Public Access
Add the encrypted local cache and the sync client
Three new client projects, and the wire-contract fix they needed. DodoSSH.Client.Domain holds the decrypted item model and the three-way merge, with no I/O at all — so the suite that decides whether a credential can be lost runs in milliseconds with nothing to mock. Scalars defer to the server on a genuine clash so every replica resolves the same triple identically and two clients cannot ping-pong; directives merge per name so two people each adding one both keep theirs; the jump chain merges as a whole value because its order is the route. Whatever loses is returned rather than dropped. DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are already ciphertext, so an encrypted file would protect protected bytes at the cost of a native dependency. It keeps the server's state and the outbox in separate tables, which is what preserves the common ancestor a merge needs. One pending operation per item, enforced by a unique index. DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts — a change with no local work pending is plumbed as ciphertext — so a first sync of thousands of items does not run twice as many AEAD operations for nothing. Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The specification has required a per-item data key since crypto.md §3, the columns have existed since the first migration and DshAad.ItemPayload binds the id, but this record had nowhere to put either — so a spec-compliant item could not be transmitted at all. Found by writing the client that has to produce one. Also closes a hole in AadResourceType, which had no value for the HostTag and HostCredential that SyncEntityType has always listed. Four bugs the tests found, not review: - SQLite refuses to order or compare its own DateTimeOffset mapping, and throws at execution rather than model build. Collecting tombstones and listing conflicts are both that shape, so this was a crash waiting for the first user with a deleted host. Timestamps are integers now, by convention so a later field cannot be the one left unconverted. - SQLitePCLRaw 2.1.11, which EF resolves, is covered by GHSA-2m69-gcr7-jv3q. Pinned forward as a family. - Resurrecting content from a remote deletion cleared the original before queueing the copy. Two transactions, so a crash between them lost the work; reversed, and the rescued id is derived from the tombstone so a replay coalesces instead of duplicating. - Several equality assertions went through Shouldly's ShouldBe, which compares IEnumerable element-wise and so tested nothing about the Equals these types exist to provide. Corrected; the falsification that caught it went from 2 failures to 6. The push response's cursor is deliberately ignored. It sits after this client's own writes, so adopting it skips anything another client committed at a lower sequence in the window between a pull and a push — permanently. Re-reading one's own writes is idempotent and costs a page. The Contracts doc that invited the shortcut now says so. 593 tests, up from 448. The delete-versus-edit rules, the ancestor retention, the fresh operation id on coalesce and the cursor safeguard were each verified by breaking them and watching the right test fail.
This commit is contained in:
@@ -0,0 +1,165 @@
|
||||
using DodoSSH.Contracts;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
|
||||
|
||||
namespace DodoSSH.Client.Storage;
|
||||
|
||||
/// <summary>
|
||||
/// Stores a timestamp as Unix milliseconds.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Not a preference. SQLite has no date type, and EF's default mapping for
|
||||
/// <see cref="DateTimeOffset"/> is a text form that it then <b>refuses to order or compare</b> — any
|
||||
/// query with <c>ORDER BY</c> or a range filter on such a column throws
|
||||
/// <see cref="NotSupportedException"/> at execution time, not at model build. Collecting tombstones
|
||||
/// older than a cutoff and listing conflicts newest-first are both exactly that shape, so this was a
|
||||
/// crash waiting for the first user with a deleted host. Found by the tests that do both.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// An integer also sorts and compares correctly by construction, which the text form does not once
|
||||
/// two rows carry different UTC offsets. The cost is losing sub-millisecond precision and normalising
|
||||
/// to UTC — neither of which matters here, and both of which docs/crypto.md §7 already does to every
|
||||
/// timestamp it signs over.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal sealed class UnixMillisecondsConverter : ValueConverter<DateTimeOffset, long>
|
||||
{
|
||||
/// <remarks>Public because EF instantiates this reflectively and needs a public constructor.</remarks>
|
||||
public UnixMillisecondsConverter()
|
||||
: base(
|
||||
value => value.ToUnixTimeMilliseconds(),
|
||||
value => DateTimeOffset.FromUnixTimeMilliseconds(value))
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The local cache database.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Public only because the migrations tooling needs to reach it. The row types stay internal and
|
||||
/// there are no <see cref="DbSet{TEntity}"/> properties: callers go through the stores, which is what
|
||||
/// keeps the sealing of protected columns from being something a call site can forget. Entities are
|
||||
/// registered explicitly in <see cref="OnModelCreating"/> and reached with
|
||||
/// <see cref="DbContext.Set{TEntity}()"/>.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Migrations rather than <c>EnsureCreated</c>, even for a cache. The item rows are indeed disposable
|
||||
/// — worst case they re-pull from a null cursor — but <see cref="UnlockMaterialRow"/> is not: dropping
|
||||
/// it would mean a user who upgrades while offline cannot open their vault until they are back on the
|
||||
/// network, which is exactly the situation the offline unlock exists for.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class ClientCacheContext(DbContextOptions<ClientCacheContext> options)
|
||||
: DbContext(options)
|
||||
{
|
||||
/// <inheritdoc />
|
||||
/// <remarks>
|
||||
/// Applied as a convention rather than per property, so a timestamp added later cannot be the one
|
||||
/// that is left un-converted — which would fail only when something eventually sorted by it.
|
||||
/// </remarks>
|
||||
protected override void ConfigureConventions(ModelConfigurationBuilder configurationBuilder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(configurationBuilder);
|
||||
|
||||
configurationBuilder.Properties<DateTimeOffset>().HaveConversion<UnixMillisecondsConverter>();
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void OnModelCreating(ModelBuilder modelBuilder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(modelBuilder);
|
||||
|
||||
ConfigureUnlockMaterial(modelBuilder);
|
||||
ConfigureVaults(modelBuilder);
|
||||
ConfigureItems(modelBuilder);
|
||||
ConfigureOutbox(modelBuilder);
|
||||
ConfigureSyncState(modelBuilder);
|
||||
ConfigureConflicts(modelBuilder);
|
||||
}
|
||||
|
||||
private static void ConfigureUnlockMaterial(ModelBuilder modelBuilder) =>
|
||||
modelBuilder.Entity<UnlockMaterialRow>(entity =>
|
||||
{
|
||||
entity.ToTable(
|
||||
"unlock_material",
|
||||
// One server and one user per cache file. The constraint is here rather than only in
|
||||
// code so that a second row cannot appear through any path at all — including a
|
||||
// future migration written by someone who has not read this comment.
|
||||
table => table.HasCheckConstraint(
|
||||
"ck_unlock_material_singleton",
|
||||
$"id = {UnlockMaterialRow.SingletonId}"));
|
||||
|
||||
entity.HasKey(row => row.Id);
|
||||
entity.Property(row => row.Id).ValueGeneratedNever();
|
||||
entity.Property(row => row.ServerUrl).IsRequired();
|
||||
entity.Property(row => row.Issuer).IsRequired();
|
||||
entity.Property(row => row.Subject).IsRequired();
|
||||
entity.Property(row => row.WrappedPrivateKey).IsRequired();
|
||||
entity.Property(row => row.KdfAlgorithm).IsRequired();
|
||||
entity.Property(row => row.KdfSalt).IsRequired();
|
||||
});
|
||||
|
||||
private static void ConfigureVaults(ModelBuilder modelBuilder) =>
|
||||
modelBuilder.Entity<CachedVaultRow>(entity =>
|
||||
{
|
||||
entity.ToTable("vault");
|
||||
entity.HasKey(row => row.VaultId);
|
||||
entity.Property(row => row.VaultId).ValueGeneratedNever();
|
||||
entity.Property(row => row.Name).IsRequired();
|
||||
});
|
||||
|
||||
private static void ConfigureItems(ModelBuilder modelBuilder) =>
|
||||
modelBuilder.Entity<CachedItemRow>(entity =>
|
||||
{
|
||||
entity.ToTable("item");
|
||||
|
||||
// Composite rather than the entity id alone. Ids are UUIDv7 and globally unique in
|
||||
// practice, but making the vault part of the identity means a row can never be read out
|
||||
// of the wrong vault by a query that forgot to filter.
|
||||
entity.HasKey(row => new { row.VaultId, row.EntityType, row.EntityId });
|
||||
|
||||
entity.HasIndex(row => new { row.VaultId, row.EntityType });
|
||||
entity.HasIndex(row => new { row.VaultId, row.ChangeSequence });
|
||||
});
|
||||
|
||||
private static void ConfigureOutbox(ModelBuilder modelBuilder) =>
|
||||
modelBuilder.Entity<OutboxRow>(entity =>
|
||||
{
|
||||
entity.ToTable("outbox");
|
||||
entity.HasKey(row => row.Sequence);
|
||||
entity.Property(row => row.Sequence).ValueGeneratedOnAdd();
|
||||
|
||||
// At most one pending operation per item, enforced by the database rather than by
|
||||
// convention. Two queued edits to one item would have to be pushed in order, and the
|
||||
// second would need the version the first produced — which is not known when it is
|
||||
// queued. Coalescing into this single row avoids the problem instead of managing it.
|
||||
entity.HasIndex(row => new { row.VaultId, row.EntityType, row.EntityId }).IsUnique();
|
||||
|
||||
// The drain order.
|
||||
entity.HasIndex(row => new { row.VaultId, row.IsParked, row.Sequence });
|
||||
|
||||
entity.HasIndex(row => row.OperationId).IsUnique();
|
||||
});
|
||||
|
||||
private static void ConfigureSyncState(ModelBuilder modelBuilder) =>
|
||||
modelBuilder.Entity<SyncStateRow>(entity =>
|
||||
{
|
||||
entity.ToTable("sync_state");
|
||||
entity.HasKey(row => row.VaultId);
|
||||
entity.Property(row => row.VaultId).ValueGeneratedNever();
|
||||
});
|
||||
|
||||
private static void ConfigureConflicts(ModelBuilder modelBuilder) =>
|
||||
modelBuilder.Entity<ConflictRow>(entity =>
|
||||
{
|
||||
entity.ToTable("conflict");
|
||||
entity.HasKey(row => row.Id);
|
||||
entity.Property(row => row.Id).ValueGeneratedNever();
|
||||
entity.Property(row => row.Detail).IsRequired();
|
||||
entity.HasIndex(row => new { row.VaultId, row.Acknowledged });
|
||||
entity.HasIndex(row => new { row.VaultId, row.EntityType, row.EntityId });
|
||||
});
|
||||
}
|
||||
Reference in New Issue
Block a user