mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
## Behavior Adds optional mobile Builderlab sign-in, identity backup/recovery, community discovery/creation, and account-aware reconnect. **Builderlab features are disabled by default:** when `BUZZ_AUTH_DOMAINS` is unset or empty, account login, creation, backup/recovery, reconnect prompts, and background account restoration are hidden/disabled. QR/code pairing, links, and invites retain Nostr-only entry. Saved account state is retained for later opt-in. `--dart-define=BUZZ_AUTH_DOMAINS=communities.buzz.xyz,communities.public.builderlabstaging.xyz` opts those DNS domains and their subdomains into required account setup. The same policy gates pairing, deep links, durable community admission, and reconnect. A nonempty list enables Builderlab features; `BUZZ_BUILDERLAB_URL` alone does not. Enabled flows still require their backend services. Existing Nostr relay authentication remains mandatory. `BUZZ_HOSTED_RELAY_AUTH=true` enables scoped relay assertions and reconnect prompts only for configured authentication domains. Configure assertion issuance and each community's issuer binding before enabling assertions; enable relay enforcement last. Account credentials stay at Builderlab. Wrong-account recovery preserves keys; failed writes are not replayed; authentication is bounded by request deadlines. Hosted flows preserve keys across cancellation/restart, reconcile interrupted creation/invitation acceptance, and support manual nsec file import/export. Account identities are scoped to backend and authenticated subject; reusing an existing local key for an unbound account requires an explicit selection. Recovery reconciles the advertised and recovered inventories before automatic selection. Successful self-hosted admission retires its pending key, and iOS startup removes interrupted export files. Adds authenticated relay `GET /operator/communities/joined` for the companion Builderlab membership endpoint. ## Validation - Follow-up review repair at `66a12ac92`: self-hosted entry presents readable choices and import despite incomplete enumeration, while generation still requires a complete empty inventory; explicit selection uses exact-key lookup. Consuming a value-equal duplicate now advances dispatch. Reconnect requires an existing account binding or a subject-scoped backup receipt before signing an assertion, and pins the subject inside the serialized account request. An empty different account is refused without sending key proof. Focused checks: configured domains 58 passed; default 49 passed, 9 hosted-only skips. Separate isolated mutations fail the incomplete-inventory sheet, exact-key reuse, duplicate dispatch and reconnect journeys (including an empty-account-only bypass); restored controls pass. Evidence uses synthetic storage/network boundaries, not physical Android or live backend association. All mandatory commit/push hooks passed; fresh GitHub CI is pending. - Bounded review repair at `d3cc0003f`: incomplete secure-storage enumeration now blocks automatic identity generation while explicit known-key reads retain their fallback; declined/failed onboarding links release the queue; HTTP 429/5xx keeps Retry regardless of response encoding. Default app-gate coverage exercises a bind link followed by ordinary community entry. Focused checks: configured domains 47 passed; default 38 passed, 9 hosted-only skips. Removing the three production fixes in an isolated source/Git/build copy fails the identity-resolution, declined/failed queue, and Retry journey assertions; clean and restored controls pass. Storage and HTTP failures are synthetic; physical Android and live outage behavior were not exercised. Published after all mandatory commit/push hooks passed (mobile analysis/tests, branch-skew and file-size gates); fresh GitHub CI remains pending. - Existing whole-PR source review cleared the reconnect defects at `fb15d5b82`. - Domain-policy increment: focused environment, entry, app-gate, pairing and onboarding journeys pass with empty and configured domains. Existing pairing provider/page tests pass. Changed Dart files analyze cleanly. - Isolated source/Git/build mutation: forcing paired credentials through hosted login fails the default-build journey; clean and restored controls pass. CI now runs configured-domain journeys in addition to the default-build suite. - Integrated main through `5b433d929` at `0067c069c`, including its pinned Flutter upgrade. Preserved the PR welcome UI with the updated transition API and added Material surfaces around onboarding selection/consent rows. Focused post-merge runs pass in both configurations; all mandatory local push gates passed (mobile analysis/tests, Rust tests, desktop-native checks, branch-skew and file-size checks). - Merge-review repair at `a315bce11`: focused identity/storage/admission and widget journeys pass, including account switching with an empty or already-bound second account, explicit reuse, and self-hosted removal/rejoin with another key. Default-domain journeys pass too (hosted-only cases intentionally skip there). - Isolated source/Git/build mutation checks: bypassing account scoping, reuse consent, pending-key retirement, or recovery inventory reconciliation fails the relevant journey/invariant assertions; clean and restored controls pass. - Native `RunnerTests/IdentityFilePluginTests`: both tests pass on the iPhone 18 Pro iOS 27 simulator with an isolated app identifier. At `24a0dcaac`, the picker journey seeds residue in Library/Caches, matching path_provider_foundation, and verifies plugin startup removes it while preserving an unrelated file. The earlier tmp-only fixture did not exercise the actual export location. This is synthetic native cleanup/picker evidence, not a real terminated-share or live account round trip. - Follow-up: Caches and tmp cleanup; fallback to individually known identity slots when Android bulk enumeration fails; explicit replacement of a refused self-hosted key preserves its original before swapping the retry slot. Configured-domain journeys/invariants: 34 passed; default: 31 passed, 3 hosted-only skips. Isolated enumeration/retry mutations fail with passing controls. Bulk-read fallback preserves but cannot enumerate arbitrary other-account slots until bulk reads recover. - Configured-domain CI exposed a stale pairing-status assertion after account scoping. The repaired test checks the admission mismatch, preserved account/transfer keys, and no admitted community. The configured-domain CI selection passes locally (56 tests); removing the production mismatch guard fails the updated test, with clean/restored controls passing. This is synthetic coordinator evidence, not physical QR acceptance. - Final review repair (`40e1e6101`): native iOS export creation uses atomic complete file protection; normal and restart cleanup remain. Account/policy/claim HTTP uses one 30-second total deadline with request abort and body cancellation. Removed the unrelated NIP-FA spec edit. - Focused account/admission/export tests: 25 pass; configured-domain account/admission/onboarding journeys: 33 pass. Isolated deadline and native-dispatch mutations fail, with passing clean/restored controls. Native export/picker tests: 2 pass on iOS 27 simulator. The real file-protection attribute assertion is physical-device-only because simulator provides no Data Protection attribute; locked-device protection and interrupted real sharing have not been observed. - Opt-in UI: configured-domain CI selection passes (57 tests); default selection passes (7 tests, 10 hosted-only skips); URL-only plus whitespace/empty domains passes (6 tests, 9 hosted-only skips). Changed Dart files analyze cleanly. Independent mutations that unconditionally initialize the coordinator in the app gate, welcome entry, or link form fail the default journey; clean/restored controls pass. - Native welcome screens exercised on iPhone 18 Pro / iOS 27 simulator in default and configured builds: default exposes community link / QR / pairing code only; configured build additionally exposes Builderlab connection and community creation. No live hosted login was exercised in this check. - Delivery at `e48fe73a9`: all mandatory push hooks passed (full mobile analysis/tests, Rust tests, desktop-native checks, branch and file-size checks). GitHub checks had not yet populated at the immediate post-push snapshot. ## Review disposition | Feedback | Disposition | | --- | --- | | Explicit self-hosted entry under unreadable inventory, duplicate invite dispatch, reconnect cross-account binding ([entry](https://github.com/block/buzz/pull/8375#discussion_r4318421622), [queue](https://github.com/block/buzz/pull/8375#discussion_r4318421640), [reconnect](https://github.com/block/buzz/pull/8375#discussion_r4318455512)) | Repaired at `66a12ac92`; evidence above. Reconnect refuses unproven ownership rather than silently establishing a binding. | | Incomplete Android identity inventory, stranded deep-link queue, transient HTTP retry classification ([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5576864143)) | All three repaired in `d3cc0003f`; focused journeys and isolated mutation evidence above. | | Account cross-link, incomplete recovery inventory, committed invite checkpoint, pending local key retirement/replacement | Repaired in the preceding commits; journey and mutation evidence above. | | iOS interrupted key export ([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5575253252)) | Native cleanup plus complete protection at creation implemented. Physical-device lock and real interrupted sharing acceptance remains pending. | | Trickle responses bypass idle timeout; unrelated NIP-FA edit ([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5575764556)) | Total request deadline/abort implemented; spec edit removed. | | Production domains rejected | Ordinary entry now needs no Builderlab configuration. Opt-in account-required domains must still use supported community mappings. | | Lost Android Keystore recovery | Backup exclusions prevent the reviewed stale-restore scenario; genuine key loss still has no in-app recovery/reset and remains deferred. | | Native secp256k1 dependency question | Obsolete against the current base: upstream C integration landed in #8398; no package diff remains here. | | Operator membership endpoint contract | Documentation now states the operator chooses the pubkey; no end-user session binding is implied. Additional handler-level coverage is optional follow-up. | | Optional Android partial document cleanup/activity retention; local work after backup cancellation | Follow-up hardening, not claimed implemented. Cancellation prevents remote backup upload. | | Semgrep crypto inventory notices | Informational inventory, not demonstrated defects. | ## Remaining draft gates Native QR/browser-return acceptance remains unverified for this revision. Optional Builderlab onboarding still needs backend backup-status and joined-community routes, recovery policy/configuration, and real backup/recovery/reconnect acceptance. The empty-domain build removes these services as prerequisites for ordinary pairing; it does not make the optional hosted flows backend-ready. Human acceptance and current CI are still required before merge. Review dispositions retained: production auth-domain configuration must use supported community mappings; enabling `builderlab.xyz` does not add support for `buzz.block.builderlab.xyz`. Recovery after genuinely losing an Android Keystore key remains a follow-up, not a newly implemented capability. Human acceptance steps: build once without `BUZZ_AUTH_DOMAINS` (including with a previously saved account) and confirm no Builderlab controls/restoration while ordinary link and QR/code entry work. Build with supported domains and confirm connection/creation appear; exercise browser return and live backup/recovery/reconnect. On physical iOS, exercise export and interrupted sharing/locked-device protection. Record results before marking review complete. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz> Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@wes.communities.public.builderlabstaging.xyz>
183 lines
7.9 KiB
Swift
183 lines
7.9 KiB
Swift
import Flutter
|
|
import UIKit
|
|
import XCTest
|
|
@testable import Buzz
|
|
|
|
/// Actual UIKit picker presentation and method-channel dispatch, followed by
|
|
/// synthetic document-provider delegate callbacks. Never persists an identity.
|
|
final class IdentityFilePluginTests: XCTestCase {
|
|
@MainActor
|
|
private func makeWindow() throws -> (UIWindow, UIViewController) {
|
|
let scene = try XCTUnwrap(UIApplication.shared.connectedScenes
|
|
.compactMap { $0 as? UIWindowScene }
|
|
.first { $0.activationState == .foregroundActive })
|
|
let parent = UIViewController()
|
|
let window = UIWindow(windowScene: scene)
|
|
window.rootViewController = parent
|
|
window.makeKeyAndVisible()
|
|
parent.loadViewIfNeeded()
|
|
return (window, parent)
|
|
}
|
|
|
|
@MainActor
|
|
private func picker(in parent: UIViewController) async throws -> UIDocumentPickerViewController {
|
|
let presented = XCTNSPredicateExpectation(predicate: NSPredicate { _, _ in
|
|
parent.presentedViewController is UIDocumentPickerViewController
|
|
}, object: nil)
|
|
await fulfillment(of: [presented], timeout: 5)
|
|
return try XCTUnwrap(parent.presentedViewController as? UIDocumentPickerViewController)
|
|
}
|
|
|
|
@MainActor
|
|
private func settle(_ controller: UIViewController) async {
|
|
if let transition = controller.transitionCoordinator {
|
|
await withCheckedContinuation { continuation in
|
|
transition.animate(alongsideTransition: nil) { _ in continuation.resume() }
|
|
}
|
|
}
|
|
}
|
|
|
|
@MainActor
|
|
private func dismiss(_ parent: UIViewController) async {
|
|
await withCheckedContinuation { continuation in
|
|
parent.dismiss(animated: false) { continuation.resume() }
|
|
}
|
|
}
|
|
|
|
@MainActor
|
|
func testPickerResolvesPresenterAtRequestAndCancelsExactlyOnce() async throws {
|
|
let messenger = IdentityFileTestMessenger()
|
|
// A previous process died with a share open. Startup must remove only its
|
|
// export directory, while preserving unrelated temporary documents.
|
|
let manager = FileManager.default
|
|
// Matches path_provider_foundation 2.6.0 getTemporaryPath().
|
|
let exportRoot = try XCTUnwrap(manager.urls(for: .cachesDirectory, in: .userDomainMask).first)
|
|
// Exercise the production method-channel writer, not a lookalike fixture.
|
|
let exporter = IdentityFilePlugin(messenger: messenger)
|
|
var exportedPath: String?
|
|
messenger.invoke("prepareExport", arguments: ["text": "synthetic-export-not-a-key\n"]) {
|
|
exportedPath = $0 as? String
|
|
}
|
|
let exported = URL(fileURLWithPath: try XCTUnwrap(exportedPath))
|
|
let interrupted = exported.deletingLastPathComponent()
|
|
XCTAssertEqual(interrupted.deletingLastPathComponent().standardizedFileURL, exportRoot.standardizedFileURL)
|
|
XCTAssertEqual(try String(contentsOf: exported, encoding: .utf8), "synthetic-export-not-a-key\n")
|
|
#if !targetEnvironment(simulator)
|
|
// Simulator does not implement iOS Data Protection attributes.
|
|
let attributes = try manager.attributesOfItem(atPath: exported.path)
|
|
XCTAssertEqual(attributes[.protectionKey] as? FileProtectionType, .complete)
|
|
#endif
|
|
withExtendedLifetime(exporter) {}
|
|
let unrelated = exportRoot.appendingPathComponent("unrelated-\(UUID().uuidString)")
|
|
try Data("keep".utf8).write(to: unrelated)
|
|
defer {
|
|
try? manager.removeItem(at: interrupted)
|
|
try? manager.removeItem(at: unrelated)
|
|
}
|
|
// Initialize before this window exists: registrar startup timing must not
|
|
// permanently prevent later user-triggered presentation.
|
|
let plugin = IdentityFilePlugin(messenger: messenger)
|
|
XCTAssertFalse(manager.fileExists(atPath: interrupted.path))
|
|
XCTAssertTrue(manager.fileExists(atPath: unrelated.path))
|
|
let (window, parent) = try makeWindow()
|
|
defer { window.isHidden = true }
|
|
var responses = 0
|
|
messenger.invokeImport { value in
|
|
responses += 1
|
|
XCTAssertNil(value)
|
|
}
|
|
let picker = try await picker(in: parent)
|
|
await settle(picker)
|
|
XCTAssertFalse(picker.allowsMultipleSelection)
|
|
XCTAssertEqual(responses, 0)
|
|
var busy: FlutterError?
|
|
messenger.invokeImport { busy = $0 as? FlutterError }
|
|
XCTAssertEqual(busy?.code, "import_busy")
|
|
XCTAssertNil(busy?.details)
|
|
let attachment = XCTAttachment(image: UIGraphicsImageRenderer(bounds: window.bounds).image { _ in
|
|
window.drawHierarchy(in: window.bounds, afterScreenUpdates: true)
|
|
})
|
|
attachment.name = "Identity document picker presented"
|
|
attachment.lifetime = .keepAlways
|
|
add(attachment)
|
|
plugin.documentPickerWasCancelled(picker)
|
|
plugin.documentPickerWasCancelled(picker)
|
|
XCTAssertEqual(responses, 1)
|
|
await dismiss(parent)
|
|
messenger.invokeImport { value in
|
|
responses += 1
|
|
XCTAssertNil(value)
|
|
}
|
|
let next = try await self.picker(in: parent)
|
|
await settle(next)
|
|
// Late callbacks from the previous picker must not finish the new request.
|
|
plugin.documentPickerWasCancelled(picker)
|
|
XCTAssertEqual(responses, 1)
|
|
plugin.documentPicker(picker, didPickDocumentsAt: [])
|
|
XCTAssertEqual(responses, 1)
|
|
plugin.documentPickerWasCancelled(next)
|
|
XCTAssertEqual(responses, 2)
|
|
await dismiss(parent)
|
|
}
|
|
|
|
@MainActor
|
|
func testSyntheticDocumentsReadInPlaceAndRejectInvalidOrOversize() async throws {
|
|
let messenger = IdentityFileTestMessenger()
|
|
let plugin = IdentityFilePlugin(messenger: messenger)
|
|
let (window, parent) = try makeWindow()
|
|
defer { window.isHidden = true }
|
|
let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
|
|
try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
|
|
defer { try? FileManager.default.removeItem(at: directory) }
|
|
let cases: [(Data, String?)] = [
|
|
(Data("synthetic-nsec-file-not-an-identity\n".utf8), "synthetic-nsec-file-not-an-identity\n"),
|
|
(Data(repeating: 97, count: 1024), String(repeating: "a", count: 1024)),
|
|
(Data(repeating: 97, count: 1025), nil),
|
|
(Data([0xc3, 0x28]), nil),
|
|
(Data(), nil),
|
|
]
|
|
for (index, entry) in cases.enumerated() {
|
|
let url = directory.appendingPathComponent("fixture-\(index).nsec")
|
|
try entry.0.write(to: url)
|
|
let completed = expectation(description: "file result \(index)")
|
|
messenger.invokeImport { value in
|
|
if let expected = entry.1 { XCTAssertEqual(value as? String, expected) }
|
|
else {
|
|
let error = value as? FlutterError
|
|
XCTAssertEqual(error?.code, "import_failed")
|
|
XCTAssertNil(error?.message)
|
|
XCTAssertNil(error?.details)
|
|
}
|
|
completed.fulfill()
|
|
}
|
|
let picker = try await picker(in: parent)
|
|
await settle(picker)
|
|
// A synthetic delegate URL, not a claim that Files/iCloud selected it.
|
|
plugin.documentPicker(picker, didPickDocumentsAt: [url])
|
|
await fulfillment(of: [completed], timeout: 5)
|
|
XCTAssertEqual(try Data(contentsOf: url), entry.0, "Original document must remain untouched")
|
|
await dismiss(parent)
|
|
}
|
|
}
|
|
}
|
|
|
|
private final class IdentityFileTestMessenger: NSObject, FlutterBinaryMessenger {
|
|
private var handler: FlutterBinaryMessageHandler?
|
|
func send(onChannel channel: String, message: Data?) {}
|
|
func send(onChannel channel: String, message: Data?, binaryReply callback: FlutterBinaryReply?) { callback?(nil) }
|
|
func setMessageHandlerOnChannel(_ channel: String, binaryMessageHandler handler: FlutterBinaryMessageHandler?) -> FlutterBinaryMessengerConnection {
|
|
self.handler = handler
|
|
return 1
|
|
}
|
|
func cleanUpConnection(_ connection: FlutterBinaryMessengerConnection) { handler = nil }
|
|
func invokeImport(reply: @escaping (Any?) -> Void) {
|
|
invoke("import", arguments: nil, reply: reply)
|
|
}
|
|
func invoke(_ method: String, arguments: Any?, reply: @escaping (Any?) -> Void) {
|
|
let codec = FlutterStandardMethodCodec.sharedInstance()
|
|
handler?(codec.encode(FlutterMethodCall(methodName: method, arguments: arguments))) { data in
|
|
reply(data.flatMap { codec.decodeEnvelope($0) })
|
|
}
|
|
}
|
|
}
|