Public Access
Merge branch 'main' into claude/host-management-ui-plan-7f20ab
Seven files needed a hand. Most were two branches adding something in the same place, but three were one branch changing what the other had moved or renamed, and those are the ones worth reading. The shell keeps both new fields and both constructor lines: the connection recorder this branch built and the teams view model main did. Where main put a teams load inside OnScreenChanged, it now sits beside the logs refresh rather than inside RaiseSurfaceState — this branch extracted that notification block and it is called from two properties, so a screen-specific side effect in there would fire on every terminal switch as well. Main gave four row types a vault id and a vault name, and this branch had moved one of them — KnownHostRowViewModel — into its own file when the pinned keys became a screen. Git resolved that as "deleted here, modified there" and took the delete, which compiles as long as nobody looks: the moved copy still had the two-argument constructor and the call site had grown to four. Carried over by hand, along with the ordering the pins list now does on them. The status line's quiet rule was the subtle one. Main extracted it into IsWorthReporting; this branch had changed the same condition to read item counts rather than raw ones, because every user action queues a log entry a moment later and this machine reads its own entries back on the next pull. Take main's structure and the merge builds, passes, and silently restores a bug this branch existed partly to fix — every save's message overwritten a second after it appears. The method now reads PulledItems and PushedItems, with the reason in its remarks. Two conflicts were prose that had gone stale rather than code. The keychain screen's comment said team vaults are refused by the server's access service, which was true when it was written and is not now; main's replacement stands, in this branch's vocabulary. The design-gaps row for groups was claimed by both — real host groups here, per-vault headings there — and they are different things, so both rows stay and the difference is stated: a group is a shelf the user chose, a vault is who can read the item. One defect the tests found and the compiler could not. Generating a key opens the same editor as pasting one, but not through NewKey — so it never set the target vault main added, and a generated key was filed into whatever vault was edited last, or none. Both key-generation tests failed on it. Fixed where the editor opens, with the reason recorded there. One gap is left deliberately and is written down rather than half-built. Hosts, keys, credentials and pins are read across every vault this session holds a key for; groups are read from the active vault alone, so a host a teammate filed shows under UNGROUPED. Nothing is lost or misfiled — it is what the sidebar already shows for a group that has been deleted — but closing it needs a vault id on every group row for rename and delete, and a way to tell two vaults' identically-named groups apart under a layout with one heading per group. Both are worth doing and neither is a merge's business. It is in the remarks on ReloadGroupsAsync and in docs/design-import-gaps.md. dotnet build, dotnet test and dotnet format --verify-no-changes are all clean: 1282 tests, including the end-to-end suite against real containers.
This commit is contained in:
@@ -22,8 +22,18 @@ namespace DodoSSH.Client.App.ViewModels;
|
||||
/// of pinning one is to compare it with what they published.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal sealed class KnownHostRowViewModel(VaultItem<KnownHostSecret> pin, bool isDialledByAHost)
|
||||
internal sealed class KnownHostRowViewModel(
|
||||
VaultItem<KnownHostSecret> pin,
|
||||
bool isDialledByAHost,
|
||||
Guid vaultId,
|
||||
string vaultName)
|
||||
{
|
||||
/// <summary>Which vault this pin lives in. See <see cref="HostRowViewModel.VaultId"/>.</summary>
|
||||
internal Guid VaultId => vaultId;
|
||||
|
||||
/// <summary>The vault's display name.</summary>
|
||||
internal string VaultName => vaultName;
|
||||
|
||||
internal Guid EntityId => pin.EntityId;
|
||||
|
||||
internal KnownHostSecret Pin => pin.Secret;
|
||||
|
||||
@@ -198,6 +198,8 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
|
||||
/// </remarks>
|
||||
private readonly ConnectionRecorder connectionLog;
|
||||
|
||||
private readonly TeamsViewModel teams;
|
||||
|
||||
private IVaultServer? connection;
|
||||
|
||||
/// <summary>The refresh token last written to the cache, so a rotation is noticed without reading it back.</summary>
|
||||
@@ -274,6 +276,12 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
|
||||
connectionLog = new ConnectionRecorder(clock, Environment.MachineName);
|
||||
this.workspace.ConnectionLog = connectionLog;
|
||||
|
||||
// Both dependencies as functions rather than values: the connection arrives after sign-in and the
|
||||
// session after unlock, and both go away again on lock. Capturing either would give this screen a
|
||||
// reference that outlives what it points at — which for a session means holding vault keys past the
|
||||
// moment locking is supposed to have zeroed them.
|
||||
teams = new TeamsViewModel(() => connection, () => Vault?.Session);
|
||||
|
||||
// Subscribed for the life of the process, because the workspace lives that long and so does the tab
|
||||
// list. Detached in DisposeAsync, which is the only point either of them ends.
|
||||
this.workspace.SessionEnded += OnWorkspaceSessionEnded;
|
||||
@@ -365,6 +373,17 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
|
||||
[ObservableProperty]
|
||||
private LogsViewModel? logsScreen;
|
||||
|
||||
/// <summary>
|
||||
/// The teams screen, which the window binds to whether or not a vault is open.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Not nullable and never replaced, for the reason <see cref="Transfers"/> is not: the screen reads a
|
||||
/// server rather than a vault, and both of its dependencies are fetched through a function at the
|
||||
/// moment they are needed. That means a lock does not have to tear it down and an unlock does not have
|
||||
/// to rebuild it, and the list it is showing survives both.
|
||||
/// </remarks>
|
||||
internal TeamsViewModel Teams => teams;
|
||||
|
||||
/// <summary>The transfers screen, which the window binds to whether or not a vault is open.</summary>
|
||||
/// <remarks>
|
||||
/// Not nullable and never replaced, unlike <see cref="Vault"/>. The screen is unreachable while locked —
|
||||
@@ -2009,6 +2028,15 @@ internal sealed partial class MainWindowViewModel : ObservableObject, IAsyncDisp
|
||||
{
|
||||
_ = logs.RefreshCommand.ExecuteAsync(null);
|
||||
}
|
||||
|
||||
// Teams are read from the server rather than from the vault, so there is nothing to show until
|
||||
// somebody asks for it — and asking for it on every unlock would be a request per launch for a
|
||||
// screen most people never open. Fire-and-forget because a property change cannot await, and
|
||||
// because the view model turns every failure into its own status line rather than throwing.
|
||||
if (value is ShellScreen.Team)
|
||||
{
|
||||
_ = teams.LoadAsync(CancellationToken.None);
|
||||
}
|
||||
}
|
||||
|
||||
/// <inheritdoc cref="OnScreenChanged" />
|
||||
|
||||
@@ -0,0 +1,523 @@
|
||||
using System.Collections.ObjectModel;
|
||||
using System.Globalization;
|
||||
using CommunityToolkit.Mvvm.ComponentModel;
|
||||
using CommunityToolkit.Mvvm.Input;
|
||||
using DodoSSH.Client.Api;
|
||||
using DodoSSH.Client.Session;
|
||||
using DodoSSH.Contracts;
|
||||
|
||||
namespace DodoSSH.Client.App.ViewModels;
|
||||
|
||||
/// <summary>One team, as a row in the list.</summary>
|
||||
internal sealed record TeamRowViewModel(TeamSummary Team)
|
||||
{
|
||||
internal Guid TeamId => Team.TeamId;
|
||||
|
||||
internal string Name => Team.Name;
|
||||
|
||||
internal string Slug => Team.Slug;
|
||||
|
||||
/// <summary>The caller's own role, as the chip the list shows.</summary>
|
||||
internal string Role => Team.Role.ToString().ToUpperInvariant();
|
||||
|
||||
internal string Detail => string.Create(
|
||||
CultureInfo.CurrentCulture,
|
||||
$"{Team.MemberCount} member(s) · {Team.VaultCount} vault(s)");
|
||||
|
||||
/// <summary>Whether this account may add members and create vaults here.</summary>
|
||||
internal bool CanAdminister =>
|
||||
Team.Role is TeamMemberRole.Admin or TeamMemberRole.Owner;
|
||||
}
|
||||
|
||||
/// <summary>One member, as a row in the members table.</summary>
|
||||
internal sealed record TeamMemberRowViewModel(TeamMemberSummary Member, bool IsSelf)
|
||||
{
|
||||
internal Guid UserId => Member.UserId;
|
||||
|
||||
/// <summary>What to call them. The address, or the id when the account has neither.</summary>
|
||||
/// <remarks>
|
||||
/// Falling through to the id rather than to "Unknown": an account with no display name and no email is
|
||||
/// rare and is exactly the row somebody needs to be able to identify in order to remove it.
|
||||
/// </remarks>
|
||||
internal string Name =>
|
||||
Member.DisplayName ?? Member.Email ?? Member.UserId.ToString();
|
||||
|
||||
internal string Email => Member.Email ?? "—";
|
||||
|
||||
internal string Role => Member.Role.ToString().ToUpperInvariant();
|
||||
|
||||
/// <summary>
|
||||
/// What the account can be given, in one phrase.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Not a two-factor column, not a last-active column. The server records neither: there is no
|
||||
/// second-factor concept anywhere in it, and <c>LastSeenAtUtc</c> is written at provisioning and at
|
||||
/// enrollment and nowhere else, so a column headed "last active" would be reporting something else.
|
||||
/// What is true and worth a column is whether a vault key can be wrapped to them at all.
|
||||
/// </remarks>
|
||||
internal string KeyState => Member.IsEnrolled
|
||||
? "key published"
|
||||
: "no key yet — cannot be given a vault";
|
||||
|
||||
internal bool CanBeRemoved => Member.Role != TeamMemberRole.Owner;
|
||||
}
|
||||
|
||||
/// <summary>One vault of the selected team, with what this account can do to it.</summary>
|
||||
internal sealed record TeamVaultRowViewModel(Guid VaultId, string Name, bool IsReadable, bool RekeyRequired)
|
||||
{
|
||||
/// <summary>What the row says about itself.</summary>
|
||||
/// <remarks>
|
||||
/// The unreadable case is the one that has to read clearly, because it is normal rather than broken:
|
||||
/// somebody has been added to a team and nobody has wrapped the vault key to them yet.
|
||||
/// </remarks>
|
||||
internal string State => (IsReadable, RekeyRequired) switch
|
||||
{
|
||||
(false, _) => "waiting for a key — ask a member who has one to share it",
|
||||
(true, true) => "readable · a rekey is owed after a membership change",
|
||||
_ => "readable",
|
||||
};
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The teams screen: who is in a team, what they may do, and which vaults they hold a key to.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>Two separate acts, and the screen is built around saying so.</b> Adding somebody to a team is a
|
||||
/// server-side authorization change and takes effect immediately. Giving them a vault key is a
|
||||
/// cryptographic act only a machine with that key can perform, and until somebody does it their vault
|
||||
/// list shows an entry they cannot open. Every product that hides this ends up implying the server can
|
||||
/// hand out access on its own — which, here, it cannot. See <c>TeamService</c> and ADR 0001.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Nothing on this screen is cached across a lock. It reads the server on open and after each change,
|
||||
/// because membership is not vault content and has no local mirror — a team list in the encrypted cache
|
||||
/// would be a second copy of something the server is authoritative for.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal sealed partial class TeamsViewModel(
|
||||
Func<IVaultServer?> connection,
|
||||
Func<VaultSession?> session) : ObservableObject
|
||||
{
|
||||
/// <summary>Teams this account belongs to.</summary>
|
||||
internal ObservableCollection<TeamRowViewModel> Teams { get; } = [];
|
||||
|
||||
/// <summary>Members of the selected team.</summary>
|
||||
internal ObservableCollection<TeamMemberRowViewModel> Members { get; } = [];
|
||||
|
||||
/// <summary>Vaults the selected team owns, as far as this account can see them.</summary>
|
||||
internal ObservableCollection<TeamVaultRowViewModel> Vaults { get; } = [];
|
||||
|
||||
[ObservableProperty]
|
||||
private TeamRowViewModel? selectedTeam;
|
||||
|
||||
[ObservableProperty]
|
||||
private TeamMemberRowViewModel? selectedMember;
|
||||
|
||||
[ObservableProperty]
|
||||
private TeamVaultRowViewModel? selectedVault;
|
||||
|
||||
[ObservableProperty]
|
||||
private string status = string.Empty;
|
||||
|
||||
[ObservableProperty]
|
||||
private bool isBusy;
|
||||
|
||||
// ---- Creating a team ----
|
||||
|
||||
[ObservableProperty]
|
||||
private bool isCreatingTeam;
|
||||
|
||||
[ObservableProperty]
|
||||
private string newTeamName = string.Empty;
|
||||
|
||||
[ObservableProperty]
|
||||
private string newTeamSlug = string.Empty;
|
||||
|
||||
// ---- Adding a member ----
|
||||
|
||||
[ObservableProperty]
|
||||
private string inviteEmail = string.Empty;
|
||||
|
||||
/// <summary>Whether there is a server to talk to at all.</summary>
|
||||
internal bool IsOnline => connection() is not null;
|
||||
|
||||
/// <summary>Whether the selected team can be administered by this account.</summary>
|
||||
internal bool CanAdministerSelected => SelectedTeam?.CanAdminister == true;
|
||||
|
||||
/// <summary>Whether there is anything to show below the team list.</summary>
|
||||
internal bool HasSelection => SelectedTeam is not null;
|
||||
|
||||
internal bool HasTeams => Teams.Count > 0;
|
||||
|
||||
/// <summary>Reads the teams this account belongs to, and the selected one's detail.</summary>
|
||||
internal Task LoadAsync(CancellationToken cancellationToken) =>
|
||||
RunAsync(() => ReloadAsync(cancellationToken));
|
||||
|
||||
/// <summary>
|
||||
/// The reload itself, without the busy gate.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Separate from <see cref="LoadAsync"/> because every command ends by reloading, and a command that
|
||||
/// called the gated version would find the gate held by itself and skip the reload silently — leaving
|
||||
/// a team that was created moments ago missing from the list it was just added to.
|
||||
/// </remarks>
|
||||
private async Task ReloadAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
if (connection() is not { } server)
|
||||
{
|
||||
Teams.Clear();
|
||||
Members.Clear();
|
||||
Vaults.Clear();
|
||||
RaiseState();
|
||||
|
||||
Status = "Offline. Teams are read from the server, so this screen needs a connection.";
|
||||
return;
|
||||
}
|
||||
|
||||
var selectedId = SelectedTeam?.TeamId;
|
||||
|
||||
var teams = await server.Teams.ListTeamsAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
Teams.Clear();
|
||||
|
||||
foreach (var team in teams)
|
||||
{
|
||||
Teams.Add(new TeamRowViewModel(team));
|
||||
}
|
||||
|
||||
SelectedTeam =
|
||||
Teams.FirstOrDefault(row => row.TeamId == selectedId) ?? Teams.FirstOrDefault();
|
||||
|
||||
RaiseState();
|
||||
|
||||
await LoadSelectedAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
Status = Teams.Count == 0
|
||||
? "You are not in a team yet. Create one to share hosts and credentials with colleagues."
|
||||
: string.Empty;
|
||||
}
|
||||
|
||||
/// <summary>Opens the create-a-team form.</summary>
|
||||
[RelayCommand]
|
||||
private void NewTeam()
|
||||
{
|
||||
NewTeamName = string.Empty;
|
||||
NewTeamSlug = string.Empty;
|
||||
IsCreatingTeam = true;
|
||||
Status = string.Empty;
|
||||
}
|
||||
|
||||
/// <summary>Abandons the create-a-team form.</summary>
|
||||
[RelayCommand]
|
||||
private void CancelNewTeam()
|
||||
{
|
||||
IsCreatingTeam = false;
|
||||
Status = string.Empty;
|
||||
}
|
||||
|
||||
/// <summary>Creates a team, with this account as its owner.</summary>
|
||||
/// <remarks>
|
||||
/// The id is generated here, which is what makes a create whose response was lost safe to send again —
|
||||
/// the server treats an identical repeat as the same team rather than a second one.
|
||||
/// </remarks>
|
||||
[RelayCommand]
|
||||
private async Task CreateTeamAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
if (connection() is not { } server)
|
||||
{
|
||||
Status = "Offline. Creating a team needs a connection.";
|
||||
return;
|
||||
}
|
||||
|
||||
var name = NewTeamName.Trim();
|
||||
var slug = NewTeamSlug.Trim().ToLowerInvariant();
|
||||
|
||||
if (name.Length == 0 || slug.Length == 0)
|
||||
{
|
||||
Status = "A team needs a name and a slug.";
|
||||
return;
|
||||
}
|
||||
|
||||
await RunAsync(async () =>
|
||||
{
|
||||
var created = await server.Teams
|
||||
.CreateTeamAsync(
|
||||
new CreateTeamRequest(Guid.CreateVersion7(), name, slug, null), cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
IsCreatingTeam = false;
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
SelectedTeam = Teams.FirstOrDefault(row => row.TeamId == created.TeamId) ?? SelectedTeam;
|
||||
|
||||
Status = $"Created '{created.Name}'. Add a vault to it, then share that vault's key with "
|
||||
+ "whoever needs it.";
|
||||
}).ConfigureAwait(true);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Adds a member, by looking their address up in the directory first.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Two calls rather than one, and the order is the point: the directory is what turns an address into
|
||||
/// an account and a public key, and the key that gets verified before any sharing is the one that
|
||||
/// lookup returned. Letting the server resolve an address to an account inside the add would put an
|
||||
/// unwitnessed step between the two.
|
||||
/// </remarks>
|
||||
[RelayCommand]
|
||||
private async Task AddMemberAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
if (connection() is not { } server || SelectedTeam is not { } team)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
var email = InviteEmail.Trim();
|
||||
|
||||
if (email.Length == 0)
|
||||
{
|
||||
Status = "Type the email address of somebody who has signed in to this server.";
|
||||
return;
|
||||
}
|
||||
|
||||
await RunAsync(async () =>
|
||||
{
|
||||
var found = await server.Directory.LookupByEmailAsync(email, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
if (found.Count == 0)
|
||||
{
|
||||
Status = $"No account here has the address '{email}'. They have to sign in to this "
|
||||
+ "server once before they can be added — that is what publishes the key a vault "
|
||||
+ "would be shared with.";
|
||||
return;
|
||||
}
|
||||
|
||||
var member = await server.Teams
|
||||
.AddTeamMemberAsync(
|
||||
team.TeamId,
|
||||
new AddTeamMemberRequest(found[0].UserId, TeamMemberRole.Member),
|
||||
cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
InviteEmail = string.Empty;
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
// Said out loud, every time. The single most common misunderstanding this design invites is
|
||||
// that adding somebody gave them the vault.
|
||||
Status = $"Added {member.Email ?? member.DisplayName ?? "the account"} as a member. They "
|
||||
+ "cannot read anything yet — select a vault below and share its key.";
|
||||
}).ConfigureAwait(true);
|
||||
}
|
||||
|
||||
/// <summary>Removes a member, revoking every vault key grant they hold from this team.</summary>
|
||||
[RelayCommand]
|
||||
private async Task RemoveMemberAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
if (connection() is not { } server
|
||||
|| SelectedTeam is not { } team
|
||||
|| SelectedMember is not { } member)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
await RunAsync(async () =>
|
||||
{
|
||||
await server.Teams
|
||||
.RemoveTeamMemberAsync(team.TeamId, member.UserId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
// The honest sentence, not the reassuring one. See ADR 0001: revocation is not retroactive,
|
||||
// and a message implying otherwise is the one thing this screen must not say.
|
||||
Status = $"Removed {member.Name}. They can no longer fetch this team's vaults, and anything "
|
||||
+ "they had already downloaded is still on their machine — rotate the credentials that "
|
||||
+ "matter.";
|
||||
}).ConfigureAwait(true);
|
||||
}
|
||||
|
||||
/// <summary>Creates a vault owned by the selected team.</summary>
|
||||
[RelayCommand]
|
||||
private async Task CreateVaultAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
if (connection() is not { } server
|
||||
|| session() is not { } open
|
||||
|| SelectedTeam is not { } team)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
await RunAsync(async () =>
|
||||
{
|
||||
var vault = await open
|
||||
.CreateTeamVaultAsync(server.Teams, team.TeamId, team.Name, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
Status = $"Created the vault '{vault.Name}'. It is yours alone until you share its key; new "
|
||||
+ "hosts and credentials can be filed into it from the Vault screen.";
|
||||
}).ConfigureAwait(true);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Wraps the selected vault's key to the selected member.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Everything that makes this safe happens inside <see cref="VaultSession.ShareVaultAsync"/>: the key
|
||||
/// log is read and its chain verified, and the directory's answer has to appear in it unchanged before
|
||||
/// anything is wrapped. A refusal is reported here in full rather than as "sharing failed", because
|
||||
/// the reasons are not interchangeable — one of them means somebody is substituting keys.
|
||||
/// </remarks>
|
||||
[RelayCommand]
|
||||
private async Task ShareVaultAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
if (connection() is not { } server
|
||||
|| session() is not { } open
|
||||
|| SelectedVault is not { } vault
|
||||
|| SelectedMember is not { } member)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
if (member.IsSelf)
|
||||
{
|
||||
Status = "You already hold this vault's key.";
|
||||
return;
|
||||
}
|
||||
|
||||
await RunAsync(async () =>
|
||||
{
|
||||
var outcome = await open
|
||||
.ShareVaultAsync(server.Grants, server.Directory, vault.VaultId, member.UserId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
Status = outcome.Shared
|
||||
? $"Shared '{vault.Name}' with {member.Name}. {outcome.Message}"
|
||||
: $"Did not share '{vault.Name}': {outcome.Message}";
|
||||
}).ConfigureAwait(true);
|
||||
}
|
||||
|
||||
/// <summary>Withdraws the selected member's key to the selected vault.</summary>
|
||||
[RelayCommand]
|
||||
private async Task RevokeVaultAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
if (connection() is not { } server
|
||||
|| SelectedVault is not { } vault
|
||||
|| SelectedMember is not { } member)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
await RunAsync(async () =>
|
||||
{
|
||||
var revoked = await server.Grants
|
||||
.RevokeVaultGrantAsync(vault.VaultId, member.UserId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
Status = revoked
|
||||
? $"Withdrew {member.Name}'s key to '{vault.Name}'. Future reads are blocked; what they "
|
||||
+ "already have is unaffected."
|
||||
: $"{member.Name} held no key to '{vault.Name}'.";
|
||||
}).ConfigureAwait(true);
|
||||
}
|
||||
|
||||
partial void OnSelectedTeamChanged(TeamRowViewModel? value)
|
||||
{
|
||||
RaiseState();
|
||||
|
||||
// Fire-and-forget on purpose, and the only place in this class that is: selection changes come
|
||||
// from a list box, which has no cancellation token and no way to await. Failures land in Status
|
||||
// through RunAsync exactly as a command's would.
|
||||
_ = LoadSelectedAsync(CancellationToken.None);
|
||||
}
|
||||
|
||||
/// <summary>Reads the selected team's members and vaults.</summary>
|
||||
private async Task LoadSelectedAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
Members.Clear();
|
||||
Vaults.Clear();
|
||||
|
||||
if (connection() is not { } server || SelectedTeam is not { } team)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
var open = session();
|
||||
var selfId = open?.Profile.UserId;
|
||||
|
||||
var members = await server.Teams
|
||||
.ListTeamMembersAsync(team.TeamId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
foreach (var member in members)
|
||||
{
|
||||
Members.Add(new TeamMemberRowViewModel(member, member.UserId == selfId));
|
||||
}
|
||||
|
||||
if (open is null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
// Read from the session rather than from a team-vaults endpoint, because the interesting fact
|
||||
// about a team vault here is whether *this* machine can open it — which is a property of the
|
||||
// keyring and not something the server can answer.
|
||||
var readable = open.ReadableVaults.Select(vault => vault.VaultId).ToHashSet();
|
||||
|
||||
foreach (var vault in open.Vaults.Where(vault => vault.TeamId == team.TeamId))
|
||||
{
|
||||
Vaults.Add(new TeamVaultRowViewModel(
|
||||
vault.VaultId, vault.Name, readable.Contains(vault.VaultId), vault.RekeyRequired));
|
||||
}
|
||||
|
||||
SelectedVault = Vaults.FirstOrDefault();
|
||||
}
|
||||
|
||||
private void RaiseState()
|
||||
{
|
||||
OnPropertyChanged(nameof(HasTeams));
|
||||
OnPropertyChanged(nameof(HasSelection));
|
||||
OnPropertyChanged(nameof(CanAdministerSelected));
|
||||
OnPropertyChanged(nameof(IsOnline));
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// One place that raises the busy flag and turns a failure into a sentence. An API exception's message
|
||||
/// is the server's problem detail, which is written for a person to read — see <c>Problems</c> — so it
|
||||
/// is shown rather than replaced with something vaguer.
|
||||
/// </remarks>
|
||||
private async Task RunAsync(Func<Task> work)
|
||||
{
|
||||
if (IsBusy)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
IsBusy = true;
|
||||
|
||||
try
|
||||
{
|
||||
await work().ConfigureAwait(true);
|
||||
}
|
||||
catch (DodoSshApiException exception)
|
||||
{
|
||||
Status = exception.Message;
|
||||
}
|
||||
catch (Exception exception) when (exception is not OutOfMemoryException
|
||||
and not OperationCanceledException)
|
||||
{
|
||||
Status = exception.Message;
|
||||
}
|
||||
finally
|
||||
{
|
||||
IsBusy = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -49,6 +49,12 @@ internal sealed class RemoteEntryRowViewModel(SftpEntry entry)
|
||||
|
||||
/// <summary>The mode as <c>drwxr-xr-x</c>, which is the design's <c>PERMS</c> column.</summary>
|
||||
internal string Permissions => entry.Permissions;
|
||||
|
||||
/// <summary>Whether the row is a file with an execute bit, which the NAME column colours for.</summary>
|
||||
internal bool IsExecutable => entry.IsExecutable;
|
||||
|
||||
/// <summary>Whether the row is a file anyone may write to, which the PERMS column colours for.</summary>
|
||||
internal bool IsWorldWritable => entry.IsWorldWritable;
|
||||
}
|
||||
|
||||
/// <summary>One local file or directory, as a row.</summary>
|
||||
|
||||
@@ -124,10 +124,40 @@ internal sealed class SnippetRowViewModel(VaultItem<SnippetSecret> snippet)
|
||||
/// the flags the list has to show: an edit this machine has not pushed, a change the server refused, and
|
||||
/// an item a newer client wrote that must not be re-encoded here.
|
||||
/// </remarks>
|
||||
internal sealed partial class HostRowViewModel(VaultItem<HostSecret> host) : ObservableObject, ISidebarRow
|
||||
internal sealed partial class HostRowViewModel(
|
||||
VaultItem<HostSecret> host,
|
||||
Guid vaultId,
|
||||
string vaultName) : ObservableObject, ISidebarRow
|
||||
{
|
||||
internal Guid EntityId => host.EntityId;
|
||||
|
||||
/// <summary>
|
||||
/// Which vault this host lives in.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Carried on the row rather than read from the session, because a session now holds several and an
|
||||
/// edit has to return to the vault the item came from. Writing it to the active vault instead would
|
||||
/// create a second copy in the personal vault and leave the team's original untouched — a silent fork
|
||||
/// that only shows up when somebody else wonders why their change never arrived.
|
||||
/// </remarks>
|
||||
internal Guid VaultId => vaultId;
|
||||
|
||||
/// <summary>The vault's display name, for the heading the sidebar groups under.</summary>
|
||||
internal string VaultName => vaultName;
|
||||
|
||||
/// <summary>
|
||||
/// The vault name to print on this row, or empty when there is only one vault to be in.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Decided by the list rather than by the row, because "is there more than one vault" is not
|
||||
/// something a row can see — and the alternative, a binding that reaches out to the parent view
|
||||
/// model from inside an item template, is the kind of thing that silently resolves to nothing.
|
||||
/// </remarks>
|
||||
internal string VaultBadge { get; init; } = string.Empty;
|
||||
|
||||
/// <summary>Whether this row has a vault to name.</summary>
|
||||
internal bool HasVaultBadge => VaultBadge.Length > 0;
|
||||
|
||||
internal HostSecret Host => host.Secret;
|
||||
|
||||
internal string Label => host.Secret.Label;
|
||||
@@ -270,10 +300,16 @@ internal sealed record AuthenticationChoice(
|
||||
/// property.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal sealed class SshKeyRowViewModel(VaultItem<SshKeySecret> key)
|
||||
internal sealed class SshKeyRowViewModel(VaultItem<SshKeySecret> key, Guid vaultId, string vaultName)
|
||||
{
|
||||
internal Guid EntityId => key.EntityId;
|
||||
|
||||
/// <summary>Which vault this key lives in. See <see cref="HostRowViewModel.VaultId"/>.</summary>
|
||||
internal Guid VaultId => vaultId;
|
||||
|
||||
/// <summary>The vault's display name.</summary>
|
||||
internal string VaultName => vaultName;
|
||||
|
||||
internal SshKeySecret Key => key.Secret;
|
||||
|
||||
internal string Label => key.Secret.Label;
|
||||
@@ -335,10 +371,19 @@ internal sealed class ObjectStoreRowViewModel(VaultItem<ObjectStoreSecret> store
|
||||
internal string Badge => ItemBadge.For(store.IsBlocked, store.IsReadOnly, store.HasUnsyncedChanges);
|
||||
}
|
||||
|
||||
internal sealed class CredentialRowViewModel(VaultItem<CredentialSecret> credential)
|
||||
internal sealed class CredentialRowViewModel(
|
||||
VaultItem<CredentialSecret> credential,
|
||||
Guid vaultId,
|
||||
string vaultName)
|
||||
{
|
||||
internal Guid EntityId => credential.EntityId;
|
||||
|
||||
/// <summary>Which vault this credential lives in. See <see cref="HostRowViewModel.VaultId"/>.</summary>
|
||||
internal Guid VaultId => vaultId;
|
||||
|
||||
/// <summary>The vault's display name.</summary>
|
||||
internal string VaultName => vaultName;
|
||||
|
||||
internal CredentialSecret Credential => credential.Secret;
|
||||
|
||||
internal string Label => credential.Secret.Label;
|
||||
@@ -504,6 +549,23 @@ internal enum VaultItemKind
|
||||
/// the badge rather than read back out of it, because the badge is a sentence for a person and a count built
|
||||
/// by comparing it against the literal "not synced" would break the day that wording improves.
|
||||
/// </param>
|
||||
/// <summary>One vault, as an option in the "file this into" picker.</summary>
|
||||
/// <param name="VaultId">The vault.</param>
|
||||
/// <param name="Name">Its display name, which is plaintext as all vault names are.</param>
|
||||
/// <param name="IsPersonal">Whether this is the caller's own vault rather than a team's.</param>
|
||||
internal sealed record VaultChoiceViewModel(Guid VaultId, string Name, bool IsPersonal)
|
||||
{
|
||||
/// <summary>
|
||||
/// What the picker shows.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// A team vault is marked as one. The whole risk this picker introduces is putting a credential
|
||||
/// somewhere more people can read it, so the option that does that must not look like the option
|
||||
/// that does not.
|
||||
/// </remarks>
|
||||
internal string Display => IsPersonal ? Name : $"{Name} · TEAM";
|
||||
}
|
||||
|
||||
internal sealed record VaultItemRowViewModel(
|
||||
VaultItemKind Kind,
|
||||
Guid EntityId,
|
||||
@@ -743,10 +805,16 @@ internal sealed partial class VaultViewModel(
|
||||
/// <remarks>
|
||||
/// The vault's name, because the vault is the only grouping a host has — there are no tags and no
|
||||
/// folders on <c>HostSecret</c>, and deriving a group from a naming convention would be a guess
|
||||
/// presented as structure. One heading, because one vault is reachable: the server denies access to
|
||||
/// every vault that is not this user's own. See <c>docs/design-import-gaps.md</c>.
|
||||
/// presented as structure.
|
||||
/// <para>
|
||||
/// One heading while one vault is reachable, which is the ordinary case. Since M3 a session can hold
|
||||
/// several, and then the heading stops naming one of them and each row names its own — a heading that
|
||||
/// went on saying "PERSONAL" over a list containing a team's hosts would be the sort of quiet lie this
|
||||
/// interface is otherwise careful about.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal string HostsHeading => VaultName.ToUpperInvariant();
|
||||
internal string HostsHeading =>
|
||||
session.ReadableVaults.Take(2).Count() > 1 ? "ALL VAULTS" : VaultName.ToUpperInvariant();
|
||||
|
||||
/// <summary>Whether the host list under the heading is folded away.</summary>
|
||||
[ObservableProperty]
|
||||
@@ -770,6 +838,36 @@ internal sealed partial class VaultViewModel(
|
||||
internal string VaultName =>
|
||||
session.Vaults.FirstOrDefault(vault => vault.VaultId == session.ActiveVaultId)?.Name ?? "Keychain";
|
||||
|
||||
/// <summary>
|
||||
/// The vaults a new item may be filed into: readable, and writable by this account.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Both conditions, not either. A vault this session cannot read has no key to encrypt with, and one
|
||||
/// it can read but not write is a team vault this member is a viewer of — offering either would end
|
||||
/// in a Save that fails, one of them locally and one at the server.
|
||||
/// </remarks>
|
||||
internal ObservableCollection<VaultChoiceViewModel> TargetVaults { get; } = [];
|
||||
|
||||
/// <summary>
|
||||
/// Where the next new item goes.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Falls back to the session's active vault, which is the personal one wherever there is one. Filing
|
||||
/// into a team's vault has to be chosen, never defaulted into: an item put in the wrong vault is
|
||||
/// visible to people who should not have it, and moving it afterwards means deleting and retyping.
|
||||
/// </remarks>
|
||||
internal Guid TargetVaultId => SelectedTargetVault?.VaultId ?? session.ActiveVaultId;
|
||||
|
||||
/// <summary>Whether there is more than one vault to choose between.</summary>
|
||||
/// <remarks>
|
||||
/// The picker is hidden entirely at one, rather than shown disabled. A control offering one option is
|
||||
/// a question with no answer, and for most people this stays at one for ever.
|
||||
/// </remarks>
|
||||
internal bool HasVaultChoice => TargetVaults.Count > 1;
|
||||
|
||||
[ObservableProperty]
|
||||
private VaultChoiceViewModel? selectedTargetVault;
|
||||
|
||||
[ObservableProperty]
|
||||
private HostRowViewModel? selectedHost;
|
||||
|
||||
@@ -1036,6 +1134,24 @@ internal sealed partial class VaultViewModel(
|
||||
/// <summary>The item being edited, or null when creating.</summary>
|
||||
private Guid? editingEntityId;
|
||||
|
||||
/// <summary>
|
||||
/// Which vault the editor will write to.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Captured when the editor opens rather than read at save time, and there are two different reasons
|
||||
/// for that depending on which way the editor was opened. Editing an existing item, it is the vault
|
||||
/// that item came from — saving to anywhere else would fork it. Creating one, it is whatever the
|
||||
/// target picker said <em>at that moment</em>, so changing the picker afterwards cannot silently move
|
||||
/// a half-typed host into a team's vault.
|
||||
/// </remarks>
|
||||
private Guid editingHostVaultId;
|
||||
|
||||
/// <summary>Which vault the key editor will write to. See <see cref="editingHostVaultId"/>.</summary>
|
||||
private Guid editingKeyVaultId;
|
||||
|
||||
/// <summary>Which vault the credential editor will write to. See <see cref="editingHostVaultId"/>.</summary>
|
||||
private Guid editingCredentialVaultId;
|
||||
|
||||
/// <summary>
|
||||
/// Whether the editor is showing a host that could have a pinned key to forget.
|
||||
/// </summary>
|
||||
@@ -1356,6 +1472,10 @@ internal sealed partial class VaultViewModel(
|
||||
/// </remarks>
|
||||
private async Task ReloadAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
// First, because the four lists below are read across the same set and a vault admitted by the
|
||||
// last refresh should appear in the picker on the same pass its items do.
|
||||
RebuildTargetVaults();
|
||||
|
||||
// Before the hosts, because the sidebar's headings are drawn from the groups and the hosts are what
|
||||
// gets counted under them — so the host reload is the pass that can put both together.
|
||||
var unreadable = await ReloadGroupsAsync(cancellationToken).ConfigureAwait(true);
|
||||
@@ -1379,20 +1499,74 @@ internal sealed partial class VaultViewModel(
|
||||
await LoadConflictsAsync(cancellationToken).ConfigureAwait(true);
|
||||
}
|
||||
|
||||
/// <summary>Refills the "file this into" picker from the vaults this session can read and write.</summary>
|
||||
/// <remarks>
|
||||
/// The selection is restored by id rather than kept, because the option objects are rebuilt. Where the
|
||||
/// previously selected vault has gone — a grant withdrawn, a team left — it falls back to the active
|
||||
/// vault rather than to nothing, so the next Save still has somewhere to go.
|
||||
/// </remarks>
|
||||
private void RebuildTargetVaults()
|
||||
{
|
||||
var selectedId = TargetVaultId;
|
||||
|
||||
TargetVaults.Clear();
|
||||
|
||||
foreach (var vault in session.ReadableVaults
|
||||
.Where(vault => vault.CanWrite)
|
||||
.OrderByDescending(vault => vault.IsPersonal)
|
||||
.ThenBy(vault => vault.Name, StringComparer.CurrentCulture))
|
||||
{
|
||||
TargetVaults.Add(new VaultChoiceViewModel(vault.VaultId, vault.Name, vault.IsPersonal));
|
||||
}
|
||||
|
||||
SelectedTargetVault =
|
||||
TargetVaults.FirstOrDefault(choice => choice.VaultId == selectedId)
|
||||
?? TargetVaults.FirstOrDefault(choice => choice.VaultId == session.ActiveVaultId)
|
||||
?? TargetVaults.FirstOrDefault();
|
||||
|
||||
OnPropertyChanged(nameof(HasVaultChoice));
|
||||
}
|
||||
|
||||
/// <returns>How many hosts would not decrypt.</returns>
|
||||
private async Task<int> ReloadHostsAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
var listing = await session.Hosts
|
||||
.ListAsync(session.ActiveVaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
var selectedId = SelectedHost?.EntityId;
|
||||
var unreadable = 0;
|
||||
var rows = new List<HostRowViewModel>();
|
||||
|
||||
// Every vault this session holds a key for, not only the one new items are filed into. A team
|
||||
// vault whose hosts never reached this list would make sharing look as though it had not worked.
|
||||
var readable = session.ReadableVaults.ToList();
|
||||
var several = readable.Count > 1;
|
||||
|
||||
foreach (var vault in readable)
|
||||
{
|
||||
var listing = await session.Hosts
|
||||
.ListAsync(vault.VaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
unreadable += listing.Unreadable;
|
||||
|
||||
rows.AddRange(listing.Items.Select(
|
||||
item => new HostRowViewModel(item, vault.VaultId, vault.Name)
|
||||
{
|
||||
// Only when there is something to tell apart. A badge on every row of a
|
||||
// single-vault list is noise that says the same thing on all of them.
|
||||
VaultBadge = several ? vault.Name.ToUpperInvariant() : string.Empty,
|
||||
}));
|
||||
}
|
||||
|
||||
Hosts.Clear();
|
||||
|
||||
foreach (var host in listing.Items.OrderBy(host => host.Secret.Label, StringComparer.CurrentCulture))
|
||||
// Grouped by vault, with the one new items go into first, then by name inside each. Two vaults can
|
||||
// hold a host with the same label and both are shown: which vault it is in is what tells them
|
||||
// apart, which is why the row carries the name rather than the list deduplicating.
|
||||
foreach (var host in rows
|
||||
.OrderByDescending(row => row.VaultId == session.ActiveVaultId)
|
||||
.ThenBy(row => row.VaultName, StringComparer.CurrentCulture)
|
||||
.ThenBy(row => row.Label, StringComparer.CurrentCulture))
|
||||
{
|
||||
Hosts.Add(new HostRowViewModel(host));
|
||||
Hosts.Add(host);
|
||||
}
|
||||
|
||||
// Selection survives a reload. Losing it on every sync would move the terminal's target out from
|
||||
@@ -1404,7 +1578,7 @@ internal sealed partial class VaultViewModel(
|
||||
RebuildGroups();
|
||||
RebuildVisibleHosts();
|
||||
|
||||
return listing.Unreadable;
|
||||
return unreadable;
|
||||
}
|
||||
|
||||
/// <returns>How many buckets would not decrypt.</returns>
|
||||
@@ -1533,9 +1707,21 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
/// <returns>How many groups would not decrypt.</returns>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The listing is kept rather than projected straight into <see cref="Groups"/>, because a group row
|
||||
/// carries how many hosts name it and the hosts have not been read yet when this runs. See
|
||||
/// <see cref="RebuildGroups"/>, which is where the two meet.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>The active vault only, unlike every other list on this screen.</b> Hosts, keys, credentials and
|
||||
/// pins are read across every vault this session holds a key for; groups are not, so a host in a team's
|
||||
/// vault that a teammate filed appears under UNGROUPED. That is the same thing the sidebar already shows
|
||||
/// for a group that has been deleted, and it is deliberate here rather than an oversight: reading them
|
||||
/// across vaults means a group row has to carry the vault it lives in — rename and delete both need it —
|
||||
/// and two vaults may hold groups with the same name, which the one-heading-per-group layout cannot tell
|
||||
/// apart. Both are worth doing and neither is a merge's business. Recorded in
|
||||
/// <c>docs/design-import-gaps.md</c>.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
private async Task<int> ReloadGroupsAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
@@ -1735,22 +1921,35 @@ internal sealed partial class VaultViewModel(
|
||||
/// </remarks>
|
||||
private async Task<int> ReloadKeysAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
var listing = await session.SshKeys
|
||||
.ListAsync(session.ActiveVaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
var selectedId = SelectedKey?.EntityId;
|
||||
var unreadable = 0;
|
||||
var rows = new List<SshKeyRowViewModel>();
|
||||
|
||||
foreach (var vault in session.ReadableVaults)
|
||||
{
|
||||
var listing = await session.SshKeys
|
||||
.ListAsync(vault.VaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
unreadable += listing.Unreadable;
|
||||
|
||||
rows.AddRange(listing.Items.Select(
|
||||
item => new SshKeyRowViewModel(item, vault.VaultId, vault.Name)));
|
||||
}
|
||||
|
||||
Keys.Clear();
|
||||
|
||||
foreach (var key in listing.Items.OrderBy(key => key.Secret.Label, StringComparer.CurrentCulture))
|
||||
foreach (var key in rows
|
||||
.OrderByDescending(row => row.VaultId == session.ActiveVaultId)
|
||||
.ThenBy(row => row.VaultName, StringComparer.CurrentCulture)
|
||||
.ThenBy(row => row.Label, StringComparer.CurrentCulture))
|
||||
{
|
||||
Keys.Add(new SshKeyRowViewModel(key));
|
||||
Keys.Add(key);
|
||||
}
|
||||
|
||||
SelectedKey = Keys.FirstOrDefault(row => row.EntityId == selectedId);
|
||||
|
||||
return listing.Unreadable;
|
||||
return unreadable;
|
||||
}
|
||||
|
||||
/// <returns>How many credentials would not decrypt.</returns>
|
||||
@@ -1762,23 +1961,35 @@ internal sealed partial class VaultViewModel(
|
||||
/// </remarks>
|
||||
private async Task<int> ReloadCredentialsAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
var listing = await session.Credentials
|
||||
.ListAsync(session.ActiveVaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
var selectedId = SelectedCredential?.EntityId;
|
||||
var unreadable = 0;
|
||||
var rows = new List<CredentialRowViewModel>();
|
||||
|
||||
foreach (var vault in session.ReadableVaults)
|
||||
{
|
||||
var listing = await session.Credentials
|
||||
.ListAsync(vault.VaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
unreadable += listing.Unreadable;
|
||||
|
||||
rows.AddRange(listing.Items.Select(
|
||||
item => new CredentialRowViewModel(item, vault.VaultId, vault.Name)));
|
||||
}
|
||||
|
||||
Credentials.Clear();
|
||||
|
||||
foreach (var credential in listing.Items
|
||||
.OrderBy(credential => credential.Secret.Label, StringComparer.CurrentCulture))
|
||||
foreach (var credential in rows
|
||||
.OrderByDescending(row => row.VaultId == session.ActiveVaultId)
|
||||
.ThenBy(row => row.VaultName, StringComparer.CurrentCulture)
|
||||
.ThenBy(row => row.Label, StringComparer.CurrentCulture))
|
||||
{
|
||||
Credentials.Add(new CredentialRowViewModel(credential));
|
||||
Credentials.Add(credential);
|
||||
}
|
||||
|
||||
SelectedCredential = Credentials.FirstOrDefault(row => row.EntityId == selectedId);
|
||||
|
||||
return listing.Unreadable;
|
||||
return unreadable;
|
||||
}
|
||||
|
||||
/// <returns>How many pins would not decrypt.</returns>
|
||||
@@ -1789,11 +2000,9 @@ internal sealed partial class VaultViewModel(
|
||||
/// </remarks>
|
||||
private async Task<int> ReloadKnownHostsAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
var listing = await session.KnownHosts
|
||||
.ListAsync(session.ActiveVaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
var selectedId = SelectedKnownHost?.EntityId;
|
||||
var unreadable = 0;
|
||||
var rows = new List<KnownHostRowViewModel>();
|
||||
|
||||
// Built once rather than searched per pin. A vault with a hundred of each would otherwise be a
|
||||
// hundred scans of the host list on every background sync.
|
||||
@@ -1801,20 +2010,39 @@ internal sealed partial class VaultViewModel(
|
||||
.Select(host => Endpoint(host.Host.Hostname, host.Host.Port))
|
||||
.ToHashSet(StringComparer.OrdinalIgnoreCase);
|
||||
|
||||
// Listed across every readable vault, unlike the trust the SSH handshake consults, which stays in
|
||||
// the active vault alone. The difference is deliberate and is stated in the README: a pin in a
|
||||
// team vault is something a teammate can write, and letting it answer for a host in somebody's
|
||||
// personal vault would let one member suppress another's first-contact prompt. Showing them is
|
||||
// safe and is the only way somebody can see what their team has trusted.
|
||||
foreach (var vault in session.ReadableVaults)
|
||||
{
|
||||
var listing = await session.KnownHosts
|
||||
.ListAsync(vault.VaultId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
unreadable += listing.Unreadable;
|
||||
|
||||
rows.AddRange(listing.Items.Select(item => new KnownHostRowViewModel(
|
||||
item,
|
||||
dialled.Contains(Endpoint(item.Secret.Host, item.Secret.Port)),
|
||||
vault.VaultId,
|
||||
vault.Name)));
|
||||
}
|
||||
|
||||
KnownHostPins.Clear();
|
||||
|
||||
foreach (var pin in listing.Items
|
||||
.OrderBy(pin => pin.Secret.Host, StringComparer.CurrentCulture)
|
||||
.ThenBy(pin => pin.Secret.Port)
|
||||
.ThenBy(pin => pin.Secret.Algorithm, StringComparer.Ordinal))
|
||||
foreach (var pin in rows
|
||||
.OrderByDescending(row => row.VaultId == session.ActiveVaultId)
|
||||
.ThenBy(row => row.VaultName, StringComparer.CurrentCulture)
|
||||
.ThenBy(row => row.Label, StringComparer.CurrentCulture))
|
||||
{
|
||||
KnownHostPins.Add(new KnownHostRowViewModel(
|
||||
pin, dialled.Contains(Endpoint(pin.Secret.Host, pin.Secret.Port))));
|
||||
KnownHostPins.Add(pin);
|
||||
}
|
||||
|
||||
SelectedKnownHost = KnownHostPins.FirstOrDefault(row => row.EntityId == selectedId);
|
||||
|
||||
return listing.Unreadable;
|
||||
return unreadable;
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
@@ -1938,16 +2166,17 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
var report = await SyncOnceAsync(server.Sync, cancellationToken).ConfigureAwait(true);
|
||||
|
||||
// A pass that had to start over says so even when it pulled nothing, which is the one place
|
||||
// this loop breaks its own rule about staying quiet. A machine that silently re-read the whole
|
||||
// vault has had something happen to it, and the alternative is that nobody ever finds out.
|
||||
// The item counts rather than the raw ones: a pass that carried nothing but log entries stays
|
||||
// quiet. Every user action queues one a moment after the action's own status message, and this
|
||||
// machine reads its own entries back on the next pull — so reporting on the raw numbers would
|
||||
// overwrite that message after every single save.
|
||||
if (report is not null
|
||||
&& (report.PulledItems > 0 || report.PushedItems > 0 || report.NeedsAttention
|
||||
|| report.ResyncedFromStart))
|
||||
if (report is null)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
// A vault that failed is recorded by SyncOnceAsync and deliberately not announced here: it
|
||||
// gets the treatment the catch below gives a total failure, the fact kept and the message
|
||||
// swallowed. Otherwise a laptop with a lid shut all afternoon replaces whatever the user was
|
||||
// reading, once a minute, with the name of a vault it could not reach. Pressing Sync still
|
||||
// names the vault and the reason, because somebody who pressed it is waiting for an answer.
|
||||
if (IsWorthReporting(report))
|
||||
{
|
||||
Status = Describe(report);
|
||||
}
|
||||
@@ -1975,7 +2204,9 @@ internal sealed partial class VaultViewModel(
|
||||
/// zero timeout rather than awaited: a pass that arrives while another is running has nothing to add by
|
||||
/// waiting for it, and queueing them would turn a slow server into a backlog of identical work.
|
||||
/// </remarks>
|
||||
private async Task<SyncReport?> SyncOnceAsync(ISyncApi api, CancellationToken cancellationToken)
|
||||
private async Task<IReadOnlyList<VaultSyncReport>?> SyncOnceAsync(
|
||||
ISyncApi api,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
if (!await syncGate.WaitAsync(0, cancellationToken).ConfigureAwait(true))
|
||||
{
|
||||
@@ -1984,9 +2215,16 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
try
|
||||
{
|
||||
var report = await session.SyncAsync(api, cancellationToken).ConfigureAwait(true);
|
||||
// Every vault this session can read, not only the one new items are filed into. A team's
|
||||
// vault that never synced would show its hosts exactly once — at the unlock that first
|
||||
// pulled it — and then quietly stop, which reads as the feature not working.
|
||||
var report = await session.SyncAllAsync(api, cancellationToken).ConfigureAwait(true);
|
||||
|
||||
LastSyncFailed = false;
|
||||
// Not unconditionally false, which it was while a pass was one vault and a failure was an
|
||||
// exception. A failure is now a report — one unreachable team vault must not stop the others
|
||||
// syncing — so clearing the flag here regardless would light the titlebar green over a vault
|
||||
// that had just failed to sync, which is exactly the lie that flag exists to prevent.
|
||||
LastSyncFailed = report.Any(vault => !vault.Succeeded);
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
|
||||
@@ -2076,6 +2314,7 @@ internal sealed partial class VaultViewModel(
|
||||
}
|
||||
|
||||
editingEntityId = null;
|
||||
editingHostVaultId = TargetVaultId;
|
||||
EditorLabel = string.Empty;
|
||||
EditorHostname = string.Empty;
|
||||
EditorPort = HostSecret.DefaultPort;
|
||||
@@ -2109,6 +2348,7 @@ internal sealed partial class VaultViewModel(
|
||||
}
|
||||
|
||||
editingEntityId = row.EntityId;
|
||||
editingHostVaultId = row.VaultId;
|
||||
EditorLabel = row.Host.Label;
|
||||
EditorHostname = row.Host.Hostname;
|
||||
EditorPort = row.Host.Port;
|
||||
@@ -2354,13 +2594,13 @@ internal sealed partial class VaultViewModel(
|
||||
if (editingEntityId is { } entityId)
|
||||
{
|
||||
await session.Hosts
|
||||
.UpdateAsync(session.ActiveVaultId, entityId, host, cancellationToken)
|
||||
.UpdateAsync(editingHostVaultId, entityId, host, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
}
|
||||
else
|
||||
{
|
||||
editingEntityId = await session.Hosts
|
||||
.CreateAsync(session.ActiveVaultId, host, cancellationToken)
|
||||
.CreateAsync(editingHostVaultId, host, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
}
|
||||
|
||||
@@ -2483,7 +2723,7 @@ internal sealed partial class VaultViewModel(
|
||||
async () =>
|
||||
{
|
||||
await session.Hosts
|
||||
.DeleteAsync(session.ActiveVaultId, row.EntityId, cancellationToken)
|
||||
.DeleteAsync(row.VaultId, row.EntityId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
@@ -2506,6 +2746,7 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
Section = VaultSection.Keys;
|
||||
editingKeyId = null;
|
||||
editingKeyVaultId = TargetVaultId;
|
||||
ClearKeyEditor();
|
||||
IsEditingKey = true;
|
||||
Status = "Adding an SSH key.";
|
||||
@@ -2532,6 +2773,7 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
Section = VaultSection.Keys;
|
||||
editingKeyId = row.EntityId;
|
||||
editingKeyVaultId = row.VaultId;
|
||||
KeyEditorLabel = row.Key.Label;
|
||||
KeyEditorPrivateKey = row.Key.PrivateKeyPem;
|
||||
KeyEditorPassphrase = row.Key.Passphrase ?? string.Empty;
|
||||
@@ -2615,6 +2857,12 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
IsGeneratingKey = false;
|
||||
editingKeyId = null;
|
||||
|
||||
// Filed where a pasted key would be, and set here rather than left over from whatever was
|
||||
// edited last: this path opens the same editor without going through NewKey, so without
|
||||
// this a key generated after editing a team's key would be saved into that team's vault.
|
||||
editingKeyVaultId = TargetVaultId;
|
||||
|
||||
ClearKeyEditor();
|
||||
|
||||
KeyEditorLabel = comment;
|
||||
@@ -2694,13 +2942,13 @@ internal sealed partial class VaultViewModel(
|
||||
if (editingKeyId is { } entityId)
|
||||
{
|
||||
await session.SshKeys
|
||||
.UpdateAsync(session.ActiveVaultId, entityId, key, cancellationToken)
|
||||
.UpdateAsync(editingKeyVaultId, entityId, key, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
}
|
||||
else
|
||||
{
|
||||
editingKeyId = await session.SshKeys
|
||||
.CreateAsync(session.ActiveVaultId, key, cancellationToken)
|
||||
.CreateAsync(editingKeyVaultId, key, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
}
|
||||
|
||||
@@ -2758,7 +3006,7 @@ internal sealed partial class VaultViewModel(
|
||||
async () =>
|
||||
{
|
||||
await session.SshKeys
|
||||
.DeleteAsync(session.ActiveVaultId, row.EntityId, cancellationToken)
|
||||
.DeleteAsync(row.VaultId, row.EntityId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
@@ -2779,6 +3027,7 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
Section = VaultSection.Credentials;
|
||||
editingCredentialId = null;
|
||||
editingCredentialVaultId = TargetVaultId;
|
||||
ClearCredentialEditor();
|
||||
IsEditingCredential = true;
|
||||
Status = "Adding a credential.";
|
||||
@@ -2805,6 +3054,7 @@ internal sealed partial class VaultViewModel(
|
||||
|
||||
Section = VaultSection.Credentials;
|
||||
editingCredentialId = row.EntityId;
|
||||
editingCredentialVaultId = row.VaultId;
|
||||
CredentialEditorLabel = row.Credential.Label;
|
||||
CredentialEditorUsername = row.Credential.Username ?? string.Empty;
|
||||
CredentialEditorPassword = row.Credential.Password;
|
||||
@@ -3028,13 +3278,13 @@ internal sealed partial class VaultViewModel(
|
||||
if (editingCredentialId is { } entityId)
|
||||
{
|
||||
await session.Credentials
|
||||
.UpdateAsync(session.ActiveVaultId, entityId, credential, cancellationToken)
|
||||
.UpdateAsync(editingCredentialVaultId, entityId, credential, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
}
|
||||
else
|
||||
{
|
||||
editingCredentialId = await session.Credentials
|
||||
.CreateAsync(session.ActiveVaultId, credential, cancellationToken)
|
||||
.CreateAsync(editingCredentialVaultId, credential, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
}
|
||||
|
||||
@@ -3086,7 +3336,7 @@ internal sealed partial class VaultViewModel(
|
||||
async () =>
|
||||
{
|
||||
await session.Credentials
|
||||
.DeleteAsync(session.ActiveVaultId, row.EntityId, cancellationToken)
|
||||
.DeleteAsync(row.VaultId, row.EntityId, cancellationToken)
|
||||
.ConfigureAwait(true);
|
||||
|
||||
await ReloadAsync(cancellationToken).ConfigureAwait(true);
|
||||
@@ -3994,6 +4244,77 @@ internal sealed partial class VaultViewModel(
|
||||
/// resurrected a host or parked a change looks identical to a quiet one otherwise, and the whole point
|
||||
/// of recording those is that somebody sees them.
|
||||
/// </remarks>
|
||||
/// <remarks>
|
||||
/// Movement and attention only — deliberately not failure. A background pass that announced every
|
||||
/// unreachable vault would be a socket error on screen once a minute, which is the thing
|
||||
/// <see cref="AutoSyncAsync"/>'s catch block exists to avoid; the caller records
|
||||
/// <see cref="LastSyncFailed"/> instead, and the titlebar stops claiming to be up to date. Pressing
|
||||
/// Sync reports the failure in full, because somebody who pressed it is waiting for an answer.
|
||||
/// </remarks>
|
||||
/// <remarks>
|
||||
/// The item counts rather than the raw ones. Every user action queues a log entry a moment after the
|
||||
/// action's own status message, and this machine reads its own entries back on the next pull — so a
|
||||
/// rule written against the raw numbers would overwrite that message after every single save, which is
|
||||
/// exactly what it did until the report learned to tell the two apart.
|
||||
/// </remarks>
|
||||
private static bool IsWorthReporting(IReadOnlyList<VaultSyncReport> reports) =>
|
||||
reports.Any(vault => vault.Succeeded
|
||||
&& (vault.Report!.PulledItems > 0
|
||||
|| vault.Report.PushedItems > 0
|
||||
|| vault.Report.NeedsAttention
|
||||
|
||||
// A pass that had to start over says so even when it pulled nothing, which is the one
|
||||
// place this rule is broken deliberately. A machine that silently re-read a whole vault
|
||||
// has had something happen to it, and the alternative is that nobody ever finds out.
|
||||
|| vault.Report.ResyncedFromStart));
|
||||
|
||||
/// <remarks>
|
||||
/// Counts are summed across vaults, and a failure is named <em>with its reason</em>. Both halves
|
||||
/// matter: "1 vault could not be synchronised" sends somebody hunting for which, and a name without a
|
||||
/// reason sends them hunting for why. There are rarely more than a handful of vaults, so listing them
|
||||
/// costs nothing.
|
||||
/// </remarks>
|
||||
private static string Describe(IReadOnlyList<VaultSyncReport> reports)
|
||||
{
|
||||
var failed = reports
|
||||
.Where(vault => !vault.Succeeded)
|
||||
.Select(vault => $"{vault.Name} ({vault.Failure?.Message})")
|
||||
.ToList();
|
||||
|
||||
var succeeded = reports.Where(vault => vault.Succeeded).Select(vault => vault.Report!).ToList();
|
||||
|
||||
var line = succeeded.Count switch
|
||||
{
|
||||
0 => string.Empty,
|
||||
1 => Describe(succeeded[0]),
|
||||
_ => DescribeMany(succeeded),
|
||||
};
|
||||
|
||||
if (failed.Count == 0)
|
||||
{
|
||||
return line.Length == 0 ? "Nothing to synchronise." : line;
|
||||
}
|
||||
|
||||
var names = string.Join("; ", failed);
|
||||
|
||||
return line.Length == 0
|
||||
? $"Could not synchronise {names}."
|
||||
: $"{line} Could not synchronise {names}.";
|
||||
}
|
||||
|
||||
private static string DescribeMany(List<SyncReport> reports)
|
||||
{
|
||||
var pulled = reports.Sum(report => report.Pulled);
|
||||
var pushed = reports.Sum(report => report.Pushed);
|
||||
var attention = reports.Count(report => report.NeedsAttention);
|
||||
|
||||
var line = pulled == 0 && pushed == 0
|
||||
? $"Already up to date across {reports.Count} vaults."
|
||||
: $"Synchronised {reports.Count} vaults: {pulled} in, {pushed} out.";
|
||||
|
||||
return attention == 0 ? line : $"{line} {attention} need attention — see the conflicts list.";
|
||||
}
|
||||
|
||||
private static string Describe(SyncReport report)
|
||||
{
|
||||
// Said first, and in both branches, because it is the explanation for the numbers after it. A pass
|
||||
|
||||
@@ -36,8 +36,10 @@
|
||||
</Border>
|
||||
|
||||
<!--
|
||||
One heading, for one vault. The chevron folds the list away; the count is the collection's own, so it
|
||||
follows the filter without a second number to keep in step.
|
||||
One heading, which names the vault while there is one and says ALL VAULTS once a team's is readable
|
||||
too — a heading that went on naming the personal vault over a list containing a team's hosts would be
|
||||
a quiet lie, so the rows carry the vault name instead. The chevron folds the list away; the count is
|
||||
the collection's own, so it follows the filter without a second number to keep in step.
|
||||
-->
|
||||
<Button Grid.Row="1" Classes="flat grouphead" Command="{Binding ToggleHostsCommand}"
|
||||
HorizontalAlignment="Stretch" HorizontalContentAlignment="Stretch">
|
||||
@@ -129,6 +131,14 @@
|
||||
-->
|
||||
<TextBlock Classes="mono" Text="{Binding Authentication}" FontSize="9.5"
|
||||
Foreground="{StaticResource TextFaint}" />
|
||||
<!--
|
||||
Which vault this host is in, and only when there is more than one to be in. It decides
|
||||
who else can see the host and where an edit goes back to, so on a list that spans
|
||||
several vaults it is not decoration.
|
||||
-->
|
||||
<TextBlock Classes="mono" Text="{Binding VaultBadge}" FontSize="9.5"
|
||||
Foreground="{StaticResource TextFaint}"
|
||||
IsVisible="{Binding HasVaultBadge}" />
|
||||
</StackPanel>
|
||||
</StackPanel>
|
||||
</Grid>
|
||||
|
||||
@@ -138,21 +138,14 @@
|
||||
</Panel>
|
||||
|
||||
<!-- ============ TEAM ============ -->
|
||||
<views:NotBuiltScreen IsVisible="{Binding IsTeamScreen}"
|
||||
Title="TEAM"
|
||||
Milestone="MILESTONE M3"
|
||||
Summary="The design shows members, roles, shared keychains and pending invitations. The server has team tables from its first migration and not one endpoint that reads them, and its access service refuses every keychain that is not your own — so there is nobody to list and no shared keychain to open."
|
||||
Instead="Everything you have is yours alone today: your hosts are in the sidebar on the Hosts screen, and your keys, passwords and approved host keys are on the Keychain screen. Sharing a credential means handing it over out of band, and rotating it afterwards.">
|
||||
<views:NotBuiltScreen.Missing>
|
||||
<sys:List x:TypeArguments="x:String">
|
||||
<x:String>Endpoints for teams, membership, roles and invitations — the server exposes eight routes and none of them is about people (DodoSSH.Api).</x:String>
|
||||
<x:String>Access to a keychain somebody else owns: VaultAccessService resolves personal ownership and denies everything else (DodoSSH.Api).</x:String>
|
||||
<x:String>Roles on the wire. VaultSummary carries a nullable TeamId and an opaque permissions flag, and no DTO gives either a meaning (DodoSSH.Contracts).</x:String>
|
||||
<x:String>Per-member facts the design shows — two-factor state, last-active time, avatars — none of which the server records.</x:String>
|
||||
<x:String>Sharing an item, which is the point of the screen: today a keychain key is sealed to one account, and sharing means re-wrapping it for another.</x:String>
|
||||
</sys:List>
|
||||
</views:NotBuiltScreen.Missing>
|
||||
</views:NotBuiltScreen>
|
||||
<!--
|
||||
Wrapped, for the reason the vault and transfers screens are: the visibility is the shell's
|
||||
business and the data context is the teams view model, and both on one element would resolve
|
||||
IsTeamScreen against a type that does not have it.
|
||||
-->
|
||||
<Panel IsVisible="{Binding IsTeamScreen}">
|
||||
<views:TeamsScreen DataContext="{Binding Teams}" />
|
||||
</Panel>
|
||||
|
||||
<!-- ============ PREFERENCES ============ -->
|
||||
<views:PreferencesScreen IsVisible="{Binding IsPreferencesScreen}" />
|
||||
|
||||
@@ -0,0 +1,188 @@
|
||||
<UserControl xmlns="https://github.com/avaloniaui"
|
||||
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
||||
xmlns:vm="using:DodoSSH.Client.App.ViewModels"
|
||||
x:Class="DodoSSH.Client.App.Views.TeamsScreen"
|
||||
x:DataType="vm:TeamsViewModel">
|
||||
|
||||
<!--
|
||||
Teams.
|
||||
|
||||
The screen is built around one fact that every other product in this category hides: adding somebody to
|
||||
a team and giving them a vault key are two different acts, and only the first is something a server can
|
||||
do. The second needs a machine that holds the key, because this server never does. So the members table
|
||||
and the vaults table are side by side, an addition says out loud that it granted nothing readable yet,
|
||||
and SHARE KEY is its own button rather than a checkbox on the member row.
|
||||
|
||||
What the design asked for and is still not here: pending invitations (there is no outbound mail path and
|
||||
no invitation token), two-factor state and last-active (the server records neither), and avatars (no
|
||||
picture is stored anywhere). None of them is drawn with invented data.
|
||||
-->
|
||||
|
||||
<Grid ColumnDefinitions="268,*">
|
||||
|
||||
<!-- ============ The team list ============ -->
|
||||
<Border Grid.Column="0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,1,0">
|
||||
<Grid RowDefinitions="44,*,Auto">
|
||||
|
||||
<Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
|
||||
<Grid ColumnDefinitions="*,Auto" VerticalAlignment="Center">
|
||||
<TextBlock Grid.Column="0" Classes="mono" Text="TEAMS" FontSize="11" FontWeight="SemiBold"
|
||||
LetterSpacing="1" Foreground="{StaticResource Text}" VerticalAlignment="Center" />
|
||||
<Button Grid.Column="1" Classes="ghost" Content="NEW"
|
||||
Command="{Binding NewTeamCommand}" IsEnabled="{Binding !IsBusy}" />
|
||||
</Grid>
|
||||
</Border>
|
||||
|
||||
<ScrollViewer Grid.Row="1">
|
||||
<StackPanel>
|
||||
<ListBox ItemsSource="{Binding Teams}" SelectedItem="{Binding SelectedTeam}"
|
||||
Background="Transparent" BorderThickness="0">
|
||||
<ListBox.ItemTemplate>
|
||||
<DataTemplate x:DataType="vm:TeamRowViewModel">
|
||||
<StackPanel Spacing="2" Margin="0,3">
|
||||
<Grid ColumnDefinitions="*,Auto">
|
||||
<TextBlock Grid.Column="0" Text="{Binding Name}" FontSize="12" FontWeight="Medium"
|
||||
Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
|
||||
<TextBlock Grid.Column="1" Classes="mono" Text="{Binding Role}" FontSize="9"
|
||||
Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
|
||||
</Grid>
|
||||
<TextBlock Classes="hint" FontSize="10" Text="{Binding Detail}" />
|
||||
</StackPanel>
|
||||
</DataTemplate>
|
||||
</ListBox.ItemTemplate>
|
||||
</ListBox>
|
||||
|
||||
<TextBlock Classes="hint" FontSize="10" Margin="14,12" TextWrapping="Wrap"
|
||||
IsVisible="{Binding !HasTeams}"
|
||||
Text="No teams yet. A team is what makes a vault shareable: its vaults can be opened by every member you wrap a key to." />
|
||||
</StackPanel>
|
||||
</ScrollViewer>
|
||||
|
||||
<!-- The create form, in place rather than in a modal: this window has no idiom for one. -->
|
||||
<Border Grid.Row="2" Padding="14,12" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
|
||||
IsVisible="{Binding IsCreatingTeam}">
|
||||
<StackPanel Spacing="8">
|
||||
<TextBlock Classes="label" Text="NEW TEAM" />
|
||||
<TextBox PlaceholderText="Name" Text="{Binding NewTeamName}" />
|
||||
<TextBox PlaceholderText="slug-for-urls" Text="{Binding NewTeamSlug}" />
|
||||
<TextBlock Classes="hint" FontSize="9.5" TextWrapping="Wrap"
|
||||
Text="The slug is lowercase letters, digits and hyphens, and has to be unique across this server." />
|
||||
<StackPanel Orientation="Horizontal" Spacing="6">
|
||||
<Button Classes="accent" Content="CREATE" Command="{Binding CreateTeamCommand}"
|
||||
IsEnabled="{Binding !IsBusy}" />
|
||||
<Button Classes="ghost" Content="CANCEL" Command="{Binding CancelNewTeamCommand}" />
|
||||
</StackPanel>
|
||||
</StackPanel>
|
||||
</Border>
|
||||
|
||||
</Grid>
|
||||
</Border>
|
||||
|
||||
<!-- ============ Members and vaults ============ -->
|
||||
<Grid Grid.Column="1" RowDefinitions="44,*,Auto">
|
||||
|
||||
<Border Grid.Row="0" Padding="14,0" BorderBrush="{StaticResource Border}" BorderThickness="0,0,0,1">
|
||||
<TextBlock Classes="mono" Text="{Binding SelectedTeam.Name}" FontSize="11" FontWeight="SemiBold"
|
||||
LetterSpacing="1" Foreground="{StaticResource Text}" VerticalAlignment="Center" />
|
||||
</Border>
|
||||
|
||||
<ScrollViewer Grid.Row="1" IsVisible="{Binding HasSelection}">
|
||||
<StackPanel Margin="14,14" Spacing="18">
|
||||
|
||||
<!-- Members -->
|
||||
|
||||
<StackPanel Spacing="8">
|
||||
<TextBlock Classes="label" Text="MEMBERS" />
|
||||
|
||||
<ListBox ItemsSource="{Binding Members}" SelectedItem="{Binding SelectedMember}"
|
||||
Background="Transparent" BorderThickness="0" MaxHeight="240">
|
||||
<ListBox.ItemTemplate>
|
||||
<DataTemplate x:DataType="vm:TeamMemberRowViewModel">
|
||||
<Grid ColumnDefinitions="*,150,Auto" Margin="0,3">
|
||||
<StackPanel Grid.Column="0" Spacing="2">
|
||||
<TextBlock Text="{Binding Name}" FontSize="12" FontWeight="Medium"
|
||||
Foreground="{StaticResource Text}" TextTrimming="CharacterEllipsis" />
|
||||
<TextBlock Classes="hint" FontSize="10" Text="{Binding Email}" />
|
||||
</StackPanel>
|
||||
<TextBlock Grid.Column="1" Classes="hint" FontSize="10" VerticalAlignment="Center"
|
||||
Text="{Binding KeyState}" TextWrapping="Wrap" />
|
||||
<TextBlock Grid.Column="2" Classes="mono" Text="{Binding Role}" FontSize="9"
|
||||
Foreground="{StaticResource TextFaint}" VerticalAlignment="Center"
|
||||
Margin="10,0,0,0" />
|
||||
</Grid>
|
||||
</DataTemplate>
|
||||
</ListBox.ItemTemplate>
|
||||
</ListBox>
|
||||
|
||||
<Grid ColumnDefinitions="*,Auto,Auto" IsVisible="{Binding CanAdministerSelected}">
|
||||
<TextBox Grid.Column="0" PlaceholderText="colleague@example.com" Text="{Binding InviteEmail}"
|
||||
Margin="0,0,6,0" />
|
||||
<Button Grid.Column="1" Classes="accent" Content="ADD MEMBER"
|
||||
Command="{Binding AddMemberCommand}" IsEnabled="{Binding !IsBusy}" />
|
||||
<Button Grid.Column="2" Classes="danger" Content="REMOVE" Margin="6,0,0,0"
|
||||
Command="{Binding RemoveMemberCommand}" IsEnabled="{Binding !IsBusy}"
|
||||
ToolTip.Tip="Removes the selected member and withdraws every vault key they hold from this team. It blocks future reads only — anything already on their machine stays there, so rotate the credentials that matter." />
|
||||
</Grid>
|
||||
|
||||
<TextBlock Classes="hint" FontSize="9.5" TextWrapping="Wrap"
|
||||
IsVisible="{Binding CanAdministerSelected}"
|
||||
Text="Adding somebody lets the server serve them this team's vaults. It does not let them read one: a vault key can only be wrapped by a machine that already holds it, which is what SHARE KEY below does." />
|
||||
</StackPanel>
|
||||
|
||||
<Border Height="1" Background="{StaticResource BorderSubtle}" />
|
||||
|
||||
<!-- Vaults -->
|
||||
|
||||
<StackPanel Spacing="8">
|
||||
<Grid ColumnDefinitions="*,Auto">
|
||||
<TextBlock Grid.Column="0" Classes="label" Text="VAULTS" VerticalAlignment="Center" />
|
||||
<Button Grid.Column="1" Classes="ghost" Content="NEW VAULT"
|
||||
Command="{Binding CreateVaultCommand}"
|
||||
IsEnabled="{Binding !IsBusy}" IsVisible="{Binding CanAdministerSelected}" />
|
||||
</Grid>
|
||||
|
||||
<ListBox ItemsSource="{Binding Vaults}" SelectedItem="{Binding SelectedVault}"
|
||||
Background="Transparent" BorderThickness="0" MaxHeight="200">
|
||||
<ListBox.ItemTemplate>
|
||||
<DataTemplate x:DataType="vm:TeamVaultRowViewModel">
|
||||
<StackPanel Spacing="2" Margin="0,3">
|
||||
<TextBlock Text="{Binding Name}" FontSize="12" FontWeight="Medium"
|
||||
Foreground="{StaticResource Text}" />
|
||||
<TextBlock Classes="hint" FontSize="10" Text="{Binding State}" />
|
||||
</StackPanel>
|
||||
</DataTemplate>
|
||||
</ListBox.ItemTemplate>
|
||||
</ListBox>
|
||||
|
||||
<TextBlock Classes="hint" FontSize="10" TextWrapping="Wrap"
|
||||
IsVisible="{Binding !HasSelection}"
|
||||
Text="Select a team to see its vaults." />
|
||||
|
||||
<StackPanel Orientation="Horizontal" Spacing="6">
|
||||
<Button Classes="accent" Content="SHARE KEY" Command="{Binding ShareVaultCommand}"
|
||||
IsEnabled="{Binding !IsBusy}"
|
||||
ToolTip.Tip="Wraps the selected vault's key to the selected member. Their published key is checked against the server's append-only key log first, and nothing is wrapped if it does not appear there unchanged." />
|
||||
<Button Classes="danger" Content="WITHDRAW KEY" Command="{Binding RevokeVaultCommand}"
|
||||
IsEnabled="{Binding !IsBusy}"
|
||||
ToolTip.Tip="Withdraws the selected member's key to the selected vault. Blocks future reads only." />
|
||||
</StackPanel>
|
||||
|
||||
<TextBlock Classes="hint" FontSize="9.5" TextWrapping="Wrap"
|
||||
Text="Sharing verifies the recipient's key against the key log, which proves this server has been consistent with itself — not that the key is the right person's. Compare the fingerprint with them over a channel this server does not carry before sharing anything that matters." />
|
||||
</StackPanel>
|
||||
|
||||
</StackPanel>
|
||||
</ScrollViewer>
|
||||
|
||||
<TextBlock Grid.Row="1" Classes="hint" FontSize="11" Margin="20" TextWrapping="Wrap"
|
||||
VerticalAlignment="Top" IsVisible="{Binding !HasSelection}"
|
||||
Text="Create a team on the left, or wait to be added to one. A team owns vaults; a vault's key is what makes its contents readable, and that key is handed out by people rather than by the server." />
|
||||
|
||||
<Border Grid.Row="2" Padding="14,10" BorderBrush="{StaticResource Border}" BorderThickness="0,1,0,0"
|
||||
IsVisible="{Binding Status, Converter={x:Static StringConverters.IsNotNullOrEmpty}}">
|
||||
<TextBlock Classes="hint" FontSize="10.5" Text="{Binding Status}" TextWrapping="Wrap" />
|
||||
</Border>
|
||||
|
||||
</Grid>
|
||||
</Grid>
|
||||
</UserControl>
|
||||
@@ -0,0 +1,9 @@
|
||||
using Avalonia.Controls;
|
||||
|
||||
namespace DodoSSH.Client.App.Views;
|
||||
|
||||
/// <summary>Teams: who is in one, what they may do, and which vaults they hold a key to.</summary>
|
||||
internal sealed partial class TeamsScreen : UserControl
|
||||
{
|
||||
public TeamsScreen() => InitializeComponent();
|
||||
}
|
||||
@@ -23,6 +23,16 @@
|
||||
A directory is marked by colour rather than by an icon: this application ships no icon set, and the
|
||||
palette already reserves blue for "a directory, a distinct scope" — see App.axaml, where it is
|
||||
described as deliberately rare. This is the one place it is spent.
|
||||
|
||||
Two further colours come from the mode, and they are split across the two columns on purpose: NAME says
|
||||
what a row is, PERMS says what is notable about how it is set. So an executable is green in NAME —
|
||||
"live, yours, something that runs" — while a file anyone may write to is amber in PERMS, over the
|
||||
characters that actually say so. The two never compete for one TextBlock, which is what lets a
|
||||
world-writable executable show both facts instead of one winning an argument.
|
||||
|
||||
Both are files only; see SftpEntry, which will not read a mode off a symbolic link or a directory.
|
||||
Rendering `-rwxrwxrwx` in two colours at once is not something this list can do, so amber over the whole
|
||||
string is the compromise: the eye lands on the column, and the string itself is the detail.
|
||||
-->
|
||||
<Style Selector="TextBlock.entry">
|
||||
<Setter Property="Foreground" Value="{StaticResource Text}" />
|
||||
@@ -30,6 +40,25 @@
|
||||
<Style Selector="TextBlock.entry.dir">
|
||||
<Setter Property="Foreground" Value="{StaticResource Info}" />
|
||||
</Style>
|
||||
<Style Selector="TextBlock.entry.exec">
|
||||
<Setter Property="Foreground" Value="{StaticResource Accent}" />
|
||||
</Style>
|
||||
|
||||
<!--
|
||||
Faint by default, as this column has always been: a mode is there so its absence would be noticed. It
|
||||
steps up to amber only when it has something to say, which is the whole reason the default is quiet.
|
||||
-->
|
||||
<Style Selector="TextBlock.perms">
|
||||
<Setter Property="Foreground" Value="{StaticResource TextFaint}" />
|
||||
</Style>
|
||||
<!--
|
||||
Warn rather than WarnText, which is the muted amber a warning card writes its sentences in. At 9.5px
|
||||
against TextFaint that one is a shade, not a signal, and a marker nobody notices is the same as no
|
||||
marker at all.
|
||||
-->
|
||||
<Style Selector="TextBlock.perms.loose">
|
||||
<Setter Property="Foreground" Value="{StaticResource Warn}" />
|
||||
</Style>
|
||||
</UserControl.Styles>
|
||||
|
||||
<Grid RowDefinitions="44,*,Auto">
|
||||
@@ -342,14 +371,15 @@
|
||||
<Grid ColumnDefinitions="2,*,84,110,92" Margin="0,5,12,5">
|
||||
<Border Grid.Column="0" Classes="rowmark" />
|
||||
<TextBlock Grid.Column="1" Classes="mono entry" Classes.dir="{Binding IsNavigable}"
|
||||
Classes.exec="{Binding IsExecutable}"
|
||||
Text="{Binding Name}" FontSize="11"
|
||||
Margin="12,0,8,0" TextTrimming="CharacterEllipsis" />
|
||||
<TextBlock Grid.Column="2" Classes="mono" Text="{Binding Size}" FontSize="9.5"
|
||||
Foreground="{StaticResource TextDim}" VerticalAlignment="Center" />
|
||||
<TextBlock Grid.Column="3" Classes="mono" Text="{Binding Modified}" FontSize="9.5"
|
||||
Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
|
||||
<TextBlock Grid.Column="4" Classes="mono" Text="{Binding Permissions}" FontSize="9.5"
|
||||
Foreground="{StaticResource TextFaint}" VerticalAlignment="Center" />
|
||||
<TextBlock Grid.Column="4" Classes="mono perms" Classes.loose="{Binding IsWorldWritable}"
|
||||
Text="{Binding Permissions}" FontSize="9.5" VerticalAlignment="Center" />
|
||||
</Grid>
|
||||
</DataTemplate>
|
||||
</ListBox.ItemTemplate>
|
||||
|
||||
@@ -22,9 +22,10 @@
|
||||
behind them, so listing them would be two headings that could never have anything under them. Recorded
|
||||
in docs/design-import-gaps.md.
|
||||
|
||||
The SCOPES rail below the categories is the keychain list, which is real and today has one entry in it.
|
||||
The design shows three, two of them teams; team keychains exist as tables on the server and are refused
|
||||
by its access service, so a rail with three entries would be showing two nothing can open.
|
||||
The SCOPES rail below the categories is the keychain list. Since M3 it genuinely has more than one entry
|
||||
when somebody is in a team — but it is still not a selector, because every table on this screen already
|
||||
spans every keychain this session holds a key for and each row names its own. What it carries instead is
|
||||
the one keychain question with an answer: where a new item is filed.
|
||||
-->
|
||||
|
||||
<Grid ColumnDefinitions="176,*,244">
|
||||
@@ -91,18 +92,35 @@
|
||||
<TextBlock Classes="label" Text="SCOPES" Margin="14,0,14,8" />
|
||||
|
||||
<!--
|
||||
One entry per vault this session opened. Not a selector: every list on this screen reads the
|
||||
active vault, and a rail that let you click a vault you cannot switch to would be a control that
|
||||
does nothing. It is here because knowing which vault you are looking at is worth a line, and
|
||||
because this is where a second one appears when shared vaults arrive.
|
||||
Still not a selector. Every list on this screen now spans every vault this session holds a key
|
||||
for, and each row names its own vault — so there is nothing to switch to. What the picker below
|
||||
chooses is where a *new* item is filed, which is a different question and the only one that has
|
||||
an answer worth asking for.
|
||||
-->
|
||||
<StackPanel Orientation="Horizontal" Margin="14,2" Spacing="7">
|
||||
<Ellipse Width="6" Height="6" Fill="{StaticResource Accent}" VerticalAlignment="Center" />
|
||||
<TextBlock Classes="mono" Text="{Binding HostsHeading}" FontSize="10"
|
||||
Foreground="{StaticResource Text}" VerticalAlignment="Center" />
|
||||
</StackPanel>
|
||||
<TextBlock Classes="hint" FontSize="9.5" Margin="14,6,14,0"
|
||||
Text="One keychain, because the server grants access to your own and refuses the rest. Sharing is a later milestone." />
|
||||
|
||||
<!--
|
||||
Hidden at one vault, which is where most people stay. A control offering a single option is a
|
||||
question with no answer.
|
||||
-->
|
||||
<StackPanel Margin="14,10,14,0" Spacing="4" IsVisible="{Binding HasVaultChoice}">
|
||||
<TextBlock Classes="label" Text="NEW ITEMS GO TO" />
|
||||
<ComboBox ItemsSource="{Binding TargetVaults}"
|
||||
SelectedItem="{Binding SelectedTargetVault}"
|
||||
HorizontalAlignment="Stretch">
|
||||
<ComboBox.ItemTemplate>
|
||||
<DataTemplate x:DataType="vm:VaultChoiceViewModel">
|
||||
<TextBlock Text="{Binding Display}" FontSize="11" />
|
||||
</DataTemplate>
|
||||
</ComboBox.ItemTemplate>
|
||||
</ComboBox>
|
||||
<TextBlock Classes="hint" FontSize="9.5" TextWrapping="Wrap"
|
||||
Text="An item filed into a team's vault is readable by everyone holding that vault's key. It defaults to your own and never moves on its own." />
|
||||
</StackPanel>
|
||||
|
||||
<!--
|
||||
Items that would not decrypt. Shown here rather than only in the status line because this is the
|
||||
|
||||
Reference in New Issue
Block a user