Given a recipient id, returns any unconfirmed identity

// FREEBIE

src/Storage/AxolotlStore/TSStorageManager+IdentityKeyStore.h

@@ -7,6 +7,8 @@
 
 NS_ASSUME_NONNULL_BEGIN
 
+@class OWSRecipientIdentity;
+
 extern NSString *const TSStorageManagerTrustedKeysCollection;
 
 @interface TSStorageManager (IdentityKeyStore) <IdentityKeyStore>
@@ -29,6 +31,15 @@ extern NSString *const TSStorageManagerTrustedKeysCollection;
     approvedForBlockingUse:(BOOL)approvedForBlockingUse
  approvedForNonBlockingUse:(BOOL)approvedForNonBlockingUse;
 
+/**
+ * Check if a recipient identity corresponds to an untrusted identity
+ *
+ * @param   recipientId unique stable identifier for the recipient, e.g. e164 phone number
+ * @returns nil if the identity doesn't exist or if it's trusted
+ *          else returns the untrusted identity
+ */
+- (nullable OWSRecipientIdentity *)unconfirmedIdentityThatShouldBlockSendingForRecipientId:(NSString *)recipientId;
+
 - (void)generateNewIdentityKey;
 - (nullable NSData *)identityKeyForRecipientId:(NSString *)recipientId;
 - (void)removeIdentityKeyForRecipient:(NSString *)receipientId;

src/Storage/AxolotlStore/TSStorageManager+IdentityKeyStore.m

@@ -175,6 +175,29 @@ const NSTimeInterval kIdentityKeyStoreNonBlockingSecondsThreshold = 5.0;
     }
 }
 
+- (nullable OWSRecipientIdentity *)unconfirmedIdentityThatShouldBlockSendingForRecipientId:(NSString *)recipientId;
+{
+    OWSAssert(recipientId != nil);
+
+    @synchronized([[self class] sharedIdentityKeyLock])
+    {
+        OWSRecipientIdentity *currentIdentity = [OWSRecipientIdentity fetchObjectWithUniqueID:recipientId];
+        if (currentIdentity == nil) {
+            // No preexisting key, Trust On First Use
+            return nil;
+        }
+
+        if ([self isTrustedIdentityKey:currentIdentity.identityKey
+                           recipientId:currentIdentity.recipientId
+                             direction:TSMessageDirectionOutgoing]) {
+            return nil;
+        }
+
+        // identity not yet trusted for sending
+        return currentIdentity;
+    }
+}
+
 - (BOOL)isTrustedKey:(NSData *)identityKey forSendingToIdentity:(nullable OWSRecipientIdentity *)recipientIdentity
 {
     OWSAssert(identityKey != nil);