contact verification process triggered twice per each single QR scan

[adbenitez]

for bots it is common to send an introduction or help message when users scan the bot contact QR or invitation link, the problem is that with latest core the secure-join protocol is triggered twice per QR scan and then the bot receives two SECUREJOIN_INVITER_PROGRESS(progress==1000) events per each single QR scan

first time it says:
[03/26/24 09:27:00] DEBUG src/securejoin.rs:292: Received secure-join message "vc-request-with-auth".
second time it says:
[03/26/24 09:27:01] DEBUG src/securejoin.rs:570: Observing secure-join message "vc-contact-confirm".

• Delta Chat Version: 1.136.6 (deltachat-rpc-server)
• Logs:

[03/26/24 09:27:00] DEBUG    src/imap.rs:1241: Starting a full FETCH of message set "26".                           
[03/26/24 09:27:00] DEBUG    src/imap.rs:1354: Passing message UID 26 to receive_imf().                             
[03/26/24 09:27:00] DEBUG    src/receive_imf.rs:220: Receiving message "Mr.JFWDfFPdnLk.8pTAm7Qi99j@localhost",      
                             seen=false...                                                                          
[03/26/24 09:27:00] DEBUG    src/securejoin.rs:292: Received secure-join message "vc-request-with-auth".            
[03/26/24 09:27:00] DEBUG    src/securejoin.rs:403: Fingerprint verified.                                           
[03/26/24 09:27:00] DEBUG    src/securejoin.rs:450: Auth verified.                                                  
[03/26/24 09:27:00] DEBUG    src/chat.rs:526: Protection status unchanged for Chat#11.                              
[03/26/24 09:27:00] DEBUG    src/ephemeral.rs:567: Ephemeral loop waiting for deletion in 23h 50m 5s or interrupt   
[03/26/24 09:27:00] DEBUG    src/mimefactory.rs:1087: Sending secure-join message "vc-contact-confirm".             
[03/26/24 09:27:00] DEBUG    src/e2ee.rs:66: Peerstate for "X@nine.testrun.org" is mutual.                  
[03/26/24 09:27:00] DEBUG    src/chat.rs:1316: Set gossiped_timestamp for chat Chat#11 to 1711445220.               
[03/26/24 09:27:00] INFO     QR SCANNED: {'contact_id': 10, 'kind': 'SecurejoinInviterProgress', 'progress': 1000}                                                         
[03/26/24 09:27:00] DEBUG    src/scheduler.rs:793: smtp fake idle - interrupted                                     
[03/26/24 09:27:00] DEBUG    src/smtp.rs:696: Selected rows from SMTP queue: [17].
.... (here the bots sends a welcome message) ...
[03/26/24 09:27:01] DEBUG    src/scheduler.rs:761: smtp fake idle - started                                         
[03/26/24 09:27:01] DEBUG    src/scheduler.rs:789: smtp has no messages to retry, waiting for interrupt             
[03/26/24 09:27:01] DEBUG    src/imap.rs:1241: Starting a full FETCH of message set "27".                           
[03/26/24 09:27:01] DEBUG    src/imap.rs:1354: Passing message UID 27 to receive_imf().                             
[03/26/24 09:27:01] DEBUG    src/receive_imf.rs:220: Receiving message                                              
                             "Mr.AD-eXxXM8yb.Mc8PKfLIPTj@nine.testrun.org", seen=false...                           
[03/26/24 09:27:01] DEBUG    src/securejoin.rs:570: Observing secure-join message "vc-contact-confirm".             
[03/26/24 09:27:01] DEBUG    src/chat.rs:526: Protection status unchanged for Chat#11.                              
[03/26/24 09:27:01] INFO     QR SCANNED: {'contact_id': 10, 'kind': 'SecurejoinInviterProgress', 'progress': 1000}

[link2xt]

This looks like you are running bot account on two devices. Are you logged into the same account on your desktop/phone as well? If this is the case, it is a duplicate of #5356.

QR codes are synchronized between devices, this is why vc-contact-confirm is sent by the other device too.

[adbenitez]

@link2xt there is not multi-device but thanks to your hint I realized the issue:

since it is the bot policy to not keep user data, I am deleting messages immediately after they are sent, but this causes the secure-join message that was just sent to be deleted and then received again due to send-copy-to-self and triggers the qr scan twice

small bot code reproducing the problem:

# to run this first install: pip install -U deltabot-cli
from deltachat2 import EventType, MsgData, events
from deltabot_cli import BotCli

cli = BotCli("echobot")


@cli.on(events.RawEvent)
def log_event(bot, accid, event):
    if event.kind == EventType.MSG_DELIVERED:
        msg = bot.rpc.get_message(accid, event.msg_id)
        bot.logger.info("deleting sent message: %s", msg.text)
        bot.rpc.delete_messages(accid, [event.msg_id])
    elif event.kind == EventType.SECUREJOIN_INVITER_PROGRESS:
        if event.progress == 1000:  # bot's QR scanned by an user
            bot.logger.info("QR scanned, contact=%s", event.contact_id)
            chatid = bot.rpc.create_chat_by_contact_id(accid, event.contact_id)
            bot.rpc.send_msg(accid, chatid, MsgData(text="You scanned my QR"))


if __name__ == "__main__":
    try:
        cli.start()
    except KeyboardInterrupt:
        pass

output after scanning the bot QR:

[04/06/24 15:38:15] INFO     QR scanned, contact=10
[04/06/24 15:38:18] INFO     deleting sent message: Secure-Join: vc-contact-confirm
[04/06/24 15:38:19] INFO     deleting sent message: You scanned my QR
[04/06/24 15:38:21] INFO     QR scanned, contact=10
[04/06/24 15:38:22] INFO     deleting sent message: You scanned my QR

this is related to #3685

and I hope will be fixed by #5382 (cc @iequidoo )

[adbenitez]

in the meanwhile I will just disable copy to self it is not really required by bots normally

EDIT 1: never mind it seems bcc_self is disabled by default but this secure-join message is sent to self nevertheless

EDIT 2: actually bcc_self is enabled by default, and disabling it solves the issue, it is the docs at deltachat.h that are outdated:

 0=do not send a copy of outgoing messages to self (default)

[iequidoo]

So maybe close this as a duplicate of #3685? If #5382 won't help, we'll reopen this.

EDIT: I'd only print smth like "QR CONTACT CONFIRMED" to the log. "QR SCANNED" isn't good at this step, the QR was actually scanned before