Did not pass session key when decrypting encrypted instance of type

[charlag]

Client: Browser
Tutanota version: 3.119.3
User agent:
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0
ProgrammingError
Error message: Did not pass session key when decrypting encrypted instance of type tutanota/Mail
Stacktrace:
ProgrammingError. Did not pass session key when decrypting encrypted instance of type tutanota/Mail

Client: android
Tutanota version: 3.118.27
User agent:
Mozilla/5.0 (Linux; Android 13; SM-G781W Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/119.0.6045.193 Mobile Safari/537.36
ProgrammingError
Error message: Did not pass session key when decrypting encrypted instance of type tutanota/Mail
Stacktrace:
ProgrammingError: Did not pass session key when decrypting encrypted instance of type tutanota/Mail
at ga.decryptAndMapToInstance (https://assets.tutanota.com/worker.js:12:29673)
at Ls._decryptMapAndMigrate (https://assets.tutanota.com/worker.js:1:26974)
at async https://assets.tutanota.com/common-min-160da492.js:1:18587

Client: Browser
Tutanota version: 3.118.30
User agent:
Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
ProgrammingError
Error message: Did not pass session key when decrypting encrypted instance of type tutanota/File
Stacktrace:
ProgrammingError. Did not pass session key when decrypting encrypted instance of type tutanota/File

[charlag]

here:

tutanota/src/api/worker/rest/EntityRestClient.ts

Lines 269 to 287 in ce7bc41

	async _decryptMapAndMigrate<T>(instance: any, model: TypeModel, ownerEncSessionKeyProvider?: OwnerEncSessionKeyProvider): Promise<T> {
	let sessionKey: Aes128Key | Aes256Key | null
	if (ownerEncSessionKeyProvider) {
	sessionKey = this._crypto.decryptSessionKey(instance, await ownerEncSessionKeyProvider(getElementId(instance)))
	} else {
	try {
	sessionKey = await this._crypto.resolveSessionKey(model, instance)
	} catch (e) {
	if (e instanceof SessionKeyNotFoundError) {
	console.log("could not resolve session key", e)
	sessionKey = null // will result in _errors being set on the instance
	} else {
	throw e
	}
	}
	}
	const decryptedInstance = await this.instanceMapper.decryptAndMapToInstance<T>(model, instance, sessionKey)
	return this._crypto.applyMigrationsForInstance<T>(decryptedInstance)
	}

the comment is wrong, we will just fail

[mpfau]

This is not a MailDetails problem, it also occurs for non MailDetails customers.

If it was a MailDetails customer, I could only find errors regarding decryption of the Mail instance.

I will add some more log output so that we have a better chance of diagnosing when no session key is found.

[mpfau]

We still have around ten of those cases per day. One thing that is remarkable is that all customers that I looked up never invoked UpdateSessionKeysService for those mails (ownerEncSK is null for all mails and also the file instances). This might have happened because the clients were no leaders at the time they decrypted the mails or because an invocation of the UpdateSessionKeysService failed.

With this fix, we will enforce updating the _ownerEncSessionKey for File instances whenever we try to decrypt data (single download, download all, inline images, export).

Other ideas for improvement if this does not help:

1. We found that we store instances with _errors in our cache.
2. Invoke UpdateSessionKeysService from non leader clients. It is weird that it is never invoked for the mails mentioned above.
3. Pass the mail with the BucketKey to BlobFacade#downloadAndDecrypt.