Public Access
Wire the Avalonia shell to the vault
The host list now comes from the vault instead of from a form. A fresh machine takes a server URL, signs in through the browser, enrolls, and from then on opens with the passphrase alone. DodoSSH.Client.Session is the composition layer: where a profile lives, how it unlocks, and how a machine gets one. ClientPaths picks a non-roaming per-OS directory — %LOCALAPPDATA% and never %APPDATA%, because a SQLite cache that roams between two machines is a corrupt one, and each machine's outbox is its own. SessionOpener needs no transport at all and could not reach one if it wanted to; that is the offline unlock, asserted rather than asserted about. A wrong passphrase, a stale KDF and a grant revoked by a rekey are three different answers, because the remedies are three different things and telling someone to retype a passphrase that was never the problem is worse than saying nothing. The shell's states are the onboarding story. The recovery code gets its own state that cannot be clicked past: it exists for one moment, losing it with the passphrase loses the vault, and there is no server-side reset by design. It is dropped from memory on confirmation rather than merely hidden. Sign-in is a delegate over IVaultServer, so the whole state machine runs in a test against an in-memory server — no browser, no identity provider, no toolkit. The view models are plain observable objects, which is what makes that possible. What it does not cover is whether the XAML binds to the right names; that needs a rendered tree and Avalonia.Headless, and is its own piece of work. Three things found by doing it rather than by reading it: - Pooled SQLite connections keep the database file open after the last context is disposed. On Windows that means locked, so the application could never replace its own cache — and a test could not clean up after itself, which is how it surfaced. Dispose now clears the pool. - EF's SQLite provider puts the database in WAL mode, so the cache is three files. A comment in ClientCacheFactory claimed the opposite; reading PRAGMA journal_mode off a real launch settled it. WAL is the right mode here — a sync pass writes while the interface reads — so the comment was wrong on the merits as well as on the fact. - Enrolling a device key with nowhere to keep the private half would put a wrap on the server nobody can open and make the device list claim this machine can unlock without a passphrase. Device binding is now optional and the shell declines it until the OS keystore is wired. Verified on Windows: the client created %LOCALAPPDATA%\DodoSSH\cache.db and migrated it on first launch, and msedgewebview2 held an established connection to the data plane while the unlock overlay covered it — which is the point of covering the WebView rather than collapsing it, since a NativeWebView that is never laid out is never realised. 630 tests, up from 593. The recovery-code gate and the offline unlock were each verified by breaking them and watching the right test fail. Still to do for M1's actual definition of done: the manual run against the real API and a real Keycloak. Credentials are not a synced entity type yet, so a connection still asks for a password, and the interface says so rather than implying otherwise.
This commit is contained in:
@@ -0,0 +1,200 @@
|
||||
using DodoSSH.Client.Api;
|
||||
using DodoSSH.Client.Auth;
|
||||
using DodoSSH.Client.Session;
|
||||
using DodoSSH.Client.Sync;
|
||||
using DodoSSH.Contracts;
|
||||
|
||||
namespace DodoSSH.Client.App.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// A signed-in server, without the signing in.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Stands in for a <c>ServerConnection</c> so the shell's state machine can be driven end to end. The
|
||||
/// account half stores what it is given and reports it back, because the provisioner re-reads <c>/me</c>
|
||||
/// after enrolling and a stub that echoed the request would make that check meaningless. The sync half
|
||||
/// applies pushes and serves them back as a change log, which is enough for the shell — the interesting
|
||||
/// conflict behaviour is covered in <c>DodoSSH.Client.Sync.Tests</c> against a server that enforces
|
||||
/// version checks.
|
||||
/// </remarks>
|
||||
internal sealed class FakeVaultServer : IVaultServer, IAccountApi, ISyncApi, IKeyBindingAuthorizer
|
||||
{
|
||||
private readonly List<SyncChange> log = [];
|
||||
private readonly Dictionary<Guid, SyncChange> rows = [];
|
||||
|
||||
private KeyStatement? statement;
|
||||
private byte[]? wrappedPrivateKey;
|
||||
private KdfParameters? kdfParameters;
|
||||
private VaultSummary? personalVault;
|
||||
|
||||
internal Guid UserId { get; } = Guid.Parse("0192f0c8-4444-7aaa-8bbb-dddddddddddd");
|
||||
|
||||
internal int EnrollmentCount { get; private set; }
|
||||
|
||||
internal int PushCount { get; private set; }
|
||||
|
||||
internal bool IsEnrolled => statement is not null;
|
||||
|
||||
internal int LiveRowCount => rows.Values.Count(row => row.Operation != SyncOperation.Delete);
|
||||
|
||||
/// <summary>When set, the next sign-in throws — how an unreachable server is exercised.</summary>
|
||||
internal Exception? SignInFailure { get; set; }
|
||||
|
||||
/// <inheritdoc />
|
||||
public Uri ServerUrl { get; } = new("https://dodossh.example");
|
||||
|
||||
/// <inheritdoc />
|
||||
public IAccountApi Account => this;
|
||||
|
||||
/// <inheritdoc />
|
||||
public ISyncApi Sync => this;
|
||||
|
||||
/// <inheritdoc />
|
||||
public IKeyBindingAuthorizer KeyBinding => this;
|
||||
|
||||
/// <inheritdoc />
|
||||
public SyncOptions SyncOptions => SyncOptions.Default;
|
||||
|
||||
/// <inheritdoc />
|
||||
public void Dispose()
|
||||
{
|
||||
// Nothing to release; the shell disposes this on lock and on shutdown, and both paths have to be
|
||||
// safe to run more than once.
|
||||
}
|
||||
|
||||
// ---- Identity provider ----
|
||||
|
||||
/// <inheritdoc />
|
||||
public Task<string> AuthorizeKeyBindingAsync(string bindingNonce, CancellationToken cancellationToken) =>
|
||||
Task.FromResult("stub-id-token");
|
||||
|
||||
// ---- Account ----
|
||||
|
||||
/// <inheritdoc />
|
||||
public Task<MeResponse> GetMeAsync(CancellationToken cancellationToken) =>
|
||||
Task.FromResult(new MeResponse(
|
||||
UserId,
|
||||
"https://idp.example/realms/dodossh",
|
||||
"alice",
|
||||
"alice@example.com",
|
||||
"Alice Example",
|
||||
EnrollmentRequired: !IsEnrolled,
|
||||
KeyGeneration: statement?.KeyGeneration,
|
||||
WrappedPrivateKey: wrappedPrivateKey,
|
||||
KdfParameters: kdfParameters,
|
||||
Vaults: personalVault is null ? [] : [personalVault]));
|
||||
|
||||
/// <inheritdoc />
|
||||
public Task<EnrollmentResponse> EnrollAsync(
|
||||
EnrollmentRequest request,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
EnrollmentCount++;
|
||||
|
||||
statement = request.Statement;
|
||||
wrappedPrivateKey = request.WrappedPrivateKey;
|
||||
kdfParameters = request.KdfParameters;
|
||||
|
||||
personalVault = new VaultSummary(
|
||||
request.PersonalVault.VaultId,
|
||||
request.PersonalVault.Name,
|
||||
IsPersonal: true,
|
||||
TeamId: null,
|
||||
KeyGeneration: 1,
|
||||
Permissions: 31,
|
||||
request.PersonalVault.WrappedVaultKey,
|
||||
RekeyRequired: false);
|
||||
|
||||
return Task.FromResult(new EnrollmentResponse(
|
||||
UserId,
|
||||
KeyGeneration: 1,
|
||||
Fingerprint: new byte[32],
|
||||
request.PersonalVault.VaultId,
|
||||
DeviceId: null,
|
||||
KeyLogSequence: 1));
|
||||
}
|
||||
|
||||
// ---- Sync ----
|
||||
|
||||
/// <inheritdoc />
|
||||
public Task<SyncPullResponse> SyncPullAsync(
|
||||
Guid vaultId,
|
||||
SyncPullRequest request,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var after = request.Cursor is null
|
||||
? 0
|
||||
: long.Parse(request.Cursor.AsSpan("app-v1:".Length), provider: null);
|
||||
|
||||
var page = log.Where(change => change.ChangeSequence > after).ToList();
|
||||
var next = page.Count > 0 ? page[^1].ChangeSequence : after;
|
||||
|
||||
return Task.FromResult(new SyncPullResponse(
|
||||
page,
|
||||
$"app-v1:{next}",
|
||||
HasMore: false,
|
||||
ServerTime: DateTimeOffset.FromUnixTimeSeconds(1_750_000_000),
|
||||
CurrentKeyGeneration: 1));
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public Task<SyncPushResponse> SyncPushAsync(
|
||||
Guid vaultId,
|
||||
SyncPushRequest request,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
PushCount++;
|
||||
|
||||
var results = new List<SyncPushResult>(request.Operations.Count);
|
||||
|
||||
foreach (var operation in request.Operations)
|
||||
{
|
||||
results.Add(Apply(operation));
|
||||
}
|
||||
|
||||
return Task.FromResult(new SyncPushResponse(results, $"app-v1:{log.Count}"));
|
||||
}
|
||||
|
||||
private SyncPushResult Apply(SyncPushOperation operation)
|
||||
{
|
||||
rows.TryGetValue(operation.EntityId, out var existing);
|
||||
|
||||
var current = existing?.Operation == SyncOperation.Delete ? null : existing;
|
||||
|
||||
if (operation.ExpectedVersion != current?.Version)
|
||||
{
|
||||
return new SyncPushResult(
|
||||
operation.OperationId,
|
||||
SyncOperationStatus.Conflict,
|
||||
current?.Version,
|
||||
current?.ChangeSequence,
|
||||
current,
|
||||
null);
|
||||
}
|
||||
|
||||
var sequence = log.Count + 1;
|
||||
|
||||
var change = new SyncChange(
|
||||
operation.EntityType,
|
||||
operation.EntityId,
|
||||
operation.Operation,
|
||||
Version: (current?.Version ?? 0) + 1,
|
||||
ChangeSequence: sequence,
|
||||
Payload: operation.Operation == SyncOperation.Delete ? null : operation.Payload,
|
||||
PlaintextFields: operation.Operation == SyncOperation.Delete
|
||||
? null
|
||||
: operation.PlaintextFields,
|
||||
UpdatedAt: DateTimeOffset.FromUnixTimeSeconds(1_750_000_000 + sequence));
|
||||
|
||||
rows[operation.EntityId] = change;
|
||||
log.Add(change);
|
||||
|
||||
return new SyncPushResult(
|
||||
operation.OperationId,
|
||||
SyncOperationStatus.Applied,
|
||||
change.Version,
|
||||
sequence,
|
||||
null,
|
||||
null);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user