Stay signed in, come back online by itself, and let a machine be given up

Three things a machine that has been set up could not do. Unlock now takes
Enter, which is the gesture everybody makes after typing a password and which
did nothing until they found the button.

Signing in survives a relaunch. The refresh token is kept in the local cache,
sealed under the vault's own cache key, so a later launch resumes the session
through the refresh grant with no browser and nobody present — and because it
is sealed under that key, only an unlocked vault can resume it. A locked
client therefore cannot reach the server at all, which is a consequence worth
stating rather than working around; docs/crypto.md §3.2 records it. Every sync
pass asks the shell for a connection rather than reading one captured at
unlock, so a laptop that unlocked on a train is online within a minute of
finding a network, with nothing pressed. Unlocking itself still never waits on
a socket.

Signing out empties this machine: the profile, the cached items, the outbox
and this machine's device key, with the account's row withdrawn when the
server can be reached. It asks first and says what it costs — the outbox count
when the vault is open, an admission that it cannot be counted when it is not,
and the shells that keep running either way. The vault is on the server and is
untouched, which is what makes the same button the only honest answer to a
forgotten passphrase, so it is on the unlock screen as well as in preferences.
It cannot end the session at the identity provider, and says so.

Two defects surfaced on the way. The synchronisation pass that runs when the
vault opens never ran at all: the loop is started from inside the unlock
command, so the busy flag it yields to was raised by that command — the first
sync was a minute late on every launch. And signing in from preferences while
unlocked threw an unlock screen over an open vault whose keys were still in
memory.

The unlock card and the new confirmation live in their own controls because
MainWindow cannot be laid out headless, so markup left inside it is markup no
test can measure; both are now measured at the window's minimum size in the
shapes that grow. What is still unverified is the composed window itself.

tests/DodoSSH.Client.Storage.Tests/RememberedSignInTests.cs

@@ -0,0 +1,124 @@
+using DodoSSH.Contracts;
+
+namespace DodoSSH.Client.Storage.Tests;
+
+/// <summary>
+/// The sign-in a machine may resume, and what emptying the cache does to it.
+/// </summary>
+/// <remarks>
+/// Two behaviours meet here for a reason: the refresh token is the one thing in this cache that is a
+/// credential for the <em>account</em> rather than for the vault, so both halves of its life — sealed
+/// while it is kept, gone when the user signs out — belong under one test class.
+/// </remarks>
+public sealed class RememberedSignInTests
+{
+    private static CancellationToken Token => TestContext.Current.CancellationToken;
+
+    [Fact]
+    public async Task ARememberedTokenRoundTrips()
+    {
+        using var harness = await CacheHarness.CreateAsync();
+
+        var store = Store(harness);
+
+        (await store.ReadAsync(Token)).ShouldBeNull("nothing has been remembered yet");
+
+        await store.SaveAsync("refresh-token-1", Token);
+
+        (await store.ReadAsync(Token)).ShouldBe("refresh-token-1");
+    }
+
+    [Fact]
+    public async Task RememberingAgain_ReplacesRatherThanAdds()
+    {
+        // What a rotating provider does on every refresh. A second row would be a constraint violation;
+        // keeping the first would leave the next launch presenting a token the provider has retired.
+        using var harness = await CacheHarness.CreateAsync();
+
+        var store = Store(harness);
+
+        await store.SaveAsync("refresh-token-1", Token);
+        await store.SaveAsync("refresh-token-2", Token);
+
+        (await store.ReadAsync(Token)).ShouldBe("refresh-token-2");
+    }
+
+    [Fact]
+    public async Task AnotherUsersCacheKey_DoesNotOpenIt()
+    {
+        // The whole reason this is sealed rather than stored. A cache file lifted off a machine cannot be
+        // made to yield an account credential without the key that only an unlocked vault holds.
+        using var owner = await CacheHarness.CreateAsync();
+        using var stranger = await CacheHarness.CreateAsync();
+
+        await Store(owner).SaveAsync("refresh-token-1", Token);
+
+        var strangersView = new RememberedSignInStore(
+            owner.Factory, stranger.Protector, CacheHarness.UserId, TimeProvider.System);
+
+        (await strangersView.ReadAsync(Token)).ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task ForgettingIt_LeavesNothingToResume()
+    {
+        using var harness = await CacheHarness.CreateAsync();
+
+        var store = Store(harness);
+
+        await store.SaveAsync("refresh-token-1", Token);
+        await store.ForgetAsync(Token);
+
+        (await store.ReadAsync(Token)).ShouldBeNull();
+
+        // And forgetting what is not there is not an error: it runs on a sign-out from a machine that
+        // never remembered one.
+        await store.ForgetAsync(Token);
+    }
+
+    [Fact]
+    public async Task ResettingTheCache_EmptiesEveryTableAndKeepsTheSchema()
+    {
+        // What signing out does on disk. Every row goes — the profile an unlock reads, the item mirror,
+        // the outbox, the remembered sign-in — and the database is immediately usable again, because the
+        // application has to be able to be set up afresh without being restarted.
+        using var harness = await CacheHarness.CreateAsync();
+
+        var entityId = Guid.CreateVersion7();
+
+        await harness.Unlock.SaveAsync(Material(), Token);
+        await harness.Items.SaveAsync(CacheHarness.Item(entityId), Token);
+        await harness.Outbox.QueueAsync(CacheHarness.Change(entityId), Token);
+        await Store(harness).SaveAsync("refresh-token-1", Token);
+
+        await harness.Factory.ResetAsync(Token);
+
+        (await harness.Unlock.ReadAsync(Token)).ShouldBeNull("the profile is what makes a machine enrolled");
+
+        (await harness.Items
+                .ListAsync(CacheHarness.VaultId, SyncEntityType.Host, includeDeleted: true, Token))
+            .ShouldBeEmpty();
+        (await harness.Outbox.ListAllAsync(CacheHarness.VaultId, Token)).ShouldBeEmpty();
+        (await Store(harness).ReadAsync(Token)).ShouldBeNull();
+
+        // Usable, not merely empty: writing to it again must not need a migration.
+        await harness.Unlock.SaveAsync(Material(), Token);
+        (await harness.Unlock.ReadAsync(Token)).ShouldNotBeNull();
+    }
+
+    private static RememberedSignInStore Store(CacheHarness harness) =>
+        new(harness.Factory, harness.Protector, CacheHarness.UserId, TimeProvider.System);
+
+    private static StoredUnlockMaterial Material() =>
+        new(
+            "https://dodossh.example",
+            CacheHarness.UserId,
+            "https://idp.example",
+            "alice",
+            "alice@example.com",
+            "Alice",
+            KeyGeneration: 1,
+            WrappedPrivateKey: [1, 2, 3, 4],
+            new KdfParameters("argon2id", [5, 6, 7, 8], 262144, 4, 1),
+            DateTimeOffset.FromUnixTimeSeconds(1_750_000_000));
+}