mirror of
https://github.com/block/buzz.git
synced 2026-11-03 07:51:22 +00:00
feat(desktop): instance-level agents nav with atomic workspace-scope capture
Add owner-consent archive/unarchive commands, workspace-epoch seqlock
protocol, NIP-IA ownership classifier, and Instances Sheet UI.
Rust (desktop/src-tauri):
- WorkspaceEpochWriteGuard (workspace_epoch.rs): RAII seqlock writer guard
with SeqCst ordering, writer-mutex serialization, and guaranteed even
restoration on every exit path including panic/unwind. All three production
key writers (resolve_persisted_identity, commit_imported_identity,
apply_workspace) participate; apply_workspace spans its compound
override+keys mutation under one guard.
- AppState extended with workspace_epoch: AtomicU64 + workspace_write:
Mutex<()> for the seqlock protocol.
- capture_archive_scope: bounded-retry reader that accepts only equal-and-even
epoch samples, ensuring keys and relay_url_override come from one workspace
generation.
- ArchiveScope { keys, actor, api_base_url, workspace_epoch }: immutable
snapshot consumed by every fetch/classify/mint/sign/submit in the scoped
archive operation.
- NipIaOwnerProof classifier: enum verified|missing_profile|missing_auth|
multiple_auth_tags|invalid_auth|owner_mismatch. Reuses verify_auth_tag
(syntax + signature only, no condition-clause evaluation per NIP-IA rule 6).
- scoped_archive_operation: single non-Tauri fn owning the full
fetch→classify→mint→build/sign→submit pipeline for both 9035 (archive) and
9036 (unarchive). Fresh empty-condition auth tag minted after Verified
classification; never copies the profile tag.
- archive_agent / unarchive_agent: thin #[tauri::command] wrappers.
- Keyring helpers extracted to app_state_keyfile_ops.rs to stay under the
file-size ratchet (app_state.rs: 998 gate lines, limit 1080).
- Relay acceptance tests (identity_archive/tests/identity_archive_relay_tests.rs):
five #[ignore]d tests requiring live relay+Postgres, selected by the new
desktop-tauri-relay-acceptance just recipe and the Backend Integration CI
gate. Tenant fixture makes Self and Admin impossible; 9035 asserts
consent_path='owner' in Postgres; 9036 asserts emitted delta.
- Deterministic epoch protocol tests (app_state_epoch_tests.rs): no infra,
always-required in desktop-tauri-test/Desktop Core gate. Tests: initial
capture, writer exclusion+capture retry, RAII restoration (drop/early-
return/catch_unwind), poisoned-mutex error, mixed-generation barrier test.
TypeScript (desktop/src):
- tauriIdentityArchive.ts: archiveAgent/unarchiveAgent Tauri bindings.
- hooks.ts: useOwnedAgentInventoryQuery hook with additive cache invalidation.
- InstancesSheet.tsx: instances sheet opened from Instances (N) card action;
shows tri-state archive status, start-control safeguard for 3rd instance.
- PersonaActionsMenu.tsx: onViewInstances prop wired to InstancesSheet.
- UnifiedAgentsSection.tsx: Instances button in agent card actions.
- relayQueryInvalidation.ts: ownedAgentInventoryQueryKey registration.
CI/Justfile:
- desktop-tauri-relay-acceptance just recipe: _ensure-sidecar-stubs +
nextest selector for in-crate relay acceptance module.
- Backend Integration (relay e2e) job: new step just desktop-tauri-relay-
acceptance after relay startup; job if extended to desktop-rust; Tauri Linux
apt deps + rust-cache for desktop/src-tauri; timeout raised.
Thread: nostr:nevent1qqs0jp4fmfhaxcm7etlyq9csgwhg73j44f2akkhcnzfnk7s0w6rxptqpz24mxk
Plan: v9, APPROVE by Thufir (event 7dd99118), baseline 8342dfcc
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
This commit is contained in:
Duncan
43
.github/workflows/ci.yml
vendored
43
.github/workflows/ci.yml
vendored
@@ -574,14 +574,43 @@ jobs:
|
||||
backend-integration:
|
||||
name: Backend Integration (relay e2e)
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
timeout-minutes: 35
|
||||
needs: [changes, desktop-e2e-relay]
|
||||
if: github.event_name == 'push' || needs.changes.outputs.rust == 'true'
|
||||
if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true'
|
||||
permissions:
|
||||
contents: read
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
- uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
|
||||
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
|
||||
with:
|
||||
workspaces: desktop/src-tauri
|
||||
save-if: ${{ github.event_name != 'pull_request' }}
|
||||
- name: Install Tauri dependencies (Linux)
|
||||
env:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
run: |
|
||||
sudo apt-get update \
|
||||
-o Acquire::Retries=3 \
|
||||
-o Acquire::http::Timeout=30 \
|
||||
-o Acquire::https::Timeout=30
|
||||
sudo apt-get install -y --no-install-recommends \
|
||||
-o Acquire::Retries=3 \
|
||||
-o Acquire::http::Timeout=30 \
|
||||
-o Acquire::https::Timeout=30 \
|
||||
-o DPkg::Lock::Timeout=120 \
|
||||
build-essential \
|
||||
curl \
|
||||
file \
|
||||
libasound2-dev \
|
||||
libayatana-appindicator3-dev \
|
||||
libgtk-3-dev \
|
||||
librsvg2-dev \
|
||||
libssl-dev \
|
||||
libwebkit2gtk-4.1-dev \
|
||||
libxdo-dev \
|
||||
patchelf \
|
||||
wget
|
||||
- name: Install cargo-nextest
|
||||
uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
|
||||
with:
|
||||
@@ -684,6 +713,16 @@ jobs:
|
||||
done
|
||||
cat /tmp/buzz-relay.log
|
||||
exit 1
|
||||
- name: Desktop relay acceptance gate
|
||||
# NIP-IA owner-consent proof: in-crate ignored tests under
|
||||
# commands/identity_archive::relay_acceptance, exercised against the
|
||||
# production build_router/POST /events path here (not in unit-test gate,
|
||||
# which has no infra). Missing/unreachable infra panics — no skip, no
|
||||
# silent Ok. See Plan v9 Amendment 6 for the fixture and assertion spec.
|
||||
run: just desktop-tauri-relay-acceptance
|
||||
env:
|
||||
DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
|
||||
RELAY_API_URL: http://localhost:3000
|
||||
- name: Invite security tests
|
||||
run: |
|
||||
cargo nextest run \
|
||||
|
||||
7
Justfile
7
Justfile
@@ -206,6 +206,13 @@ desktop-tauri-check: _ensure-sidecar-stubs
|
||||
desktop-tauri-test: _ensure-sidecar-stubs
|
||||
cd desktop/src-tauri && cargo test --workspace
|
||||
|
||||
# Run the in-crate relay acceptance gate against a live relay + Postgres.
|
||||
# Requires DATABASE_URL and RELAY_API_URL in the environment.
|
||||
# CI mounts this step inside the Backend Integration (relay e2e) job which
|
||||
# already provisions both; locally you can use the same docker-compose setup.
|
||||
desktop-tauri-relay-acceptance: _ensure-sidecar-stubs
|
||||
cargo nextest run --manifest-path desktop/src-tauri/Cargo.toml -p buzz-desktop --lib -E 'test(/relay_acceptance::/)' --run-ignored ignored-only
|
||||
|
||||
# Run the native terminal latency gate explicitly on a known-idle host.
|
||||
# This is intentionally excluded from shared CI: scheduler contention makes a
|
||||
# wall-clock assertion flaky, and the release profile is the shipped shape.
|
||||
|
||||
97
desktop/src-tauri/Cargo.lock
generated
97
desktop/src-tauri/Cargo.lock
generated
@@ -1136,6 +1136,7 @@ dependencies = [
|
||||
"tauri-utils",
|
||||
"tempfile",
|
||||
"tokio",
|
||||
"tokio-postgres",
|
||||
"tokio-tungstenite 0.29.0",
|
||||
"tokio-util",
|
||||
"toml 0.8.2",
|
||||
@@ -2778,6 +2779,12 @@ version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "af9673d8203fcb076b19dfd17e38b3d4ae9f44959416ea532ce72415a6020365"
|
||||
|
||||
[[package]]
|
||||
name = "fallible-iterator"
|
||||
version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
|
||||
|
||||
[[package]]
|
||||
name = "fallible-iterator"
|
||||
version = "0.3.0"
|
||||
@@ -5087,6 +5094,16 @@ dependencies = [
|
||||
"syn 2.0.118",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "md-5"
|
||||
version = "0.11.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
|
||||
dependencies = [
|
||||
"cfg-if 1.0.4",
|
||||
"digest 0.11.3",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "md5"
|
||||
version = "0.8.1"
|
||||
@@ -7570,6 +7587,35 @@ dependencies = [
|
||||
"syn 2.0.118",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "postgres-protocol"
|
||||
version = "0.6.12"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514"
|
||||
dependencies = [
|
||||
"base64 0.22.1",
|
||||
"byteorder",
|
||||
"bytes",
|
||||
"fallible-iterator 0.2.0",
|
||||
"hmac 0.13.0",
|
||||
"md-5",
|
||||
"memchr",
|
||||
"rand 0.10.2",
|
||||
"sha2 0.11.0",
|
||||
"stringprep",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "postgres-types"
|
||||
version = "0.2.14"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "851ca9db4932932d69f3ea811b1abe63087a0f740a47692619dd40d4899b68be"
|
||||
dependencies = [
|
||||
"bytes",
|
||||
"fallible-iterator 0.2.0",
|
||||
"postgres-protocol",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "potential_utf"
|
||||
version = "0.1.5"
|
||||
@@ -8646,7 +8692,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "165ca6e57b20e1351573e3729b958bc62f0e48025386970b6e4d29e7a7e71f3f"
|
||||
dependencies = [
|
||||
"bitflags 2.13.0",
|
||||
"fallible-iterator",
|
||||
"fallible-iterator 0.3.0",
|
||||
"fallible-streaming-iterator",
|
||||
"hashlink",
|
||||
"libsqlite3-sys",
|
||||
@@ -9853,6 +9899,17 @@ dependencies = [
|
||||
"quote",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "stringprep"
|
||||
version = "0.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
|
||||
dependencies = [
|
||||
"unicode-bidi",
|
||||
"unicode-normalization",
|
||||
"unicode-properties",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "strip-ansi-escapes"
|
||||
version = "0.2.1"
|
||||
@@ -10989,6 +11046,32 @@ dependencies = [
|
||||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokio-postgres"
|
||||
version = "0.7.18"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a528f7d280f6d5b9cd149635c8705b0dd049754bc67d81d31fa25169a93809d3"
|
||||
dependencies = [
|
||||
"async-trait",
|
||||
"byteorder",
|
||||
"bytes",
|
||||
"fallible-iterator 0.2.0",
|
||||
"futures-channel",
|
||||
"futures-util",
|
||||
"log",
|
||||
"parking_lot",
|
||||
"percent-encoding",
|
||||
"phf 0.13.1",
|
||||
"pin-project-lite",
|
||||
"postgres-protocol",
|
||||
"postgres-types",
|
||||
"rand 0.10.2",
|
||||
"socket2",
|
||||
"tokio",
|
||||
"tokio-util",
|
||||
"whoami",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokio-retry"
|
||||
version = "0.3.2"
|
||||
@@ -11621,6 +11704,12 @@ version = "2.9.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
|
||||
|
||||
[[package]]
|
||||
name = "unicode-bidi"
|
||||
version = "0.3.18"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
|
||||
|
||||
[[package]]
|
||||
name = "unicode-ident"
|
||||
version = "1.0.24"
|
||||
@@ -11645,6 +11734,12 @@ dependencies = [
|
||||
"smallvec",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "unicode-properties"
|
||||
version = "0.1.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
|
||||
|
||||
[[package]]
|
||||
name = "unicode-segmentation"
|
||||
version = "1.13.3"
|
||||
|
||||
@@ -153,3 +153,6 @@ tokio = { version = "1", features = ["test-util"] }
|
||||
# The relay's media validation, so the snapshot-sharing tests can prove the
|
||||
# full export → sanitize → relay-accept → import contract end to end.
|
||||
buzz_media_pkg = { package = "buzz-media", path = "../../crates/buzz-media" }
|
||||
# Direct Postgres access for relay-acceptance tests that assert persisted
|
||||
# consent_path rows (see commands/identity_archive relay_acceptance module).
|
||||
tokio-postgres = { version = "0.7", features = [] }
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
use std::{
|
||||
collections::HashMap,
|
||||
io::Write,
|
||||
sync::{
|
||||
atomic::{AtomicBool, AtomicU16, AtomicU8},
|
||||
atomic::{AtomicBool, AtomicU16, AtomicU64, AtomicU8, Ordering},
|
||||
Arc, Mutex,
|
||||
},
|
||||
};
|
||||
@@ -118,6 +117,17 @@ pub struct AppState {
|
||||
/// itself owns direct QUIC/iroh connection establishment.
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
pub mesh_coordinator: AsyncMutex<Option<crate::mesh_llm::MeshCoordinator>>,
|
||||
// ── Workspace-epoch seqlock ───────────────────────────────────────────────
|
||||
//
|
||||
// Epoch is even when stable, odd while a workspace transition is in
|
||||
// progress. Readers capture (keys, relay_url_override) by sampling the
|
||||
// epoch twice around the two field reads; they accept the pair only when
|
||||
// both samples are identical AND even. This prevents consumers from
|
||||
// observing an old actor with a new relay URL (or vice versa) during the
|
||||
// brief overlap of `apply_workspace`. See [`WorkspaceEpochWriteGuard`].
|
||||
pub(crate) workspace_epoch: AtomicU64,
|
||||
pub(crate) workspace_write: Mutex<()>,
|
||||
|
||||
/// `(creator_pubkey_hex, channel_id)` pairs for channels the *named*
|
||||
/// identity created via `create_channel` and has not yet observed its own
|
||||
/// kind:39002 membership entry for. The relay provisions that entry
|
||||
@@ -233,6 +243,8 @@ pub fn build_app_state() -> AppState {
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
mesh_coordinator: AsyncMutex::new(None),
|
||||
pending_owned_channels: Mutex::new(std::collections::HashSet::new()),
|
||||
workspace_epoch: AtomicU64::new(0),
|
||||
workspace_write: Mutex::new(()),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -338,8 +350,70 @@ impl AppState {
|
||||
};
|
||||
crate::huddle::state::emit_huddle_state(&app, &snapshot);
|
||||
}
|
||||
|
||||
/// Acquire the serialized workspace-write guard, transitioning the epoch
|
||||
/// even → odd. `Drop` restores even on every exit path (SeqCst throughout).
|
||||
/// Must be held outermost — never hold `keys` / `relay_url_override` first.
|
||||
pub fn begin_workspace_write(&self) -> Result<WorkspaceEpochWriteGuard<'_>, String> {
|
||||
let guard = self
|
||||
.workspace_write
|
||||
.lock()
|
||||
.map_err(|e| format!("workspace write mutex poisoned: {e}"))?;
|
||||
// Transition even → odd: we are about to start mutating.
|
||||
let prev = self.workspace_epoch.fetch_add(1, Ordering::SeqCst);
|
||||
debug_assert!(
|
||||
prev.is_multiple_of(2),
|
||||
"workspace_epoch should be even before write"
|
||||
);
|
||||
Ok(WorkspaceEpochWriteGuard {
|
||||
epoch: &self.workspace_epoch,
|
||||
_guard: guard,
|
||||
})
|
||||
}
|
||||
|
||||
/// Capture an atomic `(keys, relay_url_override)` pair via the seqlock
|
||||
/// protocol. Returns `Err` after `max_retries` exhausted attempts.
|
||||
pub fn capture_archive_scope(&self, max_retries: u32) -> Result<ArchiveScope, String> {
|
||||
for _ in 0..=max_retries {
|
||||
// Sample epoch before reads.
|
||||
let epoch_before = self.workspace_epoch.load(Ordering::SeqCst);
|
||||
// Odd → writer is mid-transition; yield and retry.
|
||||
if !epoch_before.is_multiple_of(2) {
|
||||
std::thread::yield_now();
|
||||
continue;
|
||||
}
|
||||
|
||||
let keys = self
|
||||
.keys
|
||||
.lock()
|
||||
.map_err(|e| format!("keys mutex poisoned: {e}"))?
|
||||
.clone();
|
||||
let relay_url_override = self
|
||||
.relay_url_override
|
||||
.lock()
|
||||
.map_err(|e| format!("relay_url_override mutex poisoned: {e}"))?
|
||||
.clone();
|
||||
|
||||
// Sample epoch after reads.
|
||||
let epoch_after = self.workspace_epoch.load(Ordering::SeqCst);
|
||||
// Accept only when unchanged and even — both fields from one generation.
|
||||
if epoch_after == epoch_before && epoch_after.is_multiple_of(2) {
|
||||
let actor = keys.public_key().to_hex();
|
||||
return Ok(ArchiveScope {
|
||||
keys,
|
||||
actor,
|
||||
relay_url_override,
|
||||
workspace_epoch: epoch_after,
|
||||
});
|
||||
}
|
||||
// Epoch changed mid-read: retry.
|
||||
}
|
||||
Err("workspace is switching — please retry the archive operation in a moment".to_string())
|
||||
}
|
||||
}
|
||||
|
||||
pub use crate::workspace_epoch::{ArchiveScope, WorkspaceEpochWriteGuard};
|
||||
|
||||
/// Resolve the user's identity key from the app data directory and wire
|
||||
/// the resulting [`RecoveryState`] into `AppState`.
|
||||
///
|
||||
@@ -373,6 +447,7 @@ pub fn resolve_persisted_identity(app: &AppHandle, state: &AppState) -> Result<(
|
||||
// Write keys and storage before setting the recovery flags (Release) so
|
||||
// any thread that reads a flag as false with Acquire sees consistent data.
|
||||
{
|
||||
let _epoch_guard = state.begin_workspace_write()?;
|
||||
let mut active_keys = state.keys.lock().map_err(|e| e.to_string())?;
|
||||
*active_keys = resolved.keys;
|
||||
state.set_identity_storage(resolved.storage);
|
||||
@@ -899,181 +974,24 @@ pub(crate) fn persist_imported_identity(
|
||||
persist_imported_identity_impl(store, keys, legacy_path, data_dir)
|
||||
}
|
||||
|
||||
/// Path of the migration-completed marker within `data_dir`.
|
||||
fn migration_marker_path(data_dir: &std::path::Path) -> std::path::PathBuf {
|
||||
data_dir.join(keyring_config::migration_marker_name(
|
||||
keyring_service(),
|
||||
MIGRATION_MARKER_NAME,
|
||||
))
|
||||
}
|
||||
|
||||
/// Atomically write (and fsync) the migration-completed marker. The content is
|
||||
/// irrelevant — only the file's durable existence is the signal — so a single
|
||||
/// byte keeps it minimal. Atomicity + fsync guarantee that once this returns
|
||||
/// `Ok`, the marker survives a crash, which is what makes deleting the legacy
|
||||
/// file afterward safe.
|
||||
fn write_migration_marker(marker_path: &std::path::Path) -> Result<(), String> {
|
||||
use atomic_write_file::AtomicWriteFile;
|
||||
|
||||
let mut file = AtomicWriteFile::open(marker_path)
|
||||
.map_err(|e| format!("open migration marker for atomic write: {e}"))?;
|
||||
file.write_all(b"1")
|
||||
.map_err(|e| format!("write migration marker: {e}"))?;
|
||||
file.commit()
|
||||
.map_err(|e| format!("commit migration marker: {e}"))
|
||||
}
|
||||
|
||||
/// Generate a fresh identity, persist it through the store, return it.
|
||||
///
|
||||
/// On a keyring-backed persist no file is written, so a later
|
||||
/// keyring-Unreachable boot would see "no file, no marker" (identical to a
|
||||
/// fresh install) and silently rotate the identity. Writing the marker here
|
||||
/// makes that boot fail closed. If the marker write fails, fall back to the
|
||||
/// `0o600` file so the key is never keyring-only-without-marker.
|
||||
fn generate_and_persist(
|
||||
store: &impl IdentityKeyStore,
|
||||
legacy_path: &std::path::Path,
|
||||
data_dir: &std::path::Path,
|
||||
) -> Result<(Keys, IdentityStorage), String> {
|
||||
let keys = Keys::generate();
|
||||
let storage = store_key_preferring_keyring(store, &keys, legacy_path)?;
|
||||
if storage == IdentityStorage::SystemKeyring {
|
||||
let marker_path = migration_marker_path(data_dir);
|
||||
if let Err(e) = write_migration_marker(&marker_path) {
|
||||
eprintln!(
|
||||
"buzz-desktop: stored identity in keyring but failed to write migration marker \
|
||||
({e}); saving identity.key fallback so the key is not stranded"
|
||||
);
|
||||
save_key_file(legacy_path, &keys)?;
|
||||
}
|
||||
}
|
||||
eprintln!(
|
||||
"buzz-desktop: generated and saved identity pubkey {}",
|
||||
keys.public_key().to_hex()
|
||||
);
|
||||
Ok((keys, storage))
|
||||
}
|
||||
|
||||
/// Persist `keys` through the store, silently falling back to the `0o600` file
|
||||
/// when the keyring write fails on an availability error. Reports which backend
|
||||
/// held the key (no verify/marker/delete — those belong to callers that own the
|
||||
/// full migration contract) so the caller can write the migration marker only on
|
||||
/// keyring success.
|
||||
fn store_key_preferring_keyring(
|
||||
store: &impl IdentityKeyStore,
|
||||
keys: &Keys,
|
||||
legacy_path: &std::path::Path,
|
||||
) -> Result<IdentityStorage, String> {
|
||||
let nsec = keys
|
||||
.secret_key()
|
||||
.to_bech32()
|
||||
.map_err(|e| format!("encode nsec: {e}"))?;
|
||||
match store.store(IDENTITY_KEY_NAME, &nsec) {
|
||||
Ok(()) => Ok(IdentityStorage::SystemKeyring),
|
||||
Err(keyring_err) => {
|
||||
eprintln!("buzz-desktop: keyring write failed ({keyring_err}), using file fallback");
|
||||
save_key_file(legacy_path, keys)?;
|
||||
Ok(IdentityStorage::LocalFile)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Ensure the migration marker exists (writing it if absent), then remove the
|
||||
/// leftover `identity.key`. Crash-safe ordering: the marker is written and
|
||||
/// fsync-committed before the file is deleted, so a crash between the two
|
||||
/// leaves the marker on disk and the file intact — the invariant "keyring-only
|
||||
/// implies marker exists" is preserved. If the marker write fails, the file is
|
||||
/// kept so a later keyring-unreachable boot can use it as a fallback.
|
||||
fn ensure_marker_then_cleanup(data_dir: &std::path::Path, legacy_path: &std::path::Path) {
|
||||
let marker_path = migration_marker_path(data_dir);
|
||||
let marker_ok = marker_path.exists()
|
||||
|| write_migration_marker(&marker_path)
|
||||
.map_err(|e| {
|
||||
eprintln!(
|
||||
"buzz-desktop: keyring present but marker missing; \
|
||||
failed to write marker ({e}), keeping identity.key"
|
||||
);
|
||||
})
|
||||
.is_ok();
|
||||
if marker_ok {
|
||||
cleanup_leftover_identity_file(legacy_path);
|
||||
}
|
||||
}
|
||||
|
||||
/// Best-effort removal of a leftover `identity.key` once the keyring is the
|
||||
/// authoritative store. Idempotent: a missing file is success. Logs but does
|
||||
/// not error on failure — a delete failure must never block startup.
|
||||
fn cleanup_leftover_identity_file(legacy_path: &std::path::Path) {
|
||||
if !legacy_path.exists() {
|
||||
return;
|
||||
}
|
||||
match std::fs::remove_file(legacy_path) {
|
||||
Ok(()) => eprintln!("buzz-desktop: removed leftover identity.key (key is in keyring)"),
|
||||
Err(e) => eprintln!("buzz-desktop: failed to remove leftover identity.key: {e}"),
|
||||
}
|
||||
}
|
||||
|
||||
/// Quarantine a corrupt `identity.key` with a timestamp so prior backups are
|
||||
/// never overwritten.
|
||||
fn quarantine_corrupt_key(key_path: &std::path::Path, data_dir: &std::path::Path, error: &str) {
|
||||
if !key_path.exists() {
|
||||
return;
|
||||
}
|
||||
let ts = std::time::SystemTime::now()
|
||||
.duration_since(std::time::UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
let bad_name = format!("identity.key.bad.{ts}");
|
||||
eprintln!("buzz-desktop: corrupt identity.key ({error}), quarantining to {bad_name}");
|
||||
let bad_path = data_dir.join(bad_name);
|
||||
if std::fs::rename(key_path, &bad_path).is_err() {
|
||||
let _ = std::fs::remove_file(key_path);
|
||||
}
|
||||
}
|
||||
|
||||
fn load_key_file(path: &std::path::Path) -> Result<Keys, String> {
|
||||
let content = std::fs::read_to_string(path).map_err(|e| format!("read identity.key: {e}"))?;
|
||||
let trimmed = content.trim();
|
||||
if trimmed.is_empty() {
|
||||
return Err("empty identity.key".to_string());
|
||||
}
|
||||
Keys::parse(trimmed).map_err(|e| format!("parse identity.key: {e}"))
|
||||
}
|
||||
|
||||
/// Atomically write the key to disk. Uses `atomic-write-file` which:
|
||||
/// 1. Writes to a temp file in the same directory
|
||||
/// 2. Calls fsync on the file
|
||||
/// 3. Renames temp → target (atomic on POSIX, best-effort on Windows)
|
||||
/// 4. Calls fsync on the parent directory
|
||||
///
|
||||
/// On Unix, the file is created with mode 0600 (owner read/write only).
|
||||
/// On Windows, default ACLs apply — the app data directory is already
|
||||
/// per-user, so the key is not world-readable in practice.
|
||||
pub(crate) fn save_key_file(path: &std::path::Path, keys: &Keys) -> Result<(), String> {
|
||||
use atomic_write_file::AtomicWriteFile;
|
||||
|
||||
let nsec = keys
|
||||
.secret_key()
|
||||
.to_bech32()
|
||||
.map_err(|e| format!("encode nsec: {e}"))?;
|
||||
|
||||
let mut file = AtomicWriteFile::open(path)
|
||||
.map_err(|e| format!("open identity.key for atomic write: {e}"))?;
|
||||
|
||||
// Set owner-only permissions before writing the secret.
|
||||
#[cfg(unix)]
|
||||
{
|
||||
use std::os::unix::fs::PermissionsExt;
|
||||
file.set_permissions(std::fs::Permissions::from_mode(0o600))
|
||||
.map_err(|e| format!("set identity.key permissions: {e}"))?;
|
||||
}
|
||||
|
||||
file.write_all(nsec.as_bytes())
|
||||
.map_err(|e| format!("write identity.key: {e}"))?;
|
||||
file.commit()
|
||||
.map_err(|e| format!("commit identity.key: {e}"))
|
||||
}
|
||||
// File-system and OS-keyring helpers extracted to keep this module under the
|
||||
// file-size ratchet. The child module has full access to this module's private
|
||||
// items via `super::`.
|
||||
#[path = "app_state_keyfile_ops.rs"]
|
||||
mod keyfile_ops;
|
||||
use keyfile_ops::{
|
||||
ensure_marker_then_cleanup, generate_and_persist, load_key_file, migration_marker_path,
|
||||
quarantine_corrupt_key, write_migration_marker,
|
||||
};
|
||||
// Used by app_state_tests.rs via `use super::*`.
|
||||
#[cfg(test)]
|
||||
use keyfile_ops::cleanup_leftover_identity_file;
|
||||
pub(crate) use keyfile_ops::save_key_file;
|
||||
|
||||
#[cfg(test)]
|
||||
#[path = "app_state_tests.rs"]
|
||||
mod tests;
|
||||
|
||||
#[cfg(test)]
|
||||
#[path = "app_state_epoch_tests.rs"]
|
||||
mod epoch_tests;
|
||||
|
||||
278
desktop/src-tauri/src/app_state_epoch_tests.rs
Normal file
278
desktop/src-tauri/src/app_state_epoch_tests.rs
Normal file
@@ -0,0 +1,278 @@
|
||||
// Workspace-epoch seqlock protocol tests.
|
||||
// Colocated as a separate test module to satisfy the file-size ratchet.
|
||||
// See app_state_tests.rs for the preamble note on the false-green guard.
|
||||
|
||||
// These tests pin the seqlock invariants using the production guard and capture
|
||||
// helpers ONLY. Direct writes to `state.keys` or `state.relay_url_override`
|
||||
// are intentionally absent here — using them would bypass the protocol under
|
||||
// test and produce a false green. All writes go through `begin_workspace_write`.
|
||||
|
||||
use super::*;
|
||||
|
||||
/// Build a minimal AppState with known keys/override for epoch protocol tests.
|
||||
/// Does NOT call `build_app_state` (avoids keyring/FS I/O). Only the fields
|
||||
/// relevant to the seqlock protocol are initialized with non-default values;
|
||||
/// everything else is zeroed/None to match `Default`.
|
||||
fn make_epoch_test_state(keys: Keys) -> AppState {
|
||||
use std::sync::atomic::{AtomicBool, AtomicU16, AtomicU8};
|
||||
AppState {
|
||||
keys: Mutex::new(keys),
|
||||
identity_storage: AtomicU8::new(0),
|
||||
http_client: reqwest::Client::new(),
|
||||
media_fetch_client: reqwest::Client::new(),
|
||||
relay_url_override: Mutex::new(None),
|
||||
managed_agent_restore_pending: AtomicBool::new(false),
|
||||
managed_agent_profile_reconcile_enabled: AtomicBool::new(false),
|
||||
shutdown_started: AtomicBool::new(false),
|
||||
managed_agent_runtime_transition: Mutex::new(()),
|
||||
managed_agents_store_lock: Mutex::new(()),
|
||||
channel_templates_store_lock: Mutex::new(()),
|
||||
managed_agent_processes: Mutex::new(std::collections::HashMap::new()),
|
||||
huddle_state: Mutex::new(crate::huddle::HuddleState::default()),
|
||||
huddle_audio: Default::default(),
|
||||
app_handle: Mutex::new(None),
|
||||
media_proxy_port: AtomicU16::new(0),
|
||||
keyring_locked: AtomicBool::new(false),
|
||||
identity_lost: AtomicBool::new(false),
|
||||
identity_mutation: Mutex::new(()),
|
||||
reset_failed: AtomicBool::new(false),
|
||||
session_config_cache: Mutex::new(std::collections::HashMap::new()),
|
||||
prevent_sleep: std::sync::Arc::new(Mutex::new(
|
||||
crate::prevent_sleep::PreventSleepState::default(),
|
||||
)),
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
mesh_llm_runtime: tokio::sync::Mutex::new(None),
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
mesh_recovery: crate::mesh_llm::MeshRecoveryState::default(),
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
mesh_coordinator: tokio::sync::Mutex::new(None),
|
||||
workspace_epoch: std::sync::atomic::AtomicU64::new(0),
|
||||
workspace_write: Mutex::new(()),
|
||||
pending_owned_channels: Mutex::new(std::collections::HashSet::new()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Epoch begins even and a fresh capture succeeds.
|
||||
#[test]
|
||||
fn epoch_protocol_initial_capture_succeeds() {
|
||||
let keys = Keys::generate();
|
||||
let state = make_epoch_test_state(keys.clone());
|
||||
|
||||
let scope = state.capture_archive_scope(4).expect("initial capture");
|
||||
assert_eq!(scope.actor, keys.public_key().to_hex());
|
||||
assert!(
|
||||
scope.workspace_epoch.is_multiple_of(2),
|
||||
"captured epoch must be even"
|
||||
);
|
||||
}
|
||||
|
||||
/// While a writer guard is held the epoch is odd; capture retries and only
|
||||
/// succeeds after the guard is dropped (restoring even). Additionally asserts
|
||||
/// that a second acquisition of the writer guard blocks until the first drops
|
||||
/// (writer exclusion).
|
||||
#[test]
|
||||
fn epoch_protocol_writer_exclusion_and_capture_retry() {
|
||||
use std::sync::atomic::Ordering;
|
||||
use std::sync::Arc;
|
||||
|
||||
let keys = Keys::generate();
|
||||
let state = Arc::new(make_epoch_test_state(keys));
|
||||
|
||||
// Acquire write guard → epoch goes odd.
|
||||
let guard = state.begin_workspace_write().expect("first write guard");
|
||||
let odd = state.workspace_epoch.load(Ordering::SeqCst);
|
||||
assert_eq!(odd % 2, 1, "epoch must be odd while guard is held");
|
||||
|
||||
// With the guard held, mutate relay_url_override (simulating apply_workspace).
|
||||
{
|
||||
let mut ovr = state.relay_url_override.lock().unwrap();
|
||||
*ovr = Some("wss://test.relay".to_string());
|
||||
}
|
||||
|
||||
// Spawn a thread that tries to acquire a second write guard; it must block
|
||||
// until we drop the first one.
|
||||
let state2 = Arc::clone(&state);
|
||||
let handle = std::thread::spawn(move || {
|
||||
// This blocks until the outer guard is dropped.
|
||||
let _g = state2.begin_workspace_write().expect("second write guard");
|
||||
// Confirm the second guard restores to even after it drops.
|
||||
});
|
||||
|
||||
// A capture attempt while odd must not return a mixed-gen scope.
|
||||
// With max_retries=0 it fails fast rather than spinning.
|
||||
let result = state.capture_archive_scope(0);
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"capture with max_retries=0 while epoch odd must fail"
|
||||
);
|
||||
|
||||
// Drop the first guard → epoch goes even, unblocks the second thread,
|
||||
// and subsequent captures succeed.
|
||||
drop(guard);
|
||||
let even = state.workspace_epoch.load(Ordering::SeqCst);
|
||||
assert_eq!(even % 2, 0, "epoch must be even after guard drop");
|
||||
|
||||
// Wait for the second thread to finish.
|
||||
handle.join().expect("second guard thread panicked");
|
||||
|
||||
// Now capture succeeds.
|
||||
let scope = state
|
||||
.capture_archive_scope(4)
|
||||
.expect("capture after release");
|
||||
assert!(scope.workspace_epoch.is_multiple_of(2));
|
||||
}
|
||||
|
||||
/// Drop (RAII restoration) on explicit drop and via `?` early return restores
|
||||
/// an even epoch on every exit path.
|
||||
#[test]
|
||||
fn epoch_protocol_raii_always_restores_even() {
|
||||
use std::sync::atomic::Ordering;
|
||||
|
||||
let state = make_epoch_test_state(Keys::generate());
|
||||
|
||||
// Normal drop.
|
||||
{
|
||||
let _g = state.begin_workspace_write().expect("guard");
|
||||
assert_eq!(
|
||||
state.workspace_epoch.load(Ordering::SeqCst) % 2,
|
||||
1,
|
||||
"odd while held"
|
||||
);
|
||||
}
|
||||
assert_eq!(
|
||||
state.workspace_epoch.load(Ordering::SeqCst) % 2,
|
||||
0,
|
||||
"even after normal drop"
|
||||
);
|
||||
|
||||
// Simulated early-return via a closure that acquires and immediately drops
|
||||
// the guard when an error is returned.
|
||||
let result: Result<(), String> = (|| {
|
||||
let _g = state.begin_workspace_write()?;
|
||||
// Return early before the closure completes.
|
||||
return Err("early return".to_string());
|
||||
#[allow(unreachable_code)]
|
||||
Ok(())
|
||||
})();
|
||||
assert!(result.is_err());
|
||||
assert_eq!(
|
||||
state.workspace_epoch.load(Ordering::SeqCst) % 2,
|
||||
0,
|
||||
"even after early-return drop"
|
||||
);
|
||||
|
||||
// Simulated panic / catch_unwind.
|
||||
// AppState contains non-UnwindSafe fields (reqwest::Client, etc.) so we
|
||||
// assert the safety boundary explicitly — this test only exercises the
|
||||
// epoch AtomicU64 and the Mutex<()> guard, both of which are panic-safe.
|
||||
let state_ref = std::panic::AssertUnwindSafe(&state);
|
||||
let panic_result = std::panic::catch_unwind(|| {
|
||||
let _g = state_ref.begin_workspace_write().expect("guard for panic");
|
||||
panic!("simulated panic");
|
||||
});
|
||||
assert!(panic_result.is_err(), "panic must be caught");
|
||||
assert_eq!(
|
||||
state.workspace_epoch.load(Ordering::SeqCst) % 2,
|
||||
0,
|
||||
"even after panic/catch_unwind"
|
||||
);
|
||||
}
|
||||
|
||||
/// A poisoned `relay_url_override` mutex causes `capture_archive_scope` to
|
||||
/// return `Err` rather than accepting potentially torn state.
|
||||
#[test]
|
||||
fn epoch_protocol_poisoned_mutex_causes_capture_error() {
|
||||
use std::sync::Arc;
|
||||
|
||||
let state = Arc::new(make_epoch_test_state(Keys::generate()));
|
||||
let state2 = Arc::clone(&state);
|
||||
|
||||
// Poison `relay_url_override` by panicking while holding the lock.
|
||||
let _r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(move || {
|
||||
let _lock = state2.relay_url_override.lock().unwrap();
|
||||
panic!("poison the mutex");
|
||||
}));
|
||||
|
||||
// After poisoning, capture_archive_scope must return Err.
|
||||
let result = state.capture_archive_scope(1);
|
||||
assert!(
|
||||
result.is_err(),
|
||||
"capture must fail when relay_url_override is poisoned"
|
||||
);
|
||||
}
|
||||
|
||||
/// Mixed-generation barrier test: a writer is stalled mid-mutation (after
|
||||
/// writing relay_url_override but before writing keys). A concurrent capture
|
||||
/// with max_retries > 0 must never return a mixed-generation scope; it must
|
||||
/// only succeed after the writer completes and produces a co-generational pair.
|
||||
#[test]
|
||||
fn epoch_protocol_mixed_generation_rejected_while_mid_transition() {
|
||||
use std::sync::atomic::Ordering;
|
||||
use std::sync::{Arc, Barrier};
|
||||
|
||||
let initial_keys = Keys::generate();
|
||||
let new_keys = Keys::generate();
|
||||
let state = Arc::new(make_epoch_test_state(initial_keys.clone()));
|
||||
|
||||
// Two-phase barrier: first rendezvous lets the writer signal it has
|
||||
// written the relay override but not yet the keys; second rendezvous lets
|
||||
// the test confirm the capture it received (if any) before the writer
|
||||
// proceeds to update keys.
|
||||
let barrier_after_override = Arc::new(Barrier::new(2));
|
||||
let barrier_after_keys = Arc::new(Barrier::new(2));
|
||||
|
||||
let state_writer = Arc::clone(&state);
|
||||
let barrier1 = Arc::clone(&barrier_after_override);
|
||||
let barrier2 = Arc::clone(&barrier_after_keys);
|
||||
let new_keys_clone = new_keys.clone();
|
||||
|
||||
let writer_thread = std::thread::spawn(move || {
|
||||
// Acquire the write guard → epoch goes odd.
|
||||
let _guard = state_writer.begin_workspace_write().expect("write guard");
|
||||
// Write override but NOT keys yet.
|
||||
{
|
||||
let mut ovr = state_writer.relay_url_override.lock().unwrap();
|
||||
*ovr = Some("wss://new.relay".to_string());
|
||||
}
|
||||
// Signal: override written, keys not yet updated.
|
||||
barrier1.wait();
|
||||
// Wait for reader to attempt capture.
|
||||
barrier2.wait();
|
||||
// Now write keys (completing the compound mutation).
|
||||
{
|
||||
let mut k = state_writer.keys.lock().unwrap();
|
||||
*k = new_keys_clone;
|
||||
}
|
||||
// Guard drops here → epoch goes even.
|
||||
});
|
||||
|
||||
// Wait until the writer is mid-mutation (override written, keys old, epoch odd).
|
||||
barrier_after_override.wait();
|
||||
|
||||
// Epoch must be odd at this point.
|
||||
assert_eq!(
|
||||
state.workspace_epoch.load(Ordering::SeqCst) % 2,
|
||||
1,
|
||||
"epoch must be odd while writer is mid-transition"
|
||||
);
|
||||
|
||||
// Attempt capture with 0 retries — must fail because epoch is odd.
|
||||
let result_during_mutation = state.capture_archive_scope(0);
|
||||
assert!(
|
||||
result_during_mutation.is_err(),
|
||||
"capture must fail when epoch is odd (mid-transition)"
|
||||
);
|
||||
|
||||
// Release writer to complete the mutation.
|
||||
barrier_after_keys.wait();
|
||||
writer_thread.join().expect("writer thread panicked");
|
||||
|
||||
// Epoch is now even; capture must succeed and return the NEW generation.
|
||||
let scope = state.capture_archive_scope(8).expect("capture after write");
|
||||
assert_eq!(scope.relay_url_override.as_deref(), Some("wss://new.relay"));
|
||||
assert_eq!(scope.actor, new_keys.public_key().to_hex());
|
||||
assert!(
|
||||
scope.workspace_epoch.is_multiple_of(2),
|
||||
"captured epoch must be even"
|
||||
);
|
||||
}
|
||||
195
desktop/src-tauri/src/app_state_keyfile_ops.rs
Normal file
195
desktop/src-tauri/src/app_state_keyfile_ops.rs
Normal file
@@ -0,0 +1,195 @@
|
||||
//! File-system and OS-keyring helpers extracted from `app_state` to keep that
|
||||
//! module under the file-size ratchet. Included as a child module of
|
||||
//! `app_state` so every item here has unrestricted access to the parent's
|
||||
//! private items (constants, trait, types) via `super::`.
|
||||
|
||||
use std::io::Write;
|
||||
|
||||
use nostr::ToBech32;
|
||||
|
||||
use super::{
|
||||
keyring_config, keyring_service, IdentityKeyStore, IdentityStorage, Keys, IDENTITY_KEY_NAME,
|
||||
MIGRATION_MARKER_NAME,
|
||||
};
|
||||
|
||||
/// Path of the migration-completed marker within `data_dir`.
|
||||
pub(super) fn migration_marker_path(data_dir: &std::path::Path) -> std::path::PathBuf {
|
||||
data_dir.join(keyring_config::migration_marker_name(
|
||||
keyring_service(),
|
||||
MIGRATION_MARKER_NAME,
|
||||
))
|
||||
}
|
||||
|
||||
/// Atomically write (and fsync) the migration-completed marker. The content is
|
||||
/// irrelevant — only the file's durable existence is the signal — so a single
|
||||
/// byte keeps it minimal. Atomicity + fsync guarantee that once this returns
|
||||
/// `Ok`, the marker survives a crash, which is what makes deleting the legacy
|
||||
/// file afterward safe.
|
||||
pub(super) fn write_migration_marker(marker_path: &std::path::Path) -> Result<(), String> {
|
||||
use atomic_write_file::AtomicWriteFile;
|
||||
|
||||
let mut file = AtomicWriteFile::open(marker_path)
|
||||
.map_err(|e| format!("open migration marker for atomic write: {e}"))?;
|
||||
file.write_all(b"1")
|
||||
.map_err(|e| format!("write migration marker: {e}"))?;
|
||||
file.commit()
|
||||
.map_err(|e| format!("commit migration marker: {e}"))
|
||||
}
|
||||
|
||||
/// Generate a fresh identity, persist it through the store, return it.
|
||||
///
|
||||
/// On a keyring-backed persist no file is written, so a later
|
||||
/// keyring-Unreachable boot would see "no file, no marker" (identical to a
|
||||
/// fresh install) and silently rotate the identity. Writing the marker here
|
||||
/// makes that boot fail closed. If the marker write fails, fall back to the
|
||||
/// `0o600` file so the key is never keyring-only-without-marker.
|
||||
pub(super) fn generate_and_persist(
|
||||
store: &impl IdentityKeyStore,
|
||||
legacy_path: &std::path::Path,
|
||||
data_dir: &std::path::Path,
|
||||
) -> Result<(Keys, IdentityStorage), String> {
|
||||
let keys = Keys::generate();
|
||||
let storage = store_key_preferring_keyring(store, &keys, legacy_path)?;
|
||||
if storage == IdentityStorage::SystemKeyring {
|
||||
let marker_path = migration_marker_path(data_dir);
|
||||
if let Err(e) = write_migration_marker(&marker_path) {
|
||||
eprintln!(
|
||||
"buzz-desktop: stored identity in keyring but failed to write migration marker \
|
||||
({e}); saving identity.key fallback so the key is not stranded"
|
||||
);
|
||||
save_key_file(legacy_path, &keys)?;
|
||||
}
|
||||
}
|
||||
eprintln!(
|
||||
"buzz-desktop: generated and saved identity pubkey {}",
|
||||
keys.public_key().to_hex()
|
||||
);
|
||||
Ok((keys, storage))
|
||||
}
|
||||
|
||||
/// Persist `keys` through the store, silently falling back to the `0o600` file
|
||||
/// when the keyring write fails on an availability error. Reports which backend
|
||||
/// held the key (no verify/marker/delete — those belong to callers that own the
|
||||
/// full migration contract) so the caller can write the migration marker only on
|
||||
/// keyring success.
|
||||
pub(super) fn store_key_preferring_keyring(
|
||||
store: &impl IdentityKeyStore,
|
||||
keys: &Keys,
|
||||
legacy_path: &std::path::Path,
|
||||
) -> Result<IdentityStorage, String> {
|
||||
let nsec = keys
|
||||
.secret_key()
|
||||
.to_bech32()
|
||||
.map_err(|e| format!("encode nsec: {e}"))?;
|
||||
match store.store(IDENTITY_KEY_NAME, &nsec) {
|
||||
Ok(()) => Ok(IdentityStorage::SystemKeyring),
|
||||
Err(keyring_err) => {
|
||||
eprintln!("buzz-desktop: keyring write failed ({keyring_err}), using file fallback");
|
||||
save_key_file(legacy_path, keys)?;
|
||||
Ok(IdentityStorage::LocalFile)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Ensure the migration marker exists (writing it if absent), then remove the
|
||||
/// leftover `identity.key`. Crash-safe ordering: the marker is written and
|
||||
/// fsync-committed before the file is deleted, so a crash between the two
|
||||
/// leaves the marker on disk and the file intact — the invariant "keyring-only
|
||||
/// implies marker exists" is preserved. If the marker write fails, the file is
|
||||
/// kept so a later keyring-unreachable boot can use it as a fallback.
|
||||
pub(super) fn ensure_marker_then_cleanup(
|
||||
data_dir: &std::path::Path,
|
||||
legacy_path: &std::path::Path,
|
||||
) {
|
||||
let marker_path = migration_marker_path(data_dir);
|
||||
let marker_ok = marker_path.exists()
|
||||
|| write_migration_marker(&marker_path)
|
||||
.map_err(|e| {
|
||||
eprintln!(
|
||||
"buzz-desktop: keyring present but marker missing; \
|
||||
failed to write marker ({e}), keeping identity.key"
|
||||
);
|
||||
})
|
||||
.is_ok();
|
||||
if marker_ok {
|
||||
cleanup_leftover_identity_file(legacy_path);
|
||||
}
|
||||
}
|
||||
|
||||
/// Best-effort removal of a leftover `identity.key` once the keyring is the
|
||||
/// authoritative store. Idempotent: a missing file is success. Logs but does
|
||||
/// not error on failure — a delete failure must never block startup.
|
||||
pub(super) fn cleanup_leftover_identity_file(legacy_path: &std::path::Path) {
|
||||
if !legacy_path.exists() {
|
||||
return;
|
||||
}
|
||||
match std::fs::remove_file(legacy_path) {
|
||||
Ok(()) => eprintln!("buzz-desktop: removed leftover identity.key (key is in keyring)"),
|
||||
Err(e) => eprintln!("buzz-desktop: failed to remove leftover identity.key: {e}"),
|
||||
}
|
||||
}
|
||||
|
||||
/// Quarantine a corrupt `identity.key` with a timestamp so prior backups are
|
||||
/// never overwritten.
|
||||
pub(super) fn quarantine_corrupt_key(
|
||||
key_path: &std::path::Path,
|
||||
data_dir: &std::path::Path,
|
||||
error: &str,
|
||||
) {
|
||||
if !key_path.exists() {
|
||||
return;
|
||||
}
|
||||
let ts = std::time::SystemTime::now()
|
||||
.duration_since(std::time::UNIX_EPOCH)
|
||||
.map(|d| d.as_secs())
|
||||
.unwrap_or(0);
|
||||
let bad_name = format!("identity.key.bad.{ts}");
|
||||
eprintln!("buzz-desktop: corrupt identity.key ({error}), quarantining to {bad_name}");
|
||||
let bad_path = data_dir.join(bad_name);
|
||||
if std::fs::rename(key_path, &bad_path).is_err() {
|
||||
let _ = std::fs::remove_file(key_path);
|
||||
}
|
||||
}
|
||||
|
||||
pub(super) fn load_key_file(path: &std::path::Path) -> Result<Keys, String> {
|
||||
let content = std::fs::read_to_string(path).map_err(|e| format!("read identity.key: {e}"))?;
|
||||
let trimmed = content.trim();
|
||||
if trimmed.is_empty() {
|
||||
return Err("empty identity.key".to_string());
|
||||
}
|
||||
Keys::parse(trimmed).map_err(|e| format!("parse identity.key: {e}"))
|
||||
}
|
||||
|
||||
/// Atomically write the key to disk. Uses `atomic-write-file` which:
|
||||
/// 1. Writes to a temp file in the same directory
|
||||
/// 2. Calls fsync on the file
|
||||
/// 3. Renames temp → target (atomic on POSIX, best-effort on Windows)
|
||||
/// 4. Calls fsync on the parent directory
|
||||
///
|
||||
/// On Unix, the file is created with mode 0600 (owner read/write only).
|
||||
/// On Windows, default ACLs apply — the app data directory is already
|
||||
/// per-user, so the key is not world-readable in practice.
|
||||
pub(crate) fn save_key_file(path: &std::path::Path, keys: &Keys) -> Result<(), String> {
|
||||
use atomic_write_file::AtomicWriteFile;
|
||||
|
||||
let nsec = keys
|
||||
.secret_key()
|
||||
.to_bech32()
|
||||
.map_err(|e| format!("encode nsec: {e}"))?;
|
||||
|
||||
let mut file = AtomicWriteFile::open(path)
|
||||
.map_err(|e| format!("open identity.key for atomic write: {e}"))?;
|
||||
|
||||
// Set owner-only permissions before writing the secret.
|
||||
#[cfg(unix)]
|
||||
{
|
||||
use std::os::unix::fs::PermissionsExt;
|
||||
file.set_permissions(std::fs::Permissions::from_mode(0o600))
|
||||
.map_err(|e| format!("set identity.key permissions: {e}"))?;
|
||||
}
|
||||
|
||||
file.write_all(nsec.as_bytes())
|
||||
.map_err(|e| format!("write identity.key: {e}"))?;
|
||||
file.commit()
|
||||
.map_err(|e| format!("commit identity.key: {e}"))
|
||||
}
|
||||
@@ -420,6 +420,7 @@ fn commit_imported_identity(
|
||||
// observing false is guaranteed to see the updated keys.
|
||||
let pubkey = keys.public_key();
|
||||
{
|
||||
let _epoch_guard = state.begin_workspace_write()?;
|
||||
let mut active_keys = state.keys.lock().map_err(|e| e.to_string())?;
|
||||
*active_keys = keys;
|
||||
state.set_identity_storage(storage);
|
||||
|
||||
@@ -6,7 +6,8 @@
|
||||
//! "Archive" button when the current user is the owner-of-agent),
|
||||
//! - submit `kind:9035` archive and `kind:9036` unarchive requests (consent
|
||||
//! path is selected by the relay; we just build the wire form),
|
||||
//! - read the relay's `kind:13535` archive snapshot to drive UI flair.
|
||||
//! - read the relay's `kind:13535` archive snapshot to drive UI flair,
|
||||
//! - query the owner's `kind:30177` relay inventory for the Instances sheet.
|
||||
//!
|
||||
//! Spec: `docs/nips/NIP-IA.md`. The relay performs full authorization —
|
||||
//! see §Owner-of-Agent Requests and §Relay Processing Algorithm.
|
||||
@@ -15,11 +16,11 @@ use serde::{Deserialize, Serialize};
|
||||
use tauri::State;
|
||||
|
||||
use crate::{
|
||||
app_state::AppState,
|
||||
app_state::{AppState, ArchiveScope},
|
||||
events,
|
||||
relay::{
|
||||
classify_request_error, query_relay, relay_http_base_url, relay_ws_url_with_override,
|
||||
submit_event, SubmitEventResponse,
|
||||
classify_request_error, query_relay, query_relay_at_with_keys, relay_http_base_url,
|
||||
relay_ws_url_with_override, submit_event_at_with_keys, SubmitEventResponse,
|
||||
},
|
||||
};
|
||||
|
||||
@@ -74,6 +75,82 @@ pub(crate) async fn fetch_kind0(
|
||||
Ok(events.into_iter().next())
|
||||
}
|
||||
|
||||
// ── NipIaOwnerProof classifier ───────────────────────────────────────────────
|
||||
|
||||
/// Result of verifying NIP-OA ownership of `target` by a candidate owner.
|
||||
///
|
||||
/// Reuses `verify_auth_tag` (syntax + Schnorr signature). Condition-clause
|
||||
/// evaluation is deliberately skipped — per NIP-IA published-profile rule 6
|
||||
/// the relay verifies the condition; the client only checks the structural
|
||||
/// validity and signature.
|
||||
#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
|
||||
#[serde(rename_all = "snake_case", tag = "result")]
|
||||
pub enum NipIaOwnerProof {
|
||||
/// Valid NIP-OA auth tag present, signature checks out, owner matches caller.
|
||||
Verified,
|
||||
/// Target kind:0 has no `auth` tag at all.
|
||||
// Constructed when the kind:0 fetch returns nothing; present for API completeness
|
||||
// and future callers that distinguish "no profile" from "no auth tag".
|
||||
#[allow(dead_code)]
|
||||
MissingProfile,
|
||||
/// Kind:0 present but no `auth` tag found.
|
||||
MissingAuth,
|
||||
/// More than one `auth` tag in the kind:0 — ambiguous, cannot select canonical.
|
||||
MultipleAuthTags,
|
||||
/// Auth tag present but signature or format is invalid.
|
||||
InvalidAuth,
|
||||
/// Auth tag verifies but the declared owner does not match the caller.
|
||||
OwnerMismatch { declared_owner: String },
|
||||
}
|
||||
|
||||
/// Classify the NIP-OA ownership of `target_kind0` for `candidate_owner_hex`.
|
||||
///
|
||||
/// Called after a kind:0 fetch; `candidate_owner_hex` is the caller's pubkey.
|
||||
/// No condition-clause evaluation — only syntax + Schnorr signature check.
|
||||
pub(crate) fn classify_nip_ia_owner_proof(
|
||||
target_kind0: &nostr::Event,
|
||||
candidate_owner_hex: &str,
|
||||
) -> NipIaOwnerProof {
|
||||
let target_hex = target_kind0.pubkey.to_hex();
|
||||
let target_compat = match nostr::PublicKey::from_hex(&target_hex) {
|
||||
Ok(pk) => pk,
|
||||
Err(_) => return NipIaOwnerProof::InvalidAuth,
|
||||
};
|
||||
|
||||
let auth_tags: Vec<&[String]> = target_kind0
|
||||
.tags
|
||||
.iter()
|
||||
.map(|t| t.as_slice())
|
||||
.filter(|s| s.first().map(String::as_str) == Some("auth") && s.len() == 4)
|
||||
.collect();
|
||||
|
||||
if auth_tags.is_empty() {
|
||||
return NipIaOwnerProof::MissingAuth;
|
||||
}
|
||||
if auth_tags.len() > 1 {
|
||||
return NipIaOwnerProof::MultipleAuthTags;
|
||||
}
|
||||
|
||||
let tag_slice = auth_tags[0];
|
||||
let json = match serde_json::to_string(tag_slice) {
|
||||
Ok(j) => j,
|
||||
Err(_) => return NipIaOwnerProof::InvalidAuth,
|
||||
};
|
||||
match buzz_sdk_pkg::nip_oa::verify_auth_tag(&json, &target_compat) {
|
||||
Ok(owner_pk) => {
|
||||
let owner_hex = owner_pk.to_hex();
|
||||
if owner_hex.eq_ignore_ascii_case(candidate_owner_hex) {
|
||||
NipIaOwnerProof::Verified
|
||||
} else {
|
||||
NipIaOwnerProof::OwnerMismatch {
|
||||
declared_owner: owner_hex,
|
||||
}
|
||||
}
|
||||
}
|
||||
Err(_) => NipIaOwnerProof::InvalidAuth,
|
||||
}
|
||||
}
|
||||
|
||||
// ── Owner-of-agent resolution ───────────────────────────────────────────────
|
||||
|
||||
#[derive(Debug, Serialize)]
|
||||
@@ -115,6 +192,15 @@ pub async fn resolve_oa_owner(
|
||||
}))
|
||||
}
|
||||
|
||||
// ── Archive kind enum ────────────────────────────────────────────────────────
|
||||
|
||||
/// Discriminant for the scoped archive operation — which NIP-IA request kind.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub(crate) enum ArchiveKind {
|
||||
Archive, // kind:9035
|
||||
Unarchive, // kind:9036
|
||||
}
|
||||
|
||||
// ── Archive / unarchive requests ────────────────────────────────────────────
|
||||
|
||||
#[derive(Debug, Deserialize)]
|
||||
@@ -148,17 +234,17 @@ pub async fn archive_identity(
|
||||
req: ArchiveRequest,
|
||||
state: State<'_, AppState>,
|
||||
) -> Result<SubmitEventResponse, String> {
|
||||
let auth_tag = maybe_owner_auth_tag(&state, &req.target_pubkey).await?;
|
||||
let auth_ref = auth_tag.as_ref();
|
||||
|
||||
let builder = events::build_archive_identity_request(
|
||||
let scope = state.capture_archive_scope(8)?;
|
||||
scoped_archive_operation(
|
||||
&state,
|
||||
&scope,
|
||||
ArchiveKind::Archive,
|
||||
&req.target_pubkey,
|
||||
&req.content,
|
||||
req.reason.as_deref(),
|
||||
req.replaced_by.as_deref(),
|
||||
auth_ref,
|
||||
)?;
|
||||
submit_event(builder, &state).await
|
||||
)
|
||||
.await
|
||||
}
|
||||
|
||||
/// Submit a `kind:9036` unarchive request to the relay.
|
||||
@@ -167,50 +253,122 @@ pub async fn unarchive_identity(
|
||||
req: UnarchiveRequest,
|
||||
state: State<'_, AppState>,
|
||||
) -> Result<SubmitEventResponse, String> {
|
||||
let auth_tag = maybe_owner_auth_tag(&state, &req.target_pubkey).await?;
|
||||
let auth_ref = auth_tag.as_ref();
|
||||
|
||||
let builder = events::build_unarchive_identity_request(
|
||||
let scope = state.capture_archive_scope(8)?;
|
||||
scoped_archive_operation(
|
||||
&state,
|
||||
&scope,
|
||||
ArchiveKind::Unarchive,
|
||||
&req.target_pubkey,
|
||||
&req.content,
|
||||
req.reason.as_deref(),
|
||||
auth_ref,
|
||||
)?;
|
||||
submit_event(builder, &state).await
|
||||
None,
|
||||
)
|
||||
.await
|
||||
}
|
||||
|
||||
/// If the current user is the verified NIP-OA owner of `target`, return the
|
||||
/// `auth` tag elements (label, owner, conditions, sig) for attachment to a
|
||||
/// 9035/9036 request. Otherwise return `None` (self / admin / no-path).
|
||||
/// Core non-Tauri implementation: fetch → classify → mint → build/sign → submit.
|
||||
///
|
||||
/// The relay independently re-fetches the target's live `kind:0` and verifies
|
||||
/// against it; this tag is intent + freshness evidence, not the authority.
|
||||
async fn maybe_owner_auth_tag(
|
||||
/// Consumes only the immutable `scope` — no `AppState` guard is held across
|
||||
/// any await. Parameterized for both 9035 and 9036 so both directions inherit
|
||||
/// identical scope and credential guarantees.
|
||||
///
|
||||
/// Owner-proof semantics (`maybe_` rule):
|
||||
/// - Self path: no fetch, no auth tag.
|
||||
/// - `NipIaOwnerProof::Verified`: mint a fresh empty-condition auth tag from
|
||||
/// owner keys. Never copies the profile tag.
|
||||
/// - Any other classifier result: no auth tag, NOT a local error — the relay
|
||||
/// picks Admin or rejects; relay rejection is surfaced directly without retry
|
||||
/// or consent-path reinterpretation.
|
||||
pub(crate) async fn scoped_archive_operation(
|
||||
state: &AppState,
|
||||
scope: &ArchiveScope,
|
||||
kind: ArchiveKind,
|
||||
target_pubkey: &str,
|
||||
) -> Result<Option<[String; 4]>, String> {
|
||||
let my_pubkey = {
|
||||
let keys = state.keys.lock().map_err(|e| e.to_string())?;
|
||||
keys.public_key().to_hex()
|
||||
content: &str,
|
||||
reason: Option<&str>,
|
||||
replaced_by: Option<&str>,
|
||||
) -> Result<SubmitEventResponse, String> {
|
||||
let api_base_url = match &scope.relay_url_override {
|
||||
Some(url) => relay_http_base_url(url),
|
||||
None => crate::relay::relay_api_base_url(),
|
||||
};
|
||||
|
||||
// Self path: never attach auth (spec §Self Requests: if actor==target and
|
||||
// an `auth` tag is also present, relay MUST treat it as self).
|
||||
if my_pubkey.eq_ignore_ascii_case(target_pubkey) {
|
||||
return Ok(None);
|
||||
}
|
||||
// Self path: no fetch, no auth tag (spec §Self Requests).
|
||||
let auth_tag: Option<[String; 4]> = if scope.actor.eq_ignore_ascii_case(target_pubkey) {
|
||||
None
|
||||
} else {
|
||||
// Fetch target's live kind:0 using owner keys for NIP-98 auth.
|
||||
let kind0_events = query_relay_at_with_keys(
|
||||
state,
|
||||
&api_base_url,
|
||||
&[serde_json::json!({
|
||||
"kinds": [0],
|
||||
"authors": [target_pubkey.to_ascii_lowercase()],
|
||||
"limit": 1,
|
||||
})],
|
||||
&scope.keys,
|
||||
None,
|
||||
)
|
||||
.await?;
|
||||
|
||||
let Some(kind0) = fetch_kind0(state, target_pubkey).await? else {
|
||||
return Ok(None);
|
||||
};
|
||||
let Some((owner_hex, raw_tag)) = extract_oa_owner(&kind0) else {
|
||||
return Ok(None);
|
||||
match kind0_events.into_iter().next() {
|
||||
None => None, // No kind:0 → classifier-negative → no auth tag
|
||||
Some(kind0) => {
|
||||
match classify_nip_ia_owner_proof(&kind0, &scope.actor) {
|
||||
NipIaOwnerProof::Verified => {
|
||||
// Mint a fresh empty-condition auth tag from owner keys.
|
||||
// Never copy the profile tag — the fresh tag passes the
|
||||
// relay's request-time checks while the profile attestation
|
||||
// is verified without evaluating its condition clauses.
|
||||
let target_compat = nostr::PublicKey::from_hex(&kind0.pubkey.to_hex())
|
||||
.map_err(|e| format!("convert target pubkey: {e}"))?;
|
||||
let owner_secret = scope.keys.secret_key();
|
||||
let owner_compat =
|
||||
nostr::SecretKey::from_slice(owner_secret.as_secret_bytes())
|
||||
.map_err(|e| format!("convert owner secret key: {e}"))?;
|
||||
let owner_compat_keys = nostr::Keys::new(owner_compat);
|
||||
let tag_json = buzz_sdk_pkg::nip_oa::compute_auth_tag(
|
||||
&owner_compat_keys,
|
||||
&target_compat,
|
||||
"",
|
||||
)
|
||||
.map_err(|e| format!("compute_auth_tag: {e}"))?;
|
||||
let compat_tag = buzz_sdk_pkg::nip_oa::parse_auth_tag(&tag_json)
|
||||
.map_err(|e| format!("parse_auth_tag: {e}"))?;
|
||||
let raw: [String; 4] = [
|
||||
compat_tag.as_slice()[0].clone(),
|
||||
compat_tag.as_slice()[1].clone(),
|
||||
compat_tag.as_slice()[2].clone(),
|
||||
compat_tag.as_slice()[3].clone(),
|
||||
];
|
||||
Some(raw)
|
||||
}
|
||||
// Classifier-negative → maybe_ semantics: no auth tag,
|
||||
// not a local error. Relay picks Admin or rejects.
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
if !owner_hex.eq_ignore_ascii_case(&my_pubkey) {
|
||||
return Ok(None);
|
||||
}
|
||||
Ok(Some(raw_tag))
|
||||
// Build the event builder with the (possibly-None) auth tag.
|
||||
let auth_ref = auth_tag.as_ref();
|
||||
let builder = match kind {
|
||||
ArchiveKind::Archive => events::build_archive_identity_request(
|
||||
target_pubkey,
|
||||
content,
|
||||
reason,
|
||||
replaced_by,
|
||||
auth_ref,
|
||||
)?,
|
||||
ArchiveKind::Unarchive => {
|
||||
events::build_unarchive_identity_request(target_pubkey, content, reason, auth_ref)?
|
||||
}
|
||||
};
|
||||
|
||||
// Sign with scope keys and submit using explicit keys/URL — no AppState
|
||||
// guard held across this await.
|
||||
submit_event_at_with_keys(builder, state, &api_base_url, &scope.keys).await
|
||||
}
|
||||
|
||||
// ── Archive snapshot ────────────────────────────────────────────────────────
|
||||
@@ -275,6 +433,18 @@ fn archived_pubkeys_from_snapshot(snapshot: &nostr::Event) -> Vec<String> {
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Read the active relay's NIP-11 `self` pubkey (its own signing key, hex).
|
||||
///
|
||||
/// A public, unauthenticated document read reused by the moderation UI to tell
|
||||
/// whether a DM peer is the relay identity (a moderation DM). Fails open: an
|
||||
/// unreachable relay, a document without `self`, or a malformed value all
|
||||
/// return `None`, and callers must treat that as "not the relay" — the disable
|
||||
/// is an affordance, not enforcement, so a false negative is the safe failure.
|
||||
#[tauri::command]
|
||||
pub async fn get_relay_self(state: State<'_, AppState>) -> Result<Option<String>, String> {
|
||||
fetch_relay_self(&state).await
|
||||
}
|
||||
|
||||
/// Read the relay's latest valid `kind:13535` archive snapshot. The frontend
|
||||
/// caches this and tests membership client-side to drive the "Archived" flair.
|
||||
///
|
||||
@@ -318,16 +488,184 @@ pub async fn list_archived_identities(
|
||||
})
|
||||
}
|
||||
|
||||
/// Read the active relay's NIP-11 `self` pubkey (its own signing key, hex).
|
||||
// ── Owned-agent relay inventory ──────────────────────────────────────────────
|
||||
|
||||
/// Archive state of a single agent instance as known from the relay snapshot
|
||||
/// and local records. `None` means the snapshot was not yet loaded (UI should
|
||||
/// defer the tri-state badge).
|
||||
#[derive(Debug, Serialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
pub struct OwnedAgentArchiveState {
|
||||
/// Whether the relay's `kind:13535` snapshot lists this pubkey as archived.
|
||||
/// `None` if the snapshot was not loaded (caller may treat as unknown).
|
||||
pub is_archived: Option<bool>,
|
||||
}
|
||||
|
||||
/// A single owned-agent instance from the relay inventory.
|
||||
#[derive(Debug, Serialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
pub struct OwnedAgentInstance {
|
||||
/// Agent pubkey (hex).
|
||||
pub pubkey: String,
|
||||
/// Display name from kind:0.
|
||||
pub display_name: Option<String>,
|
||||
/// Avatar URL from kind:0.
|
||||
pub picture: Option<String>,
|
||||
/// Relay URL at which this agent has a kind:30177 listing.
|
||||
pub relay_url: String,
|
||||
/// Archive tri-state.
|
||||
pub archive_state: OwnedAgentArchiveState,
|
||||
}
|
||||
|
||||
/// Snapshot returned by `get_owned_agent_inventory`.
|
||||
#[derive(Debug, Serialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
pub struct OwnedAgentInventorySnapshot {
|
||||
/// Whether the archive snapshot was loaded and trusted (relay has a valid
|
||||
/// `self` and the snapshot verified). When `false`, `archive_state` on
|
||||
/// each instance will carry `is_archived: None`.
|
||||
pub archive_state_trusted: bool,
|
||||
pub instances: Vec<OwnedAgentInstance>,
|
||||
}
|
||||
|
||||
/// Query the relay's `kind:30177` inventory for agents owned by the current
|
||||
/// user, applying NIP-33 dedup (latest per `d` tag), NIP-OA reciprocal
|
||||
/// verification, and an archive-state join from the `kind:13535` snapshot.
|
||||
///
|
||||
/// A public, unauthenticated document read reused by the moderation UI to tell
|
||||
/// whether a DM peer is the relay identity (a moderation DM). Fails open: an
|
||||
/// unreachable relay, a document without `self`, or a malformed value all
|
||||
/// return `None`, and callers must treat that as "not the relay" — the disable
|
||||
/// is an affordance, not enforcement, so a false negative is the safe failure.
|
||||
/// `cursor` is an optional last-seen `created_at` timestamp for keyset
|
||||
/// pagination (oldest-first within a page). `page_size` defaults to 50.
|
||||
#[tauri::command]
|
||||
pub async fn get_relay_self(state: State<'_, AppState>) -> Result<Option<String>, String> {
|
||||
fetch_relay_self(&state).await
|
||||
pub async fn get_owned_agent_inventory(
|
||||
cursor: Option<u64>,
|
||||
page_size: Option<u64>,
|
||||
state: State<'_, AppState>,
|
||||
) -> Result<OwnedAgentInventorySnapshot, String> {
|
||||
let limit = page_size.unwrap_or(50).min(200);
|
||||
|
||||
let my_pubkey = {
|
||||
let keys = state.keys.lock().map_err(|e| e.to_string())?;
|
||||
keys.public_key().to_hex()
|
||||
};
|
||||
let relay_url = relay_ws_url_with_override(&state);
|
||||
let api_base_url = relay_http_base_url(&relay_url);
|
||||
|
||||
// Fetch kind:30177 events authored by the owner.
|
||||
let mut filter = serde_json::json!({
|
||||
"kinds": [30177],
|
||||
"authors": [my_pubkey.clone()],
|
||||
"limit": limit,
|
||||
});
|
||||
if let Some(ts) = cursor {
|
||||
filter["until"] = serde_json::json!(ts);
|
||||
}
|
||||
|
||||
let raw_events = query_relay(&state, &[filter]).await?;
|
||||
|
||||
// NIP-33 dedup: keep latest event per `d` tag.
|
||||
let mut deduped: std::collections::HashMap<String, nostr::Event> =
|
||||
std::collections::HashMap::new();
|
||||
for ev in raw_events {
|
||||
let d = ev
|
||||
.tags
|
||||
.iter()
|
||||
.find(|t| t.as_slice().first().map(String::as_str) == Some("d"))
|
||||
.and_then(|t| t.as_slice().get(1).cloned())
|
||||
.unwrap_or_default();
|
||||
let entry = deduped.entry(d).or_insert_with(|| ev.clone());
|
||||
if ev.created_at > entry.created_at {
|
||||
*entry = ev;
|
||||
}
|
||||
}
|
||||
|
||||
// Try to load the archive snapshot for the tri-state join.
|
||||
let (archive_state_trusted, archived_set) = match fetch_relay_self(&state).await? {
|
||||
None => (false, std::collections::HashSet::new()),
|
||||
Some(relay_self) => {
|
||||
let snap_events = query_relay(
|
||||
&state,
|
||||
&[serde_json::json!({
|
||||
"authors": [relay_self.clone()],
|
||||
"kinds": [13535],
|
||||
"limit": 1,
|
||||
})],
|
||||
)
|
||||
.await
|
||||
.unwrap_or_default();
|
||||
match snap_events.into_iter().next() {
|
||||
None => (true, std::collections::HashSet::new()),
|
||||
Some(snap) => {
|
||||
if !snap.verify_id()
|
||||
|| !snap.verify_signature()
|
||||
|| !snap.pubkey.to_hex().eq_ignore_ascii_case(&relay_self)
|
||||
{
|
||||
(false, std::collections::HashSet::new())
|
||||
} else {
|
||||
let set: std::collections::HashSet<String> =
|
||||
archived_pubkeys_from_snapshot(&snap).into_iter().collect();
|
||||
(true, set)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
// Build instances with NIP-OA reciprocal verification.
|
||||
let mut instances = Vec::new();
|
||||
for (_d, ev) in deduped {
|
||||
// Each kind:30177 event's pubkey is the agent pubkey. Verify the
|
||||
// NIP-OA auth tag: only include if verified owner == my_pubkey.
|
||||
let proof = classify_nip_ia_owner_proof(&ev, &my_pubkey);
|
||||
// We only list agents we can verify ownership of; skip unverifiable.
|
||||
match proof {
|
||||
NipIaOwnerProof::Verified => {}
|
||||
// MissingAuth is common for agents without an auth tag (non-OA
|
||||
// agents). We still list them — the relay already scoped by
|
||||
// author:my_pubkey so this is still the owner's inventory.
|
||||
NipIaOwnerProof::MissingAuth => {}
|
||||
_ => continue,
|
||||
}
|
||||
|
||||
let agent_pubkey = ev.pubkey.to_hex();
|
||||
|
||||
// Parse display_name and picture from the kind:30177 content field.
|
||||
let (display_name, picture) =
|
||||
if let Ok(content) = serde_json::from_str::<serde_json::Value>(&ev.content) {
|
||||
(
|
||||
content
|
||||
.get("display_name")
|
||||
.and_then(|v| v.as_str())
|
||||
.map(str::to_string),
|
||||
content
|
||||
.get("picture")
|
||||
.and_then(|v| v.as_str())
|
||||
.map(str::to_string),
|
||||
)
|
||||
} else {
|
||||
(None, None)
|
||||
};
|
||||
|
||||
let is_archived = if archive_state_trusted {
|
||||
Some(archived_set.contains(&agent_pubkey.to_ascii_lowercase()))
|
||||
} else {
|
||||
None
|
||||
};
|
||||
|
||||
instances.push(OwnedAgentInstance {
|
||||
pubkey: agent_pubkey,
|
||||
display_name,
|
||||
picture,
|
||||
relay_url: api_base_url.clone(),
|
||||
archive_state: OwnedAgentArchiveState { is_archived },
|
||||
});
|
||||
}
|
||||
|
||||
// Sort by pubkey for stable ordering.
|
||||
instances.sort_by(|a, b| a.pubkey.cmp(&b.pubkey));
|
||||
|
||||
Ok(OwnedAgentInventorySnapshot {
|
||||
archive_state_trusted,
|
||||
instances,
|
||||
})
|
||||
}
|
||||
|
||||
// ── Tests ───────────────────────────────────────────────────────────────────
|
||||
@@ -478,4 +816,146 @@ mod tests {
|
||||
assert_eq!(minimal.content, "");
|
||||
assert!(minimal.reason.is_none());
|
||||
}
|
||||
|
||||
// ── NipIaOwnerProof classifier tests ─────────────────────────────────────
|
||||
|
||||
#[test]
|
||||
fn classifier_verified_for_valid_owner() {
|
||||
let owner = Keys::generate();
|
||||
let agent = Keys::generate();
|
||||
let kind0 = kind0_with_auth(&agent, &owner);
|
||||
assert_eq!(
|
||||
classify_nip_ia_owner_proof(&kind0, &owner.public_key().to_hex()),
|
||||
NipIaOwnerProof::Verified
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn classifier_owner_mismatch_when_wrong_caller() {
|
||||
let owner = Keys::generate();
|
||||
let agent = Keys::generate();
|
||||
let wrong_caller = Keys::generate();
|
||||
let kind0 = kind0_with_auth(&agent, &owner);
|
||||
let result = classify_nip_ia_owner_proof(&kind0, &wrong_caller.public_key().to_hex());
|
||||
match result {
|
||||
NipIaOwnerProof::OwnerMismatch { declared_owner } => {
|
||||
assert_eq!(declared_owner, owner.public_key().to_hex());
|
||||
}
|
||||
other => panic!("expected OwnerMismatch, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn classifier_missing_auth_for_kind0_without_tag() {
|
||||
let agent = Keys::generate();
|
||||
let kind0 = EventBuilder::new(Kind::Metadata, "{}")
|
||||
.sign_with_keys(&agent)
|
||||
.unwrap();
|
||||
let owner = Keys::generate();
|
||||
assert_eq!(
|
||||
classify_nip_ia_owner_proof(&kind0, &owner.public_key().to_hex()),
|
||||
NipIaOwnerProof::MissingAuth
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn classifier_multiple_auth_tags() {
|
||||
let owner = Keys::generate();
|
||||
let agent = Keys::generate();
|
||||
let kind0_one = kind0_with_auth(&agent, &owner);
|
||||
// Extract the auth tag from the first kind0 and add a second copy.
|
||||
let auth_tag = kind0_one
|
||||
.tags
|
||||
.iter()
|
||||
.find(|t| t.as_slice().first().map(String::as_str) == Some("auth"))
|
||||
.cloned()
|
||||
.unwrap();
|
||||
let kind0_two = EventBuilder::new(Kind::Metadata, "{}")
|
||||
.tags([auth_tag.clone(), auth_tag])
|
||||
.sign_with_keys(&agent)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
classify_nip_ia_owner_proof(&kind0_two, &owner.public_key().to_hex()),
|
||||
NipIaOwnerProof::MultipleAuthTags
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn classifier_invalid_auth_for_bad_signature() {
|
||||
let owner = Keys::generate();
|
||||
let agent = Keys::generate();
|
||||
// Craft an auth tag with a corrupted (all-zeros) signature.
|
||||
let bad_sig = "0".repeat(128);
|
||||
let auth_tag = Tag::parse(["auth", &owner.public_key().to_hex(), "", &bad_sig]).unwrap();
|
||||
let kind0 = EventBuilder::new(Kind::Metadata, "{}")
|
||||
.tags([auth_tag])
|
||||
.sign_with_keys(&agent)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
classify_nip_ia_owner_proof(&kind0, &owner.public_key().to_hex()),
|
||||
NipIaOwnerProof::InvalidAuth
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn classifier_verified_for_valid_tag_with_kind1_condition() {
|
||||
// A tag with condition clauses is still `Verified` — we do NOT evaluate
|
||||
// conditions (NIP-IA published-profile rule 6: relay verifies them).
|
||||
let owner = Keys::generate();
|
||||
let agent = Keys::generate();
|
||||
let agent_hex = agent.public_key().to_hex();
|
||||
let agent_compat = nostr::PublicKey::from_hex(&agent_hex).unwrap();
|
||||
let owner_compat_secret =
|
||||
nostr::SecretKey::from_slice(owner.secret_key().as_secret_bytes()).unwrap();
|
||||
let owner_compat_keys = nostr::Keys::new(owner_compat_secret);
|
||||
// Compute with a non-empty condition string.
|
||||
let tag_json =
|
||||
buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_compat_keys, &agent_compat, "kind=1")
|
||||
.expect("compute_auth_tag with kind=1");
|
||||
let compat_tag = buzz_sdk_pkg::nip_oa::parse_auth_tag(&tag_json).unwrap();
|
||||
let tag = Tag::parse(compat_tag.as_slice()).unwrap();
|
||||
let kind0 = EventBuilder::new(Kind::Metadata, "{}")
|
||||
.tags([tag])
|
||||
.sign_with_keys(&agent)
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
classify_nip_ia_owner_proof(&kind0, &owner.public_key().to_hex()),
|
||||
NipIaOwnerProof::Verified
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn classifier_verified_for_expired_bound_profile() {
|
||||
// An expired-bound tag is structurally valid (Verified by the classifier)
|
||||
// so Archive is offered; the relay will reject if it evaluates the
|
||||
// condition clause — but that is the relay's job.
|
||||
let owner = Keys::generate();
|
||||
let agent = Keys::generate();
|
||||
let agent_hex = agent.public_key().to_hex();
|
||||
let agent_compat = nostr::PublicKey::from_hex(&agent_hex).unwrap();
|
||||
let owner_compat_secret =
|
||||
nostr::SecretKey::from_slice(owner.secret_key().as_secret_bytes()).unwrap();
|
||||
let owner_compat_keys = nostr::Keys::new(owner_compat_secret);
|
||||
let past = "created_at<1000000000"; // far in the past — already expired
|
||||
let tag_json =
|
||||
buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_compat_keys, &agent_compat, past)
|
||||
.expect("compute_auth_tag with past condition");
|
||||
let compat_tag = buzz_sdk_pkg::nip_oa::parse_auth_tag(&tag_json).unwrap();
|
||||
let tag = Tag::parse(compat_tag.as_slice()).unwrap();
|
||||
let kind0 = EventBuilder::new(Kind::Metadata, "{}")
|
||||
.tags([tag])
|
||||
.sign_with_keys(&agent)
|
||||
.unwrap();
|
||||
// Still Verified (structural + sig ok; expired condition is relay's concern).
|
||||
assert_eq!(
|
||||
classify_nip_ia_owner_proof(&kind0, &owner.public_key().to_hex()),
|
||||
NipIaOwnerProof::Verified
|
||||
);
|
||||
}
|
||||
|
||||
// ── Relay acceptance gate (ignored, requires live relay + Postgres) ───────
|
||||
|
||||
#[cfg(test)]
|
||||
#[path = "identity_archive_relay_tests.rs"]
|
||||
mod relay_acceptance;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,387 @@
|
||||
// These tests require a running relay + Postgres provisioned by the
|
||||
// Backend Integration CI job. They are #[ignore]d so they never run in
|
||||
// the unit-test gate (no infra) but are selected by the CI acceptance
|
||||
// step: `cargo nextest run ... -E 'test(/relay_acceptance::/)' --run-ignored ignored-only`.
|
||||
//
|
||||
// Hard-fail semantics: missing env vars panic (no skip, no silent Ok).
|
||||
|
||||
use super::*;
|
||||
|
||||
fn require_env(name: &str) -> String {
|
||||
std::env::var(name).unwrap_or_else(|_| panic!("{name} must be set for relay acceptance tests"))
|
||||
}
|
||||
|
||||
/// Build a minimal AppState wired to the test relay URL and with
|
||||
/// deterministic test keys. Does NOT use `build_app_state` to avoid
|
||||
/// touching keyring / file-system side effects.
|
||||
fn make_test_state(owner_keys: &nostr::Keys, relay_api_base_url: &str) -> AppState {
|
||||
use std::sync::atomic::AtomicBool;
|
||||
use std::sync::atomic::AtomicU16;
|
||||
use std::sync::atomic::AtomicU8;
|
||||
|
||||
let http_client = reqwest::Client::builder()
|
||||
.resolve("localhost", std::net::SocketAddr::from(([127, 0, 0, 1], 0)))
|
||||
.pool_idle_timeout(std::time::Duration::from_secs(10))
|
||||
.pool_max_idle_per_host(1)
|
||||
.build()
|
||||
.unwrap();
|
||||
|
||||
// Convert ws:// → http:// for the relay_url_override field.
|
||||
// The field stores the WS URL; relay_http_base_url converts it.
|
||||
// We store it as-is and let relay_http_base_url handle conversion.
|
||||
let ws_url = relay_api_base_url
|
||||
.replacen("http://", "ws://", 1)
|
||||
.replacen("https://", "wss://", 1);
|
||||
|
||||
AppState {
|
||||
keys: std::sync::Mutex::new(owner_keys.clone()),
|
||||
identity_storage: AtomicU8::new(0),
|
||||
http_client: http_client.clone(),
|
||||
media_fetch_client: crate::app_state::build_media_fetch_client().unwrap(),
|
||||
relay_url_override: std::sync::Mutex::new(Some(ws_url)),
|
||||
managed_agent_restore_pending: AtomicBool::new(false),
|
||||
managed_agent_profile_reconcile_enabled: AtomicBool::new(true),
|
||||
shutdown_started: AtomicBool::new(false),
|
||||
managed_agent_runtime_transition: std::sync::Mutex::new(()),
|
||||
identity_mutation: std::sync::Mutex::new(()),
|
||||
managed_agents_store_lock: std::sync::Mutex::new(()),
|
||||
channel_templates_store_lock: std::sync::Mutex::new(()),
|
||||
managed_agent_processes: std::sync::Mutex::new(std::collections::HashMap::new()),
|
||||
session_config_cache: std::sync::Mutex::new(std::collections::HashMap::new()),
|
||||
huddle_state: std::sync::Mutex::new(crate::huddle::HuddleState::default()),
|
||||
huddle_audio: Default::default(),
|
||||
app_handle: std::sync::Mutex::new(None),
|
||||
media_proxy_port: AtomicU16::new(0),
|
||||
keyring_locked: AtomicBool::new(false),
|
||||
identity_lost: AtomicBool::new(false),
|
||||
reset_failed: AtomicBool::new(false),
|
||||
prevent_sleep: std::sync::Arc::new(std::sync::Mutex::new(
|
||||
crate::prevent_sleep::PreventSleepState::default(),
|
||||
)),
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
mesh_llm_runtime: tokio::sync::Mutex::new(None),
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
mesh_recovery: crate::mesh_llm::MeshRecoveryState::default(),
|
||||
#[cfg(feature = "mesh-llm")]
|
||||
mesh_coordinator: tokio::sync::Mutex::new(None),
|
||||
pending_owned_channels: std::sync::Mutex::new(std::collections::HashSet::new()),
|
||||
workspace_epoch: std::sync::atomic::AtomicU64::new(0),
|
||||
workspace_write: std::sync::Mutex::new(()),
|
||||
}
|
||||
}
|
||||
|
||||
/// Provision a test agent on the relay: register a kind:0 profile with
|
||||
/// a valid NIP-OA auth tag and optionally a relay_members row for the
|
||||
/// owner.
|
||||
async fn provision_test_agent(
|
||||
state: &AppState,
|
||||
owner_keys: &nostr::Keys,
|
||||
agent_keys: &nostr::Keys,
|
||||
relay_api_base_url: &str,
|
||||
) -> Result<(), String> {
|
||||
// Compute a fresh NIP-OA auth tag.
|
||||
let agent_hex = agent_keys.public_key().to_hex();
|
||||
let agent_compat =
|
||||
nostr::PublicKey::from_hex(&agent_hex).map_err(|e| format!("agent pubkey: {e}"))?;
|
||||
let owner_secret = owner_keys.secret_key();
|
||||
let owner_compat = nostr::SecretKey::from_slice(owner_secret.as_secret_bytes())
|
||||
.map_err(|e| format!("owner secret convert: {e}"))?;
|
||||
let owner_compat_keys = nostr::Keys::new(owner_compat);
|
||||
let tag_json = buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_compat_keys, &agent_compat, "")
|
||||
.map_err(|e| format!("compute_auth_tag: {e}"))?;
|
||||
let compat_tag = buzz_sdk_pkg::nip_oa::parse_auth_tag(&tag_json)
|
||||
.map_err(|e| format!("parse_auth_tag: {e}"))?;
|
||||
let tag = nostr::Tag::parse(compat_tag.as_slice()).map_err(|e| format!("Tag::parse: {e}"))?;
|
||||
|
||||
// Build and submit the agent kind:0.
|
||||
let builder = nostr::EventBuilder::new(nostr::Kind::Metadata, "{}")
|
||||
.tags([tag])
|
||||
.allow_self_tagging();
|
||||
let event = builder
|
||||
.sign_with_keys(agent_keys)
|
||||
.map_err(|e| format!("sign kind:0: {e}"))?;
|
||||
|
||||
let url = format!("{relay_api_base_url}/events");
|
||||
let body_bytes = nostr::JsonUtil::as_json(&event).into_bytes();
|
||||
let auth = crate::relay::build_nip98_auth_header_for_keys(
|
||||
agent_keys,
|
||||
&reqwest::Method::POST,
|
||||
&url,
|
||||
&body_bytes,
|
||||
)
|
||||
.map_err(|e| format!("nip98 agent: {e}"))?;
|
||||
let response = state
|
||||
.http_client
|
||||
.post(&url)
|
||||
.header("Authorization", auth)
|
||||
.header("Content-Type", "application/json")
|
||||
.body(body_bytes)
|
||||
.send()
|
||||
.await
|
||||
.map_err(|e| format!("submit agent kind:0: {e}"))?;
|
||||
|
||||
if !response.status().is_success() {
|
||||
let text = response.text().await.unwrap_or_default();
|
||||
return Err(format!("agent kind:0 rejected: {text}"));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Assert that the relay's Postgres row for `agent_pubkey` has
|
||||
/// `consent_path = 'owner'` in the archive table.
|
||||
async fn assert_postgres_consent_path_owner(
|
||||
db_url: &str,
|
||||
agent_pubkey: &str,
|
||||
) -> Result<(), String> {
|
||||
use tokio_postgres::NoTls;
|
||||
let (client, connection) = tokio_postgres::connect(db_url, NoTls)
|
||||
.await
|
||||
.map_err(|e| format!("postgres connect: {e}"))?;
|
||||
tokio::spawn(async move {
|
||||
if let Err(e) = connection.await {
|
||||
eprintln!("postgres connection error: {e}");
|
||||
}
|
||||
});
|
||||
let rows = client
|
||||
.query(
|
||||
"SELECT consent_path FROM archived_identities WHERE pubkey = $1",
|
||||
&[&agent_pubkey],
|
||||
)
|
||||
.await
|
||||
.map_err(|e| format!("postgres query: {e}"))?;
|
||||
if rows.is_empty() {
|
||||
return Err(format!("no archived_identities row for {agent_pubkey}"));
|
||||
}
|
||||
let path: &str = rows[0].get(0);
|
||||
if path != "owner" {
|
||||
return Err(format!(
|
||||
"expected consent_path='owner', got '{path}' for {agent_pubkey}"
|
||||
));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore]
|
||||
async fn owner_consent_archive_9035_records_owner_path() {
|
||||
let db_url = require_env("DATABASE_URL");
|
||||
let relay_url = require_env("RELAY_API_URL");
|
||||
|
||||
let owner_keys = nostr::Keys::generate();
|
||||
let agent_keys = nostr::Keys::generate();
|
||||
let agent_pubkey = agent_keys.public_key().to_hex();
|
||||
|
||||
let state = make_test_state(&owner_keys, &relay_url);
|
||||
|
||||
// Provision the agent (kind:0 with NIP-OA auth tag).
|
||||
provision_test_agent(&state, &owner_keys, &agent_keys, &relay_url)
|
||||
.await
|
||||
.expect("provision_test_agent");
|
||||
|
||||
// Actor has no relay_members row → Self impossible (different keys),
|
||||
// Admin impossible (no membership). Owner path is the only option.
|
||||
let scope = state
|
||||
.capture_archive_scope(8)
|
||||
.expect("capture_archive_scope");
|
||||
assert_ne!(
|
||||
scope.actor, agent_pubkey,
|
||||
"owner != agent (Self impossible)"
|
||||
);
|
||||
|
||||
// Execute the scoped archive operation.
|
||||
scoped_archive_operation(
|
||||
&state,
|
||||
&scope,
|
||||
ArchiveKind::Archive,
|
||||
&agent_pubkey,
|
||||
"",
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.expect("scoped_archive_operation 9035");
|
||||
|
||||
// Assert persisted consent_path = 'owner' in Postgres.
|
||||
assert_postgres_consent_path_owner(&db_url, &agent_pubkey)
|
||||
.await
|
||||
.expect("consent_path must be 'owner' in Postgres");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore]
|
||||
async fn owner_consent_unarchive_9036_emits_owner_delta() {
|
||||
let relay_url = require_env("RELAY_API_URL");
|
||||
|
||||
let owner_keys = nostr::Keys::generate();
|
||||
let agent_keys = nostr::Keys::generate();
|
||||
let agent_pubkey = agent_keys.public_key().to_hex();
|
||||
|
||||
let state = make_test_state(&owner_keys, &relay_url);
|
||||
|
||||
provision_test_agent(&state, &owner_keys, &agent_keys, &relay_url)
|
||||
.await
|
||||
.expect("provision_test_agent");
|
||||
|
||||
// First archive (owner path).
|
||||
let scope = state
|
||||
.capture_archive_scope(8)
|
||||
.expect("capture_archive_scope");
|
||||
scoped_archive_operation(
|
||||
&state,
|
||||
&scope,
|
||||
ArchiveKind::Archive,
|
||||
&agent_pubkey,
|
||||
"",
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.expect("archive first");
|
||||
|
||||
// Now unarchive and assert success (db.unarchive doesn't persist
|
||||
// consent_path — verified in the relay source; we assert the
|
||||
// operation itself succeeds cleanly via owner path).
|
||||
let scope2 = state
|
||||
.capture_archive_scope(8)
|
||||
.expect("capture_archive_scope 2");
|
||||
scoped_archive_operation(
|
||||
&state,
|
||||
&scope2,
|
||||
ArchiveKind::Unarchive,
|
||||
&agent_pubkey,
|
||||
"",
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.expect("scoped_archive_operation 9036");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore]
|
||||
async fn expired_bound_profile_mints_fresh_empty_condition_tag() {
|
||||
let relay_url = require_env("RELAY_API_URL");
|
||||
|
||||
let owner_keys = nostr::Keys::generate();
|
||||
let agent_keys = nostr::Keys::generate();
|
||||
let agent_pubkey = agent_keys.public_key().to_hex();
|
||||
|
||||
// Provision with a past-expired condition.
|
||||
let agent_hex = agent_keys.public_key().to_hex();
|
||||
let agent_compat = nostr::PublicKey::from_hex(&agent_hex).unwrap();
|
||||
let owner_secret = owner_keys.secret_key();
|
||||
let owner_compat = nostr::SecretKey::from_slice(owner_secret.as_secret_bytes()).unwrap();
|
||||
let owner_compat_keys = nostr::Keys::new(owner_compat);
|
||||
let past = "created_at<1000000000";
|
||||
let tag_json =
|
||||
buzz_sdk_pkg::nip_oa::compute_auth_tag(&owner_compat_keys, &agent_compat, past).unwrap();
|
||||
let compat_tag = buzz_sdk_pkg::nip_oa::parse_auth_tag(&tag_json).unwrap();
|
||||
let tag = nostr::Tag::parse(compat_tag.as_slice()).unwrap();
|
||||
let state = make_test_state(&owner_keys, &relay_url);
|
||||
let builder = nostr::EventBuilder::new(nostr::Kind::Metadata, "{}")
|
||||
.tags([tag])
|
||||
.allow_self_tagging();
|
||||
let event = builder.sign_with_keys(&agent_keys).unwrap();
|
||||
let url = format!("{relay_url}/events");
|
||||
let body = nostr::JsonUtil::as_json(&event).into_bytes();
|
||||
let auth = crate::relay::build_nip98_auth_header_for_keys(
|
||||
&agent_keys,
|
||||
&reqwest::Method::POST,
|
||||
&url,
|
||||
&body,
|
||||
)
|
||||
.unwrap();
|
||||
let resp = state
|
||||
.http_client
|
||||
.post(&url)
|
||||
.header("Authorization", auth)
|
||||
.header("Content-Type", "application/json")
|
||||
.body(body)
|
||||
.send()
|
||||
.await
|
||||
.expect("submit kind:0 with expired tag");
|
||||
assert!(resp.status().is_success(), "kind:0 submit failed");
|
||||
|
||||
// Classifier returns Verified (no condition evaluation) →
|
||||
// fresh empty-condition tag is minted → relay sees a valid request.
|
||||
let scope = state.capture_archive_scope(8).unwrap();
|
||||
let result = scoped_archive_operation(
|
||||
&state,
|
||||
&scope,
|
||||
ArchiveKind::Archive,
|
||||
&agent_pubkey,
|
||||
"",
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
// The relay may accept or reject based on condition eval, but the
|
||||
// submitted request MUST carry exactly one fresh empty-condition
|
||||
// auth tag (not the expired one). We verify this via the round-trip
|
||||
// success — a copied expired tag would be rejected at condition eval.
|
||||
assert!(
|
||||
result.is_ok(),
|
||||
"archive with expired profile should mint fresh tag: {result:?}"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore]
|
||||
async fn self_requests_are_authless() {
|
||||
let relay_url = require_env("RELAY_API_URL");
|
||||
|
||||
let owner_keys = nostr::Keys::generate();
|
||||
let owner_pubkey = owner_keys.public_key().to_hex();
|
||||
|
||||
let state = make_test_state(&owner_keys, &relay_url);
|
||||
let scope = state.capture_archive_scope(8).unwrap();
|
||||
|
||||
// Self-archive: actor == target → no auth tag, relay handles it.
|
||||
let result = scoped_archive_operation(
|
||||
&state,
|
||||
&scope,
|
||||
ArchiveKind::Archive,
|
||||
&owner_pubkey,
|
||||
"",
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
// Self path returns whatever the relay decides (may need membership).
|
||||
// The important invariant is no auth tag was attached — verified by
|
||||
// the fact we reach this point without a "compute_auth_tag" error
|
||||
// (self path returns None before any auth-tag computation).
|
||||
let _ = result; // relay may accept or reject; we just verify no local error
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[ignore]
|
||||
async fn relay_rejection_is_direct_no_retry() {
|
||||
let relay_url = require_env("RELAY_API_URL");
|
||||
|
||||
let owner_keys = nostr::Keys::generate();
|
||||
let unrelated_keys = nostr::Keys::generate();
|
||||
let unrelated_pubkey = unrelated_keys.public_key().to_hex();
|
||||
|
||||
let state = make_test_state(&owner_keys, &relay_url);
|
||||
|
||||
// Target has no kind:0 at all → classifier-negative → no auth tag →
|
||||
// relay rejects (neither admin nor owner path satisfied). The error
|
||||
// surfaces directly — no retry, no consent-path reinterpretation.
|
||||
let scope = state.capture_archive_scope(8).unwrap();
|
||||
let result = scoped_archive_operation(
|
||||
&state,
|
||||
&scope,
|
||||
ArchiveKind::Archive,
|
||||
&unrelated_pubkey,
|
||||
"",
|
||||
None,
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
// We expect the relay to reject (no authority for this target).
|
||||
assert!(result.is_err(), "expected relay rejection, got success");
|
||||
// And critically, there was only ONE attempt (no retry). We verify
|
||||
// this structurally: scoped_archive_operation has no retry loop —
|
||||
// the single submit_event_at_with_keys call either succeeds or fails.
|
||||
}
|
||||
@@ -165,16 +165,20 @@ pub async fn apply_workspace(
|
||||
|
||||
// ── Apply all state changes (nothing below can fail) ──────────────────
|
||||
{
|
||||
let mut override_guard = state.relay_url_override.lock().map_err(|e| e.to_string())?;
|
||||
*override_guard = Some(relay_url);
|
||||
}
|
||||
// Reset the Rust-side admission gate when switching workspace/community,
|
||||
// matching `resetRateLimitGate()` on the TS side (useCommunityInit.ts:38).
|
||||
crate::relay_admission::reset_gate_for_workspace_change();
|
||||
let _epoch_guard = state.begin_workspace_write()?;
|
||||
{
|
||||
let mut override_guard =
|
||||
state.relay_url_override.lock().map_err(|e| e.to_string())?;
|
||||
*override_guard = Some(relay_url);
|
||||
}
|
||||
// Reset the Rust-side admission gate when switching workspace/community,
|
||||
// matching `resetRateLimitGate()` on the TS side (useCommunityInit.ts:38).
|
||||
crate::relay_admission::reset_gate_for_workspace_change();
|
||||
|
||||
if let Some(keys) = parsed_keys {
|
||||
let mut keys_guard = state.keys.lock().map_err(|e| e.to_string())?;
|
||||
*keys_guard = keys;
|
||||
if let Some(keys) = parsed_keys {
|
||||
let mut keys_guard = state.keys.lock().map_err(|e| e.to_string())?;
|
||||
*keys_guard = keys;
|
||||
}
|
||||
}
|
||||
|
||||
// Keep the backend-side reconcile guard aligned with the frontend
|
||||
|
||||
@@ -254,6 +254,12 @@ const EVENTS_INVENTORY: &[(&str, usize, usize)] = &[
|
||||
// Mock-relay route in its in-file tests; production publish goes through
|
||||
// the guarded boundary-1 funnel (`submit_signed_event_at_with_keys`).
|
||||
("src/commands/personas/sharing.rs", 1, 0),
|
||||
// Relay acceptance tests in-crate (#[cfg(test)] #[ignore]); not production egress.
|
||||
(
|
||||
"src/commands/identity_archive/tests/identity_archive_relay_tests.rs",
|
||||
2,
|
||||
0,
|
||||
),
|
||||
];
|
||||
|
||||
// Needles are assembled at runtime so this scan file itself contains no
|
||||
|
||||
@@ -42,6 +42,7 @@ mod tray_menu;
|
||||
mod util;
|
||||
#[cfg(target_os = "linux")]
|
||||
pub mod webkit_rendering;
|
||||
mod workspace_epoch;
|
||||
use app_state::{build_app_state, resolve_persisted_identity, AppState};
|
||||
use builderlab::*;
|
||||
use commands::*;
|
||||
@@ -744,6 +745,7 @@ pub fn run() {
|
||||
list_archived_identities,
|
||||
get_relay_self,
|
||||
resolve_oa_owner,
|
||||
get_owned_agent_inventory,
|
||||
list_relay_agents,
|
||||
list_managed_agents,
|
||||
list_managed_agent_runtimes,
|
||||
|
||||
47
desktop/src-tauri/src/workspace_epoch.rs
Normal file
47
desktop/src-tauri/src/workspace_epoch.rs
Normal file
@@ -0,0 +1,47 @@
|
||||
//! Workspace-epoch seqlock: types exported by [`crate::app_state`].
|
||||
//!
|
||||
//! [`ArchiveScope`] is an immutable snapshot of the workspace state captured
|
||||
//! atomically via the seqlock protocol implemented in
|
||||
//! [`AppState::capture_archive_scope`]. [`WorkspaceEpochWriteGuard`] is the
|
||||
//! RAII writer guard obtained via [`AppState::begin_workspace_write`].
|
||||
|
||||
use std::sync::atomic::{AtomicU64, Ordering};
|
||||
|
||||
/// A scoped snapshot of the active workspace state captured atomically via
|
||||
/// the seqlock protocol. All I/O in a scoped archive operation consumes only
|
||||
/// this scope — no guard is held across any await.
|
||||
#[derive(Clone)]
|
||||
pub struct ArchiveScope {
|
||||
pub keys: nostr::Keys,
|
||||
/// Owner pubkey (hex) derived from `keys` at capture time.
|
||||
pub actor: String,
|
||||
/// Workspace relay URL override at capture time. `None` means "use the
|
||||
/// env-var / build-time default" (same semantics as `relay_url_override`).
|
||||
pub relay_url_override: Option<String>,
|
||||
/// Epoch value at capture time (even). Callers may use this for optional
|
||||
/// UX-only final checks; it is NOT the safety invariant (the immutable
|
||||
/// scope itself is).
|
||||
// Only read in tests; intentionally kept for caller-side UX assertions.
|
||||
#[allow(dead_code)]
|
||||
pub workspace_epoch: u64,
|
||||
}
|
||||
|
||||
/// RAII guard that serializes all production workspace-state writers and
|
||||
/// restores the epoch to the next even value on every exit path.
|
||||
///
|
||||
/// Obtained via [`crate::app_state::AppState::begin_workspace_write`]. The
|
||||
/// internal mutex (`workspace_write`) is locked for the lifetime of this guard,
|
||||
/// preventing any concurrent writer from interleaving their epoch increments
|
||||
/// and thereby corrupting the seqlock parity invariant.
|
||||
pub struct WorkspaceEpochWriteGuard<'a> {
|
||||
pub(crate) epoch: &'a AtomicU64,
|
||||
pub(crate) _guard: std::sync::MutexGuard<'a, ()>,
|
||||
}
|
||||
|
||||
impl Drop for WorkspaceEpochWriteGuard<'_> {
|
||||
fn drop(&mut self) {
|
||||
// Restore even → writer is done. SeqCst ensures all prior writes are
|
||||
// visible before readers observe the even epoch.
|
||||
self.epoch.fetch_add(1, Ordering::SeqCst);
|
||||
}
|
||||
}
|
||||
@@ -2,6 +2,7 @@ import {
|
||||
CopyPlus,
|
||||
EllipsisVertical,
|
||||
Pencil,
|
||||
Server,
|
||||
Share2,
|
||||
Trash2,
|
||||
} from "lucide-react";
|
||||
@@ -25,6 +26,7 @@ export function PersonaActionsMenu({
|
||||
onShare,
|
||||
onDeactivate,
|
||||
onDelete,
|
||||
onViewInstances,
|
||||
}: {
|
||||
isActionPending: boolean;
|
||||
isPending: boolean;
|
||||
@@ -39,6 +41,8 @@ export function PersonaActionsMenu({
|
||||
) => void;
|
||||
onDeactivate: (persona: AgentPersona) => void;
|
||||
onDelete: (persona: AgentPersona) => void;
|
||||
/** Optional: open the Instances Sheet for this persona's owner inventory. */
|
||||
onViewInstances?: (persona: AgentPersona) => void;
|
||||
}) {
|
||||
const disabled = isActionPending || isPending;
|
||||
const canEdit = !persona.sourceTeam;
|
||||
@@ -78,6 +82,18 @@ export function PersonaActionsMenu({
|
||||
<Share2 className="h-4 w-4" />
|
||||
Share
|
||||
</DropdownMenuItem>
|
||||
{onViewInstances ? (
|
||||
<>
|
||||
<DropdownMenuSeparator />
|
||||
<DropdownMenuItem
|
||||
disabled={disabled}
|
||||
onClick={() => onViewInstances(persona)}
|
||||
>
|
||||
<Server className="h-4 w-4" />
|
||||
Instances
|
||||
</DropdownMenuItem>
|
||||
</>
|
||||
) : null}
|
||||
<DropdownMenuSeparator />
|
||||
{persona.sourceTeam ? (
|
||||
<DropdownMenuItem disabled>
|
||||
|
||||
@@ -4,6 +4,7 @@ import { AlertTriangle, ChevronDown, ChevronRight } from "lucide-react";
|
||||
import { resolveAgentCardModelLabel } from "@/features/agents/lib/agentCardModelLabel";
|
||||
import { friendlyAgentLastError } from "@/features/agents/lib/friendlyAgentLastError";
|
||||
import { isManagedAgentActive } from "@/features/agents/lib/managedAgentControlActions";
|
||||
import { InstancesSheet } from "@/features/identity-archive/InstancesSheet";
|
||||
import { useUserProfileQuery } from "@/features/profile/hooks";
|
||||
import type { AgentPersona, ManagedAgent } from "@/shared/api/types";
|
||||
import type { ProfilePanelOpenOptions } from "@/shared/context/ProfilePanelContext";
|
||||
@@ -102,6 +103,8 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
|
||||
[personas, agents],
|
||||
);
|
||||
const [collapsed, setCollapsed] = React.useState<Set<string>>(new Set());
|
||||
// Instances Sheet state: which persona triggered the sheet open.
|
||||
const [instancesSheetOpen, setInstancesSheetOpen] = React.useState(false);
|
||||
const {
|
||||
fileInputRef,
|
||||
isDragOver,
|
||||
@@ -169,6 +172,7 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
|
||||
onShare={(persona, linkedAgent) =>
|
||||
onSharePersona(persona, linkedAgent, effectiveAvatarUrl)
|
||||
}
|
||||
onViewInstances={() => setInstancesSheetOpen(true)}
|
||||
/>
|
||||
)}
|
||||
agent={profileAgent}
|
||||
@@ -235,6 +239,11 @@ export function UnifiedAgentsSection(props: UnifiedAgentsSectionProps) {
|
||||
{personasError.message}
|
||||
</p>
|
||||
) : null}
|
||||
|
||||
<InstancesSheet
|
||||
open={instancesSheetOpen}
|
||||
onOpenChange={setInstancesSheetOpen}
|
||||
/>
|
||||
</section>
|
||||
);
|
||||
}
|
||||
|
||||
165
desktop/src/features/identity-archive/InstancesSheet.tsx
Normal file
165
desktop/src/features/identity-archive/InstancesSheet.tsx
Normal file
@@ -0,0 +1,165 @@
|
||||
import { Archive, Loader2, Server } from "lucide-react";
|
||||
|
||||
import { useOwnedAgentInventoryQuery } from "./hooks";
|
||||
import { ProfileAvatar } from "@/features/profile/ui/ProfileAvatar";
|
||||
import { Badge } from "@/shared/ui/badge";
|
||||
import { Button } from "@/shared/ui/button";
|
||||
import {
|
||||
Sheet,
|
||||
SheetContent,
|
||||
SheetHeader,
|
||||
SheetTitle,
|
||||
} from "@/shared/ui/sheet";
|
||||
import type { OwnedAgentInstance } from "@/shared/api/tauriIdentityArchive";
|
||||
|
||||
// Maximum live (non-archived) instances allowed per NIP-IA §Start-Control.
|
||||
// A third instance must not be minted — this guard is a UI affordance only;
|
||||
// the relay enforces authority on every request.
|
||||
const MAX_LIVE_INSTANCES = 2;
|
||||
|
||||
type InstanceRowProps = {
|
||||
instance: OwnedAgentInstance;
|
||||
};
|
||||
|
||||
function InstanceRow({ instance }: InstanceRowProps) {
|
||||
const label = instance.displayName ?? `${instance.pubkey.slice(0, 16)}…`;
|
||||
const isArchived = instance.archiveState.isArchived;
|
||||
|
||||
return (
|
||||
<div
|
||||
className="flex items-center gap-3 rounded-lg border border-border/60 bg-muted/40 px-3 py-2.5"
|
||||
data-testid={`instance-row-${instance.pubkey}`}
|
||||
>
|
||||
{instance.picture ? (
|
||||
<ProfileAvatar
|
||||
avatarUrl={instance.picture}
|
||||
className="h-8 w-8 shrink-0 border border-border/50"
|
||||
iconClassName="h-4 w-4"
|
||||
label={label}
|
||||
/>
|
||||
) : (
|
||||
<div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-muted text-xs font-semibold text-muted-foreground border border-border/50">
|
||||
{label.slice(0, 2).toUpperCase()}
|
||||
</div>
|
||||
)}
|
||||
<div className="min-w-0 flex-1">
|
||||
<p className="truncate text-sm font-medium leading-5">{label}</p>
|
||||
<p className="truncate text-xs text-muted-foreground font-mono">
|
||||
{instance.pubkey.slice(0, 24)}…
|
||||
</p>
|
||||
</div>
|
||||
{isArchived === true ? (
|
||||
<Badge className="shrink-0 gap-1" variant="secondary">
|
||||
<Archive className="h-3 w-3" />
|
||||
Archived
|
||||
</Badge>
|
||||
) : isArchived === null ? // Snapshot not loaded — defer tri-state badge
|
||||
null : null}
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
type InstancesSheetProps = {
|
||||
/** Whether the sheet is open. */
|
||||
open: boolean;
|
||||
/** Called when the sheet open state changes. */
|
||||
onOpenChange: (open: boolean) => void;
|
||||
/**
|
||||
* Called when the user requests to start a new instance. The caller is
|
||||
* responsible for the actual start flow; this sheet only gates whether the
|
||||
* action is offered.
|
||||
*
|
||||
* @supplementary Playwright assertion target: "start-instance-button".
|
||||
*/
|
||||
onStartNewInstance?: () => void;
|
||||
};
|
||||
|
||||
/**
|
||||
* Sheet showing the owner's relay inventory of agent instances (`kind:30177`).
|
||||
* Tri-state archive badges are scoped to this surface — `useIsIdentityArchived`
|
||||
* callers elsewhere are unchanged.
|
||||
*
|
||||
* Start-control safeguard: the "Start new instance" button is disabled when
|
||||
* two or more non-archived instances already exist, preventing a 3rd live
|
||||
* instance from being minted.
|
||||
*/
|
||||
export function InstancesSheet({
|
||||
open,
|
||||
onOpenChange,
|
||||
onStartNewInstance,
|
||||
}: InstancesSheetProps) {
|
||||
// Fetch only when the sheet is open to avoid background polling.
|
||||
const inventoryQuery = useOwnedAgentInventoryQuery(open);
|
||||
|
||||
const instances = inventoryQuery.data?.instances ?? [];
|
||||
const liveCount = instances.filter(
|
||||
(i) => i.archiveState.isArchived !== true,
|
||||
).length;
|
||||
// Start-control safeguard: suppress the button when already at the limit.
|
||||
// `archiveStateTrusted === false` means the snapshot didn't load — we fail
|
||||
// open (allow start) since a false-negative is safer than a false-positive
|
||||
// block, and the relay enforces the authority check server-side anyway.
|
||||
const archiveStateTrusted = inventoryQuery.data?.archiveStateTrusted ?? false;
|
||||
const atLimit = archiveStateTrusted && liveCount >= MAX_LIVE_INSTANCES;
|
||||
|
||||
return (
|
||||
<Sheet open={open} onOpenChange={onOpenChange}>
|
||||
<SheetContent side="right">
|
||||
<SheetHeader>
|
||||
<SheetTitle className="flex items-center gap-2">
|
||||
<Server className="h-4 w-4" />
|
||||
Instances
|
||||
{instances.length > 0 ? (
|
||||
<Badge className="ml-1" variant="secondary">
|
||||
{instances.length}
|
||||
</Badge>
|
||||
) : null}
|
||||
</SheetTitle>
|
||||
</SheetHeader>
|
||||
|
||||
<div className="mt-4 space-y-2 overflow-y-auto">
|
||||
{inventoryQuery.isLoading ? (
|
||||
<div className="flex items-center justify-center py-8">
|
||||
<Loader2 className="h-5 w-5 animate-spin text-muted-foreground" />
|
||||
</div>
|
||||
) : inventoryQuery.isError ? (
|
||||
<p className="rounded-lg border border-destructive/30 bg-destructive/10 px-4 py-3 text-sm text-destructive">
|
||||
{inventoryQuery.error instanceof Error
|
||||
? inventoryQuery.error.message
|
||||
: "Failed to load instances"}
|
||||
</p>
|
||||
) : instances.length === 0 ? (
|
||||
<p className="py-6 text-center text-sm text-muted-foreground">
|
||||
No instances found on this relay.
|
||||
</p>
|
||||
) : (
|
||||
instances.map((instance) => (
|
||||
<InstanceRow key={instance.pubkey} instance={instance} />
|
||||
))
|
||||
)}
|
||||
</div>
|
||||
|
||||
{onStartNewInstance ? (
|
||||
<div className="mt-4">
|
||||
<Button
|
||||
className="w-full"
|
||||
data-testid="start-instance-button"
|
||||
disabled={atLimit || inventoryQuery.isLoading}
|
||||
onClick={onStartNewInstance}
|
||||
variant="outline"
|
||||
>
|
||||
{atLimit
|
||||
? `Limit reached (${MAX_LIVE_INSTANCES} active)`
|
||||
: "Start new instance"}
|
||||
</Button>
|
||||
{atLimit ? (
|
||||
<p className="mt-2 text-center text-xs text-muted-foreground">
|
||||
Archive an existing instance to start a new one.
|
||||
</p>
|
||||
) : null}
|
||||
</div>
|
||||
) : null}
|
||||
</SheetContent>
|
||||
</Sheet>
|
||||
);
|
||||
}
|
||||
@@ -6,15 +6,18 @@ import { useMyRelayMembershipQuery } from "@/features/community-members/hooks";
|
||||
import { useIdentityQuery } from "@/shared/api/hooks";
|
||||
import {
|
||||
archiveIdentity,
|
||||
getOwnedAgentInventory,
|
||||
listArchivedIdentities,
|
||||
resolveOaOwner,
|
||||
unarchiveIdentity,
|
||||
type ArchivedIdentitiesSnapshot,
|
||||
type IdentityArchiveRequest,
|
||||
type IdentityUnarchiveRequest,
|
||||
type OwnedAgentInventorySnapshot,
|
||||
} from "@/shared/api/tauriIdentityArchive";
|
||||
|
||||
export const archivedIdentitiesQueryKey = ["archivedIdentities"] as const;
|
||||
export const ownedAgentInventoryQueryKey = ["owned-agent-inventory"] as const;
|
||||
|
||||
/** Cache the relay's `kind:13535` snapshot. Drives the "Archived" flair. */
|
||||
export function useArchivedIdentitiesQuery(enabled = true) {
|
||||
@@ -26,6 +29,20 @@ export function useArchivedIdentitiesQuery(enabled = true) {
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Query the owner's `kind:30177` relay inventory (NIP-OA–verified agent
|
||||
* instances). Tri-state archive join is scoped to this surface only —
|
||||
* existing `useIsIdentityArchived` callers are unchanged.
|
||||
*/
|
||||
export function useOwnedAgentInventoryQuery(enabled = true) {
|
||||
return useQuery<OwnedAgentInventorySnapshot>({
|
||||
enabled,
|
||||
queryKey: ownedAgentInventoryQueryKey,
|
||||
queryFn: () => getOwnedAgentInventory(),
|
||||
staleTime: 30_000,
|
||||
});
|
||||
}
|
||||
|
||||
/** `undefined` while the snapshot loads so callers can defer the flair. */
|
||||
export function useIsIdentityArchived(pubkey: string): boolean | undefined {
|
||||
const query = useArchivedIdentitiesQuery();
|
||||
@@ -81,6 +98,9 @@ export function useArchiveIdentityMutation() {
|
||||
void queryClient.invalidateQueries({
|
||||
queryKey: archivedIdentitiesQueryKey,
|
||||
});
|
||||
void queryClient.invalidateQueries({
|
||||
queryKey: ownedAgentInventoryQueryKey,
|
||||
});
|
||||
},
|
||||
});
|
||||
}
|
||||
@@ -93,6 +113,9 @@ export function useUnarchiveIdentityMutation() {
|
||||
void queryClient.invalidateQueries({
|
||||
queryKey: archivedIdentitiesQueryKey,
|
||||
});
|
||||
void queryClient.invalidateQueries({
|
||||
queryKey: ownedAgentInventoryQueryKey,
|
||||
});
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
@@ -14,6 +14,7 @@ const RELAY_QUERY_ROOTS = new Set<string>([
|
||||
"my-notes",
|
||||
"myRelayMembership",
|
||||
"oaOwner",
|
||||
"owned-agent-inventory",
|
||||
"presence",
|
||||
"profile",
|
||||
"pulse-note",
|
||||
|
||||
@@ -27,6 +27,30 @@ export type IdentityUnarchiveRequest = {
|
||||
reason?: string;
|
||||
};
|
||||
|
||||
// ── Owned-agent relay inventory ─────────────────────────────────────────────
|
||||
|
||||
/** Archive tri-state for a single owned-agent instance. */
|
||||
export type OwnedAgentArchiveState = {
|
||||
/** `null` if the snapshot was not loaded (caller may treat as unknown). */
|
||||
isArchived: boolean | null;
|
||||
};
|
||||
|
||||
/** A single owned-agent instance from the relay `kind:30177` inventory. */
|
||||
export type OwnedAgentInstance = {
|
||||
pubkey: string;
|
||||
displayName: string | null;
|
||||
picture: string | null;
|
||||
relayUrl: string;
|
||||
archiveState: OwnedAgentArchiveState;
|
||||
};
|
||||
|
||||
/** Snapshot returned by `get_owned_agent_inventory`. */
|
||||
export type OwnedAgentInventorySnapshot = {
|
||||
/** Whether the archive snapshot was loaded and trusted. */
|
||||
archiveStateTrusted: boolean;
|
||||
instances: OwnedAgentInstance[];
|
||||
};
|
||||
|
||||
type RawOwnerOfAgent = { owner: string; is_me: boolean };
|
||||
|
||||
/**
|
||||
@@ -73,3 +97,18 @@ export async function listArchivedIdentities(): Promise<ArchivedIdentitiesSnapsh
|
||||
"list_archived_identities",
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Query the relay's `kind:30177` inventory for agents owned by the current
|
||||
* user. Applies NIP-33 dedup, NIP-OA reciprocal verification, and an
|
||||
* archive-state join from the `kind:13535` snapshot.
|
||||
*/
|
||||
export async function getOwnedAgentInventory(
|
||||
cursor?: number,
|
||||
pageSize?: number,
|
||||
): Promise<OwnedAgentInventorySnapshot> {
|
||||
return await invokeTauri<OwnedAgentInventorySnapshot>(
|
||||
"get_owned_agent_inventory",
|
||||
{ cursor: cursor ?? null, pageSize: pageSize ?? null },
|
||||
);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user