DodoTech-Public/DodoSSH
Public Access
2
0
Fork 0
Code Issues Pull Requests 2 Actions 2 Packages Projects Releases 2 Wiki Activity

Stay signed in, come back online by itself, and let a machine be given up

Browse Source 
Three things a machine that has been set up could not do. Unlock now takes
Enter, which is the gesture everybody makes after typing a password and which
did nothing until they found the button.

Signing in survives a relaunch. The refresh token is kept in the local cache,
sealed under the vault's own cache key, so a later launch resumes the session
through the refresh grant with no browser and nobody present — and because it
is sealed under that key, only an unlocked vault can resume it. A locked
client therefore cannot reach the server at all, which is a consequence worth
stating rather than working around; docs/crypto.md §3.2 records it. Every sync
pass asks the shell for a connection rather than reading one captured at
unlock, so a laptop that unlocked on a train is online within a minute of
finding a network, with nothing pressed. Unlocking itself still never waits on
a socket.

Signing out empties this machine: the profile, the cached items, the outbox
and this machine's device key, with the account's row withdrawn when the
server can be reached. It asks first and says what it costs — the outbox count
when the vault is open, an admission that it cannot be counted when it is not,
and the shells that keep running either way. The vault is on the server and is
untouched, which is what makes the same button the only honest answer to a
forgotten passphrase, so it is on the unlock screen as well as in preferences.
It cannot end the session at the identity provider, and says so.

Two defects surfaced on the way. The synchronisation pass that runs when the
vault opens never ran at all: the loop is started from inside the unlock
command, so the busy flag it yields to was raised by that command — the first
sync was a minute late on every launch. And signing in from preferences while
unlocked threw an unlock screen over an open vault whose keys were still in
memory.

The unlock card and the new confirmation live in their own controls because
MainWindow cannot be laid out headless, so markup left inside it is markup no
test can measure; both are now measured at the window's minimum size in the
shapes that grow. What is still unverified is the composed window itself.
This commit is contained in:
jaap-jan
2026-07-31 11:07:36 +02:00
parent 94e11f5e38
commit 0b261c4d39
28 changed files with 2323 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs
+124
View File
@@ -1,4 +1,5 @@
using Avalonia.Controls;
using Avalonia.Input;
using Avalonia.VisualTree;
using DodoSSH.Client.App.ViewModels;
using DodoSSH.Client.App.Views;
@@ -54,6 +55,13 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
private VaultSession session = null!;
private VaultViewModel vault = null!;
/// <remarks>
/// Constructed and never started: the sign-out card binds to the shell rather than to a vault, and what
/// it shows comes from properties a fresh one already answers. Starting it would migrate a cache and
/// read a profile, neither of which any rectangle here depends on.
/// </remarks>
private MainWindowViewModel shell = null!;
private static CancellationToken Token => TestContext.Current.CancellationToken;
/// <inheritdoc />
@@ -82,12 +90,23 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
// every sync pass out of a suite that is only measuring rectangles.
vault = new VaultViewModel(session, workspace, knownHosts, static () => null);
shell = new MainWindowViewModel(
new ClientPaths(Path.Combine(Path.GetTempPath(), $"dodossh-layout-{Guid.CreateVersion7():N}")),
caches,
workspace,
knownHosts,
new UnavailableDeviceKeyStore(),
static (_, _) => throw new InvalidOperationException("A layout test has no network."),
TimeProvider.System,
CheapProfile);
await SeedAsync();
}
/// <inheritdoc />
public async ValueTask DisposeAsync()
{
await shell.DisposeAsync();
await vault.DisposeAsync();
knownHosts.Close();
await workspace.DisposeAsync();
@@ -363,6 +382,111 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
Token);
}
// ---- The unlock screen ----
/// <remarks>
/// <para>
/// The card a locked application is entirely made of, in its two shapes: an ordinary launch, and one
/// where shells were left running and the disclosure about them appears. It was extracted from
/// <c>MainWindow.axaml</c> to be measurable at all — that window cannot be shown here, so anything
/// inside it is unmeasured by construction — and it is the card with the least room to spare.
/// </para>
/// <para>
/// The status line is set to something long on purpose. It is bound to whatever the last thing that
/// happened said, and the longest of those is a sentence about an expired sign-in, which is exactly the
/// message this screen is most likely to be carrying on the launch where the extra rows also appear.
/// </para>
/// </remarks>
[Theory]
[InlineData(0)]
[InlineData(2)]
public async Task TheUnlockCardFitsTheCardItIsShownIn(int liveSessions)
{
shell.LiveSessionCount = liveSessions;
shell.CanUnlockWithDevice = true;
shell.StatusMessage = "Your sign-in has expired, so this machine is offline: the token endpoint "
+ "returned 400: Invalid refresh token. Sign in again from Preferences to start syncing.";
await MeasureCardAsync(new UnlockCard());
}
[Fact]
public async Task TheUnlockBoxTakesEnterAsUnlock()
{
// Enter is how everybody finishes typing a password, and this screen had no answer to it until the
// gesture below existed: the passphrase box is where locking puts the keyboard, so the one thing a
// user does without thinking did nothing at all until they found the button.
//
// The gesture is what can be asserted; that pressing it unlocks is ShellFlowTests' business,
// against the command this binds to.
await LayoutHarness.OnTheUiThreadAsync(
() =>
{
var card = new UnlockCard { DataContext = shell };
var window = LayoutHarness.HostAtMinimumSize(
card, LayoutHarness.CardContentWidth, LayoutHarness.CardContentHeight);
try
{
var binding = card.PassphraseBox.KeyBindings.ShouldHaveSingleItem();
binding.Gesture.ShouldBe(new KeyGesture(Key.Enter));
binding.Command.ShouldBeSameAs(shell.UnlockCommand);
}
finally
{
window.Close();
}
},
Token);
}
// ---- The sign-out confirmation ----
/// <remarks>
/// <para>
/// The one new card that has to share a screen with an unlock prompt, and the only one whose height
/// depends on what it is saying: the warning is a sentence about the outbox, and the disclosure about
/// shells left running appears only when there are some. Both are wrapped paragraphs, which is the
/// shape that grows.
/// </para>
/// <para>
/// Measured in the space a card gives its contents rather than inside <c>MainWindow</c>, which cannot
/// be laid out here — see <c>LayoutHarnessTests.WhyTheWindowItselfIsNeverShown</c>. What that leaves
/// unchecked is the card's own frame, which is a fixed border and a constant padding.
/// </para>
/// </remarks>
[Fact]
public async Task TheSignOutCardFitsTheCardItIsShownIn()
{
// Its tallest shape: a shell left running adds a disclosure box that an ordinary sign-out does not
// have, and a locked vault carries the longer of the two warnings.
shell.LiveSessionCount = 1;
await MeasureCardAsync(new SignOutCard());
}
/// <summary>Lays a setup-screen card out in the space <c>Border.card</c> gives its contents.</summary>
private Task MeasureCardAsync(Control card) =>
LayoutHarness.OnTheUiThreadAsync(
() =>
{
card.DataContext = shell;
var window = LayoutHarness.HostAtMinimumSize(
card, LayoutHarness.CardContentWidth, LayoutHarness.CardContentHeight);
try
{
LayoutHarness.Unreachable(window).ShouldBeEmpty();
}
finally
{
window.Close();
}
},
Token);
// ---- Helpers ----
/// <summary>Lays the sidebar out at the width the hosts screen gives it.</summary>