mirror of
https://github.com/block/buzz.git
synced 2026-10-28 13:01:10 +00:00
## Behavior Adds optional mobile Builderlab sign-in, identity backup/recovery, community discovery/creation, and account-aware reconnect. **Builderlab features are disabled by default:** when `BUZZ_AUTH_DOMAINS` is unset or empty, account login, creation, backup/recovery, reconnect prompts, and background account restoration are hidden/disabled. QR/code pairing, links, and invites retain Nostr-only entry. Saved account state is retained for later opt-in. `--dart-define=BUZZ_AUTH_DOMAINS=communities.buzz.xyz,communities.public.builderlabstaging.xyz` opts those DNS domains and their subdomains into required account setup. The same policy gates pairing, deep links, durable community admission, and reconnect. A nonempty list enables Builderlab features; `BUZZ_BUILDERLAB_URL` alone does not. Enabled flows still require their backend services. Existing Nostr relay authentication remains mandatory. `BUZZ_HOSTED_RELAY_AUTH=true` enables scoped relay assertions and reconnect prompts only for configured authentication domains. Configure assertion issuance and each community's issuer binding before enabling assertions; enable relay enforcement last. Account credentials stay at Builderlab. Wrong-account recovery preserves keys; failed writes are not replayed; authentication is bounded by request deadlines. Hosted flows preserve keys across cancellation/restart, reconcile interrupted creation/invitation acceptance, and support manual nsec file import/export. Account identities are scoped to backend and authenticated subject; reusing an existing local key for an unbound account requires an explicit selection. Recovery reconciles the advertised and recovered inventories before automatic selection. Successful self-hosted admission retires its pending key, and iOS startup removes interrupted export files. Adds authenticated relay `GET /operator/communities/joined` for the companion Builderlab membership endpoint. ## Validation - Follow-up review repair at `66a12ac92`: self-hosted entry presents readable choices and import despite incomplete enumeration, while generation still requires a complete empty inventory; explicit selection uses exact-key lookup. Consuming a value-equal duplicate now advances dispatch. Reconnect requires an existing account binding or a subject-scoped backup receipt before signing an assertion, and pins the subject inside the serialized account request. An empty different account is refused without sending key proof. Focused checks: configured domains 58 passed; default 49 passed, 9 hosted-only skips. Separate isolated mutations fail the incomplete-inventory sheet, exact-key reuse, duplicate dispatch and reconnect journeys (including an empty-account-only bypass); restored controls pass. Evidence uses synthetic storage/network boundaries, not physical Android or live backend association. All mandatory commit/push hooks passed; fresh GitHub CI is pending. - Bounded review repair at `d3cc0003f`: incomplete secure-storage enumeration now blocks automatic identity generation while explicit known-key reads retain their fallback; declined/failed onboarding links release the queue; HTTP 429/5xx keeps Retry regardless of response encoding. Default app-gate coverage exercises a bind link followed by ordinary community entry. Focused checks: configured domains 47 passed; default 38 passed, 9 hosted-only skips. Removing the three production fixes in an isolated source/Git/build copy fails the identity-resolution, declined/failed queue, and Retry journey assertions; clean and restored controls pass. Storage and HTTP failures are synthetic; physical Android and live outage behavior were not exercised. Published after all mandatory commit/push hooks passed (mobile analysis/tests, branch-skew and file-size gates); fresh GitHub CI remains pending. - Existing whole-PR source review cleared the reconnect defects at `fb15d5b82`. - Domain-policy increment: focused environment, entry, app-gate, pairing and onboarding journeys pass with empty and configured domains. Existing pairing provider/page tests pass. Changed Dart files analyze cleanly. - Isolated source/Git/build mutation: forcing paired credentials through hosted login fails the default-build journey; clean and restored controls pass. CI now runs configured-domain journeys in addition to the default-build suite. - Integrated main through `5b433d929` at `0067c069c`, including its pinned Flutter upgrade. Preserved the PR welcome UI with the updated transition API and added Material surfaces around onboarding selection/consent rows. Focused post-merge runs pass in both configurations; all mandatory local push gates passed (mobile analysis/tests, Rust tests, desktop-native checks, branch-skew and file-size checks). - Merge-review repair at `a315bce11`: focused identity/storage/admission and widget journeys pass, including account switching with an empty or already-bound second account, explicit reuse, and self-hosted removal/rejoin with another key. Default-domain journeys pass too (hosted-only cases intentionally skip there). - Isolated source/Git/build mutation checks: bypassing account scoping, reuse consent, pending-key retirement, or recovery inventory reconciliation fails the relevant journey/invariant assertions; clean and restored controls pass. - Native `RunnerTests/IdentityFilePluginTests`: both tests pass on the iPhone 18 Pro iOS 27 simulator with an isolated app identifier. At `24a0dcaac`, the picker journey seeds residue in Library/Caches, matching path_provider_foundation, and verifies plugin startup removes it while preserving an unrelated file. The earlier tmp-only fixture did not exercise the actual export location. This is synthetic native cleanup/picker evidence, not a real terminated-share or live account round trip. - Follow-up: Caches and tmp cleanup; fallback to individually known identity slots when Android bulk enumeration fails; explicit replacement of a refused self-hosted key preserves its original before swapping the retry slot. Configured-domain journeys/invariants: 34 passed; default: 31 passed, 3 hosted-only skips. Isolated enumeration/retry mutations fail with passing controls. Bulk-read fallback preserves but cannot enumerate arbitrary other-account slots until bulk reads recover. - Configured-domain CI exposed a stale pairing-status assertion after account scoping. The repaired test checks the admission mismatch, preserved account/transfer keys, and no admitted community. The configured-domain CI selection passes locally (56 tests); removing the production mismatch guard fails the updated test, with clean/restored controls passing. This is synthetic coordinator evidence, not physical QR acceptance. - Final review repair (`40e1e6101`): native iOS export creation uses atomic complete file protection; normal and restart cleanup remain. Account/policy/claim HTTP uses one 30-second total deadline with request abort and body cancellation. Removed the unrelated NIP-FA spec edit. - Focused account/admission/export tests: 25 pass; configured-domain account/admission/onboarding journeys: 33 pass. Isolated deadline and native-dispatch mutations fail, with passing clean/restored controls. Native export/picker tests: 2 pass on iOS 27 simulator. The real file-protection attribute assertion is physical-device-only because simulator provides no Data Protection attribute; locked-device protection and interrupted real sharing have not been observed. - Opt-in UI: configured-domain CI selection passes (57 tests); default selection passes (7 tests, 10 hosted-only skips); URL-only plus whitespace/empty domains passes (6 tests, 9 hosted-only skips). Changed Dart files analyze cleanly. Independent mutations that unconditionally initialize the coordinator in the app gate, welcome entry, or link form fail the default journey; clean/restored controls pass. - Native welcome screens exercised on iPhone 18 Pro / iOS 27 simulator in default and configured builds: default exposes community link / QR / pairing code only; configured build additionally exposes Builderlab connection and community creation. No live hosted login was exercised in this check. - Delivery at `e48fe73a9`: all mandatory push hooks passed (full mobile analysis/tests, Rust tests, desktop-native checks, branch and file-size checks). GitHub checks had not yet populated at the immediate post-push snapshot. ## Review disposition | Feedback | Disposition | | --- | --- | | Explicit self-hosted entry under unreadable inventory, duplicate invite dispatch, reconnect cross-account binding ([entry](https://github.com/block/buzz/pull/8375#discussion_r4318421622), [queue](https://github.com/block/buzz/pull/8375#discussion_r4318421640), [reconnect](https://github.com/block/buzz/pull/8375#discussion_r4318455512)) | Repaired at `66a12ac92`; evidence above. Reconnect refuses unproven ownership rather than silently establishing a binding. | | Incomplete Android identity inventory, stranded deep-link queue, transient HTTP retry classification ([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5576864143)) | All three repaired in `d3cc0003f`; focused journeys and isolated mutation evidence above. | | Account cross-link, incomplete recovery inventory, committed invite checkpoint, pending local key retirement/replacement | Repaired in the preceding commits; journey and mutation evidence above. | | iOS interrupted key export ([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5575253252)) | Native cleanup plus complete protection at creation implemented. Physical-device lock and real interrupted sharing acceptance remains pending. | | Trickle responses bypass idle timeout; unrelated NIP-FA edit ([review](https://github.com/block/buzz/pull/8375#pullrequestreview-5575764556)) | Total request deadline/abort implemented; spec edit removed. | | Production domains rejected | Ordinary entry now needs no Builderlab configuration. Opt-in account-required domains must still use supported community mappings. | | Lost Android Keystore recovery | Backup exclusions prevent the reviewed stale-restore scenario; genuine key loss still has no in-app recovery/reset and remains deferred. | | Native secp256k1 dependency question | Obsolete against the current base: upstream C integration landed in #8398; no package diff remains here. | | Operator membership endpoint contract | Documentation now states the operator chooses the pubkey; no end-user session binding is implied. Additional handler-level coverage is optional follow-up. | | Optional Android partial document cleanup/activity retention; local work after backup cancellation | Follow-up hardening, not claimed implemented. Cancellation prevents remote backup upload. | | Semgrep crypto inventory notices | Informational inventory, not demonstrated defects. | ## Remaining draft gates Native QR/browser-return acceptance remains unverified for this revision. Optional Builderlab onboarding still needs backend backup-status and joined-community routes, recovery policy/configuration, and real backup/recovery/reconnect acceptance. The empty-domain build removes these services as prerequisites for ordinary pairing; it does not make the optional hosted flows backend-ready. Human acceptance and current CI are still required before merge. Review dispositions retained: production auth-domain configuration must use supported community mappings; enabling `builderlab.xyz` does not add support for `buzz.block.builderlab.xyz`. Recovery after genuinely losing an Android Keystore key remains a follow-up, not a newly implemented capability. Human acceptance steps: build once without `BUZZ_AUTH_DOMAINS` (including with a previously saved account) and confirm no Builderlab controls/restoration while ordinary link and QR/code entry work. Build with supported domains and confirm connection/creation appear; exercise browser return and live backup/recovery/reconnect. On physical iOS, exercise export and interrupted sharing/locked-device protection. Record results before marking review complete. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz> Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@wes.communities.public.builderlabstaging.xyz>
179 lines
6.1 KiB
Dart
179 lines
6.1 KiB
Dart
import 'dart:async';
|
|
|
|
import 'package:flutter/foundation.dart';
|
|
import 'package:flutter/material.dart';
|
|
import 'package:flutter/services.dart';
|
|
import 'package:flutter_hooks/flutter_hooks.dart';
|
|
import 'package:hooks_riverpod/hooks_riverpod.dart';
|
|
import 'package:buzz/shared/theme/buzz_icons.dart';
|
|
import 'package:nostr/nostr.dart' as nostr;
|
|
import 'package:package_info_plus/package_info_plus.dart';
|
|
|
|
import '../../shared/auth/auth.dart';
|
|
import '../../shared/identity_transfer/nsec_export_sheet.dart';
|
|
import '../../shared/clipboard_utils.dart';
|
|
import '../../shared/success_haptic.dart';
|
|
import '../../shared/push/push_relay_capability_provider.dart';
|
|
import '../../shared/relay/relay.dart';
|
|
import '../../shared/utils/string_utils.dart';
|
|
import '../pairing/pairing_provider.dart';
|
|
import '../../shared/theme/theme.dart';
|
|
import '../../shared/widgets/app_list.dart';
|
|
import '../../shared/widgets/app_list_card.dart';
|
|
import '../../shared/widgets/frosted_app_bar.dart';
|
|
import '../../shared/widgets/frosted_scaffold.dart';
|
|
import '../../shared/widgets/ios_glass_navigation_button.dart';
|
|
import '../../shared/widgets/immediate_page_route.dart';
|
|
|
|
part 'settings_page/profile_section.dart';
|
|
part 'settings_page/status_section.dart';
|
|
part 'settings_page/connection_section.dart';
|
|
part 'settings_page/notifications_section.dart';
|
|
|
|
Widget _emptyProfileEditPage(BuildContext context) => const SizedBox.shrink();
|
|
|
|
class SettingsPage extends HookConsumerWidget {
|
|
/// Creates the settings page.
|
|
const SettingsPage({
|
|
super.key,
|
|
required this.profileHeader,
|
|
required this.identityRecoveryPageBuilder,
|
|
this.profileEditPageBuilder = _emptyProfileEditPage,
|
|
this.onSetStatus,
|
|
this.onEditDisplayName,
|
|
this.onEditProfileDescription,
|
|
});
|
|
|
|
/// Header widget displayed at the top of settings.
|
|
final Widget profileHeader;
|
|
|
|
/// Builds the identity-recovery page pushed from the recovery settings row.
|
|
final WidgetBuilder identityRecoveryPageBuilder;
|
|
|
|
/// Builds the current-user profile editor opened from the Photo row.
|
|
final WidgetBuilder profileEditPageBuilder;
|
|
|
|
/// Opens the current-user status editor.
|
|
final void Function(BuildContext context)? onSetStatus;
|
|
|
|
/// Opens the display-name editor from the settings section.
|
|
final Future<void> Function(BuildContext context)? onEditDisplayName;
|
|
|
|
/// Opens the profile-description editor from the settings section.
|
|
final Future<void> Function(BuildContext context)? onEditProfileDescription;
|
|
|
|
@override
|
|
Widget build(BuildContext context, WidgetRef ref) {
|
|
final packageInfoFuture = useMemoized(() => PackageInfo.fromPlatform());
|
|
final packageInfo = useFuture(packageInfoFuture);
|
|
final topSectionHeight = frostedAppBarHeight(
|
|
context,
|
|
bottomHeight: Grid.xxs,
|
|
);
|
|
|
|
// Keep feedback local even while Home is mounted during the transition.
|
|
return ScaffoldMessenger(
|
|
child: FrostedScaffold(
|
|
useUtilitySurfaceTheme: true,
|
|
appBar: FrostedAppBar(
|
|
nativeTitle: 'Settings',
|
|
nativeLeading: IosNavigationAction(
|
|
label: 'Close settings',
|
|
symbol: 'xmark',
|
|
onPressed: () => Navigator.of(context).pop(),
|
|
),
|
|
automaticallyImplyLeading: false,
|
|
horizontalInset: Grid.gutter,
|
|
showBottomDivider: false,
|
|
leading: Theme.of(context).platform == TargetPlatform.iOS
|
|
? IosGlassNavigationButton(
|
|
key: const ValueKey('settings-ios-glass-close'),
|
|
icon: IosGlassNavigationIcon.close,
|
|
semanticLabel: 'Close settings',
|
|
onPressed: () {
|
|
unawaited(HapticFeedback.lightImpact());
|
|
Navigator.of(context).pop();
|
|
},
|
|
foregroundColor: navigationPrimaryForeground(context),
|
|
)
|
|
: SizedBox(
|
|
width: Grid.xl,
|
|
height: Grid.xl,
|
|
child: IconButton(
|
|
tooltip: 'Close settings',
|
|
onPressed: () {
|
|
unawaited(HapticFeedback.lightImpact());
|
|
Navigator.of(context).pop();
|
|
},
|
|
color: navigationPrimaryForeground(context),
|
|
icon: const Icon(BuzzIcons.x),
|
|
),
|
|
),
|
|
bottomHeight: Grid.xxs,
|
|
bottom: const SizedBox.expand(),
|
|
),
|
|
body: ListView(
|
|
padding: EdgeInsets.only(top: topSectionHeight, bottom: Grid.xs),
|
|
children: [
|
|
profileHeader,
|
|
_StatusSection(onSetStatus: onSetStatus),
|
|
_ProfileSection(
|
|
profileEditPageBuilder: profileEditPageBuilder,
|
|
onEditDisplayName: onEditDisplayName,
|
|
onEditProfileDescription: onEditProfileDescription,
|
|
),
|
|
const _NotificationsSection(),
|
|
_ConnectionSection(
|
|
identityRecoveryPageBuilder: identityRecoveryPageBuilder,
|
|
),
|
|
if (packageInfo.hasData)
|
|
_VersionFooter(
|
|
version: packageInfo.data!.version,
|
|
buildNumber: packageInfo.data!.buildNumber,
|
|
),
|
|
],
|
|
),
|
|
),
|
|
);
|
|
}
|
|
}
|
|
|
|
class _VersionFooter extends StatelessWidget {
|
|
const _VersionFooter({required this.version, required this.buildNumber});
|
|
|
|
final String version;
|
|
final String buildNumber;
|
|
|
|
@override
|
|
Widget build(BuildContext context) {
|
|
return SafeArea(
|
|
top: false,
|
|
child: Padding(
|
|
padding: const EdgeInsets.only(bottom: Grid.xs, top: Grid.xxs),
|
|
child: Center(
|
|
child: Text(
|
|
buildNumber.isEmpty ? 'v$version' : 'v$version ($buildNumber)',
|
|
style: context.textTheme.bodySmall?.copyWith(
|
|
color: context.colors.onSurfaceVariant.withValues(alpha: 0.6),
|
|
),
|
|
),
|
|
),
|
|
),
|
|
);
|
|
}
|
|
}
|
|
|
|
/// Trailing affordance shared by the rows that push a picker page.
|
|
class _RowChevron extends StatelessWidget {
|
|
const _RowChevron();
|
|
|
|
@override
|
|
Widget build(BuildContext context) {
|
|
return Icon(
|
|
BuzzIcons.chevronRight,
|
|
size: 18,
|
|
color: context.colors.onSurfaceVariant,
|
|
);
|
|
}
|
|
}
|