attester/initial/legacy_submit and welcome message changes

[tomholub]

I'd like to move away from it, but I suspect we still use it on Android. If yes, please show the context where used.

[DenBond7]

1. Here we call this API after a user created a private key
   

   flowcrypt-android/FlowCrypt/src/main/java/com/flowcrypt/email/jetpack/viewmodel/PrivateKeysViewModel.kt

   Line 431 in fc7c69c

   val initialLegacySubmitResult = apiRepository.postInitialLegacySubmit(getApplication(), model)

2. ref submit pubkey when a user is adding a new private key from the settings #773. We were going to use this API when a user adds a new private key from the settings.

[tomholub]

Are you using https://flowcrypt.com/attester/ or https://attester.flowcrypt.com ?

[DenBond7]

I use this one https://flowcrypt.com/attester/

flowcrypt-android/FlowCrypt/build.gradle

Line 105 in 9956c47

buildConfigField 'String', 'ATTESTER_URL', "\"https://flowcrypt.com/attester/\""

[tomholub]

Thanks. In either case it will need to be changed as follows. The methods should be named the same also. Notice one of them contains id_token and is used for the primary account email, and the other method does not use id_token and is used for aliases.

  /**
   * Set or replace public key with idToken as an auth mechanism
   * Used during setup
   * Can only be used for primary email because idToken does not contain info about aliases
   */
  public submitPrimaryEmailPubkey = async (email: string, pubkey: string, idToken: string): Promise<void> => {
    if (!this.clientConfiguration.canSubmitPubToAttester()) {
      throw new Error('Cannot replace pubkey at attester because your organisation rules forbid it');
    }
    await this.pubCall(`pub/${email}`, 'POST', pubkey, { authorization: `Bearer ${idToken}` });
  };

  /**
   * Request to replace pubkey that will be verified by clicking email
   * Used when user manually chooses to replace key
   * Can also be used for aliases
   */
  public submitPubkeyWithConditionalEmailVerification = async (email: string, pubkey: string): Promise<string> => {
    if (!this.clientConfiguration.canSubmitPubToAttester()) {
      throw new Error('Cannot replace pubkey at attester because your organisation rules forbid it');
    }
    const r = await this.pubCall(`pub/${email}`, 'POST', pubkey);
    return r.responseText;
  };

Then please completely drop the initial_submit endpoint code. You can do this after the drafts work, but in the same release.

[DenBond7]

Got it. Will do.

[tomholub]

Also attester/initial/welcome should become attester/welcome-message and it should include Bearer id_token auth header (not enforced yet but will eventually enforce)

[DenBond7]

@tomholub Using idToken means pub/${email} and attester/welcome-message can be used only for accounts that use the Google Sign-In option. What about other email providers?

[tomholub]

for submitting public key on accounts that don't have id token, you can always use submitPubkeyWithConditionalEmailVerification

you may skip welcome-message calls on accounts that don't have an idToken

[DenBond7]

• attester/pub
• attester/welcome-message

[DenBond7]

@tomholub For submitPrimaryEmailPubkey I receive the following error
<-- 401 Unauthorized https://flowcrypt.com/attester/pub/...@gmail.com (154ms)

{
   "error":{
      "message":"Could not verify idToken JWT: JsonWebTokenError: jwt audience invalid. expected: 717284730244-5oejn54f10gnrektjdc4fv4rbic1bj1p.apps.googleusercontent.com or 717284730244-ostjo2fdtr3ka4q9td69tdr9acmmru2p.apps.googleusercontent.com or 679326713487-5r16ir2f57bpmuh2d6dal1bcm9m1ffqc.apps.googleusercontent.com"
   }
}

Is it Ok?