DodoTech-Public/DodoSSH
Public Access
2
0
Fork 0
Code Issues Pull Requests 2 Actions 2 Packages Projects Releases 2 Wiki Activity

Make the vault the thing you share, and ask a host which one it lives in

Browse Source 
The teams screen listed teams that owned vaults, so sharing four servers with two
colleagues meant creating a team, then a vault inside it, then wrapping a key.
Two of those three steps are about a concept nobody arrives wanting. The screen
now lists vaults: naming one creates the membership list that carries it, named
after the vault and owned by you, and members, invitations, roles, hand-over and
key holders all hang off the vault they apply to.

Nothing on the server moved. VaultAccessService still resolves a shared vault
through team_membership and every membership call still names a team id — what
went is the requirement that anybody make one. The split the whole design rests
on is untouched and is still what the screen is built around: adding somebody
authorises the server to serve them, and only a machine holding the key can make
the vault readable. ADR 0009 keeps its decision and gains an addendum recording
which half of it a person is now asked about.

The one place the team resurfaces is a membership list carrying several vaults,
which this screen cannot produce and does not hide: the members section says so,
because "adding somebody here adds them there" is precisely the fact a
vault-shaped screen is in a position to conceal.

Two things left the interface and one arrived. Creating a team is gone, and so is
archiving one — it was only ever possible for a team owning no vaults, and a
screen whose rows are vaults has no row for one, so the button would have been
unreachable or always refused. The endpoint is unchanged and the screen states
the limit instead, since a vault cannot be deleted at all. The exception is a
create whose second call failed: cancelling that form archives the membership
list it left behind, which is a deliberate departure from this client's rule
against tidying up on the user's behalf, made because nothing else can reach it.

What arrived is PUT /api/v1/vaults/{id}. Without it the screen loses its only
editing action, since renaming the team behind a vault is invisible to everybody
who was never shown the team. It is gated on PermissionFlags.Admin — the line
UpdateTeamEndpoint already draws, because a name is what everybody in the vault
sees it called rather than part of its contents — and it renames the owning team
with it when that team carries nothing else, so the row an operator reads and the
name a user says cannot drift apart. The slug never moves, for the reason it does
not move on a team rename. The session edits its cached vault row rather than
replacing it with the response, which deliberately carries no wrapped key.

The host editor now asks which vault a host goes into, beside the name, while
adding and only where there is more than one vault to write to. It is a second
picker rather than the keychain screen's reused, and the two selections are
separate on purpose: that one is a standing preference about where new items go,
this is a field of the host in front of you, and binding both to one selection
would mean a click on the other screen could move a half-typed host. An existing
host is not offered it at all rather than offered it disabled — the two vaults
are encrypted under different keys, so moving an item is a delete and a retype.

That forced a fix worth naming. The group picker was built from the active
vault's groups whatever vault the host was being filed into, so a host put in a
shared vault could be filed under a group only its author can resolve — a
colleague would see it filed under nothing, which is the quietest kind of wrong.
Groups are now kept per vault and the picker follows the vault choice.

Two renames, because the pair they would otherwise have made is a bug farm:
ShellScreen.Vault became Keychain and VaultScreen became KeychainScreen, which is
what the rail has always labelled that screen, leaving Vault for one vault's
contents and Vaults for the vaults themselves. The enum values are unchanged;
NavRail.axaml writes them as x:Static literals.

1536 tests pass, seven more than before. Five are new on the server — the rename
endpoint's success, the team it does and does not take with it, the two refusals
and the empty name — and the client suite gains six and folds four together,
having lost the two about archiving a team.
This commit is contained in:
jaap-jan
2026-08-04 12:22:29 +02:00
parent 6ae1912c34
commit 8707629a6c
47 changed files with 3204 additions and 2313 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/DodoSSH.Client.App.Layout.Tests/ScreenLayoutTests.cs
+63 -58
View File
@@ -547,7 +547,7 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
// ---- The vault screen ----
[Fact]
public async Task TheVaultScreenFitsInEveryCategory()
public async Task TheKeychainScreenFitsInEveryCategory()
{
foreach (var section in new[]
{
@@ -565,7 +565,7 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
/// wide — the narrowest column any form in this application has to fit into.
/// </remarks>
[Fact]
public async Task TheVaultScreenFitsWithTheKeyEditorOpen()
public async Task TheKeychainScreenFitsWithTheKeyEditorOpen()
{
vault.NewKeyCommand.Execute(null);
vault.IsEditingKey.ShouldBeTrue();
@@ -579,7 +579,7 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
}
[Fact]
public async Task TheVaultScreenFitsWithThePasswordEditorOpen()
public async Task TheKeychainScreenFitsWithThePasswordEditorOpen()
{
vault.NewCredentialCommand.Execute(null);
vault.IsEditingCredential.ShouldBeTrue();
@@ -595,7 +595,7 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
/// nobody was told about.
/// </remarks>
[Fact]
public async Task TheVaultScreenFitsWithTheGenerateFormOpen()
public async Task TheKeychainScreenFitsWithTheGenerateFormOpen()
{
vault.NewGeneratedKeyCommand.Execute(null);
vault.IsGeneratingKey.ShouldBeTrue();
@@ -820,7 +820,7 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
/// application.
/// </remarks>
[Fact]
public async Task TheVaultScreenFitsWithADeletionInQuestion()
public async Task TheKeychainScreenFitsWithADeletionInQuestion()
{
var keyId = vault.Keys[0].EntityId;
@@ -1607,13 +1607,11 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
bytesPerSecond,
failure)));
/// <summary>Lays the vault screen out at the width it gets once the nav rail has taken its column.</summary>
/// <summary>Lays the vaults screen out at the width it gets once the nav rail has taken its column.</summary>
/// <remarks>
/// <para>
/// The teams screen had no entry in this suite at all until it grew four sections — a rename form, an
/// armed confirmation, an invitations list and a key-holders list — plus a second line in the member
/// row. Its right-hand column is the narrowest measured here: the window's minimum is 1016, the nav
/// rail takes 190 and the team list 268, leaving 558 for everything above.
/// Its right-hand column is the narrowest measured here: the window's minimum is 1016, the nav rail
/// takes 190 and the vault list 268, leaving 558 for everything above.
/// </para>
/// <para>
/// Every list is seeded, and seeded with the long rows rather than the convenient ones — see
@@ -1623,49 +1621,32 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
/// </para>
/// </remarks>
[Fact]
public Task TheTeamsScreen_FitsWithEveryListPopulated() =>
OnTheTeamsScreenAsync(
teams => { },
public Task TheVaultsScreen_FitsWithEveryListPopulated() =>
OnTheVaultsScreenAsync(
vaults => { },
window => LayoutHarness.Unreachable(window)
.ShouldBeEmpty("the teams screen with members, invitations and key holders"));
.ShouldBeEmpty("the vaults screen with members, invitations and key holders"));
/// <remarks>
/// The rename form is drawn in place, above the members list, and pushes everything below it down.
/// </remarks>
[Fact]
public Task TheTeamsScreen_FitsWhileRenamingATeam() =>
OnTheTeamsScreenAsync(
teams => teams.RenameTeamCommand.Execute(null),
public Task TheVaultsScreen_FitsWhileRenamingAVault() =>
OnTheVaultsScreenAsync(
vaults => vaults.RenameVaultCommand.Execute(null),
window => LayoutHarness.Unreachable(window)
.ShouldBeEmpty("the teams screen with the rename form open"));
.ShouldBeEmpty("the vaults screen with the rename form open"));
/// <remarks>
/// The name-a-vault form is in the left column under the team list, and it is the taller of the two
/// forms that can appear there — one field, but two sentences under it. Worth its own case because the
/// column is 268 wide and both sentences wrap.
/// The name-a-vault form is in the left column under the vault list. Worth its own case because the
/// column is 268 wide and the sentence under the field wraps.
/// </remarks>
[Fact]
public Task TheTeamsScreen_FitsWithTheNewVaultFormOpen() =>
OnTheTeamsScreenAsync(
teams => teams.NewVaultInItsOwnTeamCommand.Execute(null),
public Task TheVaultsScreen_FitsWithTheNewVaultFormOpen() =>
OnTheVaultsScreenAsync(
vaults => vaults.NewVaultCommand.Execute(null),
window => LayoutHarness.Unreachable(window)
.ShouldBeEmpty("the teams screen with the new-vault form open"));
/// <remarks>
/// Both forms at once, which is reachable: NEW at the top of the team list and New vault… in the tab
/// strip's menu arm different forms and neither closes the other. Together they are the most the left
/// column can be asked to hold.
/// </remarks>
[Fact]
public Task TheTeamsScreen_FitsWithBothCreateFormsOpen() =>
OnTheTeamsScreenAsync(
teams =>
{
teams.NewTeamCommand.Execute(null);
teams.NewVaultInItsOwnTeamCommand.Execute(null);
},
window => LayoutHarness.Unreachable(window)
.ShouldBeEmpty("the teams screen with both create forms open"));
.ShouldBeEmpty("the vaults screen with the new-vault form open"));
/// <remarks>
/// The armed confirmation carries two sentences of prose and replaces the header's buttons. It is the
@@ -1673,35 +1654,59 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
/// key-holders list off the bottom.
/// </remarks>
[Fact]
public Task TheTeamsScreen_FitsWhileConfirmingAnArchive() =>
OnTheTeamsScreenAsync(
teams => teams.ArchiveTeamCommand.Execute(null),
public Task TheVaultsScreen_FitsWhileConfirmingAHandOver() =>
OnTheVaultsScreenAsync(
vaults =>
{
vaults.SelectedMember = vaults.Members.First(member => !member.IsSelf);
vaults.HandOverCommand.Execute(null);
},
window => LayoutHarness.Unreachable(window)
.ShouldBeEmpty("the teams screen with the archive confirmation armed"));
.ShouldBeEmpty("the vaults screen with the hand-over confirmation armed"));
/// <remarks>
/// A real <c>TeamsViewModel</c> over a stub server rather than the unlocked vault the rest of this
/// suite uses, because nothing on this screen is vault content: it is read from the server on open.
/// The session function answers null, which is the state a member is in before anybody has wrapped
/// them a key — and it is also the one that draws the most text, since every vault row then carries
/// the "waiting for a key" sentence.
/// <para>
/// A real <c>VaultsViewModel</c> over this suite's own unlocked session and a stub server. Both halves
/// are needed and they answer different questions: the vault list is the session's, and who is in each
/// vault is the server's.
/// </para>
/// <para>
/// A shared vault is created into the session first, because a session that has only ever been unlocked
/// offline holds one personal vault — and the personal vault draws none of what this screen is for. It
/// is created through the real <c>CreateTeamVaultAsync</c> rather than poked into the cache, so the row
/// being measured is one the application could actually produce.
/// </para>
/// <para>
/// Selected before the second load rather than after it, so the members read is the awaited one: a
/// selection assignment starts a read nothing can wait for, and measuring a window while it was still
/// in flight would certify a screen with empty lists.
/// </para>
/// </remarks>
private static async Task OnTheTeamsScreenAsync(
Action<TeamsViewModel> arrange,
private async Task OnTheVaultsScreenAsync(
Action<VaultsViewModel> arrange,
Action<Window> assert)
{
using var teamServer = new StubTeamServer();
var teams = new TeamsViewModel(() => teamServer, () => null);
await session.CreateTeamVaultAsync(
teamServer.Teams, StubTeamServer.SharedTeamId, "Platform secrets", Token);
await teams.LoadAsync(Token);
var vaults = new VaultsViewModel(() => teamServer, () => session);
await vaults.LoadAsync(Token);
vaults.SelectedVault = vaults.Vaults.First(row => row.IsShared);
await vaults.LoadAsync(Token);
vaults.Members.ShouldNotBeEmpty("there is nothing to measure otherwise");
await LayoutHarness.OnTheUiThreadAsync(
() =>
{
arrange(teams);
arrange(vaults);
var screen = new TeamsScreen { DataContext = teams };
var screen = new VaultsScreen { DataContext = vaults };
var window = LayoutHarness.HostAtMinimumSize(
screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);
@@ -1721,11 +1726,11 @@ public sealed class ScreenLayoutTests : IAsyncLifetime
private Task MeasureVaultAsync(Action<IReadOnlyList<string>> assert) =>
OnTheVaultAsync((_, window) => assert(LayoutHarness.Unreachable(window)));
private Task OnTheVaultAsync(Action<VaultScreen, Window> body) =>
private Task OnTheVaultAsync(Action<KeychainScreen, Window> body) =>
LayoutHarness.OnTheUiThreadAsync(
() =>
{
var screen = new VaultScreen { DataContext = vault };
var screen = new KeychainScreen { DataContext = vault };
var window = LayoutHarness.HostAtMinimumSize(
screen, LayoutHarness.ScreenWidth, LayoutHarness.ScreenHeight);