Add the encrypted local cache and the sync client

Three new client projects, and the wire-contract fix they needed. DodoSSH.Client.Domain holds the decrypted item model and the three-way merge, with no I/O at all — so the suite that decides whether a credential can be lost runs in milliseconds with nothing to mock. Scalars defer to the server on a genuine clash so every replica resolves the same triple identically and two clients cannot ping-pong; directives merge per name so two people each adding one both keep theirs; the jump chain merges as a whole value because its order is the route. Whatever loses is returned rather than dropped. DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are already ciphertext, so an encrypted file would protect protected bytes at the cost of a native dependency. It keeps the server's state and the outbox in separate tables, which is what preserves the common ancestor a merge needs. One pending operation per item, enforced by a unique index. DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts — a change with no local work pending is plumbed as ciphertext — so a first sync of thousands of items does not run twice as many AEAD operations for nothing. Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The specification has required a per-item data key since crypto.md §3, the columns have existed since the first migration and DshAad.ItemPayload binds the id, but this record had nowhere to put either — so a spec-compliant item could not be transmitted at all. Found by writing the client that has to produce one. Also closes a hole in AadResourceType, which had no value for the HostTag and HostCredential that SyncEntityType has always listed. Four bugs the tests found, not review: - SQLite refuses to order or compare its own DateTimeOffset mapping, and throws at execution rather than model build. Collecting tombstones and listing conflicts are both that shape, so this was a crash waiting for the first user with a deleted host. Timestamps are integers now, by convention so a later field cannot be the one left unconverted. - SQLitePCLRaw 2.1.11, which EF resolves, is covered by GHSA-2m69-gcr7-jv3q. Pinned forward as a family. - Resurrecting content from a remote deletion cleared the original before queueing the copy. Two transactions, so a crash between them lost the work; reversed, and the rescued id is derived from the tombstone so a replay coalesces instead of duplicating. - Several equality assertions went through Shouldly's ShouldBe, which compares IEnumerable element-wise and so tested nothing about the Equals these types exist to provide. Corrected; the falsification that caught it went from 2 failures to 6. The push response's cursor is deliberately ignored. It sits after this client's own writes, so adopting it skips anything another client committed at a lower sequence in the window between a pull and a push — permanently. Re-reading one's own writes is idempotent and costs a page. The Contracts doc that invited the shortcut now says so. 593 tests, up from 448. The delete-versus-edit rules, the ancestor retention, the fresh operation id on coalesce and the cursor safeguard were each verified by breaking them and watching the right test fail.
2026-07-29 10:27:37 +02:00
parent a878c2b6bb
commit 8d2416a602
72 changed files with 11313 additions and 30 deletions
@@ -0,0 +1,137 @@
+using DodoSSH.Contracts;
+using Microsoft.EntityFrameworkCore;
+
+namespace DodoSSH.Client.Storage;
+
+/// <summary>
+/// Thrown when the cache belongs to a different account than the one signing in.
+/// </summary>
+/// <remarks>
+/// Loud on purpose. Silently adopting the cache would mix one user's items into another's vault list
+/// and, worse, would offer an unlock prompt whose passphrase can never work.
+/// </remarks>
+public sealed class CacheIdentityMismatchException : InvalidOperationException
+{
+    /// <summary>Creates the exception.</summary>
+    public CacheIdentityMismatchException(string message)
+        : base(message)
+    {
+    }
+
+    /// <summary>Creates the exception.</summary>
+    public CacheIdentityMismatchException()
+        : base("This cache belongs to a different account.")
+    {
+    }
+
+    /// <summary>Creates the exception.</summary>
+    public CacheIdentityMismatchException(string message, Exception innerException)
+        : base(message, innerException)
+    {
+    }
+}
+
+/// <summary>
+/// The material an offline unlock needs.
+/// </summary>
+/// <remarks>
+/// <para>
+/// This store is the reason the client works on a plane. The Argon2id salt and the wrapped secret
+/// bundle are cached the moment the server hands them over, so deriving the master key and opening the
+/// bundle need no network at all. Fetching either at unlock time would make an offline launch
+/// impossible, which is the most common moment a user actually needs their vault.
+/// </para>
+/// <para>
+/// Neither value is a secret. The salt is public by construction and the bundle is ciphertext whose key
+/// exists only in the user's head. The master key itself is never written here or anywhere else.
+/// </para>
+/// </remarks>
+public sealed class UnlockStore(IDbContextFactory<ClientCacheContext> contexts, TimeProvider clock)
+{
+    /// <summary>Reads the cached material, or null when this cache has never been enrolled.</summary>
+    public async Task<StoredUnlockMaterial?> ReadAsync(CancellationToken cancellationToken)
+    {
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        var row = await context.Set<UnlockMaterialRow>()
+            .AsNoTracking()
+            .SingleOrDefaultAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        return row is null ? null : ToStored(row);
+    }
+
+    /// <summary>
+    /// Writes the material, replacing what is there.
+    /// </summary>
+    /// <exception cref="CacheIdentityMismatchException">
+    /// The cache already holds a different user. One cache file is one account; see
+    /// <see cref="UnlockMaterialRow"/> for why multiple accounts are not half-supported here.
+    /// </exception>
+    public async Task SaveAsync(StoredUnlockMaterial material, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(material);
+
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        var row = await context.Set<UnlockMaterialRow>()
+            .SingleOrDefaultAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+        if (row is null)
+        {
+            row = new UnlockMaterialRow();
+            context.Add(row);
+        }
+        else if (row.UserId != material.UserId)
+        {
+            throw new CacheIdentityMismatchException(
+                $"This cache holds user {row.UserId}; refusing to overwrite it with {material.UserId}.");
+        }
+
+        Apply(row, material, clock.GetUtcNow());
+
+        await context.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    private static void Apply(
+        UnlockMaterialRow row,
+        StoredUnlockMaterial material,
+        DateTimeOffset now)
+    {
+        row.ServerUrl = material.ServerUrl;
+        row.UserId = material.UserId;
+        row.Issuer = material.Issuer;
+        row.Subject = material.Subject;
+        row.Email = material.Email;
+        row.DisplayName = material.DisplayName;
+        row.KeyGeneration = material.KeyGeneration;
+        row.WrappedPrivateKey = material.WrappedPrivateKey;
+        row.KdfAlgorithm = material.KdfParameters.Algorithm;
+        row.KdfSalt = material.KdfParameters.Salt;
+        row.KdfMemoryKibibytes = material.KdfParameters.MemoryKibibytes;
+        row.KdfPasses = material.KdfParameters.Passes;
+        row.KdfParallelism = material.KdfParameters.Parallelism;
+        row.UpdatedAtUtc = now;
+    }
+
+    private static StoredUnlockMaterial ToStored(UnlockMaterialRow row) =>
+        new(
+            row.ServerUrl,
+            row.UserId,
+            row.Issuer,
+            row.Subject,
+            row.Email,
+            row.DisplayName,
+            row.KeyGeneration,
+            row.WrappedPrivateKey,
+            new KdfParameters(
+                row.KdfAlgorithm,
+                row.KdfSalt,
+                row.KdfMemoryKibibytes,
+                row.KdfPasses,
+                row.KdfParallelism),
+            row.UpdatedAtUtc);
+}