DodoTech-Public/DodoSSH
Public Access
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Sync the vault automatically instead of only on a button press

Browse Source 
Three triggers: once when the vault opens, straight after any local change,
and every minute while it stays open. The Sync button stays, because someone
just handed a credential wants to know now rather than within the minute, but
nothing depends on it being pressed any more.

A background pass is deliberately not the button's code path. Routing it
through RunAsync would raise the busy flag every minute — disabling Connect
and Save for the duration — and repaint the status line over whatever the user
was reading. So it is quiet: the status changes only when a pass actually
moved an item or produced something needing attention, and a pass is skipped
outright while a command is running rather than queueing behind it. Both
guards are covered; removing either fails a test.

A shared semaphore serialises every pass, taken with a zero timeout rather
than awaited — a pass arriving while another runs has nothing to add by
waiting, and queueing them would turn a slow server into a backlog of
identical work.

Failures are swallowed, which is right in exactly this one place: a laptop
closed all afternoon would otherwise replace the status line with a socket
error once a minute. It is quiet rather than hidden — the account bar already
shows when there is no connection, and pressing Sync reports the real reason.
What earns that is the outbox: a test proves a change left queued by a failed
pass is still sent by the next sync, so quiet never means lost.

Two existing tests asserted the opposite behaviour — that a save queued and
pushed nothing until Sync was pressed — and were rewritten rather than
deleted; the local-first guarantee they were really protecting is that the
list updates with no server, which the offline test still covers.

Two things the tests caught in my own work. ReloadAsync had to be split out
of LoadAsync because rebuilding the list repainted the status line
unconditionally, which made "the background pass is quiet" false on the one
path that mattered. And the yields-to-a-command test was vacuous as first
written: saving pushes, so there was no pending change left and the assertion
held with the guard deleted. It now fails the automatic push first to arrange
a real queue.
This commit is contained in:
jaap-jan
2026-07-29 14:53:19 +02:00
parent ea271d980a
commit c6fc19bbbd
4 changed files with 317 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/DodoSSH.Client.App.Tests/FakeVaultServer.cs
+15
View File
@@ -40,6 +40,16 @@ internal sealed class FakeVaultServer : IVaultServer, IAccountApi, ISyncApi, IKe
/// <summary>When set, the next sign-in throws — how an unreachable server is exercised.</summary>
internal Exception? SignInFailure { get; set; }
/// <summary>
/// When set, every synchronisation throws.
/// </summary>
/// <remarks>
/// A server that answers but fails, as distinct from no server at all. The two are handled quite
/// differently by a background pass: one is expected and silent, the other has to not overwrite
/// whatever the user was reading.
/// </remarks>
internal Exception? SyncFailure { get; set; }
/// <inheritdoc />
public Uri ServerUrl { get; } = new("https://dodossh.example");
@@ -122,6 +132,11 @@ internal sealed class FakeVaultServer : IVaultServer, IAccountApi, ISyncApi, IKe
SyncPullRequest request,
CancellationToken cancellationToken)
{
if (SyncFailure is { } failure)
{
return Task.FromException<SyncPullResponse>(failure);
}
var after = request.Cursor is null
? 0
: long.Parse(request.Cursor.AsSpan("app-v1:".Length), provider: null);
tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
+101 -10
View File
@@ -266,8 +266,14 @@ public sealed class ShellFlowTests : IAsyncLifetime
offline.Vault.ShouldNotBeNull();
}
/// <remarks>
/// This used to assert the opposite of its last two lines — that a save queued the change and pushed
/// nothing until Sync was pressed. Saving now pushes, so the assertion had to move rather than be
/// deleted: the local-first guarantee it was really protecting is that the list updates without a
/// server, and that is still covered by the offline test below.
/// </remarks>
[Fact]
public async Task AddingAHost_ShowsItImmediatelyAndQueuesIt()
public async Task AddingAHost_ShowsItImmediatelyAndPushesIt()
{
await UnlockedAsync();
var vault = shell.Vault!;
@@ -287,11 +293,83 @@ public sealed class ShellFlowTests : IAsyncLifetime
var row = vault.Hosts.ShouldHaveSingleItem();
row.Label.ShouldBe("prod-db");
row.Address.ShouldBe("deploy@db.internal:2222");
row.HasUnsyncedChanges.ShouldBeTrue();
row.Badge.ShouldBe("not synced");
vault.PendingChanges.ShouldBe(1);
server.LiveRowCount.ShouldBe(0, "nothing should have been pushed yet");
row.HasUnsyncedChanges.ShouldBeFalse("saving pushes, so nothing should still be pending");
row.Badge.ShouldBeEmpty();
vault.PendingChanges.ShouldBe(0);
server.LiveRowCount.ShouldBe(1, "a save should reach the server without pressing Sync");
}
[Fact]
public async Task AnAutomaticPass_SaysNothingWhenThereIsNothingToDo()
{
await UnlockedAsync();
var vault = shell.Vault!;
vault.Status = "Reading something the user cares about.";
await vault.AutoSyncAsync(Token);
vault.Status.ShouldBe(
"Reading something the user cares about.",
"a background pass with no changes must not repaint the status line");
vault.IsBusy.ShouldBeFalse("a background pass must never raise the busy flag");
}
/// <remarks>
/// The queue has to be arranged by failing the automatic push first. Written the obvious way — add a
/// host, then call the pass — this test proved nothing at all: saving pushes, so there was no pending
/// change left and the count was unchanged whether the guard existed or not. It passed with the guard
/// deleted, which is the only reason it was noticed.
/// </remarks>
[Fact]
public async Task AnAutomaticPass_YieldsWhileACommandIsRunning()
{
await UnlockedAsync();
var vault = shell.Vault!;
server.SyncFailure = new HttpRequestException("The server is having a bad day.");
await AddHostAsync(vault, "prod-db");
server.SyncFailure = null;
vault.PendingChanges.ShouldBe(1, "there must be something to push for this to mean anything");
var pushesBefore = server.PushCount;
// Standing in for a command in flight. A pass that pushed here would be competing with whatever
// the user is doing for the same session and the same cache.
vault.IsBusy = true;
await vault.AutoSyncAsync(Token);
server.PushCount.ShouldBe(pushesBefore, "the pass should have been skipped, not queued");
}
/// <remarks>
/// The behaviour a background loop lives or dies by. A pass runs every minute; one that reported a
/// transient server error would replace whatever the user was reading, once a minute, indefinitely.
/// </remarks>
[Fact]
public async Task AnAutomaticPassThatFails_LeavesTheStatusAlone()
{
await UnlockedAsync();
var vault = shell.Vault!;
await AddHostAsync(vault, "prod-db");
vault.Status = "Reading something the user cares about.";
server.SyncFailure = new HttpRequestException("The server is having a bad day.");
await vault.AutoSyncAsync(Token);
vault.Status.ShouldBe("Reading something the user cares about.");
vault.IsBusy.ShouldBeFalse();
// And pressing Sync still reports the real reason, so the failure is quiet rather than hidden.
await vault.SyncCommand.ExecuteAsync(null);
vault.Status.ShouldContain("bad day");
}
[Fact]
@@ -311,13 +389,26 @@ public sealed class ShellFlowTests : IAsyncLifetime
vault.Status.ShouldContain("needs a name");
}
/// <remarks>
/// This is what earns the right to let a background pass fail silently. The automatic push after a save
/// is best-effort; the outbox is the durable part. If a failed pass dropped the change, "quiet" would
/// mean "lost".
/// </remarks>
[Fact]
public async Task SyncingSendsTheQueueAndClearsIt()
public async Task AQueueLeftByAFailedPass_IsStillSentByTheNextSync()
{
await UnlockedAsync();
var vault = shell.Vault!;
server.SyncFailure = new HttpRequestException("The server is having a bad day.");
await AddHostAsync(vault, "prod-db");
server.LiveRowCount.ShouldBe(0, "the automatic push should have failed");
vault.PendingChanges.ShouldBe(1, "and the change should still be queued");
vault.Hosts.ShouldHaveSingleItem().HasUnsyncedChanges.ShouldBeTrue();
server.SyncFailure = null;
await vault.SyncCommand.ExecuteAsync(null);
server.LiveRowCount.ShouldBe(1);
@@ -349,22 +440,22 @@ public sealed class ShellFlowTests : IAsyncLifetime
}
[Fact]
public async Task DeletingAHostRemovesItLocallyBeforeTheServerAgrees()
public async Task DeletingAHost_RemovesItLocallyAndPushesTheTombstone()
{
await UnlockedAsync();
var vault = shell.Vault!;
await AddHostAsync(vault, "prod-db");
await vault.SyncCommand.ExecuteAsync(null);
vault.SelectedHost = vault.Hosts[0];
await vault.DeleteHostCommand.ExecuteAsync(null);
vault.Hosts.ShouldBeEmpty();
server.LiveRowCount.ShouldBe(1, "the tombstone has not been pushed yet");
await vault.SyncCommand.ExecuteAsync(null);
// Pushed without a second action. A tombstone that sat in the outbox would let the item come back
// on a machine that synced in the meantime.
server.LiveRowCount.ShouldBe(0);
vault.PendingChanges.ShouldBe(0);
}
[Fact]