Pro: atomic credential storage; key rotation & renewal logic; add_pro_payment renewal

CMakeLists.txt

@@ -80,6 +80,7 @@ else()
 endif()
 
 option(WARNINGS_AS_ERRORS "Treat all compiler warnings as errors" OFF)
+option(WARN_UNUSED_PARAMETERS "Enabled unused parameter warnings" ON)
 
 option(STATIC_LIBSTD "Statically link libstdc++/libgcc" ${default_static_libstd})
 

include/session/config/pro.hpp

@@ -8,16 +8,15 @@ namespace session::config {
 
 /// keys used currently or in the past (so that we don't reuse):
 ///
-/// s + session pro data
-///   |
-///   +-- p + proof
-///   |     |
-///   |     +-- @ - version
-///   |     +-- e - expiry unix timestamp (in milliseconds)
-///   |     +-- g - revocation_tag
-///   |     +-- s - proof signature, signed by the Session Pro Backend's ed25519 key
-///   |
-///   +-- r - rotating ed25519 seed (32b)
+/// s - session pro credential: a single opaque, bt-encoded string (NOT a config sub-dict). Storing
+///     it as one value is deliberate: config dicts merge per-key and non-atomically, so a proof
+///     split across sibling keys could end up with its signature stitched onto a *different*
+///     update's fields (or its seed desynced from the pubkey the sig authorizes). As one lone
+///     string the whole credential moves as an indivisible unit. The bt-encoded dict inside is:
+///       e - proof expiry unix timestamp (seconds)
+///       g - revocation_tag (32 bytes)
+///       r - rotating ed25519 seed (32 bytes); the rotating pubkey is derived from it
+///       s - proof signature by the Session Pro Backend's ed25519 key (64 bytes)
 class ProConfig {
   public:
     /// Rotating private key for the public key specified in the proof. On the wire we store the
@@ -27,7 +26,14 @@ class ProConfig {
     /// A cryptographic proof for entitling an Ed25519 key to Session Pro
     ProProof proof;
 
-    bool load(const dict& root);
+    /// Parse the credential from its bt-encoded config value (the "s" key). Returns false if the
+    /// value is empty, not well-formed bt, or missing/wrong-sized fields -- the caller treats that
+    /// as "no usable proof" (e.g. an older client's dict-shaped value, which self-heals on the next
+    /// proof fetch).
+    bool load(std::string_view bt_encoded);
+
+    /// Serialise the credential to the bt-encoded string stored at the "s" config key.
+    std::string serialize() const;
 
     bool operator==(const ProConfig& other) const {
         return rotating_privkey == other.rotating_privkey && proof == other.proof;

include/session/config/user_profile.h

@@ -399,6 +399,73 @@ LIBSESSION_EXPORT int64_t user_profile_get_pro_access_expiry(const config_object
 LIBSESSION_EXPORT void user_profile_set_pro_access_expiry(
         config_object* conf, int64_t access_expiry_ts);
 
+/// API: user_profile/user_profile_get_refund_requested
+///
+/// Retrieves the timestamp at which the user requested a refund of their current Session Pro
+/// subscription.  This state is synced across the user's devices via config (not the Pro backend).
+/// A stored value more than a week in the past is ignored (returns 0).
+///
+/// Inputs:
+/// - `conf` -- [in] Pointer to the config object
+///
+/// Outputs:
+/// - `int64_t` - the unix timestamp (seconds) at which a refund was requested, or 0 if no refund
+/// has been requested (or the stored value is stale).
+LIBSESSION_EXPORT int64_t user_profile_get_refund_requested(const config_object* conf);
+
+/// API: user_profile/user_profile_set_refund_requested
+///
+/// Records (or clears) that the user has requested a refund of their current Session Pro
+/// subscription, propagating it to the user's other devices via config sync.  The client should
+/// clear it (passing 0) when a new subscription begins.
+///
+/// Inputs:
+/// - `conf` -- [in] Pointer to the config object
+/// - `refund_ts` -- the timestamp (unix epoch seconds) at which the refund was requested, or 0 to
+/// clear the refund-requested state.
+LIBSESSION_EXPORT void user_profile_set_refund_requested(config_object* conf, int64_t refund_ts);
+
+/// API: user_profile/user_profile_get_pro_prepaid
+///
+/// Retrieves the timestamp at which a Session Pro purchase was initiated (the "purchase in flight"
+/// marker), synced across the user's devices. A stored value more than a week in the past is
+/// ignored (returns 0).
+///
+/// Inputs:
+/// - `conf` -- [in] Pointer to the config object
+///
+/// Outputs:
+/// - `int64_t` - the unix timestamp (seconds) at which a purchase was initiated, or 0 if none is
+/// pending (or the stored value is stale).
+LIBSESSION_EXPORT int64_t user_profile_get_pro_prepaid(const config_object* conf);
+
+/// API: user_profile/user_profile_set_pro_prepaid
+///
+/// Records (or clears) that a Session Pro purchase is in flight so the user's other devices poll
+/// the backend to pull the entitlement through. A no-op if the account is already Pro; cleared
+/// automatically once entitlement lands, or explicitly by passing 0.
+///
+/// Inputs:
+/// - `conf` -- [in] Pointer to the config object
+/// - `prepaid_ts` -- the timestamp (unix epoch seconds) at which the purchase was initiated, or 0
+/// to clear the marker.
+LIBSESSION_EXPORT void user_profile_set_pro_prepaid(config_object* conf, int64_t prepaid_ts);
+
+/// API: user_profile/user_profile_get_pro_renewal_target
+///
+/// Decide when to (re)request a Session Pro proof (see the C++ pro_renewal_target). Given `now`,
+/// returns the unix timestamp (seconds) at which a renewal should be attempted -- renew now if it
+/// is <= now, otherwise schedule for then -- or 0 if no renewal is needed.
+///
+/// Inputs:
+/// - `conf` -- [in] Pointer to the config object
+/// - `now` -- the caller's current unix timestamp (seconds)
+///
+/// Outputs:
+/// - `int64_t` - the renewal-target unix timestamp, or 0 for "no renewal needed".
+LIBSESSION_EXPORT int64_t
+user_profile_get_pro_renewal_target(const config_object* conf, int64_t now);
+
 #ifdef __cplusplus
 }  // extern "C"
 #endif

include/session/config/user_profile.hpp

@@ -25,10 +25,21 @@ using namespace std::literals;
 ///     omitted if the setting has not been explicitly set (or has been explicitly cleared for some
 ///     reason).
 /// f - session pro features bitset
+/// s - session pro credential (rotating seed + proof) as a single opaque bt-encoded string, stored
+///     as one value so it merges atomically; see config/pro.hpp.
 /// t - The unix timestamp (seconds) that the user last explicitly updated their profile information
 ///     (automatically updates when changing `name`, `profile_pic` or `set_blinded_msgreqs`).
-/// E - user pro access expiry unix timestamp (in milliseconds). Note: This can be different from
-///     the pro proof expiry which can be sooner.
+/// E - user pro access expiry unix timestamp (in seconds). Note: This can be different from the pro
+///     proof expiry which can be sooner. (Some (unreleased) testing clients stored this in
+///     milliseconds; the getter migrates any such value on read -- see get_pro_access_expiry.)
+/// R - unix timestamp (seconds) at which the user requested a refund of their current Session Pro
+///     subscription, for cross-device sync of the refund-requested state.  Omitted when no refund
+///     has been requested; cleared by the client when a new subscription begins.  Values more than
+///     a week in the past are ignored on read (treated as if unset).
+/// I - unix timestamp (seconds) at which a Session Pro purchase was initiated ("purchase in
+///     flight"), so all the account's devices poll the backend to pull the entitlement through.
+///     Inserted only when not already pro; cleared automatically when entitlement lands; values
+///     more than a week in the past are ignored on read.
 /// P - user profile url after re-uploading (should take precedence over `p` when `T > t`).
 /// Q - user profile decryption key (binary) after re-uploading (should take precedence over `q`
 ///     when `T > t`).
@@ -327,6 +338,84 @@ class UserProfile : public ConfigBase {
     /// - `access_expiry_ts` -- The timestamp (unix epoch seconds) that the users Session Pro access
     /// will expire, or nullopt to remove the value.
     void set_pro_access_expiry(std::optional<sys_seconds> access_expiry_ts);
+
+    /// API: user_profile/UserProfile::get_refund_requested
+    ///
+    /// Retrieves the timestamp at which the user requested a refund of their current Session Pro
+    /// subscription, if any.  This is synced across the user's devices so that a refund requested
+    /// on one device is reflected on the others; it does not go through the Pro backend.
+    ///
+    /// A stored value more than a week in the past is ignored (returns nullopt), so that a
+    /// refund-requested flag some client neglected to clear cannot linger indefinitely.
+    ///
+    /// Inputs: None
+    ///
+    /// Outputs:
+    /// - `std::optional<sys_seconds>` - the unix timestamp (seconds) at which a refund was
+    /// requested, or nullopt if no refund has been requested (or the stored value is stale).
+    std::optional<sys_seconds> get_refund_requested() const;
+
+    /// API: user_profile/UserProfile::set_refund_requested
+    ///
+    /// Records (or clears) that the user has requested a refund of their current Session Pro
+    /// subscription.  Setting this propagates the refund-requested state to the user's other
+    /// devices via config sync.  The client is responsible for clearing it (passing nullopt) when a
+    /// new subscription begins so a future subscription does not inherit a stale value.
+    ///
+    /// Inputs:
+    /// - `when` -- the timestamp (unix epoch seconds) at which the refund was requested, or nullopt
+    /// to clear the refund-requested state.
+    void set_refund_requested(std::optional<sys_seconds> when);
+
+    /// API: user_profile/UserProfile::get_pro_prepaid
+    ///
+    /// Retrieves the timestamp at which a Session Pro purchase was initiated (the "purchase in
+    /// flight" marker), synced across the user's devices so that any device can drive the backend
+    /// redemption to completion. A stored value more than a week in the past is ignored (returns
+    /// nullopt) so a purchase that never propagated doesn't make devices poll forever.
+    ///
+    /// Inputs: None
+    ///
+    /// Outputs:
+    /// - `std::optional<sys_seconds>` - the unix timestamp (seconds) at which a purchase was
+    /// initiated, or nullopt if none is pending (or the stored value is stale).
+    std::optional<sys_seconds> get_pro_prepaid() const;
+
+    /// API: user_profile/UserProfile::set_pro_prepaid
+    ///
+    /// Records (or clears) that a Session Pro purchase is in flight, propagating it to the user's
+    /// other devices so they poll the backend to pull the new entitlement through. Setting is a
+    /// no-op if the account is already entitled to Pro (there would be nothing to poll for); it is
+    /// otherwise cleared automatically once entitlement lands (see set_pro_config /
+    /// set_pro_access_expiry), or explicitly by passing nullopt.
+    ///
+    /// Inputs:
+    /// - `when` -- the timestamp (unix epoch seconds) at which the purchase was initiated, or
+    /// nullopt to clear the marker.
+    void set_pro_prepaid(std::optional<sys_seconds> when);
+
+    /// API: user_profile/UserProfile::pro_renewal_target
+    ///
+    /// Decide when the client should (re)request a Session Pro proof, centralising logic clients
+    /// previously each implemented (and got inconsistently wrong). Returns the timestamp at which a
+    /// renewal should be attempted -- if it is <= the caller's clock, renew now; a future value can
+    /// be scheduled -- or nullopt when no renewal is needed. Given the stored proof and access
+    /// expiry:
+    ///   - a present-but-expired proof -> `now` (always re-check with the backend; it may have
+    ///     auto-renewed, and an authoritative not-Pro then clears the credential);
+    ///   - no proof at all but a purchase in flight (prepaid marker) -> `now`;
+    ///   - no proof and no purchase in flight -> nullopt (the account isn't Pro);
+    ///   - a valid proof with access expiry still more than an hour ahead -> an hour before the
+    ///     proof expires (preemptive), nudged off a rotating-seed period boundary so all devices
+    ///     agree;
+    ///   - otherwise (valid proof, entitlement ending or unknown) -> nullopt.
+    ///
+    /// Inputs:
+    /// - `now` -- the caller's current time.
+    ///
+    /// Outputs:
+    /// - `std::optional<sys_seconds>` - when to renew, or nullopt for "no renewal needed".
+    std::optional<sys_seconds> pro_renewal_target(sys_seconds now) const;
 };
 
 }  // namespace session::config

include/session/network/transport/network_transport.hpp

@@ -15,7 +15,7 @@ class ITransport {
     virtual void close_connections() = 0;
 
     virtual ConnectionStatus get_status() const = 0;
-    virtual void set_node_failure_reporter(node_failure_reporter_t reporter) {}
+    virtual void set_node_failure_reporter(node_failure_reporter_t /*reporter*/) {}
     virtual void verify_connectivity(
             service_node node,
             std::chrono::milliseconds timeout,

include/session/network/transport/quic_transport.hpp

@@ -92,7 +92,6 @@ class QuicTransport : public ITransport, public std::enable_shared_from_this<Qui
     void _fail_connection(
             const std::string& address_pubkey_hex,
             const std::string& initiating_req_id,
-            std::optional<oxen::quic::ConnectionID> conn_id,
             std::optional<uint64_t> error_code,
             std::optional<std::string> custom_error);
 };