Public Access
jaap-jan
8d2416a602
Three new client projects, and the wire-contract fix they needed. DodoSSH.Client.Domain holds the decrypted item model and the three-way merge, with no I/O at all — so the suite that decides whether a credential can be lost runs in milliseconds with nothing to mock. Scalars defer to the server on a genuine clash so every replica resolves the same triple identically and two clients cannot ping-pong; directives merge per name so two people each adding one both keep theirs; the jump chain merges as a whole value because its order is the route. Whatever loses is returned rather than dropped. DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are already ciphertext, so an encrypted file would protect protected bytes at the cost of a native dependency. It keeps the server's state and the outbox in separate tables, which is what preserves the common ancestor a merge needs. One pending operation per item, enforced by a unique index. DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts — a change with no local work pending is plumbed as ciphertext — so a first sync of thousands of items does not run twice as many AEAD operations for nothing. Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The specification has required a per-item data key since crypto.md §3, the columns have existed since the first migration and DshAad.ItemPayload binds the id, but this record had nowhere to put either — so a spec-compliant item could not be transmitted at all. Found by writing the client that has to produce one. Also closes a hole in AadResourceType, which had no value for the HostTag and HostCredential that SyncEntityType has always listed. Four bugs the tests found, not review: - SQLite refuses to order or compare its own DateTimeOffset mapping, and throws at execution rather than model build. Collecting tombstones and listing conflicts are both that shape, so this was a crash waiting for the first user with a deleted host. Timestamps are integers now, by convention so a later field cannot be the one left unconverted. - SQLitePCLRaw 2.1.11, which EF resolves, is covered by GHSA-2m69-gcr7-jv3q. Pinned forward as a family. - Resurrecting content from a remote deletion cleared the original before queueing the copy. Two transactions, so a crash between them lost the work; reversed, and the rescued id is derived from the tombstone so a replay coalesces instead of duplicating. - Several equality assertions went through Shouldly's ShouldBe, which compares IEnumerable element-wise and so tested nothing about the Equals these types exist to provide. Corrected; the falsification that caught it went from 2 failures to 6. The push response's cursor is deliberately ignored. It sits after this client's own writes, so adopting it skips anything another client committed at a lower sequence in the window between a pull and a push — permanently. Re-reading one's own writes is idempotent and costs a page. The Contracts doc that invited the shortcut now says so. 593 tests, up from 448. The delete-versus-edit rules, the ancestor retention, the fresh operation id on coalesce and the cursor safeguard were each verified by breaking them and watching the right test fail.
164 lines
7.8 KiB
INI
164 lines
7.8 KiB
INI
# EditorConfig for DodoSSH — https://editorconfig.org
|
|
root = true
|
|
|
|
[*]
|
|
charset = utf-8
|
|
end_of_line = lf
|
|
indent_style = space
|
|
indent_size = 4
|
|
insert_final_newline = true
|
|
trim_trailing_whitespace = true
|
|
|
|
[*.{json,yml,yaml,js,ts,css,html,axaml,xaml,csproj,props,targets,slnx}]
|
|
indent_size = 2
|
|
|
|
[*.md]
|
|
# Two trailing spaces are a hard line break in Markdown.
|
|
trim_trailing_whitespace = false
|
|
|
|
[*.{cmd,bat,ps1}]
|
|
end_of_line = crlf
|
|
|
|
[*.cs]
|
|
indent_size = 4
|
|
|
|
#### Language conventions ####
|
|
|
|
csharp_style_namespace_declarations = file_scoped:error
|
|
csharp_using_directive_placement = outside_namespace:error
|
|
csharp_style_var_for_built_in_types = false:suggestion
|
|
csharp_style_var_when_type_is_apparent = true:suggestion
|
|
csharp_style_var_elsewhere = false:suggestion
|
|
csharp_prefer_braces = true:suggestion
|
|
csharp_style_prefer_primary_constructors = true:suggestion
|
|
csharp_style_expression_bodied_methods = when_on_single_line:suggestion
|
|
csharp_style_expression_bodied_properties = true:suggestion
|
|
|
|
dotnet_sort_system_directives_first = true
|
|
dotnet_separate_import_directive_groups = false
|
|
|
|
dotnet_style_qualification_for_field = false:suggestion
|
|
dotnet_style_qualification_for_property = false:suggestion
|
|
dotnet_style_qualification_for_method = false:suggestion
|
|
dotnet_style_readonly_field = true:warning
|
|
dotnet_style_require_accessibility_modifiers = for_non_interface_members:warning
|
|
dotnet_style_coalesce_expression = true:suggestion
|
|
dotnet_style_null_propagation = true:suggestion
|
|
dotnet_style_prefer_is_null_check_over_reference_equality_method = true:suggestion
|
|
|
|
# Async methods must be suffixed Async (VSTHRD200 equivalent via naming rules below).
|
|
dotnet_naming_rule.async_methods_end_in_async.severity = warning
|
|
dotnet_naming_rule.async_methods_end_in_async.symbols = any_async_method
|
|
dotnet_naming_rule.async_methods_end_in_async.style = ends_with_async
|
|
dotnet_naming_symbols.any_async_method.applicable_kinds = method
|
|
dotnet_naming_symbols.any_async_method.required_modifiers = async
|
|
dotnet_naming_style.ends_with_async.required_suffix = Async
|
|
dotnet_naming_style.ends_with_async.capitalization = pascal_case
|
|
|
|
dotnet_naming_rule.interfaces_start_with_i.severity = warning
|
|
dotnet_naming_rule.interfaces_start_with_i.symbols = any_interface
|
|
dotnet_naming_rule.interfaces_start_with_i.style = starts_with_i
|
|
dotnet_naming_symbols.any_interface.applicable_kinds = interface
|
|
dotnet_naming_style.starts_with_i.required_prefix = I
|
|
dotnet_naming_style.starts_with_i.capitalization = pascal_case
|
|
|
|
# Constants and static readonly fields are PascalCase, per .NET convention. These rules must
|
|
# come before the camelCase rule below: the first matching rule wins, and a rule matching all
|
|
# private fields would otherwise force `const int Foo` to be named `foo`.
|
|
dotnet_naming_rule.constants_are_pascal_case.severity = warning
|
|
dotnet_naming_rule.constants_are_pascal_case.symbols = any_const_field
|
|
dotnet_naming_rule.constants_are_pascal_case.style = pascal_case_style
|
|
dotnet_naming_symbols.any_const_field.applicable_kinds = field
|
|
dotnet_naming_symbols.any_const_field.applicable_accessibilities = *
|
|
dotnet_naming_symbols.any_const_field.required_modifiers = const
|
|
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.severity = warning
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.symbols = static_readonly_field
|
|
dotnet_naming_rule.static_readonly_fields_are_pascal_case.style = pascal_case_style
|
|
dotnet_naming_symbols.static_readonly_field.applicable_kinds = field
|
|
dotnet_naming_symbols.static_readonly_field.applicable_accessibilities = *
|
|
dotnet_naming_symbols.static_readonly_field.required_modifiers = static, readonly
|
|
|
|
dotnet_naming_style.pascal_case_style.capitalization = pascal_case
|
|
|
|
# Private instance fields are camelCase.
|
|
dotnet_naming_rule.private_fields_are_camel_case.severity = warning
|
|
dotnet_naming_rule.private_fields_are_camel_case.symbols = private_field
|
|
dotnet_naming_rule.private_fields_are_camel_case.style = camel_case_style
|
|
dotnet_naming_symbols.private_field.applicable_kinds = field
|
|
dotnet_naming_symbols.private_field.applicable_accessibilities = private
|
|
dotnet_naming_style.camel_case_style.capitalization = camel_case
|
|
|
|
#### Diagnostics ####
|
|
|
|
# Formatting violations fail the build; `dotnet format --verify-no-changes` gates CI.
|
|
dotnet_diagnostic.IDE0055.severity = error
|
|
|
|
# ConfigureAwait is not meaningful in ASP.NET Core (no SynchronizationContext). It IS
|
|
# meaningful in the Avalonia client, which re-enables CA2007 in its own .editorconfig.
|
|
dotnet_diagnostic.CA2007.severity = none
|
|
|
|
# Require LoggerMessage source generation over ILogger extension calls — allocation-free,
|
|
# and event ids plus message templates become a greppable inventory rather than string
|
|
# literals scattered through the code. Effectively an error, since warnings are errors;
|
|
# stated as such rather than pretending it is advisory.
|
|
dotnet_diagnostic.CA1848.severity = warning
|
|
|
|
# Exceptions carry ProblemDetails codes, not localised text.
|
|
dotnet_diagnostic.CA1303.severity = none
|
|
|
|
# CA1711 reserves the suffixes Flags, Permission, Collection, Stream and friends for
|
|
# .NET Framework CAS and BCL base types that have no bearing on this codebase. The BCL
|
|
# itself ships BindingFlags. PermissionFlags is the clearest name for a [Flags] enum of
|
|
# permissions, and contorting domain vocabulary to satisfy a legacy rule costs more than
|
|
# it returns.
|
|
dotnet_diagnostic.CA1711.severity = none
|
|
|
|
# CA1724 flags any type whose name collides with a BCL *namespace* (e.g. a type named
|
|
# Permissions vs System.Security.Permissions). Namespace-qualified resolution makes this
|
|
# a non-issue in practice and it heavily constrains domain naming.
|
|
dotnet_diagnostic.CA1724.severity = none
|
|
|
|
# MA0048 requires one type per file. Good for large types, actively worse for small DTO
|
|
# clusters: splitting SyncPullRequest from SyncPullResponse means a reviewer opens two files
|
|
# to understand one endpoint's contract. The BCL groups related types the same way.
|
|
dotnet_diagnostic.MA0048.severity = none
|
|
|
|
# We use file-scoped namespaces and modern C#; these fire on deliberate style choices.
|
|
dotnet_diagnostic.CA1812.severity = none # internal types instantiated by DI
|
|
dotnet_diagnostic.CA1849.severity = warning # sync call in async method
|
|
|
|
[tests/**/*.cs]
|
|
# Test classes are instantiated by xunit, and test data is often public static.
|
|
dotnet_diagnostic.CA1812.severity = none
|
|
dotnet_diagnostic.CA1034.severity = none
|
|
|
|
# A test name is documentation: Push_WithAStaleVersion_ReportsConflict says what is being
|
|
# asserted, and Push_WithAStaleVersion_ReportsConflictAsync says the same thing plus an
|
|
# implementation detail nobody reading a failure report cares about. The async suffix
|
|
# convention exists so callers can spot awaitables; a test method has no callers.
|
|
dotnet_diagnostic.IDE1006.severity = none
|
|
|
|
# Matches every project's Migrations folder, not just Infrastructure's: the client's local cache
|
|
# is migrated too. A glob rather than one block per project, so a third one is not a build break
|
|
# for whoever adds it.
|
|
[src/*/Migrations/*.cs]
|
|
# EF Core generates these; do not lint or format them.
|
|
generated_code = true
|
|
dotnet_analyzer_diagnostic.severity = none
|
|
dotnet_diagnostic.IDE0055.severity = none
|
|
# IDE style rules are not covered by dotnet_analyzer_diagnostic above and have to be named.
|
|
dotnet_diagnostic.IDE0161.severity = none
|
|
|
|
[*.{g,g.i,generated,designer}.cs]
|
|
# Source-generator output. In particular the System.Text.Json generator emits a public
|
|
# JsonTypeInfo member per serialisable type, which PublicApiAnalyzers would otherwise demand
|
|
# be tracked in PublicAPI.txt — hundreds of entries derived mechanically from the
|
|
# [JsonSerializable] list, drowning the entries that describe the actual wire contract.
|
|
generated_code = true
|
|
dotnet_analyzer_diagnostic.severity = none
|
|
dotnet_diagnostic.RS0016.severity = none
|
|
dotnet_diagnostic.RS0017.severity = none
|
|
dotnet_diagnostic.RS0041.severity = none
|
|
dotnet_diagnostic.IDE0055.severity = none
|