Public Access
The teams screen listed teams that owned vaults, so sharing four servers with two
colleagues meant creating a team, then a vault inside it, then wrapping a key.
Two of those three steps are about a concept nobody arrives wanting. The screen
now lists vaults: naming one creates the membership list that carries it, named
after the vault and owned by you, and members, invitations, roles, hand-over and
key holders all hang off the vault they apply to.
Nothing on the server moved. VaultAccessService still resolves a shared vault
through team_membership and every membership call still names a team id — what
went is the requirement that anybody make one. The split the whole design rests
on is untouched and is still what the screen is built around: adding somebody
authorises the server to serve them, and only a machine holding the key can make
the vault readable. ADR 0009 keeps its decision and gains an addendum recording
which half of it a person is now asked about.
The one place the team resurfaces is a membership list carrying several vaults,
which this screen cannot produce and does not hide: the members section says so,
because "adding somebody here adds them there" is precisely the fact a
vault-shaped screen is in a position to conceal.
Two things left the interface and one arrived. Creating a team is gone, and so is
archiving one — it was only ever possible for a team owning no vaults, and a
screen whose rows are vaults has no row for one, so the button would have been
unreachable or always refused. The endpoint is unchanged and the screen states
the limit instead, since a vault cannot be deleted at all. The exception is a
create whose second call failed: cancelling that form archives the membership
list it left behind, which is a deliberate departure from this client's rule
against tidying up on the user's behalf, made because nothing else can reach it.
What arrived is PUT /api/v1/vaults/{id}. Without it the screen loses its only
editing action, since renaming the team behind a vault is invisible to everybody
who was never shown the team. It is gated on PermissionFlags.Admin — the line
UpdateTeamEndpoint already draws, because a name is what everybody in the vault
sees it called rather than part of its contents — and it renames the owning team
with it when that team carries nothing else, so the row an operator reads and the
name a user says cannot drift apart. The slug never moves, for the reason it does
not move on a team rename. The session edits its cached vault row rather than
replacing it with the response, which deliberately carries no wrapped key.
The host editor now asks which vault a host goes into, beside the name, while
adding and only where there is more than one vault to write to. It is a second
picker rather than the keychain screen's reused, and the two selections are
separate on purpose: that one is a standing preference about where new items go,
this is a field of the host in front of you, and binding both to one selection
would mean a click on the other screen could move a half-typed host. An existing
host is not offered it at all rather than offered it disabled — the two vaults
are encrypted under different keys, so moving an item is a delete and a retype.
That forced a fix worth naming. The group picker was built from the active
vault's groups whatever vault the host was being filed into, so a host put in a
shared vault could be filed under a group only its author can resolve — a
colleague would see it filed under nothing, which is the quietest kind of wrong.
Groups are now kept per vault and the picker follows the vault choice.
Two renames, because the pair they would otherwise have made is a bug farm:
ShellScreen.Vault became Keychain and VaultScreen became KeychainScreen, which is
what the rail has always labelled that screen, leaving Vault for one vault's
contents and Vaults for the vaults themselves. The enum values are unchanged;
NavRail.axaml writes them as x:Static literals.
1536 tests pass, seven more than before. Five are new on the server — the rename
endpoint's success, the team it does and does not take with it, the two refusals
and the empty name — and the client suite gains six and folds four together,
having lost the two about archiving a team.
270 lines
10 KiB
C#
270 lines
10 KiB
C#
using DodoSSH.Client.Api;
|
|
using DodoSSH.Client.Auth;
|
|
using DodoSSH.Client.Session;
|
|
using DodoSSH.Client.Sync;
|
|
using DodoSSH.Contracts;
|
|
|
|
namespace DodoSSH.Client.App.Layout.Tests;
|
|
|
|
/// <summary>
|
|
/// The least server a <c>VaultsViewModel</c> needs in order to be laid out with something in it.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para>
|
|
/// The vaults screen draws its list from the session and everything under it from the server: who is in a
|
|
/// vault, who has been invited, and who holds a key are all read on open, and the suite's
|
|
/// <c>FakeAccountServer</c> implements <see cref="IAccountApi"/> and nothing else. Rather than teach that
|
|
/// fake five more interfaces for one screen, this serves fixed rows and refuses everything a layout test
|
|
/// has no business calling.
|
|
/// </para>
|
|
/// <para>
|
|
/// It does answer <see cref="CreateTeamVaultAsync"/>, unlike the other writes, because that is how the
|
|
/// suite gets a shared vault into the session at all — an offline layout test has no other way to reach
|
|
/// the state this screen exists to draw.
|
|
/// </para>
|
|
/// <para>
|
|
/// The rows are deliberately the <em>long</em> ones. A layout suite that measured "Bob" in a column sized
|
|
/// for an email address would certify a shape no real team produces — so the names, addresses and status
|
|
/// sentences here are at or near the length the interface can really be handed, which is what makes an
|
|
/// overflow show up at the minimum window rather than on somebody's screen.
|
|
/// </para>
|
|
/// </remarks>
|
|
internal sealed class StubTeamServer : IVaultServer, ITeamApi, IVaultGrantApi
|
|
{
|
|
private static readonly Guid OwnerId = Guid.CreateVersion7();
|
|
private static readonly Guid ColleagueId = Guid.CreateVersion7();
|
|
private static readonly Guid TeamId = Guid.CreateVersion7();
|
|
private static readonly Guid VaultId = Guid.CreateVersion7();
|
|
|
|
/// <inheritdoc />
|
|
public Uri ServerUrl { get; } = new("https://dodossh.example");
|
|
|
|
/// <inheritdoc />
|
|
public ITeamApi Teams => this;
|
|
|
|
/// <inheritdoc />
|
|
public IVaultGrantApi Grants => this;
|
|
|
|
/// <inheritdoc />
|
|
public IAccountApi Account => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public ISyncApi Sync => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public IDirectoryApi Directory => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public IKeyBindingAuthorizer KeyBinding => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public SyncOptions SyncOptions => new();
|
|
|
|
/// <inheritdoc />
|
|
public string? RefreshToken => null;
|
|
|
|
/// <summary>The vault whose key holders are listed, so a test can select it.</summary>
|
|
internal static Guid TeamVaultId => VaultId;
|
|
|
|
/// <summary>The membership list behind that vault, so a test can create it in the session.</summary>
|
|
internal static Guid SharedTeamId => TeamId;
|
|
|
|
/// <inheritdoc />
|
|
public Task<IReadOnlyList<TeamSummary>> ListTeamsAsync(CancellationToken cancellationToken) =>
|
|
Task.FromResult<IReadOnlyList<TeamSummary>>(
|
|
[
|
|
new TeamSummary(
|
|
TeamId,
|
|
"Platform Engineering",
|
|
"platform-engineering",
|
|
"Everything that runs the estate.",
|
|
TeamMemberRole.Owner,
|
|
MemberCount: 2,
|
|
VaultCount: 1,
|
|
DateTimeOffset.UnixEpoch),
|
|
]);
|
|
|
|
/// <inheritdoc />
|
|
public Task<IReadOnlyList<TeamMemberSummary>> ListTeamMembersAsync(
|
|
Guid teamId,
|
|
CancellationToken cancellationToken) =>
|
|
Task.FromResult<IReadOnlyList<TeamMemberSummary>>(
|
|
[
|
|
new TeamMemberSummary(
|
|
OwnerId,
|
|
"alexandra.hollingsworth@dodotech.example",
|
|
"Alexandra Hollingsworth",
|
|
TeamMemberRole.Owner,
|
|
TeamMemberStatus.Active,
|
|
IsEnrolled: true,
|
|
DateTimeOffset.UnixEpoch,
|
|
DateTimeOffset.UnixEpoch),
|
|
|
|
// The unenrolled case on purpose: its key-state phrase is the longest the column ever
|
|
// carries, and it is the row that decides whether that column is wide enough.
|
|
new TeamMemberSummary(
|
|
ColleagueId,
|
|
"bartholomew.fotheringay@dodotech.example",
|
|
"Bartholomew Fotheringay",
|
|
TeamMemberRole.Member,
|
|
TeamMemberStatus.Active,
|
|
IsEnrolled: false,
|
|
DateTimeOffset.UnixEpoch,
|
|
LastActiveAt: null),
|
|
]);
|
|
|
|
/// <inheritdoc />
|
|
public Task<IReadOnlyList<TeamInvitationSummary>> ListTeamInvitationsAsync(
|
|
Guid teamId,
|
|
CancellationToken cancellationToken) =>
|
|
Task.FromResult<IReadOnlyList<TeamInvitationSummary>>(
|
|
[
|
|
// Pending, because its sentence is the long one — it has to carry the whole mechanism,
|
|
// since nothing was sent and there is nothing else on the screen that could say so.
|
|
new TeamInvitationSummary(
|
|
Guid.CreateVersion7(),
|
|
"wilhelmina.ashworth-blake@dodotech.example",
|
|
TeamMemberRole.Admin,
|
|
TeamInvitationState.Pending,
|
|
OwnerId,
|
|
DateTimeOffset.UnixEpoch,
|
|
DateTimeOffset.UnixEpoch.AddDays(14),
|
|
AcceptedAt: null),
|
|
]);
|
|
|
|
/// <inheritdoc />
|
|
public Task<VaultGrantsResponse> ListVaultGrantsAsync(
|
|
Guid vaultId,
|
|
CancellationToken cancellationToken) =>
|
|
Task.FromResult(new VaultGrantsResponse(
|
|
vaultId,
|
|
KeyGeneration: 2,
|
|
RekeyRequired: true,
|
|
Grants:
|
|
[
|
|
new VaultGrantSummary(
|
|
OwnerId,
|
|
"alexandra.hollingsworth@dodotech.example",
|
|
"Alexandra Hollingsworth",
|
|
KeyGeneration: 2,
|
|
VaultGrantState.Active,
|
|
OwnerId,
|
|
DateTimeOffset.UnixEpoch,
|
|
RevokedAt: null),
|
|
|
|
// A generation behind, so the "stale" phrasing is the one being measured rather than
|
|
// the two-word happy case.
|
|
new VaultGrantSummary(
|
|
ColleagueId,
|
|
"bartholomew.fotheringay@dodotech.example",
|
|
"Bartholomew Fotheringay",
|
|
KeyGeneration: 1,
|
|
VaultGrantState.Active,
|
|
OwnerId,
|
|
DateTimeOffset.UnixEpoch,
|
|
RevokedAt: null),
|
|
]));
|
|
|
|
/// <inheritdoc />
|
|
public Task<TeamSummary> CreateTeamAsync(
|
|
CreateTeamRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<TeamSummary> UpdateTeamAsync(
|
|
Guid teamId,
|
|
UpdateTeamRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<bool> ArchiveTeamAsync(Guid teamId, CancellationToken cancellationToken) =>
|
|
throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task TransferTeamOwnershipAsync(
|
|
Guid teamId,
|
|
TransferTeamOwnershipRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<TeamMemberSummary> AddTeamMemberAsync(
|
|
Guid teamId,
|
|
AddTeamMemberRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<TeamMemberSummary> ChangeTeamMemberRoleAsync(
|
|
Guid teamId,
|
|
Guid userId,
|
|
ChangeTeamMemberRoleRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<bool> RemoveTeamMemberAsync(
|
|
Guid teamId,
|
|
Guid userId,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<TeamInvitationSummary> CreateTeamInvitationAsync(
|
|
Guid teamId,
|
|
CreateTeamInvitationRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<bool> RevokeTeamInvitationAsync(
|
|
Guid teamId,
|
|
Guid invitationId,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <summary>
|
|
/// Accepts the vault, so a layout test can put a shared one into the session it is drawing.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// The client's own id and wrapped key are echoed back, exactly as the real endpoint answers: the key
|
|
/// was generated on this machine and the session adopts its own copy, so anything else here would be
|
|
/// either discarded or a vault nobody could open.
|
|
/// <para>
|
|
/// It comes back owing a rekey, which is not decoration: that is the longer of the two lines a vault row
|
|
/// can carry, and this suite exists to measure the long one.
|
|
/// </para>
|
|
/// </remarks>
|
|
public Task<VaultSummary> CreateTeamVaultAsync(
|
|
Guid teamId,
|
|
CreateTeamVaultRequest request,
|
|
CancellationToken cancellationToken) =>
|
|
Task.FromResult(new VaultSummary(
|
|
request.VaultId,
|
|
request.Name,
|
|
IsPersonal: false,
|
|
TeamId: teamId,
|
|
KeyGeneration: 1,
|
|
Permissions: 31,
|
|
request.WrappedVaultKey,
|
|
RekeyRequired: true));
|
|
|
|
/// <inheritdoc />
|
|
public Task<VaultSummary> RenameVaultAsync(
|
|
Guid vaultId,
|
|
UpdateVaultRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task IssueVaultGrantAsync(
|
|
Guid vaultId,
|
|
IssueVaultGrantRequest request,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public Task<bool> RevokeVaultGrantAsync(
|
|
Guid vaultId,
|
|
Guid userId,
|
|
CancellationToken cancellationToken) => throw new NotSupportedException();
|
|
|
|
/// <inheritdoc />
|
|
public void Dispose()
|
|
{
|
|
// Nothing held.
|
|
}
|
|
}
|