Public Access
Sync and authenticate with SSH keys on the client
Completes the client half of SSH keys: they sync alongside hosts, appear in their own list, and can be selected to authenticate a connection instead of typing a password. The reconciler and the repository were Host-typed throughout, so the choice was to generalise them or to keep a second copy per item type. Generalised, because ItemReconciler's whole premise is that the pull and the push paths must answer the same collision the same way — two copies would drift the first time one of them was fixed. What is genuinely per-type now arrives through IItemKind<TSecret>: the cipher, the merge, the plaintext columns, and the noun to use when telling a person what happened to their item. Generic where the server's IItemKind is not, and for the reason that reverses there — the client needs the concrete type, because it merges field by field. The pull filter is derived from the same registry that builds the reconcilers. That is the specific failure being designed out: an item type that encrypts, merges and lists perfectly and is never once requested from the server, so it works on the machine that made it and exists nowhere else. No client cache migration. The item table's primary key and the outbox's unique index already carry the entity type, and AadResourceTypes already mapped SshKey — so a host and a key may share an id and never see each other's rows, which SshKeySyncTests now arranges deliberately. A key hands the server nothing in plaintext. There is a public_key_fingerprint column and it would be accepted; leaving it null is deliberate. A fingerprint is not secret but it is a stable identifier for a key pair, so filling it would let an operator tell which of their users hold the same key and correlate one across vaults, for a column nothing reads. The design allows itself one plaintext concession — the relay address, which the relay cannot work without — and this is not that. A key is chosen per connection rather than bound to a host, which works the way ssh -i does. Binding one needs a field on HostSecret and therefore a payload schema bump, which makes every host written afterwards read-only on an older build; worth doing deliberately rather than as a side effect of adding keys. Three things this found, all of them by being falsified rather than by review: - Making the reconciler generic silently turned a record comparison into reference equality, because == on a type parameter is not value equality. The effect would have been a conflict recorded on every pass for an unacknowledged create that had in fact landed. Sabotaging the fix left all 73 tests passing — nothing covered that branch — so ConflictMatrixTests now has AnUnacknowledgedCreateThatDidLand_IsDroppedQuietly, which fails without it. - A test asserting that a blank passphrase reaches SSH.NET as null was vacuous: it exercised the editor, not the credential path, and passed with the guard deleted. Resolved by making SshKeySecret.Passphrase normalise an empty string to null, so there is one spelling of one state — which also keeps two clients from producing different payload bytes for an identical key. That exposed a wider gap: SshKeySecret, its codec and its merge had no direct unit tests at all. They have 25 now. - The reason first given for that normalisation was false. It claimed SSH.NET rejects a passphrase supplied for an unprotected key; measured against a real sshd it ignores it and authenticates anyway. Corrected everywhere it was stated and recorded in docs/platform-flags.md. The same test file also closes a real hole: SshPrivateKeyCredential had never been exercised against a server, because the existing key test builds SSH.NET's auth method directly and bypasses the path a vault-held key actually takes. Only one editor may be open at a time. Both sit in the same 340-pixel column as Auto rows and their heights together exceed it at the window's minimum size, so two open editors put the lower one's Save and Cancel past the bottom edge — the same failure this window already shipped once with the setup screens. Expressed as a state rule because that is the only form of it this repository can check: nothing here loads a .axaml. The refusal keeps what was typed, since in the key editor that is a pasted private key the user may have nowhere else. The end-to-end slice now carries a key as well as a host, so both item types go through the real API, the real PostgreSQL and the real crypto in one pass — the three hand-kept mappings between enums that do not line up are the reason that is worth doing rather than trusting the unit suites. 735 tests green, including the container-backed SSH and end-to-end suites. Zero warnings, dotnet format clean.
This commit is contained in:
@@ -0,0 +1,317 @@
|
||||
using DodoSSH.Client.Domain;
|
||||
using DodoSSH.Client.Storage;
|
||||
using DodoSSH.Contracts;
|
||||
|
||||
namespace DodoSSH.Client.Sync;
|
||||
|
||||
/// <summary>One vault item as the interface should show it.</summary>
|
||||
/// <param name="EntityId">The item id.</param>
|
||||
/// <param name="Secret">The decrypted item.</param>
|
||||
/// <param name="Version">
|
||||
/// The server version this is based on. Zero for an item that has never been accepted.
|
||||
/// </param>
|
||||
/// <param name="HasUnsyncedChanges">
|
||||
/// Whether this reflects a local edit the server has not accepted yet. Worth showing: it is the
|
||||
/// difference between "saved" and "saved here".
|
||||
/// </param>
|
||||
/// <param name="IsBlocked">
|
||||
/// Whether the pending change was refused and is waiting on a person, so it will not retry on its own.
|
||||
/// </param>
|
||||
/// <param name="IsReadOnly">
|
||||
/// Whether this item was written by a newer client and so must not be edited here, because re-encoding
|
||||
/// it would drop fields this build cannot represent.
|
||||
/// </param>
|
||||
public sealed record VaultItem<TSecret>(
|
||||
Guid EntityId,
|
||||
TSecret Secret,
|
||||
int Version,
|
||||
bool HasUnsyncedChanges,
|
||||
bool IsBlocked,
|
||||
bool IsReadOnly)
|
||||
where TSecret : class, IVaultSecret;
|
||||
|
||||
/// <summary>The items of one kind in a vault, and what could not be read.</summary>
|
||||
/// <param name="Items">The readable items.</param>
|
||||
/// <param name="Unreadable">
|
||||
/// How many items would not decrypt. Surfaced rather than swallowed: a non-zero count here after a
|
||||
/// rekey is the signal that new grants are needed.
|
||||
/// </param>
|
||||
public sealed record ItemListing<TSecret>(IReadOnlyList<VaultItem<TSecret>> Items, int Unreadable)
|
||||
where TSecret : class, IVaultSecret;
|
||||
|
||||
/// <summary>
|
||||
/// Reading and writing one kind of vault item, as the interface sees them.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The view is the mirror of the server's state with the outbox laid over it, which is what makes the
|
||||
/// application feel local: an edit appears immediately and a delete disappears immediately, whether or
|
||||
/// not the network is there. Nothing here talks to the server; the sync engine reconciles later.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Writes never touch the mirror. That separation is load-bearing — the mirror is the common ancestor a
|
||||
/// three-way merge needs, and a repository that updated it on save would destroy the very state that
|
||||
/// lets a conflict be merged instead of arbitrated.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Every read and write is scoped to <see cref="IItemKind{TSecret}.EntityType"/>, which is also what
|
||||
/// keeps two kinds apart in storage: the item table is keyed on the type as well as the id, so a host and
|
||||
/// a key could share an id and never see each other's rows.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
internal sealed class VaultItemRepository<TSecret>(
|
||||
IItemKind<TSecret> kind,
|
||||
ItemStore items,
|
||||
OutboxStore outbox,
|
||||
VaultKeyring keyring)
|
||||
where TSecret : class, IVaultSecret
|
||||
{
|
||||
/// <summary>Reads every item of this kind the user should see in a vault.</summary>
|
||||
internal async Task<ItemListing<TSecret>> ListAsync(
|
||||
Guid vaultId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
if (!keyring.TryGet(vaultId, out var vaultKey, out _))
|
||||
{
|
||||
throw new VaultUnreadableException(vaultId);
|
||||
}
|
||||
|
||||
var mirrored = await items
|
||||
.ListAsync(vaultId, kind.EntityType, includeDeleted: true, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var pending = await outbox.ListAllAsync(vaultId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
var pendingByEntity = pending
|
||||
.Where(operation => operation.EntityType == kind.EntityType)
|
||||
.ToDictionary(operation => operation.EntityId);
|
||||
|
||||
var listed = new List<VaultItem<TSecret>>();
|
||||
var unreadable = 0;
|
||||
|
||||
foreach (var item in mirrored)
|
||||
{
|
||||
if (pendingByEntity.Remove(item.EntityId, out var local))
|
||||
{
|
||||
AddPending(listed, ref unreadable, vaultKey, local);
|
||||
continue;
|
||||
}
|
||||
|
||||
if (item.IsDeleted || item.Payload is null)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
var opened = kind.TryOpen(item.Payload, vaultKey.Span, item.EntityId, item.Version);
|
||||
|
||||
if (opened is null)
|
||||
{
|
||||
unreadable++;
|
||||
continue;
|
||||
}
|
||||
|
||||
listed.Add(new VaultItem<TSecret>(
|
||||
item.EntityId, opened.Secret, item.Version, false, false, opened.IsReadOnly));
|
||||
}
|
||||
|
||||
// Whatever is left has no mirror row yet: items created here and not yet accepted.
|
||||
foreach (var local in pendingByEntity.Values)
|
||||
{
|
||||
AddPending(listed, ref unreadable, vaultKey, local);
|
||||
}
|
||||
|
||||
return new ItemListing<TSecret>(listed, unreadable);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Adds an item, returning the id it was given.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The id is generated here, not by the server, which is what lets an item be created with no network
|
||||
/// at all — the point of the whole outbox. UUIDv7 so that ids sort by creation time, which keeps
|
||||
/// index locality reasonable on the server side.
|
||||
/// </remarks>
|
||||
internal async Task<Guid> CreateAsync(
|
||||
Guid vaultId,
|
||||
TSecret secret,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(secret);
|
||||
Validate(secret);
|
||||
|
||||
var (vaultKey, generation) = Key(vaultId);
|
||||
var entityId = Guid.CreateVersion7();
|
||||
|
||||
await outbox.QueueAsync(
|
||||
new QueuedChange(
|
||||
vaultId,
|
||||
kind.EntityType,
|
||||
entityId,
|
||||
SyncOperation.Upsert,
|
||||
ExpectedVersion: null,
|
||||
kind.Seal(secret, vaultKey.Span, entityId, generation, itemVersion: 1),
|
||||
kind.Fields(secret),
|
||||
Ancestor: null),
|
||||
cancellationToken).ConfigureAwait(false);
|
||||
|
||||
return entityId;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Replaces an item's contents.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The base is taken from the pending operation when there is one, and from the mirror otherwise.
|
||||
/// Reading it the other way round would seal the payload at a version that does not match the
|
||||
/// <c>expectedVersion</c> the coalesced row keeps — and because the AAD binds the item version, the
|
||||
/// result would encrypt cleanly and never decrypt again.
|
||||
/// </remarks>
|
||||
internal async Task UpdateAsync(
|
||||
Guid vaultId,
|
||||
Guid entityId,
|
||||
TSecret secret,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(secret);
|
||||
Validate(secret);
|
||||
|
||||
var (vaultKey, generation) = Key(vaultId);
|
||||
|
||||
var pending = await outbox
|
||||
.FindAsync(vaultId, kind.EntityType, entityId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var expectedVersion = pending is not null
|
||||
? pending.ExpectedVersion
|
||||
: await MirrorVersionAsync(vaultId, entityId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
var ancestor = pending?.Ancestor
|
||||
?? await MirrorAncestorAsync(vaultId, entityId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
await outbox.QueueAsync(
|
||||
new QueuedChange(
|
||||
vaultId,
|
||||
kind.EntityType,
|
||||
entityId,
|
||||
SyncOperation.Upsert,
|
||||
expectedVersion,
|
||||
kind.Seal(
|
||||
secret,
|
||||
vaultKey.Span,
|
||||
entityId,
|
||||
generation,
|
||||
SyncVersions.NextVersion(expectedVersion)),
|
||||
kind.Fields(secret),
|
||||
ancestor),
|
||||
cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Deletes an item.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Queued as a tombstone, never a local removal. An offline client that simply forgot the row would
|
||||
/// be unable to tell the server anything, and the item would come back on the next pull.
|
||||
/// </remarks>
|
||||
internal async Task DeleteAsync(Guid vaultId, Guid entityId, CancellationToken cancellationToken)
|
||||
{
|
||||
var pending = await outbox
|
||||
.FindAsync(vaultId, kind.EntityType, entityId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var expectedVersion = pending is not null
|
||||
? pending.ExpectedVersion
|
||||
: await MirrorVersionAsync(vaultId, entityId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
var ancestor = pending?.Ancestor
|
||||
?? await MirrorAncestorAsync(vaultId, entityId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
await outbox.QueueAsync(
|
||||
new QueuedChange(
|
||||
vaultId,
|
||||
kind.EntityType,
|
||||
entityId,
|
||||
SyncOperation.Delete,
|
||||
expectedVersion,
|
||||
Payload: null,
|
||||
Fields: null,
|
||||
ancestor),
|
||||
cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
|
||||
private static void Validate(TSecret secret)
|
||||
{
|
||||
if (!secret.TryValidate(out var error))
|
||||
{
|
||||
throw new ArgumentException(error, nameof(secret));
|
||||
}
|
||||
}
|
||||
|
||||
private void AddPending(
|
||||
List<VaultItem<TSecret>> listed,
|
||||
ref int unreadable,
|
||||
ReadOnlyMemory<byte> vaultKey,
|
||||
PendingOperation local)
|
||||
{
|
||||
if (local.Operation == SyncOperation.Delete)
|
||||
{
|
||||
// Gone as far as this machine is concerned, even before the server agrees.
|
||||
return;
|
||||
}
|
||||
|
||||
if (local.Payload is null)
|
||||
{
|
||||
unreadable++;
|
||||
return;
|
||||
}
|
||||
|
||||
var version = SyncVersions.NextVersion(local.ExpectedVersion);
|
||||
var opened = kind.TryOpen(local.Payload, vaultKey.Span, local.EntityId, version);
|
||||
|
||||
if (opened is null)
|
||||
{
|
||||
unreadable++;
|
||||
return;
|
||||
}
|
||||
|
||||
listed.Add(new VaultItem<TSecret>(
|
||||
local.EntityId,
|
||||
opened.Secret,
|
||||
local.ExpectedVersion ?? 0,
|
||||
HasUnsyncedChanges: true,
|
||||
local.IsParked,
|
||||
opened.IsReadOnly));
|
||||
}
|
||||
|
||||
private (ReadOnlyMemory<byte> VaultKey, uint Generation) Key(Guid vaultId) =>
|
||||
keyring.TryGet(vaultId, out var vaultKey, out var generation)
|
||||
? (vaultKey, generation)
|
||||
: throw new VaultUnreadableException(vaultId);
|
||||
|
||||
private async Task<int?> MirrorVersionAsync(
|
||||
Guid vaultId,
|
||||
Guid entityId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var item = await items
|
||||
.FindAsync(vaultId, kind.EntityType, entityId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
// A null means the server has never seen this item, which is exactly what "create" is.
|
||||
return item?.Version;
|
||||
}
|
||||
|
||||
private async Task<StoredAncestor?> MirrorAncestorAsync(
|
||||
Guid vaultId,
|
||||
Guid entityId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var item = await items
|
||||
.FindAsync(vaultId, kind.EntityType, entityId, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return item?.Payload is null
|
||||
? null
|
||||
: new StoredAncestor(item.Version, item.Payload, item.Fields);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user