BREAKING: implement Native OIDC as per MSC 3861

lib/encryption/utils/bootstrap.dart

@@ -469,12 +469,12 @@ class Bootstrap {
         }
       }
       if (newSsssKey != null) {
-        final storeFutures = <Future<void>>[];
+        Logs().v('Store new SSSS key entries...');
+        // NOTE(TheOneWithTheBraid): do not use Future.wait due to rate limits
+        // and token refresh trouble
         for (final entry in secretsToStore.entries) {
-          storeFutures.add(newSsssKey!.store(entry.key, entry.value));
+          await newSsssKey!.store(entry.key, entry.value);
         }
-        Logs().v('Store new SSSS key entries...');
-        await Future.wait(storeFutures);
       }
 
       final keysToSign = <SignableKey>[];

lib/matrix.dart

@@ -78,6 +78,7 @@ export 'msc_extensions/extension_recent_emoji/recent_emoji.dart';
 export 'msc_extensions/msc_3935_cute_events/msc_3935_cute_events.dart';
 export 'msc_extensions/msc_1236_widgets/msc_1236_widgets.dart';
 export 'msc_extensions/msc_2835_uia_login/msc_2835_uia_login.dart';
+export 'msc_extensions/msc_3861_native_oidc/msc_3861_native_oidc.dart';
 export 'msc_extensions/msc_3814_dehydrated_devices/msc_3814_dehydrated_devices.dart';
 export 'msc_extensions/extension_timeline_export/timeline_export.dart';
 

lib/msc_extensions/README.md

@@ -20,5 +20,13 @@ Please try to cover the following conventions:
 - MSC 1236 - Widget API V2
 - MSC 2835 - UIA login
 - MSC 3814 - Dehydrated Devices
+- MSC 3861 - Next-generation auth for Matrix, based on OAuth 2.0/OIDC
+  - MSC 1597 - Better spec for matrix identifiers
+  - MSC 2964 - Usage of OAuth 2.0 authorization code grant and refresh token grant
+  - MSC 2965 - OAuth 2.0 Authorization Server Metadata discovery
+  - MSC 2966 - Usage of OAuth 2.0 Dynamic Client Registration in Matrix
+  - MSC 2967 - API scopes
+  - MSC 3824 - OIDC aware clients
+  - MSC 4191 - Account management deep-linking
 - MSC 3935 - Cute Events
-- `io.element.recent_emoji` - recent emoji sync in account data
+- `io.element.recent_emoji` - recent emoji sync in account data

lib/msc_extensions/msc_3861_native_oidc/README.md

@@ -0,0 +1,56 @@
+# Implement \[matrix\] OIDC using the Matrix Dart SDK
+
+```dart
+import 'dart:async';
+
+import 'package:flutter/foundation.dart';
+
+import 'package:matrix/matrix.dart';
+import 'package:url_launcher:url_launcher.dart';
+
+Future<void> main() async {
+  final client = Client(
+    // [...]
+  );
+
+  await client.checkHomeserver(myHomeserver);
+
+  final name = 'My [matrix] client on web';
+
+  final registrationData = OidcDynamicRegistrationData.localized(
+    contacts: {myOidcAdminContact},
+    url: 'https://example.com',
+    defaultLocale: myDefaultLocale,
+    localizations: {
+      'fr_FR': LocalizedOidcClientMetadata(
+        // [...]
+      )
+    },
+    redirect: kIsWeb
+        ? { 'http://localhost:0'}
+        : {
+      Uri.parse('com.example:/oauth2redirect/'),
+      Uri.parse('http://localhost/oauth2redirect/'),
+    },
+    applicationType: kIsWeb ? 'web' : 'native',
+  );
+
+  final oidcClientId = await client.oidcEnsureDynamicClientId(
+    registrationData,
+  );
+
+  // You can e.g. use `package:app_links` to forward the called deep link into this completer
+  final nativeCompleter = Completer<OidcCallbackResponse>();
+
+  await client.oidcAuthorizationGrantFlow(
+    nativeCompleter: nativeCompleter,
+    oidcClientId: oidcClientId,
+    redirectUri: client.oAuth2RedirectUri,
+    launchOAuth2Uri: launchUrl,
+    responseMode: kIsWeb ? 'fragment' : 'query',
+    prompt: 'consent',
+    initialDeviceDisplayName: name,
+    enforceNewDeviceId: true,
+  );
+}
+```

lib/msc_extensions/msc_3861_native_oidc/msc1597_matrix_identifier_syntax/msc1597_matrix_identifier_syntax.dart

@@ -0,0 +1,37 @@
+import 'dart:math';
+
+import 'package:matrix/matrix.dart';
+
+extension GenerateDeviceIdExtension on Client {
+  /// Checks whether the client already generated a device ID and creates one in case there is no.
+  /// Returns the generated device ID.
+  ///
+  /// This is particularly useful when authenticating via OIDC since clients must supply a locally generated device ID for login via OIDC.
+  /// - [MSC 2964](https://github.com/matrix-org/matrix-spec-proposals/pull/2964) defines the code grant flow requiring a device ID in the OAuth2.0 scopes
+  /// - [MSC 2967](https://github.com/matrix-org/matrix-spec-proposals/pull/2967) requires a device ID to be present for requesting OAuth2.0 scopes
+  Future<String> oidcEnsureDeviceId([bool enforceNewDevice = false]) async {
+    if (!enforceNewDevice) {
+      final storedDeviceId =
+          deviceID ?? await database.getClientData(ClientData.deviceId);
+      if (storedDeviceId is String) {
+        Logs().d('[OIDC] Restoring device ID $storedDeviceId.');
+        return storedDeviceId;
+      }
+    }
+
+    // [MSC 1597](https://github.com/matrix-org/matrix-spec-proposals/pull/1597)
+    //
+    // [A-Z] but without I and O (smth too similar to 1 and 0)
+    const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ';
+    final deviceId = String.fromCharCodes(
+      List.generate(
+        10,
+        (_) => chars.codeUnitAt(Random().nextInt(chars.length)),
+      ),
+    );
+
+    await database.putClientData(ClientData.deviceId, deviceId);
+    Logs().d('[OIDC] Generated device ID $deviceId.');
+    return deviceId;
+  }
+}