arminius_server_client/handlers/

room_keys.rs

// SPDX-FileCopyrightText: 2025 BWI GmbH
//
// SPDX-License-Identifier: Apache-2.0

//! Implements APIs for room keys backups.
//!
//! NOTE: This file contains a total of 14 endpoints. We sorted them with the
//! same ordering as in [ruma::api::client::backup].

#![allow(
	clippy::allow_attributes,
	reason = "This source file contains enums which allow `clippy::missing_docs_in_private_items`.
	But an exception to this lint will mistakenly report that it's unfulfilled when used with
	expect, even though it is not."
)]

mod tests;

use std::collections::BTreeMap;

use arminius_lib_component::{
	Component, ServerState,
	error::{InputJsonError, InternalServerError, MatrixApiError, ResultExt as _},
	ruma_requests::ArminiusResponse,
};
use arminius_lib_db::{Database as _, TransactedDb};
use arminius_lib_db_keys::{
	DbRoomKeysBackup, RoomKeysQueries as _, TransactedRoomKeysQueries as _,
};
use axum::{
	Router,
	extract::State,
	routing::{delete, post, put},
};
use itertools::Itertools as _;
use reqwest::StatusCode;
use ruma::{
	OwnedRoomId, UInt, UserId,
	api::{
		client::backup::{
			BackupAlgorithm, KeyBackupData, RoomKeyBackup, add_backup_keys,
			add_backup_keys_for_room, add_backup_keys_for_session, create_backup_version,
			delete_backup_keys, delete_backup_keys_for_room, delete_backup_keys_for_session,
			delete_backup_version, get_backup_info, get_backup_keys, get_backup_keys_for_room,
			get_backup_keys_for_session, get_latest_backup_info, update_backup_version,
		},
		error::{ErrorBody, ErrorKind, StandardErrorBody, WrongRoomKeysVersionErrorData},
	},
	serde::Raw,
};

use crate::client_request::AuthenticatedClientRequest;

/// Error thrown when the version specified does not match the current
/// backup version.
///
/// NOTE: Since this error is turned into a [`ErrorKind::WrongRoomKeysVersion`],
/// we need to manually implement [`MatrixApiError`] for it.
#[derive(Debug, thiserror::Error)]
#[error("Wrong backup version")]
struct WrongBackupVersion {
	/// The current backup version of the user that should have been used.
	error_data: WrongRoomKeysVersionErrorData,
}

impl WrongBackupVersion {
	/// Helper to create a [`WrongBackupVersion`].
	fn new(current_version: String) -> Self {
		Self { error_data: WrongRoomKeysVersionErrorData::new(current_version) }
	}
}

/// Turns a [`WrongBackupVersion`] into a [`ruma::api::error::Error`].
impl MatrixApiError for WrongBackupVersion {
	fn create_matrix_error(&self) -> ruma::api::error::Error {
		ruma::api::error::Error::new(
			StatusCode::FORBIDDEN,
			ErrorBody::Standard(StandardErrorBody::new(
				ErrorKind::WrongRoomKeysVersion(self.error_data.clone()),
				"Wrong backup version".to_owned(),
			)),
		)
	}
}

#[allow(
	clippy::missing_docs_in_private_items,
	reason = "All of the variants of the enum are documented, documenting them here would be redundant."
)]
#[derive(Debug, thiserror::Error, MatrixApiError, arminius_lib_macros::FromDbError)]
enum RoomKeysError {
	#[error(transparent)]
	InternalServerError(#[from] InternalServerError),
	#[error(transparent)]
	InputJsonError(#[from] InputJsonError),
	/// Error returned when requesting an unspecified backup but we find none.
	#[error("No current backup version")]
	#[matrix_api_error(status_code = StatusCode::NOT_FOUND, error_kind = ErrorKind::NotFound)]
	NoBackupFound,

	/// Error returned when the specified backup version was not found.
	#[error("Backup not found")]
	#[matrix_api_error(status_code = StatusCode::NOT_FOUND, error_kind = ErrorKind::NotFound)]
	BackupNotFound,

	/// Error returned when the specified backup's key was not found.
	#[error("Key not found")]
	#[matrix_api_error(status_code = StatusCode::NOT_FOUND, error_kind = ErrorKind::NotFound)]
	KeyNotFound,
	/// Error returned when a specified backup version fails to being parsed.
	#[error("Invalid version string")]
	#[matrix_api_error(status_code = StatusCode::BAD_REQUEST, error_kind = ErrorKind::InvalidParam)]
	InvalidBackupVersion,
	#[error(transparent)]
	WrongBackupVersion(#[from] WrongBackupVersion),
	/// Error returned when given an algorithm that does not match the stored
	/// one.
	#[error("Invalid version string")]
	#[matrix_api_error(status_code = StatusCode::BAD_REQUEST, error_kind = ErrorKind::InvalidParam)]
	AlgorithmMismatch,
}

/// Checks whether we should replace an existing backup's data with the given
/// new one.
///
/// First, if there is no existing current backup, we of course want to keep the
/// new one.
///
/// Then, the rules to decide whether to keep the existing one or to replace it
/// are:
/// - If the keys have different values for `is_verified`, keep the one which `is_verified = true`
/// - Otherwise if they are identical, keep the key with the lowest `first_message_index`
/// - Otherwise if they are identical, keep the key with the lowest `forwarded_count`
fn should_keep_new_backup(
	current_backup: Option<&KeyBackupData>,
	new_backup: &KeyBackupData,
) -> bool {
	current_backup.is_none_or(|existing_backup| {
		new_backup.is_verified && !existing_backup.is_verified
			|| new_backup.first_message_index < existing_backup.first_message_index
			|| new_backup.forwarded_count < existing_backup.forwarded_count
	})
}

/// Handles newly uploaded backup(s) and upserts the new one if they match the
/// rules of [should_keep_new_backup].
///
/// Note that it will only upsert (and hence bump the `etag`) if there is new
/// backup data to store.
///
/// Returns the backup's `etag` and `count` fields, taken from the newly
/// upserted one or the existing one.
async fn handle_new_backups<'a>(
	transaction: &mut TransactedDb<'a>,
	user_id: &UserId,
	current_backup: &DbRoomKeysBackup,
	new_backups: BTreeMap<OwnedRoomId, RoomKeyBackup>,
) -> Result<(i64, u64), RoomKeysError> {
	let mut to_upsert: BTreeMap<_, BTreeMap<_, _>> = BTreeMap::new();

	for (room_id, room_backups) in new_backups {
		for (session_id, backup_data) in room_backups.sessions {
			let new_backup_data = backup_data.deserialize().map_err(InputJsonError::from)?;

			if should_keep_new_backup(
				current_backup.rooms.get(&room_id).and_then(|room_keys| room_keys.get(&session_id)),
				&new_backup_data,
			) {
				to_upsert.entry(room_id.clone()).or_default().insert(
					session_id,
					serde_json::to_value(new_backup_data)
						.unrecoverable_error("Failed to serialize backup data")?,
				);
			}
		}
	}

	let (backup_etag, backup_count) = match to_upsert.is_empty() {
		true => (current_backup.etag, current_backup.keys_count),
		false => transaction.upsert_backup_data(user_id, current_backup.version, to_upsert).await?,
	};

	Ok((backup_etag, backup_count))
}

/// Handler for `PUT /_matrix/client/v3/room_keys/keys` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#put_matrixclientv3room_keyskeys>).
///
/// Store several keys in a backup.
async fn add_backup_keys_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		add_backup_keys::v3::Request,
	>,
) -> Result<ArminiusResponse<add_backup_keys::v3::Response>, RoomKeysError> {
	let req_version =
		request.version.parse::<i64>().map_err(|_e| RoomKeysError::InvalidBackupVersion)?;

	let mut transaction = state.database.begin_transaction().await?;
	let current_backup = transaction
		.fetch_user_backup(&claims.user_id, None, None, None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;

	if req_version != current_backup.version {
		return Err(WrongBackupVersion::new(current_backup.version.to_string()).into());
	}

	let (backup_etag, backup_count) =
		handle_new_backups(&mut transaction, &claims.user_id, &current_backup, request.rooms)
			.await?;

	transaction.commit().await?;

	Ok(add_backup_keys::v3::Response::new(
		backup_etag.to_string(),
		UInt::new(backup_count).unrecoverable_error("Failed to instantiate UInt")?,
	)
	.into())
}

/// Handler for `PUT /_matrix/client/v3/room_keys/keys/{roomId}` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#put_matrixclientv3room_keyskeysroomid>).
///
/// Store several keys in a backup for a given room.
async fn add_backup_keys_for_room_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		add_backup_keys_for_room::v3::Request,
	>,
) -> Result<ArminiusResponse<add_backup_keys_for_room::v3::Response>, RoomKeysError> {
	let req_version =
		request.version.parse::<i64>().map_err(|_e| RoomKeysError::InvalidBackupVersion)?;

	let mut transaction = state.database.begin_transaction().await?;
	let current_backup = transaction
		.fetch_user_backup(&claims.user_id, None, None, None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;

	if req_version != current_backup.version {
		return Err(WrongBackupVersion::new(current_backup.version.to_string()).into());
	}

	let (backup_etag, backup_count) = handle_new_backups(
		&mut transaction,
		&claims.user_id,
		&current_backup,
		BTreeMap::from([(request.room_id, RoomKeyBackup::new(request.sessions))]),
	)
	.await?;

	transaction.commit().await?;

	Ok(add_backup_keys_for_room::v3::Response::new(
		backup_etag.to_string(),
		UInt::new(backup_count).unrecoverable_error("Failed to instantiate UInt")?,
	)
	.into())
}

/// Handler for `PUT /_matrix/client/v3/room_keys/keys/{roomId}/{sessionId}`
/// (See <https://spec.matrix.org/v1.18/client-server-api/#put_matrixclientv3room_keyskeysroomidsessionid>).
///
/// Store a key in a backup.
async fn add_backup_keys_for_session_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		add_backup_keys_for_session::v3::Request,
	>,
) -> Result<ArminiusResponse<add_backup_keys_for_session::v3::Response>, RoomKeysError> {
	let req_version =
		request.version.parse::<i64>().map_err(|_e| RoomKeysError::InvalidBackupVersion)?;

	let mut transaction = state.database.begin_transaction().await?;
	let current_backup = transaction
		.fetch_user_backup(&claims.user_id, None, None, None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;

	if req_version != current_backup.version {
		return Err(WrongBackupVersion::new(current_backup.version.to_string()).into());
	}

	let (new_etag, new_count) = handle_new_backups(
		&mut transaction,
		&claims.user_id,
		&current_backup,
		BTreeMap::from([(
			request.room_id,
			RoomKeyBackup::new(BTreeMap::from([(request.session_id, request.session_data)])),
		)]),
	)
	.await?;

	transaction.commit().await?;

	Ok(add_backup_keys_for_session::v3::Response::new(
		new_etag.to_string(),
		UInt::new(new_count).unrecoverable_error("Failed to instantiate UInt")?,
	)
	.into())
}

/// Handler for `POST /_matrix/client/v3/room_keys/version` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#post_matrixclientv3room_keysversion>).
///
/// Inserts a new backup in the database.
async fn create_backup_version_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		create_backup_version::v3::Request,
	>,
) -> Result<ArminiusResponse<create_backup_version::v3::Response>, RoomKeysError> {
	let algorithm = request.algorithm.deserialize().map_err(InputJsonError::from)?;

	let auth_data =
		serde_json::to_value(algorithm).unrecoverable_error("Failed to serialize algorithm")?;

	let version = state
		.database
		.insert_backup(&claims.user_id, &auth_data)
		.await
		.unrecoverable_error("Failed to insert new backup")?;

	Ok(create_backup_version::v3::Response::new(version).into())
}

/// Handler for `DELETE /_matrix/client/v3/room_keys/keys` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#delete_matrixclientv3room_keyskeys>).
///
/// Delete the keys from a backup.
async fn delete_backup_keys_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		delete_backup_keys::v3::Request,
	>,
) -> Result<ArminiusResponse<delete_backup_keys::v3::Response>, RoomKeysError> {
	let version =
		request.version.parse::<i64>().map_err(|_e| RoomKeysError::InvalidBackupVersion)?;

	let (new_etag, new_count) = state
		.database
		.delete_backup_keys(&claims.user_id, version, None, None)
		.await?
		.ok_or(RoomKeysError::BackupNotFound)?;

	Ok(delete_backup_keys::v3::Response::new(
		new_etag.to_string(),
		UInt::new(new_count).unrecoverable_error("Creating UInt")?,
	)
	.into())
}

/// Handler for `DELETE /_matrix/client/v3/room_keys/keys/{roomId}` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#delete_matrixclientv3room_keyskeysroomid>).
///
/// Delete the keys from a backup for a given room.
async fn delete_backup_keys_for_room_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		delete_backup_keys_for_room::v3::Request,
	>,
) -> Result<ArminiusResponse<delete_backup_keys_for_room::v3::Response>, RoomKeysError> {
	let version =
		request.version.parse::<i64>().map_err(|_e| RoomKeysError::InvalidBackupVersion)?;

	let (new_etag, new_count) = state
		.database
		.delete_backup_keys(&claims.user_id, version, Some(request.room_id), None)
		.await?
		.ok_or(RoomKeysError::BackupNotFound)?;

	Ok(delete_backup_keys_for_room::v3::Response::new(
		new_etag.to_string(),
		UInt::new(new_count).unrecoverable_error("Creating UInt")?,
	)
	.into())
}

/// Handler for `DELETE /_matrix/client/v3/room_keys/keys/{roomId}/{sessionId}`
/// (See <https://spec.matrix.org/v1.18/client-server-api/#delete_matrixclientv3room_keyskeysroomidsessionid>).
///
/// Delete a key from a backup.
async fn delete_backup_keys_for_session_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		delete_backup_keys_for_session::v3::Request,
	>,
) -> Result<ArminiusResponse<delete_backup_keys_for_session::v3::Response>, RoomKeysError> {
	let version =
		request.version.parse::<i64>().map_err(|_e| RoomKeysError::InvalidBackupVersion)?;

	let (new_etag, new_count) = state
		.database
		.delete_backup_keys(
			&claims.user_id,
			version,
			Some(request.room_id),
			Some(request.session_id),
		)
		.await?
		.ok_or(RoomKeysError::BackupNotFound)?;

	Ok(delete_backup_keys_for_session::v3::Response::new(
		new_etag.to_string(),
		UInt::new(new_count).unrecoverable_error("Creating UInt")?,
	)
	.into())
}

/// Handler for `DELETE /_matrix/client/v3/room_keys/version/{version}` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#delete_matrixclientv3room_keysversionversion>).
///
/// Delete a specific backup.
async fn delete_backup_version_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		delete_backup_version::v3::Request,
	>,
) -> Result<ArminiusResponse<delete_backup_version::v3::Response>, RoomKeysError> {
	let mut transaction = state.database.begin_transaction().await?;

	let last_user_backup_version =
		transaction.fetch_max_user_backup_version(&claims.user_id).await?;

	let req_version: i64 =
		request.version.parse().map_err(|_err| RoomKeysError::InvalidBackupVersion)?;

	if req_version < 1 || req_version > last_user_backup_version {
		return Err(RoomKeysError::BackupNotFound);
	}

	transaction.delete_user_backup(&claims.user_id, req_version).await?;

	transaction.commit().await?;

	Ok(delete_backup_version::v3::Response::new().into())
}

/// Handler for `GET /_matrix/client/v3/room_keys/version/{version}` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv3room_keysversionversion>).
///
/// Gets information about a specific backup.
async fn get_backup_info_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		get_backup_info::v3::Request,
	>,
) -> Result<ArminiusResponse<get_backup_info::v3::Response>, RoomKeysError> {
	let version = request.version.parse().map_err(|_err| RoomKeysError::InvalidBackupVersion)?;

	let mut transaction = state.database.begin_transaction().await?;
	let backup = transaction
		.fetch_user_backup(&claims.user_id, Some(version), None, None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;
	transaction.commit().await?;

	let algorithm = Raw::<BackupAlgorithm>::from_json(
		serde_json::value::to_raw_value(&backup.auth_data)
			.unrecoverable_error("Failed to convert backup data to raw")?,
	);

	Ok(get_backup_info::v3::Response::new(
		algorithm,
		UInt::new(backup.keys_count).unrecoverable_error("Failed to create UInt")?,
		backup.etag.to_string(),
		backup.version.to_string(),
	)
	.into())
}

/// Handler for `GET /_matrix/client/v3/room_keys/keys` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv3room_keyskeys>).
///
/// Retrieve the keys from a backup.
async fn get_backup_keys_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		get_backup_keys::v3::Request,
	>,
) -> Result<ArminiusResponse<get_backup_keys::v3::Response>, RoomKeysError> {
	let version = request.version.parse().map_err(|_err| RoomKeysError::InvalidBackupVersion)?;

	let mut transaction = state.database.begin_transaction().await?;
	let backup = transaction
		.fetch_user_backup(&claims.user_id, Some(version), None, None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;
	transaction.commit().await?;

	let backups = backup
		.rooms
		.into_iter()
		.map(|(room_id, room_backups)| {
			let sessions = room_backups
				.into_iter()
				.map(|(session_id, backup_data)| {
					let raw =
						Raw::new(&backup_data).unrecoverable_error("Failed to convert to raw")?;

					Ok((session_id, raw))
				})
				.collect::<Result<_, InternalServerError>>()?;

			Ok((room_id, RoomKeyBackup::new(sessions)))
		})
		.collect::<Result<_, InternalServerError>>()?;

	Ok(get_backup_keys::v3::Response::new(backups).into())
}

/// Handler for `GET /_matrix/client/v3/room_keys/keys/{roomId}` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv3room_keyskeysroomid>).
///
/// Retrieve the keys from a backup for a given room.
async fn get_backup_keys_for_room_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		get_backup_keys_for_room::v3::Request,
	>,
) -> Result<ArminiusResponse<get_backup_keys_for_room::v3::Response>, RoomKeysError> {
	let version = request.version.parse().map_err(|_err| RoomKeysError::InvalidBackupVersion)?;

	let mut transaction = state.database.begin_transaction().await?;
	let backup = transaction
		.fetch_user_backup(&claims.user_id, Some(version), Some(request.room_id), None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;
	transaction.commit().await?;

	let backups = backup
		.rooms
		.into_values()
		.at_most_one()
		.unrecoverable_error("Query should have filtered a single room")?
		.map(|room_backups| {
			room_backups
				.into_iter()
				.map(|(session_id, backup_data)| {
					let raw =
						Raw::new(&backup_data).unrecoverable_error("Failed to convert to raw")?;

					Ok((session_id, raw))
				})
				.collect::<Result<_, InternalServerError>>()
		})
		.transpose()?
		.unwrap_or(BTreeMap::new());

	Ok(get_backup_keys_for_room::v3::Response::new(backups).into())
}

/// Handler for `GET /_matrix/client/v3/room_keys/keys/{roomId}/{sessionId}`
/// (See <https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv3room_keyskeysroomidsessionid>).
///
/// Retrieve a key from a backup.
async fn get_backup_keys_for_session_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		get_backup_keys_for_session::v3::Request,
	>,
) -> Result<ArminiusResponse<get_backup_keys_for_session::v3::Response>, RoomKeysError> {
	let version = request.version.parse().map_err(|_err| RoomKeysError::InvalidBackupVersion)?;

	let mut transaction = state.database.begin_transaction().await?;
	let backup = transaction
		.fetch_user_backup(
			&claims.user_id,
			Some(version),
			Some(request.room_id),
			Some(request.session_id),
		)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;
	transaction.commit().await?;

	let backup = backup
		.rooms
		.into_values()
		.at_most_one()
		.unrecoverable_error("Query should have filtered a single room")?
		.map(|room_backups| -> Result<_, InternalServerError> {
			room_backups
				.into_values()
				.at_most_one()
				.unrecoverable_error("Query should have filtered a single session")?
				.map(|backup_data| -> Result<_, InternalServerError> {
					Raw::new(&backup_data).unrecoverable_error("Failed to convert to raw")
				})
				.transpose()
		})
		.transpose()?
		.flatten()
		.ok_or(RoomKeysError::KeyNotFound)?;

	Ok(get_backup_keys_for_session::v3::Response::new(backup).into())
}

/// Handler for `GET /_matrix/client/v3/room_keys/version` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv3room_keysversion>).
///
/// Gets the latest room keys backup information.
async fn get_latest_backup_info_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, _request): AuthenticatedClientRequest<
		get_latest_backup_info::v3::Request,
	>,
) -> Result<ArminiusResponse<get_latest_backup_info::v3::Response>, RoomKeysError> {
	let mut transaction = state.database.begin_transaction().await?;
	let backup_info = transaction
		.fetch_user_backup(&claims.user_id, None, None, None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;
	transaction.commit().await?;

	let algorithm = Raw::<BackupAlgorithm>::from_json(
		serde_json::value::to_raw_value(&backup_info.auth_data)
			.unrecoverable_error("Failed to convert backup data to raw")?,
	);

	Ok(get_latest_backup_info::v3::Response::new(
		algorithm,
		UInt::new(backup_info.keys_count).unrecoverable_error("Failed to create UInt")?,
		backup_info.etag.to_string(),
		backup_info.version.to_string(),
	)
	.into())
}

/// Handler for `PUT /_matrix/client/v3/room_keys/version/{version}` (See
/// <https://spec.matrix.org/v1.18/client-server-api/#put_matrixclientv3room_keysversionversion>).
///
/// Update information about an existing backup.
///
/// NOTE: Only `auth_data` can be modified.
async fn update_backup_version_handler(
	mut state: State<ServerState>,
	AuthenticatedClientRequest(claims, request): AuthenticatedClientRequest<
		update_backup_version::v3::Request,
	>,
) -> Result<ArminiusResponse<update_backup_version::v3::Response>, RoomKeysError> {
	let version = request.version.parse().map_err(|_err| RoomKeysError::InvalidBackupVersion)?;

	// Fetch the backup to make sure it exists and the fields other than
	// `auth_data` are identical.
	let mut transaction = state.database.begin_transaction().await?;
	let backup_info = transaction
		.fetch_user_backup(&claims.user_id, Some(version), None, None)
		.await?
		.ok_or(RoomKeysError::NoBackupFound)?;

	let db_algorithm: BackupAlgorithm = serde_json::from_value(backup_info.auth_data)
		.unrecoverable_error("Invalid auth_data in database")?;

	let req_algorithm = request.algorithm.deserialize().map_err(InputJsonError::from)?;

	if db_algorithm.algorithm() != req_algorithm.algorithm() {
		return Err(RoomKeysError::AlgorithmMismatch);
	}

	let new_auth_data =
		serde_json::to_value(req_algorithm).unrecoverable_error("Failed to serialize algorithm")?;
	transaction.update_user_backup(&claims.user_id, version, &new_auth_data).await?;

	transaction.commit().await?;

	Ok(update_backup_version::v3::Response::new().into())
}

/// Component implementing the room keys backups
#[derive(Debug)]
pub struct RoomKeysComponent;

impl Component for RoomKeysComponent {
	fn router() -> Router<ServerState> {
		Router::new()
			.route(
				"/_matrix/client/v3/room_keys/version",
				post(create_backup_version_handler).get(get_latest_backup_info_handler),
			)
			.route(
				"/_matrix/client/v3/room_keys/keys",
				put(add_backup_keys_handler)
					.delete(delete_backup_keys_handler)
					.get(get_backup_keys_handler),
			)
			.route(
				"/_matrix/client/v3/room_keys/keys/{roomId}",
				put(add_backup_keys_for_room_handler)
					.delete(delete_backup_keys_for_room_handler)
					.get(get_backup_keys_for_room_handler),
			)
			.route(
				"/_matrix/client/v3/room_keys/keys/{roomId}/{sessionId}",
				put(add_backup_keys_for_session_handler)
					.delete(delete_backup_keys_for_session_handler)
					.get(get_backup_keys_for_session_handler),
			)
			.route(
				"/_matrix/client/v3/room_keys/version/{version}",
				delete(delete_backup_version_handler)
					.get(get_backup_info_handler)
					.put(update_backup_version_handler),
			)
	}
}