avoid no pubkey with guards, make sure primary and secondary authorization match

js/modules/loki_app_dot_net_api.js

@@ -860,6 +860,7 @@ class LokiPublicChannelAPI {
 
       if (pendingMessages.length) {
         const newSlavePrimaryMap = {};
+        const checkSigs = {};
 
         // console.log('premultiDeviceResults', pubKeys)
         if (pubKeys.length) {
@@ -878,6 +879,10 @@ class LokiPublicChannelAPI {
                     const { authorisations } = note.value;
                     if (Array.isArray(authorisations)) {
                       authorisations.forEach(auth => {
+                        if (auth.secondaryDevicePubKey !== user.username) {
+                          // this is not the authorization we're looking for
+                          return;
+                        }
                         // console.log('auth', auth);
                         try {
                           // request (secondary wants to be paired with this primary)
@@ -907,6 +912,7 @@ class LokiPublicChannelAPI {
                             );
                             return;
                           }
+                          checkSigs[user.username] = auth;
                           newSlavePrimaryMap[user.username] =
                             auth.primaryDevicePubKey;
                         } catch (e) {
@@ -956,6 +962,7 @@ class LokiPublicChannelAPI {
           pendingMessages = []; // free memory
 
           const verifiedPrimaryPKs = [];
+          if (primaryPubKeys.length) {
             // get a list of all of primary pubKeys to verify the secondaryDevice
             const primaryDeviceResults = await lokiFileServerAPI.getDeviceMappingForUsers(
               primaryPubKeys
@@ -991,6 +998,21 @@ class LokiPublicChannelAPI {
                                 `@${auth.primaryDevicePubKey}`
                               );
                             }
+                            // assuming both are ordered
+                            // make sure our secondary and primary authorization match
+                            if (
+                              JSON.stringify(
+                                checkSigs[auth.secondaryDevicePubKey]
+                              ) !== JSON.stringify(auth)
+                            ) {
+                              // should hopefully never happen
+                              log.warn(
+                                `Valid authorizations from ${
+                                  auth.secondaryDevicePubKey
+                                } does not match ${auth.primaryDevicePubKey}`
+                              );
+                              return;
+                            }
                             found = true;
                           } catch (e) {
                             log.warn(
@@ -1018,6 +1040,7 @@ class LokiPublicChannelAPI {
                 }
               });
             });
+          }
 
           // update this.slavePrimaryMap live with updated map
           this.slavePrimaryMap = newSlavePrimaryMap;
@@ -1025,9 +1048,11 @@ class LokiPublicChannelAPI {
             `Updated device mappings ${JSON.stringify(this.slavePrimaryMap)}`
           );
 
+          // if we have verified primaryKeys then update them
+          if (verifiedPrimaryPKs.length) {
             // get final list of verified chat server profile names
             const verifiedDeviceResults = await this.serverAPI.getUsersAnnotations(
-            pubKeys
+              verifiedPrimaryPKs
             );
             // console.log('verifiedDeviceResults', verifiedDeviceResults)
 
@@ -1038,6 +1063,7 @@ class LokiPublicChannelAPI {
             });
             // replace whole
             this.primaryUserProfileName = newPrimaryUserProfileName;
+          }
 
           // process remaining messages
           const ourNumber = textsecure.storage.user.getNumber();