From da1a5b691acffbdf40c43924379e111cca83d9f2 Mon Sep 17 00:00:00 2001
From: Goffi <goffi@goffi.org>
Date: Thu, 16 Apr 2026 12:19:35 +0200
Subject: [PATCH] plugin XEP-0473: Fix early exit when checking items:

The secrets were loaded for all items in `_items_trigger` instead of exiting early when
there is nothing to decrypt, this was inefficient, and showing annoying warnings.
---
 libervia/backend/plugins/plugin_xep_0473.py | 56 ++++++++++-----------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/libervia/backend/plugins/plugin_xep_0473.py b/libervia/backend/plugins/plugin_xep_0473.py
index 2855f986..25f907b6 100644
--- a/libervia/backend/plugins/plugin_xep_0473.py
+++ b/libervia/backend/plugins/plugin_xep_0473.py
@@ -140,7 +140,7 @@ class XEP_0473:
 
     async def load_secrets(
         self, client: SatXMPPEntity, node_uri: str
-    ) -> Optional[Dict[str, SharedSecret]]:
+    ) -> dict[str, SharedSecret] | None:
         """Load shared secret from databse or cache
 
         A cache is used per client to avoid usueless db access, as shared secrets are
@@ -672,39 +672,39 @@ class XEP_0473:
     async def _items_trigger(
         self,
         client: SatXMPPEntity,
-        service: Optional[jid.JID],
+        service: jid.JID | None,
         node: str,
-        items: List[domish.Element],
+        items: list[domish.Element],
         rsm_response: rsm.RSMResponse,
-        extra: Dict[str, Any],
+        extra: dict[str, Any],
     ) -> bool:
         if not extra.get(C.KEY_DECRYPT, True):
             return True
-        if service is None:
-            service = client.jid.userhostJID()
-        node_uri = uri.build_xmpp_uri("pubsub", path=service.full(), node=node)
-        shared_secrets = await self.load_secrets(client, node_uri)
-        if shared_secrets is None:
-            log.warning(f"No known shared secret for {node_uri}, can't decrypt")
-            return True
+        shared_secrets = None
+        node_uri = None
         for item_elt in items:
-            payload = item_elt.firstChildElement()
-            if (
-                payload is not None
-                and payload.name == "encrypted"
-                and payload.uri == NS_OXPS
-            ):
-                encrypted_elt = payload
-                try:
-                    decrypted_elt = self.decrypt_payload(
-                        encrypted_elt, shared_secrets, item_elt["id"]
-                    )
-                except DecryptionFailed as e:
-                    log.warning(f"Can't decrypt item: {e}\n{item_elt.toXml()}")
-                    continue
-                item_elt.children.clear()
-                item_elt.addChild(decrypted_elt)
-                extra.setdefault("encrypted", {})[item_elt["id"]] = {"type": NS_OXPS}
+            encrypted_elt = next(item_elt.elements(NS_OXPS, "encrypted"), None)
+            if encrypted_elt is None:
+                continue
+            if service is None:
+                service = client.jid.userhostJID()
+            if node_uri is None:
+                node_uri = uri.build_xmpp_uri("pubsub", path=service.full(), node=node)
+            if shared_secrets is None:
+                shared_secrets = await self.load_secrets(client, node_uri)
+                if shared_secrets is None:
+                    log.warning(f"No known shared secret for {node_uri}, can't decrypt")
+                    return True
+            try:
+                decrypted_elt = self.decrypt_payload(
+                    encrypted_elt, shared_secrets, item_elt["id"]
+                )
+            except DecryptionFailed as e:
+                log.warning(f"Can't decrypt item: {e}\n{item_elt.toXml()}")
+                continue
+            item_elt.children.clear()
+            item_elt.addChild(decrypted_elt)
+            extra.setdefault("encrypted", {})[item_elt["id"]] = {"type": NS_OXPS}
         return True
 
     def decrypt_payload(