mirror of
https://github.com/block/buzz.git
synced 2026-11-10 11:21:05 +00:00
Block is turning on NIP-FI enforcement on the Block relay. Desktop gets organization sign-in in block/buzz-app#1424. Mobile can already attach NIP-FI assertions, but only for Builderlab-hosted communities, through the build's single Builderlab account. The dogfood build needs that account for public hosted communities, so it can't simply be pointed at the Block tenant. This adds a separate **organization realm**, configured at build time: - `BUZZ_ORGANIZATION_URL`: the tenant's HTTPS origin (for example `https://block.builderlab.xyz`). - `BUZZ_ORGANIZATION_RELAYS`: the exact relay hosts that trust that tenant. The two must be set together. The app refuses to start if they're malformed, overlap a hosted community, or reuse the hosted origin. Without them, nothing changes. For a configured relay: - The app keeps its own organization session and signs in through the browser at the tenant's existing login (`/api/goose/v1/auth/login`). Block SSO happens there. - It requests assertions from the same `/v1/buzz/identity/assertions` route that hosted communities use, and attaches them to the relay socket, HTTP, media, huddle and remote-agent requests. - Unlike the hosted path, it doesn't require an identity backup before the first binding. As on desktop, the tenant binds the member's existing key on first issuance. A key already bound to a different one is refused before any request is sent. - When signed out, it connects without an assertion and lets the relay decide. A bottom banner offers **Sign in**. After sign-in, the relay reconnects with a fresh assertion. Hosted communities keep their existing banner and flow. The tenant accepts only the registered `xyz.block.buzz.mobile:/auth/callback` return URL, so both realms share it. Each `BrowserAuth` owner leaves callbacks whose `state` belongs to another owner's attempt to that owner. ### Before merge - [ ] Kenny Lopez reviews the visible changes. ### Validation Added tests (`organization_relay_auth_test.dart`): - Configuration parsing and exact host matching. - An assertion is issued for the exact relay and key, then cached. - A different bound key is refused. - Signed out connects without an assertion. - Other relays never receive the assertion. - The shared callback is routed between the hosted and organization owners. Full `mobile-check` and `mobile-test` pass. RunnerTests pass locally except `testNativeNavigationTitleExpandsAgainAtTop`, which this PR doesn't touch. Added tests (`organization_sign_in_test.dart`, `relay_auth_isolation_test.dart`, `builderlab_account_test.dart`), each failing without its fix: - Concurrent account restores at cold start share one adopted account. - An exchange from a cancelled attempt never changes a newer sign-in. - Storage failures while clearing the intent or cancelling leave the busy state. - An unreadable saved organization session is replaced by signing in again. - A stalled organization issuer never delays a hosted relay's assertion. This test needs `BUZZ_AUTH_DOMAINS` and skips without it. CI's configured-auth-domains step doesn't list it yet, because that workflow change needs a token with `workflow` scope. Added tests also cover a restore after an offline start (the banner clears once a relay retry restores the session) and the iOS bridge allowlist (`/auth/native` and tenant login on Builderlab subdomains; other hosts, paths, ports, userinfo and fragments refused). Simulator (iPhone 17, iOS 27) with the dogfood defines against the production Block relay `buzz.block.builderlab.xyz`, on a WARP Mac: - The app starts with the organization configuration and connects to the relay while signed out, showing the organization **Sign in** banner. - **Sign in** opens the system sign-in session for `block.builderlab.xyz`, and the banner shows **Finishing organization sign-in…**. Cancelling returns to **Sign in** with no error. Before the bridge fix, no browser opened and the banner reported that sign-in did not finish. - The bottom banners (organization sign-in, hosted reconnect, and the sign-in recovery row) now sit above Home's floating Search/New bar, which used to cover **Sign in**. A journey test checks the banner clears the bar, and fails without the fix.  - The simulator run stopped at the system consent prompt (SSO does not work in the simulator). The app calls were driven through the VM service (the same `signIn()`/`cancel()` the banner buttons call) because the simulator could not be tapped. Device (iPhone 12 mini) against bb-block staging in enforce mode, where every probe without an assertion gets 401: - Signed out, the organization banner shows and the app stays responsive. Cancel at the consent prompt returns to **Sign in**, and retry works. - Block SSO through Okta completes, and the relay admits the reconnect with the assertion. - After relaunch the app connects, loads channel history, and shows no banner for over 60 seconds. - Before the restore fix, 2 of 4 cold starts showed "cannot use this community with this key" although the session was valid. With it, 8 of 8 cold starts connected. Known limitation: adding an enforcing organization relay by community link is tracked in #8791. The dogfood build enables this in squareup/buzz-releases (`tomb/dogfood-organization-sign-in`). App Store builds stay unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Tom Brow <tomb@squareup.com> Co-authored-by: Tom Brow <tomb@squareup.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
100 lines
3.2 KiB
Dart
100 lines
3.2 KiB
Dart
import 'package:flutter/material.dart';
|
|
|
|
import '../theme/theme.dart';
|
|
|
|
/// Height of the floating mobile tab bar, excluding its bottom clearance.
|
|
const mobileTabBarHeight = 56.0;
|
|
|
|
/// Gap between the floating mobile tab bar and the bottom safe area.
|
|
const mobileTabBarBottomGap = Grid.twelve;
|
|
|
|
/// Distance from the screen bottom to the floating mobile tab bar's bottom.
|
|
double mobileTabBarBottom(BuildContext context) {
|
|
final inset = MediaQuery.viewPaddingOf(context).bottom;
|
|
return inset > mobileTabBarBottomGap ? inset : mobileTabBarBottomGap;
|
|
}
|
|
|
|
/// Distance from the screen bottom to the floating mobile tab bar's top.
|
|
///
|
|
/// Overlays drawn above Home, such as sign-in banners, sit above this so the
|
|
/// bar's controls do not cover them.
|
|
double mobileTabBarTop(BuildContext context) =>
|
|
mobileTabBarBottom(context) + mobileTabBarHeight;
|
|
|
|
/// Fixed visual height of the shared footer fade behind the floating tab bar.
|
|
double mobileTabFooterBackdropHeight(BuildContext _) => 180;
|
|
|
|
/// Builds the shared transparent-to-surface footer fade.
|
|
///
|
|
/// Kept separate from [MobileTabFooterBackdrop] so floating controls such as
|
|
/// the channel composer can paint the exact same fade behind their own content.
|
|
LinearGradient mobileTabFooterBackdropGradient(
|
|
BuildContext context, {
|
|
List<double> stops = const [0, 0.18, 0.38, 0.6, 0.8, 1],
|
|
List<double> opacities = const [0, 0.03, 0.12, 0.34, 0.7, 1],
|
|
Color? tint,
|
|
double tintBlend = 0,
|
|
}) {
|
|
assert(stops.length == opacities.length);
|
|
assert(tintBlend >= 0 && tintBlend <= 1);
|
|
final surface = Color.lerp(context.colors.surface, tint, tintBlend)!;
|
|
return LinearGradient(
|
|
begin: Alignment.topCenter,
|
|
end: Alignment.bottomCenter,
|
|
stops: stops,
|
|
colors: [
|
|
for (final opacity in opacities) surface.withValues(alpha: opacity),
|
|
],
|
|
);
|
|
}
|
|
|
|
/// Shared fade behind the floating mobile tab bar.
|
|
class MobileTabFooterBackdrop extends StatelessWidget {
|
|
/// Vertical extent of the backdrop in logical pixels.
|
|
final double height;
|
|
|
|
/// Gradient stop positions, from the transparent top to the opaque bottom.
|
|
final List<double> stops;
|
|
|
|
/// Surface-color alpha values paired with [stops].
|
|
final List<double> opacities;
|
|
|
|
/// Optional color blended into the surface before opacity is applied.
|
|
final Color? tint;
|
|
|
|
/// Amount of [tint] mixed into the surface, from 0 to 1.
|
|
final double tintBlend;
|
|
|
|
/// Creates a footer backdrop with the required [height].
|
|
///
|
|
/// Override [stops] and [opacities] together to customize the gradient.
|
|
const MobileTabFooterBackdrop({
|
|
super.key,
|
|
required this.height,
|
|
this.stops = const [0, 0.18, 0.38, 0.6, 0.8, 1],
|
|
this.opacities = const [0, 0.03, 0.12, 0.34, 0.7, 1],
|
|
this.tint,
|
|
this.tintBlend = 0,
|
|
}) : assert(stops.length == opacities.length),
|
|
assert(tintBlend >= 0 && tintBlend <= 1);
|
|
|
|
@override
|
|
Widget build(BuildContext context) {
|
|
return SizedBox(
|
|
height: height,
|
|
width: double.infinity,
|
|
child: DecoratedBox(
|
|
decoration: BoxDecoration(
|
|
gradient: mobileTabFooterBackdropGradient(
|
|
context,
|
|
stops: stops,
|
|
opacities: opacities,
|
|
tint: tint,
|
|
tintBlend: tintBlend,
|
|
),
|
|
),
|
|
),
|
|
);
|
|
}
|
|
}
|