Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed.

DodoSSH.Client.Domain holds the decrypted item model and the three-way
merge, with no I/O at all — so the suite that decides whether a
credential can be lost runs in milliseconds with nothing to mock.
Scalars defer to the server on a genuine clash so every replica resolves
the same triple identically and two clients cannot ping-pong; directives
merge per name so two people each adding one both keep theirs; the jump
chain merges as a whole value because its order is the route. Whatever
loses is returned rather than dropped.

DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are
already ciphertext, so an encrypted file would protect protected bytes
at the cost of a native dependency. It keeps the server's state and the
outbox in separate tables, which is what preserves the common ancestor a
merge needs. One pending operation per item, enforced by a unique index.

DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts
— a change with no local work pending is plumbed as ciphertext — so a
first sync of thousands of items does not run twice as many AEAD
operations for nothing.

Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The
specification has required a per-item data key since crypto.md §3, the
columns have existed since the first migration and DshAad.ItemPayload
binds the id, but this record had nowhere to put either — so a
spec-compliant item could not be transmitted at all. Found by writing
the client that has to produce one. Also closes a hole in
AadResourceType, which had no value for the HostTag and HostCredential
that SyncEntityType has always listed.

Four bugs the tests found, not review:

- SQLite refuses to order or compare its own DateTimeOffset mapping, and
  throws at execution rather than model build. Collecting tombstones and
  listing conflicts are both that shape, so this was a crash waiting for
  the first user with a deleted host. Timestamps are integers now, by
  convention so a later field cannot be the one left unconverted.
- SQLitePCLRaw 2.1.11, which EF resolves, is covered by
  GHSA-2m69-gcr7-jv3q. Pinned forward as a family.
- Resurrecting content from a remote deletion cleared the original
  before queueing the copy. Two transactions, so a crash between them
  lost the work; reversed, and the rescued id is derived from the
  tombstone so a replay coalesces instead of duplicating.
- Several equality assertions went through Shouldly's ShouldBe, which
  compares IEnumerable element-wise and so tested nothing about the
  Equals these types exist to provide. Corrected; the falsification that
  caught it went from 2 failures to 6.

The push response's cursor is deliberately ignored. It sits after this
client's own writes, so adopting it skips anything another client
committed at a lower sequence in the window between a pull and a push —
permanently. Re-reading one's own writes is idempotent and costs a page.
The Contracts doc that invited the shortcut now says so.

593 tests, up from 448. The delete-versus-edit rules, the ancestor
retention, the fresh operation id on coalesce and the cursor safeguard
were each verified by breaking them and watching the right test fail.
This commit is contained in:
2026-07-29 10:27:37 +02:00
parent a878c2b6bb
commit 8d2416a602
72 changed files with 11313 additions and 30 deletions
@@ -0,0 +1,178 @@
using System.Globalization;
namespace DodoSSH.Client.Domain;
/// <summary>
/// A value the merge had to override, kept so the user can see it and put it back.
/// </summary>
/// <remarks>
/// This record is the reason the merge is allowed to pick a winner at all. Choosing a side is only
/// acceptable because the other side is preserved verbatim and surfaced; without that, a
/// field-level merge is just last-writer-wins with extra steps.
/// </remarks>
/// <param name="Field">
/// Which field, as a path. A directive reads <c>Options[ServerAliveInterval]</c> so the user is told
/// which one rather than merely that "options" changed.
/// </param>
/// <param name="DiscardedSide">Whose intent was overridden.</param>
/// <param name="Kept">The value that survives, rendered for display.</param>
/// <param name="Discarded">The value that lost, rendered for display.</param>
/// <param name="DiscardedWasRemoval">
/// True when what lost was a deletion rather than a different value.
/// </param>
public sealed record HostFieldConflict(
string Field,
MergeSide DiscardedSide,
string? Kept,
string? Discarded,
bool DiscardedWasRemoval);
/// <summary>The merged host, and everything that had to be overridden to produce it.</summary>
/// <param name="Merged">The host to store and push.</param>
/// <param name="Conflicts">Empty when the two sides were reconcilable field by field.</param>
public sealed record HostMergeResult(
HostSecret Merged,
IReadOnlyList<HostFieldConflict> Conflicts)
{
/// <summary>Whether anything had to be overridden.</summary>
public bool HasConflicts => Conflicts.Count > 0;
}
/// <summary>
/// Merges two divergent versions of a host against the version they both started from.
/// </summary>
/// <remarks>
/// <para>
/// Called when a pull brings down a change to an item that also has a local edit pending, and again
/// when a push comes back <c>Conflict</c> carrying the server's current row. Both paths need the
/// same answer, so both go through here.
/// </para>
/// <para>
/// Scalar fields defer to the server on a genuine clash and the jump chain merges as a whole value,
/// because its order is its meaning. Directives merge per name, which is what lets two people each
/// add one and both keep it. See <see cref="ThreeWayMerge"/> for why the remote side wins.
/// </para>
/// </remarks>
public static class HostSecretMerge
{
/// <summary>
/// Produces the merged host.
/// </summary>
/// <param name="ancestor">
/// The version both sides branched from — the ciphertext the client retained when it queued its
/// local edit. Without it this degrades to a two-way diff, which cannot tell an edit from a
/// revert and so cannot avoid resurrecting deleted values.
/// </param>
/// <param name="local">The pending local version.</param>
/// <param name="remote">The server's current version.</param>
public static HostMergeResult Merge(HostSecret ancestor, HostSecret local, HostSecret remote)
{
ArgumentNullException.ThrowIfNull(ancestor);
ArgumentNullException.ThrowIfNull(local);
ArgumentNullException.ThrowIfNull(remote);
var conflicts = new List<HostFieldConflict>();
var merged = new HostSecret
{
Label = Text(nameof(HostSecret.Label), ancestor.Label, local.Label, remote.Label, conflicts),
Hostname = Text(
nameof(HostSecret.Hostname), ancestor.Hostname, local.Hostname, remote.Hostname, conflicts),
Port = Field(
nameof(HostSecret.Port),
ancestor.Port,
local.Port,
remote.Port,
conflicts,
static port => port.ToString(CultureInfo.InvariantCulture)),
Username = Text(
nameof(HostSecret.Username), ancestor.Username, local.Username, remote.Username, conflicts),
Notes = Text(nameof(HostSecret.Notes), ancestor.Notes, local.Notes, remote.Notes, conflicts),
JumpHostIds = Field(
nameof(HostSecret.JumpHostIds),
ancestor.JumpHostIds,
local.JumpHostIds,
remote.JumpHostIds,
conflicts,
FormatChain),
Options = MergeOptions(ancestor.Options, local.Options, remote.Options, conflicts),
RelayEnabled = Field(
nameof(HostSecret.RelayEnabled),
ancestor.RelayEnabled,
local.RelayEnabled,
remote.RelayEnabled,
conflicts,
static enabled => enabled ? "enabled" : "disabled"),
};
return new HostMergeResult(merged, conflicts);
}
private static string Text(
string name,
string? ancestor,
string? local,
string? remote,
List<HostFieldConflict> conflicts) =>
Field(name, ancestor, local, remote, conflicts, static value => value, StringComparer.Ordinal)!;
/// <remarks>
/// A scalar clash always overrides the local side — see <see cref="ThreeWayMerge"/> — so the
/// discarded side is fixed here rather than derived.
/// </remarks>
private static T Field<T>(
string name,
T ancestor,
T local,
T remote,
List<HostFieldConflict> conflicts,
Func<T, string?> format,
IEqualityComparer<T>? comparer = null)
{
var merge = ThreeWayMerge.Scalar(ancestor, local, remote, comparer);
if (merge.IsConflicted)
{
conflicts.Add(new HostFieldConflict(
name,
MergeSide.Local,
format(merge.Value),
merge.Discarded is null ? null : format(merge.Discarded),
DiscardedWasRemoval: false));
}
return merge.Value;
}
private static HostOptions MergeOptions(
HostOptions ancestor,
HostOptions local,
HostOptions remote,
List<HostFieldConflict> conflicts)
{
var merge = ThreeWayMerge.Map(
ancestor.ToNameMap(),
local.ToNameMap(),
remote.ToNameMap(),
HostOption.NameComparer,
StringComparer.Ordinal);
foreach (var conflict in merge.Conflicts)
{
conflicts.Add(new HostFieldConflict(
$"{nameof(HostSecret.Options)}[{conflict.Key}]",
conflict.DiscardedSide,
conflict.Kept,
conflict.Discarded,
conflict.DiscardedWasRemoval));
}
// The merged map is keyed by the same comparer, so uniqueness already holds and Create
// cannot throw here.
return HostOptions.Create(
merge.Merged.Select(entry => new HostOption(entry.Key, entry.Value)));
}
private static string FormatChain(JumpChain chain) =>
chain.Count == 0 ? "(none)" : string.Join(" → ", chain);
}