Let a shared vault arrive, a bucket be found, and a vault be deleted

Three things a user reported, one of which was a real bug and one of which was
not the bug it looked like.

**A vault shared with somebody never reached their machine.** The grant was
correct at both ends: the sharing client verified the recipient's key against the
key log and wrapped every generation to it, the server stored it, and /me would
have returned it. Nothing asked. VaultSession.RefreshVaultsAsync — the method
whose own summary says it is "called after a share and on a periodic pass" — had
no caller anywhere in the application, so the vault list was whatever the last
browser sign-in cached. A restart did not help: an offline unlock reads that same
cache. The vault appeared only if the recipient happened to sign in through the
browser again, which is why this looked like sharing being broken rather than
like a list that was never re-read.

So every synchronisation pass now re-reads it, before it syncs. SyncOnceAsync
takes the whole server rather than its sync half for that reason, and the order
matters: a vault admitted by the refresh is one that same pass then pulls, where
the other order would show a newly shared vault as an empty one until the minute
after. The shell is told only when the set actually changed — it rebuilds the tab
strip's vault menu from the session's list, and doing that on every quiet pass
would rebuild a menu once a minute for nothing.

The test needed the fake server to be able to do something no test here had
needed before: hand this account a vault it did not make. ShareVaultWithMe wraps
a real key to the encryption key this account enrolled, so the keyring opens it
exactly as it opens a real colleague's — a helper that filled the field with
bytes would let a vault appear in the list and never prove it could be read.

**Adding an S3 bucket on the desktop works, and could not be found.** The report
was that it is not possible; driving the real XAML headlessly says otherwise —
Keychain, + BUCKET, and the editor saves. What is true is that S3 is where
somebody goes looking, and from there SELECT BUCKET opened a combo box with
nothing in it and no sentence anywhere saying that a bucket is a keychain item.
From where the user was standing that is indistinguishable from an application
with no way to add one.

The empty state now says what a bucket is and offers a button that lands on the
keychain with the editor already open — navigating to the screen and leaving
+ BUCKET to be found among five buttons would be most of the same problem. The
phone gets the sentence and no button: its keychain screen reads and deletes and
edits nothing, so there is no editor to send anybody to, and naming the machine
that has one beats an empty control that reads as a screen still loading.

The keychain screen's layout test grew the two categories it never covered.
Tags and buckets arrived after it was written, and the header strip it measures
is one that has overflowed twice before.

**A vault can now be deleted.** DELETE /api/v1/vaults/{id}, gated on Admin —
the line the rename already drew, for a stronger version of its reason, since
this takes the vault from everybody in it at once. The row is soft-deleted and
every grant to it withdrawn in one write; VaultAccessService filters on the stamp
at both ends, so from that moment the vault is absent from every member's /me and
every call naming it answers 404. Their clients notice on the pass described
above.

The team behind it is archived when it owned nothing else, which is the mirror of
renaming it: a vault made from the vaults screen gets a team named after it that
nobody was ever shown, and leaving that behind would leave a membership list no
screen has a row for. That is a second call rather than one transaction —
archiving is TeamService's, it refuses while a team owns vaults, and it can only
tell that this one no longer does once the deletion is committed. A crash between
the two leaves an empty team: invisible, archivable afterwards, harmless, and a
better failure than a vault that could not be deleted because tidying up after it
did not work.

Two refusals worth stating. The personal vault cannot be deleted at either end:
it is created by enrollment, everything filed nowhere else lives in it, and no
call would make another. And the items are kept — ciphertext behind a vault
nothing will resolve, so deleting them buys no confidentiality while destroying
what an operator undoing a mistake would need.

The client drops the key from the keyring and the row from the cache rather than
waiting for a refresh, so the list is right immediately; the items stay, as they
stay for a vault whose grant was withdrawn, because a copy is on every other
member's machine too and removing these rows would be the client pretending to a
reach it does not have. The confirmation says that out loud before it is
answered. It is the one sentence this screen must not leave implied: deletion is
no more retroactive than revocation is. See ADR 0001.

Desktop only, deliberately. The Android vaults screen offers no rename and no
hand-over either, so adding delete alone there would be the one destructive vault
operation on a screen with no other.

Three places asserted that a vault can never be deleted — TeamService's refusal
message, the TeamNotEmpty problem code, and ADR 0009 — and each now names the
route instead.

tests/DodoSSH.Client.App.Tests/FakeVaultServer.Teams.cs

@@ -156,6 +156,89 @@ internal sealed partial class FakeVaultServer : ITeamApi, IDirectoryApi, IVaultG
         return userId;
     }
 
+    /// <summary>
+    /// Puts a vault somebody else made, and shared with this account, on the server.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The other half of sharing, which no test can otherwise reach: every vault in this suite is one
+    /// this client made, and a vault this client made is one it already holds the key to. What arrives
+    /// on the machine somebody shared <em>with</em> is different — a vault that appears in <c>/me</c>
+    /// out of nowhere, with a key wrapped to this account by a client this one never spoke to.
+    /// </para>
+    /// <para>
+    /// The wrap is real, made against the encryption key this account enrolled, so the keyring opens it
+    /// exactly as it opens one from a real colleague. A helper that filled the field with bytes would
+    /// let a vault appear in the list and never prove it could be read.
+    /// </para>
+    /// </remarks>
+    /// <param name="name">What the vault is called.</param>
+    /// <param name="sharedBy">The account that made it, from <see cref="AddAccount"/>.</param>
+    /// <returns>The vault's id.</returns>
+    internal Guid ShareVaultWithMe(string name, Guid sharedBy)
+    {
+        if (statement is not { } enrolled)
+        {
+            throw new InvalidOperationException(
+                "Nothing can be wrapped to this account until it has enrolled a key.");
+        }
+
+        var teamId = Guid.CreateVersion7();
+        var vaultId = Guid.CreateVersion7();
+        var vaultKey = VaultKeys.Create();
+
+        var wrapped = VaultKeys.WrapTo(vaultKey, enrolled.EncryptionPublicKey, vaultId, 1);
+
+        teams.Add(new TeamSummary(
+            teamId,
+            name,
+            name.ToLowerInvariant().Replace(' ', '-'),
+            Description: null,
+
+            // A member rather than an owner: somebody else made this and this account was added to it,
+            // which is what decides whether the screen offers to rename or remove it.
+            TeamMemberRole.Member,
+            MemberCount: 2,
+            VaultCount: 1,
+            DateTimeOffset.UnixEpoch));
+
+        var sharer = accounts.Find(account => account.UserId == sharedBy);
+
+        members[teamId] =
+        [
+            Member(sharedBy, sharer.Email, sharer.DisplayName, TeamMemberRole.Owner),
+            Member(UserId, "alice@example.com", "Alice Example", TeamMemberRole.Member),
+        ];
+
+        teamVaults[vaultId] = new VaultSummary(
+            vaultId,
+            name,
+            IsPersonal: false,
+            TeamId: teamId,
+            KeyGeneration: 1,
+            Permissions: 31,
+            wrapped,
+            RekeyRequired: false);
+
+        return vaultId;
+    }
+
+    /// <summary>One active, enrolled member, which is the only kind this helper makes.</summary>
+    private static TeamMemberSummary Member(
+        Guid userId,
+        string email,
+        string displayName,
+        TeamMemberRole role) =>
+        new(
+            userId,
+            email,
+            displayName,
+            role,
+            TeamMemberStatus.Active,
+            IsEnrolled: true,
+            DateTimeOffset.UnixEpoch,
+            DateTimeOffset.UnixEpoch);
+
     /// <inheritdoc />
     public Task<IReadOnlyList<TeamSummary>> ListTeamsAsync(CancellationToken cancellationToken) =>
         Task.FromResult<IReadOnlyList<TeamSummary>>([.. teams]);
@@ -583,6 +666,43 @@ internal sealed partial class FakeVaultServer : ITeamApi, IDirectoryApi, IVaultG
         return Task.FromResult(renamed);
     }
 
+    /// <inheritdoc />
+    /// <remarks>
+    /// Every grant to the vault goes with it, as the real service withdraws them in the same write, and the
+    /// team behind it is archived when it owns nothing else — the second half of what the endpoint does.
+    /// A fake that kept either would let a test assert a deletion that had left the vault readable, or
+    /// leave the vaults screen listing a membership list with no vault under it.
+    /// </remarks>
+    public Task<bool> DeleteVaultAsync(Guid vaultId, CancellationToken cancellationToken)
+    {
+        if (personalVault is { } personal && personal.VaultId == vaultId)
+        {
+            throw new DodoSshApiException(
+                System.Net.HttpStatusCode.BadRequest,
+                ProblemCodes.InvalidVaultGrant,
+                "A personal vault cannot be deleted.");
+        }
+
+        if (!teamVaults.Remove(vaultId, out var vault))
+        {
+            return Task.FromResult(false);
+        }
+
+        foreach (var key in grants.Keys.Where(key => key.VaultId == vaultId).ToList())
+        {
+            grants.Remove(key);
+        }
+
+        if (vault.TeamId is { } teamId && !teamVaults.Values.Any(other => other.TeamId == teamId))
+        {
+            teams.RemoveAll(team => team.TeamId == teamId);
+            members.Remove(teamId);
+            invitations.Remove(teamId);
+        }
+
+        return Task.FromResult(true);
+    }
+
     /// <inheritdoc />
     public Task<IReadOnlyList<DirectoryEntry>> LookupByEmailAsync(
         string email,

tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs

@@ -5586,6 +5586,50 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.Transfers.IsChoosingRemote.ShouldBeFalse("a form offering a choice between nothing");
     }
 
+    /// <remarks>
+    /// <para>
+    /// The S3 screen with nothing in the keychain, which is where every new account starts and which used to
+    /// be a dead end: SELECT BUCKET opened a combo box with nothing in it, and nothing anywhere said that a
+    /// bucket is made on the keychain screen. Somebody standing here had arrived at the place a bucket is
+    /// used and been shown no route to the place one is created — which is indistinguishable from an
+    /// application that cannot add one at all.
+    /// </para>
+    /// <para>
+    /// The assertion that matters is the last pair: pressing the button lands on the keychain <em>with the
+    /// editor already open</em>. Navigating to the screen and leaving the user to find + BUCKET among five
+    /// buttons would be most of the same problem.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task TheS3ScreenWithNoBuckets_SaysWhereOneIsMadeAndGoesThere()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        shell.Transfers.Attach(vault, knownHosts);
+        shell.ShowFilesCommand.Execute(RemoteKind.Bucket);
+
+        shell.Transfers.ShowsNoBuckets.ShouldBeTrue("nothing has been added to the keychain");
+        shell.Transfers.ShowsBucketChoice.ShouldBeFalse("there is nothing to choose between");
+
+        shell.Transfers.AddBucketCommand.Execute(null);
+
+        shell.Screen.ShouldBe(ShellScreen.Keychain);
+        vault.IsEditingObjectStore.ShouldBeTrue("the route has to land on the editor, not near it");
+
+        vault.BucketEditorLabel = "Backups";
+        vault.BucketEditorBucket = "backups";
+        vault.BucketEditorAccessKeyId = "AKIAEXAMPLE";
+        vault.BucketEditorSecretAccessKey = "a-secret-access-key";
+        vault.BucketEditorRegion = "eu-west-1";
+
+        await vault.SaveObjectStoreCommand.ExecuteAsync(null);
+
+        shell.ShowFilesCommand.Execute(RemoteKind.Bucket);
+
+        shell.Transfers.ShowsNoBuckets.ShouldBeFalse(vault.Status);
+        shell.Transfers.ShowsBucketChoice.ShouldBeTrue("the bucket that was just made is the one to open");
+    }
+
     private async Task UnlockedAsync()
     {
         await EnrolledAndConfirmedAsync();

tests/DodoSSH.Client.App.Tests/VaultSharingTests.cs

@@ -345,6 +345,124 @@ public sealed class VaultSharingTests : IAsyncLifetime
         vaults.Members.ShouldHaveSingleItem().Role.ShouldBe("OWNER");
     }
 
+    /// <remarks>
+    /// <para>
+    /// Sharing from the receiving end, which is the half that has to happen on somebody else's machine and
+    /// the half that was missing. A vault wrapped to this account appears in <c>/me</c> and nowhere else —
+    /// there is no push channel — so a client that never re-read that list showed nothing, indefinitely,
+    /// while the server and the grant were both perfectly correct.
+    /// </para>
+    /// <para>
+    /// Readable rather than merely listed, because those are two different failures with the same symptom:
+    /// a row that cannot be opened is a vault whose key never arrived, and this asserts the wrap was taken
+    /// into the keyring. The switch is asserted too — it is built by the shell rather than by the vault, so
+    /// it is the one thing a pass could admit a vault without redrawing.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task AVaultSomebodyElseShared_ArrivesOnTheNextSynchronisation()
+    {
+        await UnlockedAsync();
+
+        var colleague = server.AddAccount("bob@example.com", "Bob Example");
+        var vaultId = server.ShareVaultWithMe("Platform secrets", colleague);
+
+        var vault = shell.Vault.ShouldNotBeNull();
+
+        await vault.SyncCommand.ExecuteAsync(null);
+
+        vault.Session.ReadableVaults.ShouldContain(
+            row => row.VaultId == vaultId,
+            "a vault shared with this account arrives on a synchronisation pass, with its key");
+
+        shell.VaultToggles.ShouldContain(
+            toggle => toggle.VaultId == vaultId,
+            "the tab strip's vault menu is built by the shell and has to be told");
+
+        await shell.Vaults.LoadAsync(Token);
+
+        var row = shell.Vaults.Vaults.Single(vault => vault.VaultId == vaultId);
+
+        row.IsReadable.ShouldBeTrue(shell.Vaults.Status);
+        row.IsOwned.ShouldBeFalse("somebody else made this one");
+    }
+
+    /// <remarks>
+    /// <para>
+    /// Deleting a shared vault, which is an admin's operation and the only one on this screen that cannot
+    /// be undone. It has to take three things with it: the vault, everybody's key to it — including the
+    /// people it was shared with — and this machine's own copy of the row, so the list is right before the
+    /// next refresh rather than after it.
+    /// </para>
+    /// <para>
+    /// The status line is asserted for what it says about the limit rather than for its wording. A message
+    /// implying that deletion reaches a colleague's laptop would be the one dishonest sentence this screen
+    /// could print; see ADR 0001.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task DeletingAVault_TakesItAndEverybodysKeyToIt()
+    {
+        await UnlockedAsync();
+
+        var vaults = shell.Vaults;
+        var colleague = server.AddAccount("bob@example.com", "Bob Example");
+
+        await CreateVaultAsync(vaults, "Platform secrets");
+
+        var vaultId = vaults.SelectedVault!.VaultId;
+
+        vaults.InviteEmail = "bob@example.com";
+        await vaults.AddMemberCommand.ExecuteAsync(null);
+
+        server.IssuedGrants.ShouldContainKey((vaultId, colleague));
+
+        vaults.CanDeleteSelected.ShouldBeTrue("an admin may delete a shared vault");
+
+        vaults.DeleteVaultCommand.Execute(null);
+
+        var question = vaults.PendingAction.ShouldNotBeNull("deletion is never carried out unasked");
+
+        question.Consequence.ShouldContain(
+            "already synced", Case.Insensitive, "the one limit this must not leave implied");
+
+        await vaults.ConfirmActionCommand.ExecuteAsync(null);
+
+        vaults.Vaults.ShouldNotContain(row => row.VaultId == vaultId, vaults.Status);
+        server.IssuedGrants.ShouldNotContainKey((vaultId, colleague));
+
+        shell.Vault!.Session.Vaults.ShouldNotContain(
+            row => row.VaultId == vaultId,
+            "the machine that deleted it does not wait for a refresh to stop listing it");
+
+        shell.VaultToggles.ShouldNotContain(toggle => toggle.VaultId == vaultId);
+    }
+
+    /// <remarks>
+    /// The one vault deletion cannot reach, refused by the screen rather than by the server: everything
+    /// filed nowhere else lives in it and nothing can make another, so the button is not offered and the
+    /// command says why if something reaches it anyway.
+    /// </remarks>
+    [Fact]
+    public async Task ThePersonalVault_CannotBeDeleted()
+    {
+        await UnlockedAsync();
+
+        var vaults = shell.Vaults;
+
+        await vaults.LoadAsync(Token);
+
+        vaults.SelectedVault = vaults.Vaults.Single(vault => vault.IsPersonal);
+
+        vaults.CanDeleteSelected.ShouldBeFalse();
+
+        vaults.DeleteVaultCommand.Execute(null);
+
+        vaults.PendingAction.ShouldBeNull("nothing was armed");
+        vaults.Status.ShouldContain("cannot be deleted");
+        vaults.Vaults.ShouldContain(vault => vault.IsPersonal);
+    }
+
     /// <remarks>
     /// The personal vault is in the list, is marked as the one thing it is, and offers nothing to share:
     /// the server refuses a grant on one outright, so a screen that let somebody try would be sending them