleLen := boolToInt(hasWildcard) + boolToInt(hasExampleUser) + boolToInt(hasExampleDomain)
+	if len(bc.Permissions) <= exampleLen {
+		return errors.New("bridge.permissions not configured")
+	}
+	return nil
+}
+
 type umBridgeConfig BridgeConfig
 
 func (bc *BridgeConfig) UnmarshalYAML(unmarshal func(interface{}) error) error {

config/upgrade.go

@@ -30,6 +30,8 @@ func DoUpgrade(helper *up.Helper) {
 	helper.Copy(up.Str, "bridge", "channelname_template")
 	helper.Copy(up.Int, "bridge", "portal_message_buffer")
 	helper.Copy(up.Bool, "bridge", "delivery_receipts")
+	helper.Copy(up.Bool, "bridge", "message_status_events")
+	helper.Copy(up.Bool, "bridge", "message_error_notices")
 	helper.Copy(up.Bool, "bridge", "restricted_rooms")
 	helper.Copy(up.Bool, "bridge", "sync_with_custom_puppets")
 	helper.Copy(up.Bool, "bridge", "sync_direct_chat_list")
@@ -44,9 +46,11 @@ func DoUpgrade(helper *up.Helper) {
 	helper.Copy(up.Str|up.Null, "bridge", "management_room_text", "additional_help")
 	helper.Copy(up.Bool, "bridge", "encryption", "allow")
 	helper.Copy(up.Bool, "bridge", "encryption", "default")
-	helper.Copy(up.Bool, "bridge", "encryption", "key_sharing", "allow")
+	helper.Copy(up.Bool, "bridge", "encryption", "require")
-	helper.Copy(up.Bool, "bridge", "encryption", "key_sharing", "require_cross_signing")
+	helper.Copy(up.Bool, "bridge", "encryption", "allow_key_sharing")
-	helper.Copy(up.Bool, "bridge", "encryption", "key_sharing", "require_verification")
+	helper.Copy(up.Str, "bridge", "encryption", "verification_levels", "receive")
+	helper.Copy(up.Str, "bridge", "encryption", "verification_levels", "send")
+	helper.Copy(up.Str, "bridge", "encryption", "verification_levels", "share")
 	helper.Copy(up.Bool, "bridge", "encryption", "rotation", "enable_custom")
 	helper.Copy(up.Int, "bridge", "encryption", "rotation", "milliseconds")
 	helper.Copy(up.Int, "bridge", "encryption", "rotation", "messages")

example-config.yaml

@@ -82,6 +82,10 @@ bridge:
 
     # Should the bridge send a read receipt from the bridge bot when a message has been sent to Discord?
     delivery_receipts: false
+    # Whether the bridge should send the message status as a custom com.beeper.message_send_status event.
+    message_status_events: true
+    # Whether the bridge should send error notices via m.notice events when a message fails to bridge.
+    message_error_notices: true
     # Should the bridge use space-restricted join rules instead of invite-only for guild rooms?
     # This can avoid unnecessary invite events in guild rooms when members are synced in.
     restricted_rooms: true
@@ -131,18 +135,28 @@ bridge:
         # This will cause the bridge bot to be in private chats for the encryption to work properly.
         # It is recommended to also set private_chat_portal_meta to true when using this.
         default: false
-        # Options for automatic key sharing.
+        # Require encryption, drop any unencrypted messages.
-        key_sharing:
+        require: false
-            # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
+        # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
-            # You must use a client that supports requesting keys from other users to use this feature.
+        # You must use a client that supports requesting keys from other users to use this feature.
-            allow: false
+        allow_key_sharing: false
-            # Require the requesting device to have a valid cross-signing signature?
+        # What level of device verification should be required from users?
-            # This doesn't require that the bridge has verified the device, only that the user has verified it.
+        #
-            # Not yet implemented.
+        # Valid levels:
-            require_cross_signing: false
+        #   unverified - Send keys to all device in the room.
-            # Require devices to be verified by the bridge?
+        #   cross-signed-untrusted - Require valid cross-signing, but trust all cross-signing keys.
-            # Verification by the bridge is not yet implemented.
+        #   cross-signed-tofu - Require valid cross-signing, trust cross-signing keys on first use (and reject changes).
-            require_verification: true
+        #   cross-signed-verified - Require valid cross-signing, plus a valid user signature from the bridge bot.
+        #                           Note that creating user signatures from the bridge bot is not currently possible.
+        #   verified - Require manual per-device verification
+        #              (currently only possible by modifying the `trust` column in the `crypto_device` database table).
+        verification_levels:
+            # Minimum level for which the bridge should send keys to when bridging messages from WhatsApp to Matrix.
+            receive: unverified
+            # Minimum level that the bridge should accept for incoming Matrix messages.
+            send: unverified
+            # Minimum level that the bridge should require for accepting key requests.
+            share: cross-signed
         # Options for Megolm room key rotation. These options allow you to
         # configure the m.room.encryption event content. See:
         # https://spec.matrix.org/v1.3/client-server-api/#mroomencryption for