Files
buzz/mobile/ios/RunnerTests/IdentityFilePluginTests.swift
Wes b6aa5539e3 feat(mobile): account onboarding, key recovery and hosted reconnect (#8375)
## Behavior

Adds optional mobile Builderlab sign-in, identity backup/recovery,
community discovery/creation, and account-aware reconnect. **Builderlab
features are disabled by default:** when `BUZZ_AUTH_DOMAINS` is unset or
empty, account login, creation, backup/recovery, reconnect prompts, and
background account restoration are hidden/disabled. QR/code pairing,
links, and invites retain Nostr-only entry. Saved account state is
retained for later opt-in.


`--dart-define=BUZZ_AUTH_DOMAINS=communities.buzz.xyz,communities.public.builderlabstaging.xyz`
opts those DNS domains and their subdomains into required account setup.
The same policy gates pairing, deep links, durable community admission,
and reconnect. A nonempty list enables Builderlab features;
`BUZZ_BUILDERLAB_URL` alone does not. Enabled flows still require their
backend services. Existing Nostr relay authentication remains mandatory.

`BUZZ_HOSTED_RELAY_AUTH=true` enables scoped relay assertions and
reconnect prompts only for configured authentication domains. Configure
assertion issuance and each community's issuer binding before enabling
assertions; enable relay enforcement last. Account credentials stay at
Builderlab. Wrong-account recovery preserves keys; failed writes are not
replayed; authentication is bounded by request deadlines.

Hosted flows preserve keys across cancellation/restart, reconcile
interrupted creation/invitation acceptance, and support manual nsec file
import/export. Account identities are scoped to backend and
authenticated subject; reusing an existing local key for an unbound
account requires an explicit selection. Recovery reconciles the
advertised and recovered inventories before automatic selection.
Successful self-hosted admission retires its pending key, and iOS
startup removes interrupted export files. Adds authenticated relay `GET
/operator/communities/joined` for the companion Builderlab membership
endpoint.

## Validation

- Follow-up review repair at `66a12ac92`: self-hosted entry presents
readable choices and import despite incomplete enumeration, while
generation still requires a complete empty inventory; explicit selection
uses exact-key lookup. Consuming a value-equal duplicate now advances
dispatch. Reconnect requires an existing account binding or a
subject-scoped backup receipt before signing an assertion, and pins the
subject inside the serialized account request. An empty different
account is refused without sending key proof. Focused checks: configured
domains 58 passed; default 49 passed, 9 hosted-only skips. Separate
isolated mutations fail the incomplete-inventory sheet, exact-key reuse,
duplicate dispatch and reconnect journeys (including an
empty-account-only bypass); restored controls pass. Evidence uses
synthetic storage/network boundaries, not physical Android or live
backend association. All mandatory commit/push hooks passed; fresh
GitHub CI is pending.

- Bounded review repair at `d3cc0003f`: incomplete secure-storage
enumeration now blocks automatic identity generation while explicit
known-key reads retain their fallback; declined/failed onboarding links
release the queue; HTTP 429/5xx keeps Retry regardless of response
encoding. Default app-gate coverage exercises a bind link followed by
ordinary community entry. Focused checks: configured domains 47 passed;
default 38 passed, 9 hosted-only skips. Removing the three production
fixes in an isolated source/Git/build copy fails the
identity-resolution, declined/failed queue, and Retry journey
assertions; clean and restored controls pass. Storage and HTTP failures
are synthetic; physical Android and live outage behavior were not
exercised. Published after all mandatory commit/push hooks passed
(mobile analysis/tests, branch-skew and file-size gates); fresh GitHub
CI remains pending.

- Existing whole-PR source review cleared the reconnect defects at
`fb15d5b82`.
- Domain-policy increment: focused environment, entry, app-gate, pairing
and onboarding journeys pass with empty and configured domains. Existing
pairing provider/page tests pass. Changed Dart files analyze cleanly.
- Isolated source/Git/build mutation: forcing paired credentials through
hosted login fails the default-build journey; clean and restored
controls pass. CI now runs configured-domain journeys in addition to the
default-build suite.
- Integrated main through `5b433d929` at `0067c069c`, including its
pinned Flutter upgrade. Preserved the PR welcome UI with the updated
transition API and added Material surfaces around onboarding
selection/consent rows. Focused post-merge runs pass in both
configurations; all mandatory local push gates passed (mobile
analysis/tests, Rust tests, desktop-native checks, branch-skew and
file-size checks).

- Merge-review repair at `a315bce11`: focused identity/storage/admission
and widget journeys pass, including account switching with an empty or
already-bound second account, explicit reuse, and self-hosted
removal/rejoin with another key. Default-domain journeys pass too
(hosted-only cases intentionally skip there).
- Isolated source/Git/build mutation checks: bypassing account scoping,
reuse consent, pending-key retirement, or recovery inventory
reconciliation fails the relevant journey/invariant assertions; clean
and restored controls pass.
- Native `RunnerTests/IdentityFilePluginTests`: both tests pass on the
iPhone 18 Pro iOS 27 simulator with an isolated app identifier. At
`24a0dcaac`, the picker journey seeds residue in Library/Caches,
matching path_provider_foundation, and verifies plugin startup removes
it while preserving an unrelated file. The earlier tmp-only fixture did
not exercise the actual export location. This is synthetic native
cleanup/picker evidence, not a real terminated-share or live account
round trip.

- Follow-up: Caches and tmp cleanup; fallback to individually known
identity slots when Android bulk enumeration fails; explicit replacement
of a refused self-hosted key preserves its original before swapping the
retry slot. Configured-domain journeys/invariants: 34 passed; default:
31 passed, 3 hosted-only skips. Isolated enumeration/retry mutations
fail with passing controls. Bulk-read fallback preserves but cannot
enumerate arbitrary other-account slots until bulk reads recover.

- Configured-domain CI exposed a stale pairing-status assertion after
account scoping. The repaired test checks the admission mismatch,
preserved account/transfer keys, and no admitted community. The
configured-domain CI selection passes locally (56 tests); removing the
production mismatch guard fails the updated test, with clean/restored
controls passing. This is synthetic coordinator evidence, not physical
QR acceptance.

- Final review repair (`40e1e6101`): native iOS export creation uses
atomic complete file protection; normal and restart cleanup remain.
Account/policy/claim HTTP uses one 30-second total deadline with request
abort and body cancellation. Removed the unrelated NIP-FA spec edit.
- Focused account/admission/export tests: 25 pass; configured-domain
account/admission/onboarding journeys: 33 pass. Isolated deadline and
native-dispatch mutations fail, with passing clean/restored controls.
Native export/picker tests: 2 pass on iOS 27 simulator. The real
file-protection attribute assertion is physical-device-only because
simulator provides no Data Protection attribute; locked-device
protection and interrupted real sharing have not been observed.

- Opt-in UI: configured-domain CI selection passes (57 tests); default
selection passes (7 tests, 10 hosted-only skips); URL-only plus
whitespace/empty domains passes (6 tests, 9 hosted-only skips). Changed
Dart files analyze cleanly. Independent mutations that unconditionally
initialize the coordinator in the app gate, welcome entry, or link form
fail the default journey; clean/restored controls pass.
- Native welcome screens exercised on iPhone 18 Pro / iOS 27 simulator
in default and configured builds: default exposes community link / QR /
pairing code only; configured build additionally exposes Builderlab
connection and community creation. No live hosted login was exercised in
this check.

- Delivery at `e48fe73a9`: all mandatory push hooks passed (full mobile
analysis/tests, Rust tests, desktop-native checks, branch and file-size
checks). GitHub checks had not yet populated at the immediate post-push
snapshot.

## Review disposition

| Feedback | Disposition |
| --- | --- |
| Explicit self-hosted entry under unreadable inventory, duplicate
invite dispatch, reconnect cross-account binding
([entry](https://github.com/block/buzz/pull/8375#discussion_r4318421622),
[queue](https://github.com/block/buzz/pull/8375#discussion_r4318421640),
[reconnect](https://github.com/block/buzz/pull/8375#discussion_r4318455512))
| Repaired at `66a12ac92`; evidence above. Reconnect refuses unproven
ownership rather than silently establishing a binding. |
| Incomplete Android identity inventory, stranded deep-link queue,
transient HTTP retry classification
([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5576864143))
| All three repaired in `d3cc0003f`; focused journeys and isolated
mutation evidence above. |
| Account cross-link, incomplete recovery inventory, committed invite
checkpoint, pending local key retirement/replacement | Repaired in the
preceding commits; journey and mutation evidence above. |
| iOS interrupted key export
([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5575253252))
| Native cleanup plus complete protection at creation implemented.
Physical-device lock and real interrupted sharing acceptance remains
pending. |
| Trickle responses bypass idle timeout; unrelated NIP-FA edit
([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5575764556))
| Total request deadline/abort implemented; spec edit removed. |
| Production domains rejected | Ordinary entry now needs no Builderlab
configuration. Opt-in account-required domains must still use supported
community mappings. |
| Lost Android Keystore recovery | Backup exclusions prevent the
reviewed stale-restore scenario; genuine key loss still has no in-app
recovery/reset and remains deferred. |
| Native secp256k1 dependency question | Obsolete against the current
base: upstream C integration landed in #8398; no package diff remains
here. |
| Operator membership endpoint contract | Documentation now states the
operator chooses the pubkey; no end-user session binding is implied.
Additional handler-level coverage is optional follow-up. |
| Optional Android partial document cleanup/activity retention; local
work after backup cancellation | Follow-up hardening, not claimed
implemented. Cancellation prevents remote backup upload. |
| Semgrep crypto inventory notices | Informational inventory, not
demonstrated defects. |

## Remaining draft gates

Native QR/browser-return acceptance remains unverified for this
revision. Optional Builderlab onboarding still needs backend
backup-status and joined-community routes, recovery
policy/configuration, and real backup/recovery/reconnect acceptance. The
empty-domain build removes these services as prerequisites for ordinary
pairing; it does not make the optional hosted flows backend-ready. Human
acceptance and current CI are still required before merge.



Review dispositions retained: production auth-domain configuration must
use supported community mappings; enabling `builderlab.xyz` does not add
support for `buzz.block.builderlab.xyz`. Recovery after genuinely losing
an Android Keystore key remains a follow-up, not a newly implemented
capability.


Human acceptance steps: build once without `BUZZ_AUTH_DOMAINS`
(including with a previously saved account) and confirm no Builderlab
controls/restoration while ordinary link and QR/code entry work. Build
with supported domains and confirm connection/creation appear; exercise
browser return and live backup/recovery/reconnect. On physical iOS,
exercise export and interrupted sharing/locked-device protection. Record
results before marking review complete.

---------

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz>
Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@wes.communities.public.builderlabstaging.xyz>
2026-10-19 15:46:58 -06:00

183 lines
7.9 KiB
Swift

import Flutter
import UIKit
import XCTest
@testable import Buzz
/// Actual UIKit picker presentation and method-channel dispatch, followed by
/// synthetic document-provider delegate callbacks. Never persists an identity.
final class IdentityFilePluginTests: XCTestCase {
@MainActor
private func makeWindow() throws -> (UIWindow, UIViewController) {
let scene = try XCTUnwrap(UIApplication.shared.connectedScenes
.compactMap { $0 as? UIWindowScene }
.first { $0.activationState == .foregroundActive })
let parent = UIViewController()
let window = UIWindow(windowScene: scene)
window.rootViewController = parent
window.makeKeyAndVisible()
parent.loadViewIfNeeded()
return (window, parent)
}
@MainActor
private func picker(in parent: UIViewController) async throws -> UIDocumentPickerViewController {
let presented = XCTNSPredicateExpectation(predicate: NSPredicate { _, _ in
parent.presentedViewController is UIDocumentPickerViewController
}, object: nil)
await fulfillment(of: [presented], timeout: 5)
return try XCTUnwrap(parent.presentedViewController as? UIDocumentPickerViewController)
}
@MainActor
private func settle(_ controller: UIViewController) async {
if let transition = controller.transitionCoordinator {
await withCheckedContinuation { continuation in
transition.animate(alongsideTransition: nil) { _ in continuation.resume() }
}
}
}
@MainActor
private func dismiss(_ parent: UIViewController) async {
await withCheckedContinuation { continuation in
parent.dismiss(animated: false) { continuation.resume() }
}
}
@MainActor
func testPickerResolvesPresenterAtRequestAndCancelsExactlyOnce() async throws {
let messenger = IdentityFileTestMessenger()
// A previous process died with a share open. Startup must remove only its
// export directory, while preserving unrelated temporary documents.
let manager = FileManager.default
// Matches path_provider_foundation 2.6.0 getTemporaryPath().
let exportRoot = try XCTUnwrap(manager.urls(for: .cachesDirectory, in: .userDomainMask).first)
// Exercise the production method-channel writer, not a lookalike fixture.
let exporter = IdentityFilePlugin(messenger: messenger)
var exportedPath: String?
messenger.invoke("prepareExport", arguments: ["text": "synthetic-export-not-a-key\n"]) {
exportedPath = $0 as? String
}
let exported = URL(fileURLWithPath: try XCTUnwrap(exportedPath))
let interrupted = exported.deletingLastPathComponent()
XCTAssertEqual(interrupted.deletingLastPathComponent().standardizedFileURL, exportRoot.standardizedFileURL)
XCTAssertEqual(try String(contentsOf: exported, encoding: .utf8), "synthetic-export-not-a-key\n")
#if !targetEnvironment(simulator)
// Simulator does not implement iOS Data Protection attributes.
let attributes = try manager.attributesOfItem(atPath: exported.path)
XCTAssertEqual(attributes[.protectionKey] as? FileProtectionType, .complete)
#endif
withExtendedLifetime(exporter) {}
let unrelated = exportRoot.appendingPathComponent("unrelated-\(UUID().uuidString)")
try Data("keep".utf8).write(to: unrelated)
defer {
try? manager.removeItem(at: interrupted)
try? manager.removeItem(at: unrelated)
}
// Initialize before this window exists: registrar startup timing must not
// permanently prevent later user-triggered presentation.
let plugin = IdentityFilePlugin(messenger: messenger)
XCTAssertFalse(manager.fileExists(atPath: interrupted.path))
XCTAssertTrue(manager.fileExists(atPath: unrelated.path))
let (window, parent) = try makeWindow()
defer { window.isHidden = true }
var responses = 0
messenger.invokeImport { value in
responses += 1
XCTAssertNil(value)
}
let picker = try await picker(in: parent)
await settle(picker)
XCTAssertFalse(picker.allowsMultipleSelection)
XCTAssertEqual(responses, 0)
var busy: FlutterError?
messenger.invokeImport { busy = $0 as? FlutterError }
XCTAssertEqual(busy?.code, "import_busy")
XCTAssertNil(busy?.details)
let attachment = XCTAttachment(image: UIGraphicsImageRenderer(bounds: window.bounds).image { _ in
window.drawHierarchy(in: window.bounds, afterScreenUpdates: true)
})
attachment.name = "Identity document picker presented"
attachment.lifetime = .keepAlways
add(attachment)
plugin.documentPickerWasCancelled(picker)
plugin.documentPickerWasCancelled(picker)
XCTAssertEqual(responses, 1)
await dismiss(parent)
messenger.invokeImport { value in
responses += 1
XCTAssertNil(value)
}
let next = try await self.picker(in: parent)
await settle(next)
// Late callbacks from the previous picker must not finish the new request.
plugin.documentPickerWasCancelled(picker)
XCTAssertEqual(responses, 1)
plugin.documentPicker(picker, didPickDocumentsAt: [])
XCTAssertEqual(responses, 1)
plugin.documentPickerWasCancelled(next)
XCTAssertEqual(responses, 2)
await dismiss(parent)
}
@MainActor
func testSyntheticDocumentsReadInPlaceAndRejectInvalidOrOversize() async throws {
let messenger = IdentityFileTestMessenger()
let plugin = IdentityFilePlugin(messenger: messenger)
let (window, parent) = try makeWindow()
defer { window.isHidden = true }
let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
defer { try? FileManager.default.removeItem(at: directory) }
let cases: [(Data, String?)] = [
(Data("synthetic-nsec-file-not-an-identity\n".utf8), "synthetic-nsec-file-not-an-identity\n"),
(Data(repeating: 97, count: 1024), String(repeating: "a", count: 1024)),
(Data(repeating: 97, count: 1025), nil),
(Data([0xc3, 0x28]), nil),
(Data(), nil),
]
for (index, entry) in cases.enumerated() {
let url = directory.appendingPathComponent("fixture-\(index).nsec")
try entry.0.write(to: url)
let completed = expectation(description: "file result \(index)")
messenger.invokeImport { value in
if let expected = entry.1 { XCTAssertEqual(value as? String, expected) }
else {
let error = value as? FlutterError
XCTAssertEqual(error?.code, "import_failed")
XCTAssertNil(error?.message)
XCTAssertNil(error?.details)
}
completed.fulfill()
}
let picker = try await picker(in: parent)
await settle(picker)
// A synthetic delegate URL, not a claim that Files/iCloud selected it.
plugin.documentPicker(picker, didPickDocumentsAt: [url])
await fulfillment(of: [completed], timeout: 5)
XCTAssertEqual(try Data(contentsOf: url), entry.0, "Original document must remain untouched")
await dismiss(parent)
}
}
}
private final class IdentityFileTestMessenger: NSObject, FlutterBinaryMessenger {
private var handler: FlutterBinaryMessageHandler?
func send(onChannel channel: String, message: Data?) {}
func send(onChannel channel: String, message: Data?, binaryReply callback: FlutterBinaryReply?) { callback?(nil) }
func setMessageHandlerOnChannel(_ channel: String, binaryMessageHandler handler: FlutterBinaryMessageHandler?) -> FlutterBinaryMessengerConnection {
self.handler = handler
return 1
}
func cleanUpConnection(_ connection: FlutterBinaryMessengerConnection) { handler = nil }
func invokeImport(reply: @escaping (Any?) -> Void) {
invoke("import", arguments: nil, reply: reply)
}
func invoke(_ method: String, arguments: Any?, reply: @escaping (Any?) -> Void) {
let codec = FlutterStandardMethodCodec.sharedInstance()
handler?(codec.encode(FlutterMethodCall(methodName: method, arguments: arguments))) { data in
reply(data.flatMap { codec.decodeEnvelope($0) })
}
}
}