fix(e2ee) avoid restarting media sessions more than once

After enabling E2EE for the first time, keep the media transform
inplace, but make it a no-op.

This simplifies the flow a little since it doesn't require a media
session restart.

Way back when, there were performance concerns when having a transform,
which is what prompted us to implement the restar mechanism, but a lot
has changed since and both audio and video frames don't need to jump
threads these days. We are still not enabling an empty transform at all
times out of precaution.

modules/e2ee/Context.js

 /* eslint-disable no-bitwise */
-/* global BigInt */
 
 import { deriveKeys, importKey, ratchet } from './crypto-utils';
 
         this._sendCounts = new Map();
 
         this._sharedKey = sharedKey;
+
+        this._enabled = false;
+    }
+
+    /**
+     * Enables or disables the E2EE context. When disabled packets are passed through.
+     * @param {boolean} enabled True if E2EE is enabled, false otherwise.
+     */
+    setEnabled(enabled) {
+        this._enabled = enabled;
     }
 
     /**
         }
 
         this._cryptoKeyRing[this._currentKeyIndex] = keys;
-
-        this._sendCount = BigInt(0); // eslint-disable-line new-cap
     }
 
     /**
      * 9) Enqueue the encrypted frame for sending.
      */
     encodeFunction(encodedFrame, controller) {
+        if (!this._enabled) {
+            return controller.enqueue(encodedFrame);
+        }
+
         const keyIndex = this._currentKeyIndex;
+        const currentKey = this._cryptoKeyRing[keyIndex];
 
-        if (this._cryptoKeyRing[keyIndex]) {
+        if (currentKey) {
             const iv = this._makeIV(encodedFrame.getMetadata().synchronizationSource, encodedFrame.timestamp);
 
-            // Thіs is not encrypted and contains the VP8 payload descriptor or the Opus TOC byte.
+            // This is not encrypted and contains the VP8 payload descriptor or the Opus TOC byte.
             const frameHeader = new Uint8Array(encodedFrame.data, 0, UNENCRYPTED_BYTES[encodedFrame.type]);
 
             // Frame trailer contains the R|IV_LENGTH and key index
                 name: ENCRYPTION_ALGORITHM,
                 iv,
                 additionalData: new Uint8Array(encodedFrame.data, 0, frameHeader.byteLength)
-            }, this._cryptoKeyRing[keyIndex].encryptionKey, new Uint8Array(encodedFrame.data,
+            }, currentKey.encryptionKey, new Uint8Array(encodedFrame.data,
                 UNENCRYPTED_BYTES[encodedFrame.type]))
             .then(cipherText => {
                 const newData = new ArrayBuffer(frameHeader.byteLength + cipherText.byteLength
                 // We are not enqueuing the frame here on purpose.
             });
         }
-
-        /* NOTE WELL:
-         * This will send unencrypted data (only protected by DTLS transport encryption) when no key is configured.
-         * This is ok for demo purposes but should not be done once this becomes more relied upon.
-         */
-        controller.enqueue(encodedFrame);
     }
 
     /**
      * @param {TransformStreamDefaultController} controller - TransportStreamController.
      */
     async decodeFunction(encodedFrame, controller) {
+        if (!this._enabled) {
+            return controller.enqueue(encodedFrame);
+        }
+
         const data = new Uint8Array(encodedFrame.data);
         const keyIndex = data[encodedFrame.data.byteLength - 1];
 
         if (this._cryptoKeyRing[keyIndex]) {
-
             const decodedFrame = await this._decryptFrame(
                 encodedFrame,
                 keyIndex);

modules/e2ee/Context.spec.js

 
     beforeEach(() => {
         sender = new Context('sender');
+        sender.setEnabled(true);
         receiver = new Context('receiver');
+        receiver.setEnabled(true);
     });
 
     describe('encode function', () => {

modules/e2ee/E2EEContext.js

         }
     }
 
+    /**
+     * Set the E2EE enabled state.
+     *
+     * @param {boolean} enabled - whether E2EE is enabled or not.
+     */
+    setEnabled(enabled) {
+        this._worker.postMessage({
+            operation: 'setEnabled',
+            enabled
+        });
+    }
+
     /**
      * Set the E2EE key for the specified participant.
      *

modules/e2ee/KeyHandler.js

 
         this.enabled = false;
         this._enabling = undefined;
+        this._firstEnable = false;
 
         // Conference media events in order to attach the encryptor / decryptor.
         // FIXME add events to TraceablePeerConnection which will allow to see when there's new receiver or sender
 
         this.enabled = enabled;
 
-        if (!enabled) {
-            this.e2eeCtx.cleanupAll();
-        }
-
         this._setEnabled && await this._setEnabled(enabled);
 
         this.conference.setLocalParticipantProperty('e2ee.enabled', enabled);
 
-        this.conference._restartMediaSessions();
+        // Only restart media sessions if E2EE is enabled. If it's later disabled
+        // we'll continue to use the existing media sessions with an empty transform.
+        if (!this._firstEnable && enabled) {
+            this._firstEnable = true;
+            this.conference._restartMediaSessions();
+        }
 
-        this._enabling.resolve();
-    }
+        this.e2eeCtx.setEnabled(enabled);
 
-    /**
-     * Sets the key for End-to-End encryption.
-     *
-     * @returns {void}
-     */
-    setEncryptionKey() {
-        throw new Error('Not implemented by subclass');
+        this._enabling.resolve();
     }
 
     /**
      * @private
      */
     _setupReceiverE2EEForTrack(tpc, track) {
-        if (!this.enabled) {
+        if (!this.enabled && !this._firstEnable) {
             return;
         }
 
      * @private
      */
     _setupSenderE2EEForTrack(session, track) {
-        if (!this.enabled) {
+        if (!this.enabled && !this._firstEnable) {
             return;
         }
 

modules/e2ee/ManagedKeyHandler.js

         this.conference.eventEmitter.emit(JitsiConferenceEvents.E2EE_VERIFICATION_AVAILABLE, pId);
     }
 
-
     /**
      * Handles the SAS completed event.
      *

modules/e2ee/Worker.js

 
 let sharedContext;
 
+let enabled = false;
+
 /**
  * Retrieves the participant {@code Context}, creating it if necessary.
  *
     }
 
     if (!contexts.has(participantId)) {
-        contexts.set(participantId, new Context());
+        const context = new Context();
+
+        context.setEnabled(enabled);
+        contexts.set(participantId, context);
     }
 
     return contexts.get(participantId);
         const context = getParticipantContext(participantId);
 
         handleTransform(context, operation, readableStream, writableStream);
+    } else if (operation === 'setEnabled') {
+        enabled = event.data.enabled;
+        contexts.forEach(context => context.setEnabled(enabled));
     } else if (operation === 'setKey') {
         const { participantId, key, keyIndex } = event.data;
         const context = getParticipantContext(participantId);