DodoTech-Public/DodoSSH
Public Access
2
0
Fork 0
Code Issues Pull Requests 2 Actions 2 Packages Projects Releases 2 Wiki Activity

Make the vault the thing you share, and ask a host which one it lives in

Browse Source 
The teams screen listed teams that owned vaults, so sharing four servers with two
colleagues meant creating a team, then a vault inside it, then wrapping a key.
Two of those three steps are about a concept nobody arrives wanting. The screen
now lists vaults: naming one creates the membership list that carries it, named
after the vault and owned by you, and members, invitations, roles, hand-over and
key holders all hang off the vault they apply to.

Nothing on the server moved. VaultAccessService still resolves a shared vault
through team_membership and every membership call still names a team id — what
went is the requirement that anybody make one. The split the whole design rests
on is untouched and is still what the screen is built around: adding somebody
authorises the server to serve them, and only a machine holding the key can make
the vault readable. ADR 0009 keeps its decision and gains an addendum recording
which half of it a person is now asked about.

The one place the team resurfaces is a membership list carrying several vaults,
which this screen cannot produce and does not hide: the members section says so,
because "adding somebody here adds them there" is precisely the fact a
vault-shaped screen is in a position to conceal.

Two things left the interface and one arrived. Creating a team is gone, and so is
archiving one — it was only ever possible for a team owning no vaults, and a
screen whose rows are vaults has no row for one, so the button would have been
unreachable or always refused. The endpoint is unchanged and the screen states
the limit instead, since a vault cannot be deleted at all. The exception is a
create whose second call failed: cancelling that form archives the membership
list it left behind, which is a deliberate departure from this client's rule
against tidying up on the user's behalf, made because nothing else can reach it.

What arrived is PUT /api/v1/vaults/{id}. Without it the screen loses its only
editing action, since renaming the team behind a vault is invisible to everybody
who was never shown the team. It is gated on PermissionFlags.Admin — the line
UpdateTeamEndpoint already draws, because a name is what everybody in the vault
sees it called rather than part of its contents — and it renames the owning team
with it when that team carries nothing else, so the row an operator reads and the
name a user says cannot drift apart. The slug never moves, for the reason it does
not move on a team rename. The session edits its cached vault row rather than
replacing it with the response, which deliberately carries no wrapped key.

The host editor now asks which vault a host goes into, beside the name, while
adding and only where there is more than one vault to write to. It is a second
picker rather than the keychain screen's reused, and the two selections are
separate on purpose: that one is a standing preference about where new items go,
this is a field of the host in front of you, and binding both to one selection
would mean a click on the other screen could move a half-typed host. An existing
host is not offered it at all rather than offered it disabled — the two vaults
are encrypted under different keys, so moving an item is a delete and a retype.

That forced a fix worth naming. The group picker was built from the active
vault's groups whatever vault the host was being filed into, so a host put in a
shared vault could be filed under a group only its author can resolve — a
colleague would see it filed under nothing, which is the quietest kind of wrong.
Groups are now kept per vault and the picker follows the vault choice.

Two renames, because the pair they would otherwise have made is a bug farm:
ShellScreen.Vault became Keychain and VaultScreen became KeychainScreen, which is
what the rail has always labelled that screen, leaving Vault for one vault's
contents and Vaults for the vaults themselves. The enum values are unchanged;
NavRail.axaml writes them as x:Static literals.

1536 tests pass, seven more than before. Five are new on the server — the rename
endpoint's success, the team it does and does not take with it, the two refusals
and the empty name — and the client suite gains six and folds four together,
having lost the two about archiving a team.
This commit is contained in:
jaap-jan
2026-08-04 12:22:29 +02:00
parent 6ae1912c34
commit 8707629a6c
47 changed files with 3204 additions and 2313 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/DodoSSH.Client.App.Tests/VaultVisibilityTests.cs
+95 -61
View File
@@ -6,6 +6,7 @@ using DodoSSH.Client.Shell.ViewModels;
using DodoSSH.Client.Ssh;
using DodoSSH.Client.Storage;
using DodoSSH.Client.Terminal;
using DodoSSH.Contracts;
using DodoSSH.Crypto;
namespace DodoSSH.Client.App.Tests;
@@ -90,28 +91,31 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
/// <remarks>
/// The whole feature in one test. A name is all that is asked for, and what comes back is a vault this
/// machine can already write to inside a team this account owns — which is what makes the rest of the
/// screen, members and roles and key holders, apply to it.
/// machine can already write to, with a membership list this account owns — which is what makes the
/// rest of the screen, members and roles and key holders, apply to it.
/// </remarks>
[Fact]
public async Task CreatingAVaultByNameAlone_MakesATeamForItAndOwnsIt()
public async Task CreatingAVaultByNameAlone_MakesTheMembershipListForItAndOwnsIt()
{
await UnlockedAsync();
var teams = shell.Teams;
var vaults = shell.Vaults;
await teams.LoadAsync(Token);
await vaults.LoadAsync(Token);
await CreateVaultAsync("Platform secrets");
var team = teams.Teams.ShouldHaveSingleItem();
// Read from the server rather than off the screen: the membership list behind a vault is not a
// thing this screen shows any more, and that is exactly why it is worth asserting on directly.
var team = (await server.Teams.ListTeamsAsync(Token)).ShouldHaveSingleItem();
team.Name.ShouldBe("Platform secrets");
team.Slug.ShouldBe("platform-secrets", "the slug is derived rather than asked for");
team.Role.ShouldBe("OWNER");
team.Role.ShouldBe(TeamMemberRole.Owner);
var vault = teams.Vaults.ShouldHaveSingleItem();
var vault = vaults.Vaults.Single(
row => string.Equals(row.Name, "Platform secrets", StringComparison.Ordinal));
vault.Name.ShouldBe("Platform secrets");
vault.IsOwned.ShouldBeTrue(vaults.Status);
shell.Vault!.Session.ReadableVaults
.Select(row => row.VaultId)
.ShouldContain(vault.VaultId, "a vault made here is usable here, without a relock");
@@ -122,81 +126,109 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
/// next thing anybody making a shared vault wants is the people, and the people are here.
/// </remarks>
[Fact]
public async Task CreatingAVaultByNameAlone_LeavesTheNewVaultSelectedOnTheTeamsScreen()
public async Task CreatingAVaultByNameAlone_LeavesTheNewVaultSelectedOnTheVaultsScreen()
{
await UnlockedAsync();
var teams = shell.Teams;
var vaults = shell.Vaults;
await teams.LoadAsync(Token);
await vaults.LoadAsync(Token);
await CreateVaultAsync("Platform secrets");
teams.SelectedTeam.ShouldNotBeNull(teams.Status);
teams.SelectedTeam.Name.ShouldBe("Platform secrets");
teams.SelectedVault.ShouldNotBeNull(teams.Status);
teams.SelectedVault.Name.ShouldBe("Platform secrets");
vaults.SelectedVault.ShouldNotBeNull(vaults.Status);
vaults.SelectedVault.Name.ShouldBe("Platform secrets");
vaults.Members.ShouldHaveSingleItem().Role.ShouldBe("OWNER");
}
/// <remarks>
/// The failure between the two calls. The team is real and stays — a client that archived it because a
/// later step failed is a client that will one day archive a team somebody has just been added to — so
/// the sentence has to carry the whole state rather than "creating the vault failed".
/// The failure between the two calls. The membership list is real and is kept for the retry — the
/// sentence has to carry the whole state rather than "creating the vault failed", because pressing
/// CREATE again is what finishes the job and cancelling is what undoes it.
/// </remarks>
[Fact]
public async Task AVaultCreateThatFailsAfterTheTeam_KeepsTheTeamAndSaysSo()
public async Task AVaultCreateThatFailsAfterTheMembershipList_KeepsItAndSaysSo()
{
await UnlockedAsync();
var teams = shell.Teams;
var vaults = shell.Vaults;
await teams.LoadAsync(Token);
await vaults.LoadAsync(Token);
server.VaultCreateFailures = 1;
teams.NewVaultInItsOwnTeamCommand.Execute(null);
teams.NewVaultName = "Platform secrets";
vaults.NewVaultCommand.Execute(null);
vaults.NewVaultName = "Platform secrets";
await teams.CreateVaultCommand.ExecuteAsync(null);
await vaults.CreateVaultCommand.ExecuteAsync(null);
teams.Teams.ShouldHaveSingleItem().Name.ShouldBe("Platform secrets");
teams.Vaults.ShouldBeEmpty();
(await server.Teams.ListTeamsAsync(Token)).ShouldHaveSingleItem();
vaults.Vaults.ShouldNotContain(
row => string.Equals(row.Name, "Platform secrets", StringComparison.Ordinal));
teams.IsCreatingVault.ShouldBeTrue("the form stays open so CREATE can be pressed again");
teams.NewVaultName.ShouldBe("Platform secrets", "and what was typed is still in it");
vaults.IsCreatingVault.ShouldBeTrue("the form stays open so CREATE can be pressed again");
vaults.NewVaultName.ShouldBe("Platform secrets", "and what was typed is still in it");
teams.Status.ShouldContain("was created, but its vault was not");
teams.Status.ShouldContain("Press CREATE again");
vaults.Status.ShouldContain("was not created");
vaults.Status.ShouldContain("Press CREATE again");
}
/// <remarks>
/// The retry, and the reason the team id is generated once and held rather than per attempt. A second
/// team would leave somebody with two identically named ones and no way to tell which is which.
/// The retry, and the reason the id is generated once and held rather than per attempt. A second
/// membership list would be one nothing on this screen could show and nobody could remove.
/// </remarks>
[Fact]
public async Task RetryingAfterTheVaultCreateFailed_ReusesTheTeamRatherThanMakingASecond()
public async Task RetryingAfterTheVaultCreateFailed_ReusesTheMembershipListRatherThanMakingASecond()
{
await UnlockedAsync();
var teams = shell.Teams;
var vaults = shell.Vaults;
await teams.LoadAsync(Token);
await vaults.LoadAsync(Token);
server.VaultCreateFailures = 1;
teams.NewVaultInItsOwnTeamCommand.Execute(null);
teams.NewVaultName = "Platform secrets";
vaults.NewVaultCommand.Execute(null);
vaults.NewVaultName = "Platform secrets";
await teams.CreateVaultCommand.ExecuteAsync(null);
await vaults.CreateVaultCommand.ExecuteAsync(null);
var teamId = teams.Teams.ShouldHaveSingleItem().TeamId;
var teamId = (await server.Teams.ListTeamsAsync(Token)).ShouldHaveSingleItem().TeamId;
// Pressed again on the form that is still open, which is exactly what the message tells the user
// to do.
await teams.CreateVaultCommand.ExecuteAsync(null);
await vaults.CreateVaultCommand.ExecuteAsync(null);
teams.Teams.ShouldHaveSingleItem().TeamId.ShouldBe(teamId);
teams.Vaults.ShouldHaveSingleItem().Name.ShouldBe("Platform secrets");
teams.IsCreatingVault.ShouldBeFalse(teams.Status);
(await server.Teams.ListTeamsAsync(Token)).ShouldHaveSingleItem().TeamId.ShouldBe(teamId);
vaults.Vaults.ShouldContain(
row => string.Equals(row.Name, "Platform secrets", StringComparison.Ordinal));
vaults.IsCreatingVault.ShouldBeFalse(vaults.Status);
}
/// <remarks>
/// Cancelling takes the half-made membership list with it, which is the one place this application
/// tidies up on the user's behalf. The reason is that nothing on the screen can reach it: a membership
/// list with no vault has no row, so leaving it would leave something the user can neither see nor
/// remove.
/// </remarks>
[Fact]
public async Task CancellingAfterTheVaultCreateFailed_TakesTheMembershipListWithIt()
{
await UnlockedAsync();
var vaults = shell.Vaults;
await vaults.LoadAsync(Token);
server.VaultCreateFailures = 1;
vaults.NewVaultCommand.Execute(null);
vaults.NewVaultName = "Platform secrets";
await vaults.CreateVaultCommand.ExecuteAsync(null);
await vaults.CancelNewVaultCommand.ExecuteAsync(null);
(await server.Teams.ListTeamsAsync(Token))
.ShouldBeEmpty("the membership list nobody was shown is not left behind");
}
/// <remarks>
@@ -209,15 +241,15 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
{
await UnlockedAsync();
var teams = shell.Teams;
var vaults = shell.Vaults;
await teams.LoadAsync(Token);
await vaults.LoadAsync(Token);
server.TakenSlugs.Add("platform-secrets");
await CreateVaultAsync("Platform secrets");
var team = teams.Teams.ShouldHaveSingleItem();
var team = (await server.Teams.ListTeamsAsync(Token)).ShouldHaveSingleItem();
team.Name.ShouldBe("Platform secrets", "the name is what the user typed");
team.Slug.ShouldStartWith("platform-secrets-");
@@ -226,20 +258,20 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
/// <remarks>
/// A name written in a script with no a-z or 0-9 in it leaves nothing to slugify. It still has to be a
/// vault a person can make, so the fallback is the team's own id rather than a refusal pointing at a
/// field that does not exist.
/// vault a person can make, so the fallback is an id rather than a refusal pointing at a field that
/// does not exist.
/// </remarks>
[Fact]
public async Task AVaultNameWithNothingSluggableInIt_StillGetsAUsableSlug()
{
await UnlockedAsync();
var teams = shell.Teams;
var vaults = shell.Vaults;
await teams.LoadAsync(Token);
await vaults.LoadAsync(Token);
await CreateVaultAsync("διαχείριση");
var team = teams.Teams.ShouldHaveSingleItem();
var team = (await server.Teams.ListTeamsAsync(Token)).ShouldHaveSingleItem();
team.Name.ShouldBe("διαχείριση");
team.Slug.ShouldStartWith("vault-");
@@ -455,7 +487,9 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
shell.HasVaultSwitches.ShouldBeTrue();
shell.VaultToggles.Count.ShouldBe(2);
shell.VaultToggles[0].IsPersonal.ShouldBeTrue();
shell.VaultToggles[1].Display.ShouldBe("Platform secrets · TEAM");
// SHARED rather than TEAM: a team is no longer something the person reading this menu has been
// shown, so the word names what the switch is actually about.
shell.VaultToggles[1].Display.ShouldBe("Platform secrets · SHARED");
}
// ---- Helpers ----
@@ -475,22 +509,22 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
/// <summary>Names a vault, from the form the tab strip's menu opens.</summary>
private async Task<Guid> CreateVaultAsync(string name)
{
var teams = shell.Teams;
var vaults = shell.Vaults;
teams.NewVaultInItsOwnTeamCommand.Execute(null);
teams.NewVaultName = name;
vaults.NewVaultCommand.Execute(null);
vaults.NewVaultName = name;
await teams.CreateVaultCommand.ExecuteAsync(null);
await vaults.CreateVaultCommand.ExecuteAsync(null);
teams.IsCreatingVault.ShouldBeFalse(teams.Status);
vaults.IsCreatingVault.ShouldBeFalse(vaults.Status);
return teams.Vaults.Single(row => string.Equals(row.Name, name, StringComparison.Ordinal))
return vaults.Vaults.Single(row => string.Equals(row.Name, name, StringComparison.Ordinal))
.VaultId;
}
private async Task<Guid> VaultWithAHostAsync(string vaultName, string hostLabel)
{
await shell.Teams.LoadAsync(Token);
await shell.Vaults.LoadAsync(Token);
var vaultId = await CreateVaultAsync(vaultName);
@@ -501,7 +535,7 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
private async Task<Guid> VaultWithAKeyAsync(string vaultName, string keyLabel)
{
await shell.Teams.LoadAsync(Token);
await shell.Vaults.LoadAsync(Token);
var vaultId = await CreateVaultAsync(vaultName);
var vault = shell.Vault!;