1 files changed, 17 insertions, 17 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
index ba76ac9..09ee6c9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/file-utils.js
@@ -110,13 +110,6 @@ function _saveBlob(blob, filename) {
   URL.revokeObjectURL(url);
 }
 
-function _b64ToU8(b64) {
-  const bin = atob(b64);
-  const arr = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) arr[i] = bin.charCodeAt(i);
-  return arr;
-}
-
 // A dead transport (screen-lock WebRTC failure, see transport.js's
 // _reconnectLoop) surfaces here as a rejected fetchChunk — TransportLostError
 // when the pending request was killed outright, a plain timeout if it was
@@ -173,16 +166,23 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
       throw err;
     }
     const chunkMsg = await inflight[nextRecv];
-    let plaintext;
-    if (gekKey && chunkMsg.ct) {
-      plaintext = await window.MeshBayCrypto.decryptChunkBin(
-        gekKey, fileId, nextRecv, chunkMsg.nonce, chunkMsg.ct);
-    } else if (gekKey && chunkMsg.ct_b64) {
-      plaintext = await window.MeshBayCrypto.decryptChunk(
-        gekKey, fileId, nextRecv, chunkMsg.nonce_b64, chunkMsg.ct_b64);
-    } else {
-      plaintext = _b64ToU8(chunkMsg.ct_b64 || chunkMsg.data_b64);
+    // One shape, and a refusal for anything else. There used to be two fallbacks
+    // below this: a base64 `ct_b64` chunk, which was the real wire format until
+    // the binary switch in Phase 9.15 and which no node has sent since, and a
+    // plaintext branch that base64-decoded `undefined` when neither field was
+    // there. That last one is why this now throws: a chunk we cannot decrypt has
+    // to stop the download, not write whatever it decoded into the file the user
+    // is saving. MNP 0.15 removed the last producer of the base64 shape (it was
+    // still emitted on the QUIC transport), so a node that sends one is a node
+    // older than the SPA serving this page.
+    if (!gekKey || !chunkMsg.ct) {
+      throw new Error(
+        `Chunk ${nextRecv} of ${fileId.slice(0, 8)} cannot be decrypted `
+        + `(${gekKey ? 'unexpected chunk format' : 'no group key'}) — `
+        + 'the node may be running an older version.');
     }
+    const plaintext = await window.MeshBayCrypto.decryptChunkBin(
+      gekKey, fileId, nextRecv, chunkMsg.nonce, chunkMsg.ct);
     if (writable) {
       await writable.write(plaintext);
     } else {
@@ -328,6 +328,6 @@ async function downloadDirectory(transfers, transport, gek, entries, dir, { setE
 export {
   FILE_ICONS,
   formatSize, formatDate, PREVIEWABLE_TEXT, canPreview, CHUNK_SIZE,
-  _openDownloadTarget, _saveBlob, _b64ToU8, pipelinedDownload, downloadEntry,
+  _openDownloadTarget, _saveBlob, pipelinedDownload, downloadEntry,
   downloadDirectory,
 };