Add CryptoApi.resetEncryption

[florianduros]

Checklist

• Tests written for new code (and old code if feasible).
• New or updated public/exported symbols have accurate TSDoc documentation.
• Linter and other CI checks pass.
• Sign-off given on the changes (see CONTRIBUTING.md).

Task element-hq/element-web#28977
Require #4615
Add CryptoApi.resetEncryption.

The goal of this new api is to give an easy to reset the current encryption state of the user:

• Disable backing up room keys and delete any existing backup.
• Remove the default secret storage key from the account data (ie: the recovery key).
• Reset the cross-signing keys.
• Re-enable backing up room keys if enabled before.

[andybalaam]

Looks like it does what it says it does!

[richvdh]

generally looks good, a few nits, mostly around the tests

[richvdh]

lgtm

[BillCarsonFr]

Why only if backup was enabled?
That means that if there was a backup that was not working (not trusted signed correctly for example), then the resetEncryption flow won't put me back in a working state?

Maybe what we want to check here is if there was a backup server side, or even better do it unless the opt-out flag is set (account data m.org.matrix.custom.backup_disabled)?

[BillCarsonFr]

I think that the rust-sdk is ultimatly looking at the opt-out flag m.org.matrix.custom.backup_disabled, but there is also a local setting to force disable

/~https://github.com/matrix-org/matrix-rust-sdk/blob/a528624274ecd557427835511eb24513f00696d3/crates/matrix-sdk/src/encryption/recovery/mod.rs#L500-L508

So I believe this code is not consistent with rust.
Even if the rust doc is misleading https://docs.rs/matrix-sdk/latest/matrix_sdk/encryption/recovery/struct.Recovery.html#method.reset_identity

Finally, re-enable key backups (only if they were already enabled)

It is unfortunatly not the same enabled meaning

[richvdh]

As discussed elsewhere: ugh, yes, this is not what Element X is doing.

I think we should just enable backups here, regardless of whether they were enabled before. If you're resetting, you're going to be looking at the settings dialog, so can see if you're being opted in to keybackup against your will; and I'd rather err on the side of just making it work for everyone.

[richvdh]

while we're here: it would be good to add some logging at the start and end of resetEncryption to make it more obvious what's going on in rageshakes.