Development Update - Pro Beta Release Submitted to App Stores

Preparing Session Pro Beta for release accounted for most of the development carried out in August, across the three Session clients and the payment backend supporting them. The remainder went to cross-platform testing, attachment and networking fixes, and continued upkeep of the Session Protocol v2 branch.

Session Pro Beta submitted for review

Session Pro Beta has been submitted to Apple and Google for review. Once the release is approved, it will start rolling out.

Development efforts concentrated on the aspects of Pro that can only be tested once real payments and real proofs are in circulation: granting access at the point of purchase, maintaining it across renewals and grace periods, and withdrawing it when a payment is refunded or Pro is cancelled through the store.

Extensive testing was carried out ahead of the release. End-to-end tests now run across Desktop and mobile at the same time, covering message syncing between Desktop and Android and between Desktop and iOS, and attachments in all six directions between the three clients.

How Pro access works

Session accounts carry no email address, phone number, or other identifier that a store payment could be attached to. Pro instead uses a separate key, derived one way from the account's recovery password, which the Pro backend records against the payment and which cannot be linked back to an Account ID in either direction. Pro status is demonstrated to other users through a Session Pro Proof: a signature issued over a temporary key that is valid for up to 30 days before rotating, so a message can carry evidence of Pro status without carrying anything that identifies the account paying for it. Nearly all of the client changes made during August concerned issuing, refreshing, and withdrawing those proofs correctly.

The largest change was reworking how a client obtains and holds on to Pro access. Pro access is now granted automatically once a payment completes, with no separate step to claim it. The job of renewing access and rotating Pro keys has moved into libsession rather than being written three times over, once for each platform. Handling it in one place also keeps Pro status behaving the same way regardless of which device an account is used from.

Handling of withdrawn access was also completed during the month, ensuring that if a payment is refunded, or Pro is cancelled through the store, the Session Pro Proof stops certifying Pro, and the clients all agree on when access ends.

The Session Pro backend

The Pro backend is the service that confirms a payment with Apple or Google and issues a proof in return. Most of the month was spent making that exchange reliable in cases where the stores may report payment activity inconsistently.

Attention also went to the more routine requirements of running the service in production, including logging, database maintenance, and container configuration.

Attachments and networking

Several changes made during August also apply to all Session users. Attachment uploads now use stream encryption on all three clients, which encrypts a file piece by piece as it uploads rather than encrypting the whole file in memory first.

A number of networking fixes were also made in libsession. Messages are held on a swarm, the small group of Session Nodes responsible for a given account, and swarms change as nodes join and leave the network. A client that contacts the wrong swarm after such a change now finds the right one on the next attempt, and a client whose list of known Session Nodes fails to refresh completely now keeps the list it already had rather than discarding it. Both improve the reliability of message delivery on unstable connections.

Libsession and Session Protocol v2

Three libsession releases were published across August and the start of September (1.8.0, 1.9.0, and 1.9.1), carrying the Pro, attachment, and networking changes described above.

A dedicated pfs branch holds the Perfect Forward Secrecy and post-quantum encryption changes, and is kept current as other development continues, with changes from the main branch merged in as they are made.

While Pro Beta is in the hands of users and feedback is being gathered, Session Protocol v2 will become a focus of development. The immediate priority is the invite-only alpha for v2 in a separate version of the Session app, to which Pro users will have early access. Development so far has taken place in libsession and in a command line client, where the private device groups that Protocol v2 depends on have been taking shape. The next step is setting up the cross-platform interface for the alpha. 

External payment support for Pro

Apple and Google both require that premium features in an app distributed through their stores can be purchased through their own in-app payment systems, which is why Session Pro Beta will launch with in-app payments only at first. Once in-app payments are available, external payment gateways can be supported alongside them, with Pro access purchased outside the stores imported into the app.

Adding that support is the next area of development following the Pro Beta release. One gateway under consideration is Stripe, matching the arrangement already used for Session donations. Other payment methods are also under investigation, with the intention to give Session users more flexibility in how they pay for Pro and support the project.

Pro Beta launch

Session Pro Beta will launch shortly, once review by Apple and Google is complete. As a Beta, Pro will continue to change in response to how it performs in use and what users report. Announcements will be made on this blog and through Session's official channels once the release is live.