Files
DodoSSH/tests/DodoSSH.Client.App.Tests/TransferQueueingTests.cs
jaap-jan cfc2e3ae0c
ci / build and test (push) Successful in 3m22s
ci / android head (push) Successful in 3m33s
ci / desktop nightly (push) Successful in 1m26s
ci / api image (push) Successful in 24s
Notice when a file session stops, and give the file browser the four things it was short of
The commit before this one taught a terminal to notice its machine going away.
The file browser had the same defect and three of the same symptoms, and it is
also the screen people leave soonest — so the disconnect work and four things it
was missing arrive together, because they are the same complaint: this screen
knows less about the host than the host does.

◆ THE DISCONNECT HALF, WHICH IS THE OTHER SURFACE OF THE LAST COMMIT.

IsConnected was set at connect and cleared only by the DISCONNECT button. A host
that went away therefore left this screen saying CONNECTED over a session that
was gone, and every action after it failing with the same server message and
nothing saying why they all did.

IRemoteFileStore now carries a latched TransportFailure and a ConnectionLost
event. The latch is the shell's own — read ISshShellSession.TransportFailure for
the argument, which is unchanged. The event is not, and it is the part this
surface needs: a file browser is idle between operations, so without something
raised at the moment the transport fails, nobody finds out until they click. A
bucket implements both and raises neither, which is honest rather than a gap:
S3 is request-per-operation with no connection to lose.

  - THE LISTING STAYS ON SCREEN, and that is the half that makes the rest worth
    having. SftpEntry is a record of what the server said rather than a handle,
    so the pane can go on showing where the user was — which is what RECONNECT
    is offering to put them back into. That needed a new ShowsRemoteContents on
    both heads: every "is there anything here" binding read IsConnected, which
    was right while the only way to stop being connected was to press a button
    that empties the pane, and wrong the moment a session could be lost.

  - RECONNECT re-dials through the ordinary connect path — same host key gate,
    same refusals, same log entry — and then walks back to the directory the
    pane was showing. The path is read off RemotePath rather than captured,
    because the pane already keeps it up to date and a copy is a second thing to
    get wrong. A host wanting a typed password is asked for one rather than
    dialled with an empty box.

  - SessionEndedBar is now one control on both surfaces, with the shell
    resolving which it is drawn over: a terminal has two endings to tell apart
    and a keychain entry to check, a file session has one ending and already
    captured what it would dial. The phone's Files screen has its own copy,
    bound to TransfersViewModel directly, because its DataContext is that rather
    than the shell.

◆ PERMISSIONS: THE PERMS COLUMN STOPS BEING READ-ONLY.

It has been a true fact about a file with nothing to be done about it since it
arrived, and the commonest next act after using this screen was opening a
terminal — a whole second authenticated connection — to chmod what had just been
uploaded.

Nine checkboxes rather than a box to type 755 into, because the mode is already
drawn as -rwxr-xr-x in the column the form was opened from: a who-can-do-what
grid is the same representation the reader is holding, where an octal field asks
them to translate something they can see into something they cannot check. The
octal is printed underneath as it changes, so the two readings check each other.
The EXEC column is headed "enter" over a directory, which is what that bit means
there and the commonest misreading of a POSIX mode. The listing is re-read after
APPLY, because a umask, an ACL or a filesystem mounted without permissions can
all land somewhere other than what was asked for.

Beside it, mode and mtime carried across a transfer — which is what makes an
uploaded deploy.sh arrive executable instead of with the server's umask on it.
THE MODE IS ONLY SENT FROM A PLATFORM THAT HAS ONE. A file on Windows has no
POSIX mode; this screen already says so by leaving the local pane's PERMS column
empty rather than filling it with a plausible -rw-r--r--, and inventing 0644, or
0755 for anything called .sh, would be this client deciding a fact about
somebody's file that nothing on the machine it came from ever said. The
timestamp goes either way, because every platform has one. A store with neither
refuses in its own words and is never asked.

◆ MULTI-SELECT: A TICK IS NOT THE LIST'S SELECTION.

The two answer different questions and the split is the whole design. The
selection is "the row I am looking at", which rename, move and permissions act
on — each takes a form naming one path and is one-at-a-time by construction. The
tick is "the rows I have gathered up", which download, upload and delete take,
and it survives the highlight moving.

With nothing ticked the batch falls back to the selection, which is what keeps
the commonest use of this screen from growing a step — the usual way a
multi-select makes a tool worse. Ticks are released once a set is queued, or a
second press sends everything again.

Deleting several names every path rather than a count, because agreeing to "3
items" is agreeing to a number, and this is the one act on this screen that
nothing walks back. Each goes on its own and a refusal does not stop the rest:
the host turns down a directory that still has something in it, and in a set of
five that must not silently cancel the four it would have removed — nor hide
which ones it did not.

A drawn checkbox rather than ctrl-click, and not for taste: the phone shares
this view model and has neither ctrl nor shift, so a multi-selection has to be a
tap target there whatever the desktop does. One shape on both heads, and a state
somebody can see.

◆ RECURSIVE FOLDERS: THE TREE BECOMES FILES BEFORE THE QUEUE SEES IT.

A directory used to be counted and skipped. It is now walked, and the queue
still knows nothing about trees — which is what keeps every property it has:
each file resumable on its own, each written to a part file and renamed into
place, none able to overwrite anything already there.

The plan is collected whole and then queued, because directories have to exist
before the files that go in them and shortest-first is the only order that
guarantees a parent before its child. It also means a walk refused halfway has
queued nothing yet, so the sentence it produces describes one outcome rather
than an outcome and a queue that half happened.

Links are counted, not followed, in both directions. One pointing at an ancestor
is a walk with no end, and on the remote side there is a second reason: an lstat
listing says a name is a link and not what it leads to, so descending would be a
round trip per entry to find out. Locally that is AttributesToSkip on the one
enumeration that decides what to descend into. A 5000-file ceiling is a backstop
for the accidental drag of a home directory, and it says so rather than
truncating quietly.

The status line grew four more ways to be partly what was asked for, and states
each: gone, refused, left alone, not a file.

◆ EDITING IN PLACE: FETCH, OPEN, WATCH, PUSH BACK.

The round trip this replaces is download, find it, open it, edit, come back,
delete the old one because nothing here overwrites, upload, check the mode
survived.

DELIBERATELY NOT THROUGH THE TRANSFER QUEUE, in either direction. The queue
refuses to overwrite, which is the right rule for a file somebody dragged and
exactly the wrong one for a file they are editing, where replacing the original
is the entire intent. The write-back deletes first: OpenWriteAsync at offset
zero writes over the beginning and leaves any tail that is longer — its own
contract says so — which for a config that got shorter means a file ending in
the back half of its previous version. Deleting is the only truncation this
interface offers, and the mode goes back on afterwards because deleting took it.

A stat before every save, compared against what the server said when the copy
was taken, catches somebody else writing while the file is open — which is how a
config gets silently reverted. There is no merge and no button pretending
otherwise; the three answers offered are the three that exist. Length and
timestamp rather than a digest, because a digest is a second full read of a file
there is otherwise no reason to fetch.

Both platform halves are injected: what opens a .conf is a registry
association, a desktop entry or a Launch Services binding depending on the
desktop, and watching a file is a platform object with its own thread. The
watcher watches the directory and filters the name, because a great many editors
write a temporary file and rename it over the top — which to a watcher pointed
at an inode is the file disappearing. The phone gets neither delegate, so the
button is not live there rather than there and disappointing.

◆ TWO THINGS FOUND ON THE WAY, BOTH WORTH STATING.

The shell suite's inline `post` was not serialising the way a dispatcher does.
Routing TransfersViewModel through it exposed a check-then-add in
OnTransferChanged that two threads turn into two rows for one transfer. Harmless
in production, where the UI thread serialises — the fixture was under-specifying
what it stood in for, and now posts under a lock.

And the edit session replaced its own record with `with` on each save, which
left the watcher holding an instance that was no longer the current one: every
save after the first quietly did nothing. The stamp moves in place now, and the
test saves twice.

◆ WHAT IS VERIFIED.

901 across the five suites this touches, 19 of them new. The layout suite earned
its keep three times over: the batch deletion card's path list overflowed the
204-pixel pane at 120, at 72 and at 56 before 32 held, and the edit strip
overflowed by 131 until the whole strip — rather than the log inside it — was
bounded. Each number in those files is measured and says which failure it came
from, because the next person to add a line to either card will move them again.

What no suite covers is the platform halves of editing: Process.Start with
UseShellExecute and a live FileSystemWatcher are the operating system, and a test
waiting on one would be measuring it. The shell's own half — when a save is
written back, when it is refused, what stopping releases — is covered against a
watcher that fires on demand.
2026-08-24 11:48:23 +02:00

342 lines
13 KiB
C#

using System.Collections.Concurrent;
using DodoSSH.Client.Shell.ViewModels;
using DodoSSH.Client.Ssh;
using DodoSSH.Client.Transfer;
using NSubstitute;
namespace DodoSSH.Client.App.Tests;
/// <summary>
/// What may be queued for transfer, and what is said about the rest.
/// </summary>
/// <remarks>
/// <para>
/// This is the whole of what drag and drop decides. The handlers on the screen extract paths or rows from a
/// drop and hand them here; every rule about which of them can be moved, which are skipped and what the
/// status line says lives in the view model, where it needs no window.
/// </para>
/// <para>
/// <b>What these cannot cover is the drag itself.</b> Headless Avalonia has no native window and cannot
/// synthesise a platform drag, so a test that pretended to drop a file from the file manager would pass
/// while confirming nothing. The wiring is verified by hand — see <c>docs/manual-checks.md</c> — and what
/// is automated is the half that a person checking by eye would most easily get wrong: the counting.
/// </para>
/// </remarks>
public sealed class TransferQueueingTests : IDisposable
{
private readonly string directory =
Path.Combine(Path.GetTempPath(), $"dodossh-drop-{Guid.CreateVersion7():N}");
/// <summary>What the view model has posted and <see cref="Queued"/> has not run yet.</summary>
/// <remarks>
/// A queue of this test's own, standing in for the dispatcher — which is what it replaces. Draining
/// <c>Dispatcher.UIThread</c> meant depending on which thread a runner happened to touch that
/// process-wide object from first, and once another class got there first every test here died on
/// "the calling thread cannot access this object" having asserted nothing about transfers at all.
/// <para>
/// A queue rather than a poster that runs the action inline, and the difference is not stylistic: the
/// transfer queue raises <c>Changed</c> from its pump thread as well as from the call that enqueued,
/// so inline execution would have a background thread adding rows to an <c>ObservableCollection</c>
/// while the test reads it. Draining keeps every mutation on the thread doing the asserting, which is
/// the one thing the dispatcher was providing that is worth keeping.
/// </para>
/// </remarks>
private readonly ConcurrentQueue<Action> posted = new();
private readonly TransfersViewModel transfers;
public TransferQueueingTests()
{
Directory.CreateDirectory(directory);
transfers = new TransfersViewModel(
Substitute.For<ISftpSessionFactory>(),
TimeProvider.System,
posted.Enqueue);
}
/// <inheritdoc />
public void Dispose()
{
if (Directory.Exists(directory))
{
Directory.Delete(directory, recursive: true);
}
}
/// <remarks>
/// The refusal that has to happen before anything else: there is nowhere to put a file until a host is
/// connected, and a queue that filled up first would start failing the moment one was.
/// </remarks>
[Fact]
public void DroppingFilesWhileDisconnected_QueuesNothingAndSaysWhy()
{
transfers.IsConnected = false;
transfers.QueueUploads([File("one.txt")]);
Queued().ShouldBeEmpty();
transfers.Status.ShouldContain("Connect to a host first");
}
[Fact]
public void DroppingSeveralFiles_QueuesEachOfThem()
{
Connected();
transfers.QueueUploads([File("one.txt"), File("two.txt"), File("three.txt")]);
Queued().Count.ShouldBe(3);
transfers.Status.ShouldContain("3 files");
transfers.Status.ShouldContain("/srv/app");
}
/// <remarks>
/// The paths in an operating-system drop come from another process and are not obliged to still be
/// right by the time the drop lands.
/// </remarks>
[Fact]
public void DroppingAFileThatHasGone_SkipsItAndSaysSo()
{
Connected();
transfers.QueueUploads([File("one.txt"), Path.Combine(directory, "never-existed.txt")]);
Queued().ShouldHaveSingleItem();
transfers.Status.ShouldContain("1 item was no longer there");
}
[Fact]
public void DroppingRemoteRowsOnTheLocalPane_QueuesDownloads()
{
Connected();
transfers.QueueDownloads([RemoteFile("one.log"), RemoteFile("two.log")]);
Queued().Count.ShouldBe(2);
transfers.Status.ShouldContain("2 files");
transfers.Status.ShouldContain("download into");
}
/// <remarks>
/// <para>
/// The buttons were the only way to queue anything before drag and drop, and they now go through the
/// same two methods — so there is one set of rules rather than two that have to agree. This is what
/// says they still do.
/// </para>
/// <para>
/// Files only, since folders stopped being skipped: walking one needs a session to list and to make
/// directories on, and this fixture deliberately has none — everything here is about what may be
/// queued, which needs no server. The recursive half is exercised in <c>ShellFlowTests</c>, against the
/// SFTP fake that a real connect produces.
/// </para>
/// </remarks>
[Fact]
public void TheDownloadButton_GoesThroughTheSamePathAsADrop()
{
Connected();
transfers.SelectedRemoteEntry = RemoteFile("one.log");
transfers.DownloadCommand.Execute(null);
Queued().ShouldHaveSingleItem();
transfers.Status.ShouldContain("download into");
}
/// <remarks>
/// Queueing is reachable from any thread — a drop is handled on the UI thread, a retry is not — and
/// nothing about it may depend on which one. Worth stating because the version of this class that
/// drained <c>Dispatcher.UIThread</c> did depend on exactly that, and said so only by failing in CI on
/// a machine whose scheduling differed. The draining still happens on the test's own thread, as
/// <see cref="Queued"/> explains; what is asserted here is the half that has no business caring.
/// </remarks>
[Fact]
public void QueueingFromAnotherThread_StillEnqueues()
{
Exception? failure = null;
var thread = new Thread(() =>
{
try
{
Connected();
transfers.QueueUploads([File("one.txt")]);
}
catch (Exception exception)
{
failure = exception;
}
});
thread.Start();
thread.Join();
failure.ShouldBeNull();
Queued().ShouldHaveSingleItem();
}
/// <remarks>
/// The phone's way in, and it has to obey the same rules as every other: a document chosen in the system
/// picker is copied into the cache and the copy is queued, which is an upload with one extra property —
/// that this application made the file and will delete it again. Everything about *what may be queued*
/// is the same, and this says so rather than leaving a second path free to drift.
/// </remarks>
[Fact]
public void StagedUploads_QueueUnderTheSameRulesAsAnyOther()
{
Connected();
transfers.QueueStagedUploads([File("picked.txt"), Path.Combine(directory, "never-existed.txt")]);
Queued().ShouldHaveSingleItem();
transfers.Status.ShouldContain("1 file");
transfers.Status.ShouldContain("1 item was no longer there");
}
/// <remarks>
/// <para>
/// The phone's way out. The delivery itself — copying the finished file into the document the save
/// picker made — needs a transfer that actually runs and a picker to have made something, so it is
/// checked by hand in <c>docs/manual-checks.md</c> phase 14. What is worth pinning here is the pair of
/// refusals in front of it, because both would otherwise be discovered as an empty file sitting in
/// somebody's Downloads: the picker creates the destination the moment it is dismissed, so anything
/// this method turns away after that point has already cost a visible artefact.
/// </para>
/// </remarks>
[Fact]
public void ADeliveredDownload_QueuesTheFileAndRefusesADirectory()
{
var delivered = 0;
Connected();
transfers.QueueDeliveredDownload(
RemoteFile("one.log"),
Path.Combine(directory, "staged", "one.log"),
_ =>
{
delivered++;
return Task.CompletedTask;
});
Queued().ShouldHaveSingleItem();
transfers.Status.ShouldContain("one.log");
// A directory has nothing to fetch, and the message is the same one every other path on this screen
// gives for the same mistake.
transfers.QueueDeliveredDownload(
RemoteDirectory("logs"),
Path.Combine(directory, "staged", "logs"),
_ => Task.CompletedTask);
Queued().Count.ShouldBe(1);
transfers.Status.ShouldContain("Only files");
// Nothing is delivered by queueing. The callback runs when the bytes are there and not before.
delivered.ShouldBe(0);
}
/// <remarks>
/// <para>
/// The local half of the automatic refresh. A download that finished left this pane showing the folder
/// as it was before the file arrived, so the file this application had just fetched was not in the
/// listing it was fetched into — and the way to see it was to press REFRESH.
/// </para>
/// <para>
/// Synchronous, unlike its remote counterpart, and that is the whole reason it is nothing more than a
/// re-read where it stands: a local listing is a filesystem call, so there is no round trip to defer and
/// no busy state to wait out. See <c>TransfersViewModel.SettleRemoteListingAsync</c> for the other side.
/// </para>
/// </remarks>
[Fact]
public void ADownloadThatLandsInTheFolderShowing_ReReadsItWithoutBeingAsked()
{
Connected();
transfers.RefreshLocalCommand.Execute(null);
transfers.LocalEntries.ShouldBeEmpty();
var landed = File("fetched.bin");
transfers.NoteTransferLanded(new TransferSnapshot(
Guid.CreateVersion7(),
TransferDirection.Download,
"fetched.bin",
landed,
"/srv/app/fetched.bin",
128,
128,
TransferState.Completed,
BytesPerSecond: 0,
Failure: null));
transfers.LocalEntries.Select(row => row.Name).ShouldBe(["fetched.bin"]);
}
/// <remarks>
/// Only the folder on screen, for the reason its remote counterpart gives: a queue writing into
/// somewhere nobody is looking at would otherwise re-read a directory per completed transfer.
/// </remarks>
[Fact]
public void ADownloadThatLandsSomewhereElse_ChangesNothingOnScreen()
{
Connected();
transfers.RefreshLocalCommand.Execute(null);
File("elsewhere.bin");
transfers.NoteTransferLanded(new TransferSnapshot(
Guid.CreateVersion7(),
TransferDirection.Download,
"elsewhere.bin",
Path.Combine(Path.GetTempPath(), "somewhere-else", "elsewhere.bin"),
"/srv/app/elsewhere.bin",
128,
128,
TransferState.Completed,
BytesPerSecond: 0,
Failure: null));
transfers.LocalEntries.ShouldBeEmpty();
}
/// <summary>The queue's rows, once the posts that create them have been let run.</summary>
/// <remarks>
/// <c>TransfersViewModel</c> adds a row from the transfer queue's own <c>Changed</c> event, which it
/// marshals because the queue raises it from a pump thread. Nothing drains that here, so the posts are
/// run by hand — the alternative is asserting on the status line alone, which is a string this code
/// wrote about itself and proves nothing about anything having been enqueued.
/// </remarks>
private IReadOnlyList<TransferRowViewModel> Queued()
{
while (posted.TryDequeue(out var action))
{
action();
}
return transfers.Transfers;
}
private void Connected()
{
transfers.IsConnected = true;
transfers.RemotePath = "/srv/app";
transfers.LocalPath = directory;
}
private string File(string name)
{
var path = Path.Combine(directory, name);
System.IO.File.WriteAllText(path, "contents");
return path;
}
private static RemoteEntryRowViewModel RemoteFile(string name) => new(
new SftpEntry(name, $"/srv/app/{name}", SftpEntryKind.File, 128, DateTimeOffset.UnixEpoch, "-rw-r--r--"));
private static RemoteEntryRowViewModel RemoteDirectory(string name) => new(
new SftpEntry(name, $"/srv/app/{name}", SftpEntryKind.Directory, 0, DateTimeOffset.UnixEpoch, "drwxr-xr-x"));
}