diff --git a/README.md b/README.md index bb3beb7..7bb53b7 100644 --- a/README.md +++ b/README.md @@ -441,8 +441,18 @@ keychain plus a terminal — and the spike that gates all of it. synced items — encrypted, merged and pushed like every other — and both are invisible until used: a keychain with no groups draws the flat host list it always did. Two things about them are deliberate. Group membership is a field on the *host* rather than a member list on the group, so filing two machines at - once on two laptops is two independent writes instead of one contested one; and groups are flat, because a - parent pointer merged field by field lets two offline clients build a cycle that nothing can repair. + once on two laptops is two independent writes instead of one contested one; and a group carries the port, + username and key the hosts inside it fall back to, read at connect time rather than copied in, so changing + one changes every host that never overrode it. + + Groups nest, and that reverses an earlier decision worth recording. They were flat because a parent pointer + merged field by field lets two offline clients build a cycle nothing upstream can see — the pointer is + inside the payload, so the server cannot read it, and the merge resolves one item against one item and + never sees the pair. That is still true. What changed is that inheritance made the chain something the + *connect* path walks, so the answer had to be a walk that terminates whatever it is handed: every walk + carries a visited set and stops at a repeat, which degrades a cycle to a group reading as a root rather + than to a shell that never opens. Given a walk that had to be cycle-safe anyway, refusing to nest bought + nothing. Inserting a snippet types it at the prompt and stops. Pressing Enter is a per-snippet decision, off by default, and the reason is worth stating: a terminal is one input stream with no notion of being at a diff --git a/docs/adding-hosts-on-the-phone.md b/docs/adding-hosts-on-the-phone.md index 76ec36b..42e8a89 100644 --- a/docs/adding-hosts-on-the-phone.md +++ b/docs/adding-hosts-on-the-phone.md @@ -4,9 +4,8 @@ The phone can read a keychain and connect through it. It cannot put anything in plan for the change that fixes that, and it is written to be picked up cold — the decisions, the reasons, the ordered work, and the traps that are already known. -> **Status: steps 1–4 built, 5–6 not started.** The domain and the desktop are done and the phone has not -> been touched. Each built step compiles with the whole suite green, which is the rule the ordering below -> sets. +> **Status: built.** All six steps. Each one compiled with the whole suite green before the next began, +> which is the rule the ordering below sets. > > | Step | State | Notes | > | --- | --- | --- | @@ -14,12 +13,16 @@ ordered work, and the traps that are already known. > | 2. The `Tag` item kind | **Done** | Secret, codec, merge, cipher, repository, both registries, EF entity and the generated `AddTagItem` migration. | > | 3. `HostSecret` grows, `Port` goes nullable | **Done** | `TagSet`, `TagIds`, `Port` as `int?`, `AsksForPassword`, both schema versions, and `HostInheritance` — the resolver. | > | 4. The shared view model | **Done** | Every choke point below, plus the group editor the plan never assigned a step to and without which nothing could set a default at all. | -> | 5. The phone | Not started | Nothing in `Views/HostsScreen.axaml`, `Theme/Phone.axaml` or `PhoneShell` has changed. | -> | 6. Tests and false prose | Partly done as it went | The guards each step tripped are fixed and the connect path is covered. `docs/design-import-gaps.md` and the three phone files still say the `+` is deliberately absent. | +> | 5. The phone | **Done** | The `+`, the sheet, both editor cards, the back guard and EDIT on the connect bar. | +> | 6. Tests and false prose | **Done** | Plus a fourth "groups are flat" site in `README.md` this plan did not list, and a cross-vault resolution bug the scouting for it turned up. | > -> **Tags are stored but not editable.** `TagIds` merges, encodes and resolves, and no screen can put one on a -> host yet — the desktop editor carries the set through a save untouched so that a client which can set them -> does not lose them. The chips belong with the phone's editors in step 5. +> **Tags are stored and still not editable, and that is the one thing asked for that did not ship.** `Tag` is +> a full item kind and `HostSecret.TagIds` merges, encodes and resolves — but no screen on either head draws +> a chip or offers to add one, so the tags a client can store are ones nothing here can see. Both editors +> carry the set through a save untouched, so a client that can set them does not lose them to somebody +> editing a port. What is missing is a picker and a chip row, on both heads: the plan's step 5 list does not +> mention them, and building the sheet, both editors and the back guard was already the larger half of it. +> Recorded as half-shipped in `docs/design-import-gaps.md` rather than quietly left out. > > **`HostFields.From` was answered by a refusal rather than by threading the resolver into the sync engine.** > A relay host may not inherit its port; `HostSecret.TryValidate` refuses one that tries. A plaintext column @@ -50,7 +53,7 @@ Three of those fields do not exist at any layer, and one of them is refused on t | Asked for | What exists today | | --- | --- | -| The `+` and the editors behind it | Nothing. `Theme/Phone.axaml` has no `.fab` class, and its comment says an unused style would be "a claim that the control exists somewhere". `HostsScreen.axaml` and `ConnectionsScreen.axaml` both tell the user, in prose on screen, that hosts are created on the desktop and sync down. | +| The `+` and the editors behind it | Nothing. `Theme/Phone.axaml` has no `.fab` class, and its comment says an unused style would be "a claim that the control exists somewhere". `HostsScreen.axaml`'s own v2 note says hosts are created on the desktop and sync down. *(This row named a `ConnectionsScreen.axaml` as a second site. No such file exists or ever has; and the `HostsScreen` statement is an XAML comment, so no phone screen ever rendered that sentence to a user.)* | | Vault picker | **Built.** `VaultViewModel.TargetVaults` / `SelectedTargetVault` / `HasVaultChoice`, hidden at one vault. The desktop's `VaultScreen.axaml` already draws it. | | Alias, hostname, port, username, key-or-password, group | **Built**, in the shared `VaultViewModel` host editor — `EditorLabel`, `EditorHostname`, `EditorPort`, `EditorUsername`, `EditorAuthenticationChoices`, `EditorGroupChoices`, `SaveHostCommand`. The phone has never bound any of it. | | Tags | **Nothing.** `SyncEntityType.Tag = 5` and `HostTag = 6` are reserved slots with nothing behind them. `HostSecret` has no tag field. | @@ -272,8 +275,10 @@ repo-wide, so any XAML warning fails CI. `HostKeySheet`, which is exactly why that control lives there. - **The back gesture needs a new guard**, above the `switch` in `PhoneShell.axaml.cs`, in the shape of the host-key guard: back should close the sheet or the editor rather than leave the screen. The comment on that - method states an invariant — the two switch cases are the membership tests of `IsVaultsSurface` and - `IsConnectionsSurface` and must stay in step — so add a guard, do not extend the switch. + method states an invariant about the switch cases staying in step with the surface tests — so add a guard, + do not extend the switch. *(This named `IsVaultsSurface` and `IsConnectionsSurface`. Neither exists + anywhere in the repo; the real properties are `IsMoreSurface` and `IsTerminalSurface`, and only the first + is what the switch mirrors.)* - The editors follow `SnippetsScreen.axaml`: a `Border Classes="card"` in the same grid row as the list, toggled on `IsEditing`, with the list toggled on `!IsEditing`. There is no dialog, no modal and no editor-screen anywhere on this head, and the reason is written down — a form stacked over the list hides what @@ -324,7 +329,9 @@ deliberately absent, and each states a reason that will no longer hold. - `Theme/Phone.axaml` — the "No floating action button" block. - `Views/HostsScreen.axaml` — the v2 and v3 notes on the missing `+`. -- `Views/ConnectionsScreen.axaml` — "hosts are created on the desktop and sync down", rendered on screen. +- ~~`Views/ConnectionsScreen.axaml`~~ — **this file does not exist and never did.** The real inventory is + the two above plus `README.md`, `docs/android-port.md` and `docs/design-import-gaps.md`. Neither phone + site was "rendered on screen": both are XAML comments. - `HostGroupSecret.cs` and `HostGroupSecretTests.cs` — "No parent. Groups are flat." - `docs/design-import-gaps.md` — the **Add host** row, the two floating-button rows, the "Tag / HostTag still reserved and unused" paragraph, and the tag-chips and groups-on-a-team's-hosts rows in the Hosts table. diff --git a/docs/android-port.md b/docs/android-port.md index 3754a1b..c3795c8 100644 --- a/docs/android-port.md +++ b/docs/android-port.md @@ -331,7 +331,9 @@ that appear rarely and matter most. Those are marked **◆**. - **◆ Conflict log** — what a merge overrode and what it discarded, scrollable, with DISMISS ALL. The merge is only allowed to pick a winner because this exists. - *Groups panel:* the groups as chips with host counts, a name box that both adds and renames, delete with - its own confirmation counting the affected hosts. + its own confirmation counting the affected hosts. Since groups gained a parent and the four defaults their + hosts inherit, the panel is a small form rather than a box: a parent picker that excludes the group's own + descendants, and a default port, username and binding beside the name. **2. Files** — two panes and a queue. diff --git a/docs/design-import-gaps.md b/docs/design-import-gaps.md index d83e296..19be8da 100644 --- a/docs/design-import-gaps.md +++ b/docs/design-import-gaps.md @@ -33,7 +33,7 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference > | SFTP: the `LOCAL / REMOTE` toggle | One remote pane. Scoped storage means there is no browsable local filesystem, which `docs/android-port.md` decided before any of this was built. | > | SFTP: the transfer card, and moving files at all | ◆ **Browsing, opening and deleting only, and the screen says so.** Both transfer commands exist and both work — against the local pane. `QueueDownloads` writes to `Path.Combine(LocalPath, name)`, and `LocalPath` starts at `SpecialFolder.UserProfile`, which on Android is the application's own private directory: a download would report success and leave the file somewhere the person who asked for it cannot open. That is worse than not offering it, because a refusal is visible and a file in `/data/user/0/…` is not. The queue is not drawn either, since nothing on this head can put anything in it. Both return with the document picker. | > | S3: `96 objects · 412 GB` and `lifecycle: IA after 7d` | Omitted. Neither a bucket total nor a lifecycle policy is fetched; the listing is what `IRemoteFileStore` returns. | -> | A `+` floating button on **HOSTS** | Omitted. It would open a host editor, and this head has none — hosts are created on the desktop and sync down. | +> | A `+` floating button on **HOSTS** | **Shipped in v3.** It was omitted twice, on the grounds that it would open a host editor this head had not got — and that was true until one existed. It raises a sheet rather than a form, because "add" on this screen is two operations: a host, or a group to file hosts under. | > | A 14px rounded inset around the terminal | Not drawn. The renderer is a native child view composited above everything Avalonia draws, so a rounded frame behind it clips nothing. What the design was after comes from the page's own background, which is the design's `#171A26`. | > | Instrument Sans / Fira Code | Inter and the system monospace stack, as before and for the same reason — see the note on `MonoFont` in `Palette.axaml`. | > | A theme toggle (`☀`) in the header, and the desktop v2's light theme | Omitted. There is one theme by decision, and a switch with one position is a control that does nothing. | @@ -59,7 +59,7 @@ the chrome, hosts and terminals, file transfer, the vault, teams, and preference > | v2 element | What ships instead | > | --- | --- | > | The **FORWARDING** screen, the `⇄ N forwards` chip on the session strip, and the host detail's FORWARDING card | Nothing, as on the phone and for the same reason. Three surfaces for a feature the SSH layer does not have. | -> | The host detail's 2×2 card grid — IDENTITY fingerprint, TAGS, LAST SESSION | Not drawn. There is no fingerprint on a stored key, no tag item type, and no last-used timestamp at any layer. The pane keeps the host editor the design has no equivalent of, which is the thing that is actually used. | +> | The host detail's 2×2 card grid — IDENTITY fingerprint, TAGS, LAST SESSION | Not drawn. There is no fingerprint on a stored key and no last-used timestamp at any layer. A tag item type now exists and a host names them, but nothing on either head draws or edits a chip, so the card would have one field of the three and it would be empty. The pane keeps the host editor the design has no equivalent of, which is the thing that is actually used. | > | The keychain detail's public-key block, USED BY hosts, and **Rotate** | The detail pane as it stands. Copy public key is real and already there; rotation is not a thing this client can do. | > | Logs: **FOLLOW**, the severity chips, and `tailing via ssh · journald + files` | The two logs it really has. Same as the phone — these are synced audit records, not a tail, and the footer sentence describes a feature rather than the screen. | > | Snippets: **RUNS ON** host tags and a last-run line | The command and the two buttons that name the terminal they type into. | @@ -136,8 +136,15 @@ protocol rather than a protocol change. Two of those slots are now taken. `HostGroup` and `Snippet` shipped as full item kinds — a table, an EF configuration, a server kind that refuses every plaintext field, a codec, a merge, a cipher and a repository -— and neither needed a contract change, which is what the reservation bought. `Tag`, `HostTag`, -`HostCredential` and `PortForward` are still reserved and still unused. +— and neither needed a contract change, which is what the reservation bought. `Tag = 5` has since shipped the +same way, for the same cost, and is the clearest case the reservation ever paid for: a whole item kind, a +table, a migration and an AAD arm, with `PublicAPI.Unshipped.txt` untouched. + +`HostTag`, `HostCredential` and `PortForward` are still reserved and still unused — and `HostTag` is now +reserved *against a decision* rather than pending one. Which hosts wear a tag is a set of ids inside each +host's payload, not a join: the one thing a join buys over that is two machines tagging the same host +without either losing, and the client's per-key three-way merge already gives it. A second item type would +be a second table and a second pass through every rule in this file, for nothing. **A third was added for something the design never mentioned**: `ObjectStore = 13`, an S3-compatible bucket and the keys that reach it. It is a keychain item like any other — the endpoint and the secret access key are @@ -198,10 +205,10 @@ caption buttons and window title drawn on top of the application's own — two s | Design element | Layer | What it would take | What ships instead | | --- | --- | --- | --- | -| Tag chips (`nginx`, `eu`, `pg16`) | client-domain | A tag item type and a host-tag join. Both reserved on the wire (`Tag = 5`, `HostTag = 6`), neither implemented, plus a payload schema bump on `HostSecret`. | Omitted. The filter box searches name, address and notes instead. | -| Groups `PRODUCTION` / `STAGING` / `PERSONAL` | client-domain | A host-group item type (`HostGroup = 4`, reserved) or a group field on `HostSecret`. | **Shipped**, as both: `VaultHostGroup` is a synced item kind and `HostSecret.GroupId` names one. Flat, not nested. A keychain with no groups renders exactly as it did before — one flat list, no headings. | +| Tag chips (`nginx`, `eu`, `pg16`) | client-domain | A tag item type, and a way to put one on a host. | **Half shipped.** `Tag = 5` is a live item kind and `HostSecret.TagIds` names them, merged per tag so two people tagging one host both keep theirs — which is what `HostTag = 6` was going to buy, so it stays reserved and unused. No chip is drawn or edited on either head yet, so the tags a client can store are ones nothing here can see. The filter box searches name, address and notes. | +| Groups `PRODUCTION` / `STAGING` / `PERSONAL` | client-domain | A host-group item type (`HostGroup = 4`, reserved) or a group field on `HostSecret`. | **Shipped**, as both: `VaultHostGroup` is a synced item kind and `HostSecret.GroupId` names one. Nested in the data and drawn flat — a group carries a `ParentId` and the defaults its hosts inherit, and the sidebar still emits one heading per group in label order with no indentation. A keychain with no groups renders exactly as it did before — one flat list, no headings. | | Group badge `TEAM·PLATFORM` | server | **Built in M3.** | The vault's name on each row, and the personal vault ordered first. Not the team's name: two of a team's vaults would then carry the same badge and the badge would be naming the wrong thing. Distinct from the groups above, and deliberately so — a group is a shelf the user chose, a vault is who can read the item. | -| Groups on a **team's** hosts | client-domain | Reading groups across every readable vault, a vault id on each group row for rename and delete, and a way to tell two vaults' identically-named groups apart in a list with one heading per group. | Not yet. Groups are read from the active vault alone, so a host a teammate filed shows under UNGROUPED — the same way a host whose group was deleted does. Nothing is lost or misfiled; the grouping is simply not shown. | +| Groups on a **team's** hosts | client-domain | A vault id on each group row for rename and delete, and a way to tell two vaults' identically-named groups apart in a list with one heading per group. | **Half shipped, and the half that shipped had to.** Every readable vault's groups are now read into the resolution map, because a group lends a port, a username and a binding — so a host whose group went unread would silently dial 22 as nobody while the machine is on 2222 as `deploy`. A missing heading is cosmetic; a missing port is a connection to the wrong place. The editable list is still the active vault's alone, so a host a teammate filed still shows under UNGROUPED and cannot be renamed or unfiled from here. | | Per-host status dot, three colours | client-ssh | The amber state would mean "reachable but not connected", and nothing here ever probes a host. | Two states, both real: green when a terminal is open on that host, grey when not. | | `· ⤷ bastion-eu` in the host subtitle | client-ssh | **Jump hosts are data-only.** `HostSecret.JumpHostIds` is a `JumpChain` that is stored, encrypted, synced and three-way merged — and nothing reads it at connect time. `SshConnectionRequest` carries one host. | Omitted. The stored chain is preserved untouched by every edit. | | `SPLIT ⌘D` and side-by-side panes | client-ssh + ui | The renderer stacks panes and shows one (`terminal.css`: `.pane { position:absolute; inset:0; display:none }`). Tiling needs a real pane geometry and a splitter. | Omitted. Tabs ship instead, over the same one-WebView multiplexing. | diff --git a/docs/manual-checks.md b/docs/manual-checks.md index 109c9ba..30dc766 100644 --- a/docs/manual-checks.md +++ b/docs/manual-checks.md @@ -691,3 +691,101 @@ add a bucket — then come back. **Failure means:** the screen has gone back to copying the vault's lists once at unlock. Covered by `TheTransfersScreen_FollowsTheVaultsHostList`; this is the version of it with a real picker in front of it. + +## Phase 8 — Adding hosts on the phone + +Nine checks, and the reason there are nine rather than none is worth stating: **the layout suite cannot see +any of this and structurally never will.** `DodoSSH.Client.App.Layout.Tests` targets `net10.0` and +`DodoSSH.Client.Android` targets `net10.0-android`, so a project reference is impossible; Avalonia's +application, dispatcher and platform are one-shot process globals, so a second head cannot share the +process either; and the phone's numbers only mean anything measured under the phone's own style graph. +Every property and command below is covered headlessly in `ShellFlowTests` — the flow is shared, and only +the rectangles are not. So what follows is the rectangles. + +Run on a 360dp-wide device or emulator, unlocked, on HOSTS. + +### 8.1 The + is reachable and is not covering anything + +Look at the bottom right of the host list with no host selected. + +**Pass:** a filled accent circle, 56×56, clear of the bottom edge and of the last row's text. Then select a +host so the connect bar rises. + +**Pass:** the + has moved up with the bar and is not over the CONNECT button. + +**Failure means:** the + was anchored to the screen rather than to the list's row. Nothing in the layout +harness would catch it if it could run — its only fit rule is containment inside the window, never overlap +between two controls, so a button sitting squarely on top of CONNECT reports clean. + +### 8.2 The sheet says what each choice does + +Tap the +. + +**Pass:** a sheet rises from the bottom with a grab handle, two rows — **New host** and **New group** — each +with a sentence under it, and CANCEL. The scrim darkens the list. + +**Note:** the four nav destinations underneath stay lit and tappable. That is deliberate — this is a menu, +not a decision, and navigating away is a fine way to answer it. Compare the changed-host-key screen, which +must offer no way out but BACK. + +### 8.3 The sheet is dismissible three ways + +Tap the scrim. Reopen, tap CANCEL. Reopen, use the system back gesture. + +**Pass:** all three lower it, and none of them opens an editor. + +**Failure means:** back is being handled by the screen switch rather than by the guard above it, and the +gesture has left HOSTS instead of closing the sheet. + +### 8.4 An empty port box says what it will dial + +Add a group with a default port of 2222, then tap + → New host and choose that group in the GROUP picker. + +**Pass:** the port box is **empty**, and the greyed text inside it changes to `2222` the moment the group is +chosen. The username box behaves the same way. + +**Failure means:** the editor loaded a resolved value into the box instead of a placeholder behind it — +saving would then pin 2222 onto the host, and changing the group later would leave that host behind. + +### 8.5 A host created that way inherits rather than copies + +Save that host, then edit the group's default port to 2200 and look at the host's row. + +**Pass:** the address now reads `…:2200`. Connect: the session goes to 2200. + +**Failure means:** the port was copied at creation and the group is a one-shot template. + +### 8.6 Filing a host into a group does not silently pin its password + +Add a group with a default SSH key. Add a host with no group and leave AUTHENTICATION on **Password (ask +each time)**. Save. Now edit it and choose the group. + +**Pass:** the picker gains an **Inherit from group** entry and moves to it. Save, and the host row reads +`key`, and the connect bar shows a note naming the group rather than a password box. + +**Failure means:** the picker's "Password (ask each time)" was written as a decision when it was only the +absence of one, and this host will never use the fleet's key. + +### 8.7 A host can still refuse its group's key + +On that same host, set AUTHENTICATION back to **Password (ask each time)** and save. + +**Pass:** the connect bar shows a password box again, and it survives a lock and unlock. + +**Failure means:** the fourth state has no storage and the host is inheriting whatever the group says. + +### 8.8 Back closes the topmost thing, one at a time + +Tap + → New host, then use the back gesture. + +**Pass:** the editor closes and the list is back, with the boxes cleared. Back again leaves the application +— HOSTS is the screen the app opens on and back from it should exit, as it always did. + +### 8.9 Every target is a thumb's size + +Walk the sheet's two rows, the editor's fields, both pickers, the checkbox and the four buttons. + +**Pass:** nothing is under 44 effective pixels tall. + +**Failure means:** a control took its size from its glyph. The desktop suite's only tap-target assertion has +a floor of 20 pixels — set for a mouse — so copying it here would certify a target no thumb can hit. diff --git a/src/DodoSSH.Client.Android/Theme/Phone.axaml b/src/DodoSSH.Client.Android/Theme/Phone.axaml index e9de5f5..e6ae763 100644 --- a/src/DodoSSH.Client.Android/Theme/Phone.axaml +++ b/src/DodoSSH.Client.Android/Theme/Phone.axaml @@ -115,10 +115,65 @@ + + + + + + + + + + @@ -75,7 +92,7 @@ - @@ -106,10 +123,24 @@ the filter, which is what a heading over a filtered list has to say. --> - + - + + + + + + + +