mirror of
https://github.com/block/buzz.git
synced 2026-11-02 23:41:08 +00:00
75854111b8
Self-hosted invite claims retain the generated identity in secure storage before the HTTP request and reuse it after a lost response or restart. Saving or reopening an existing destination retires the matching journal. Sign-out/removal deletes all matching pending key copies before removing the saved community, preserving the community for retry if cleanup fails. Pairing verifies that relay authentication completed before saving/activating a destination or reporting success. On iOS 16, hosted entry permits recovery and reuse of backed-up identities, including binding a recovered identity with a confirmed backup receipt. Paths requiring a new secure backup explain the iOS 17 requirement before generating or binding a new key. Self-hosted entry remains available. ### Validation - Initial focused entry/recovery files: 83 passed, 1 skipped. Review-fix focused storage, community, invite and hosted files: 82 passed, 1 skipped; extended invite journey: 17 passed, 1 skipped. - Final hosted journey extension: 20 passed, including both bound and unbound recovery with native sealing unavailable. - Isolated mutations removing invite retention, pairing validation, journal removal/re-entry cleanup or restoring the blanket platform gate fail their intended regressions. Restored controls pass. - iOS simulator build passed on the original integration base; final native/device acceptance remains outstanding. - Carl and three specialist reviewers found no source-review blockers at `323cec6ea2`. `a55a246857` adds analyzer fixes, copy cleanup and the recovered-unbound journey coverage. Reviewers did not run tests or the app. - Fixed a push-hook timeout in `4564b3562a`: idle serial queues now release completed futures, avoiding scheduler retention across widget tests while preserving in-flight ordering and failure isolation. The existing dispatcher journey fails promptly before the fix and passes afterward; Carl reviewed this delta with no blockers. Focused dispatcher/invite/storage checks passed, and all 20 hosted journeys passed with hosted auth enabled. - Mandatory pre-push checks passed at `4564b3562a` (scope, branch skew, file size, mobile analysis/tests and crypto package checks); GitHub head verified at that commit. ### Remaining acceptance Draft pending agent/device and human acceptance. Exercise interrupted one-use invite claim and retry across restart, sign-out then reopen without restoring the removed identity, rejected self-hosted pairing, iOS 16 backed-up identity recovery (including binding), and iOS 16 new setup blocked before key creation. Synthetic network/storage boundaries do not prove native durability or live server behavior. Hosted CI results are not claimed here. Optional follow-ups remain outside this patch: pruning provably unadmitted journals, malformed-record recovery, avoiding an iOS 16 dead-end device-key selection, and pre-existing removal/push-revocation ordering. This PR contains three existing-path fixes. The two organization-login fixes depend on #8700 and remain separate: its stale parent conflicts with main in unrelated relay code, and the required branch-skew hook prevents publishing that stack unchanged. This PR does not refresh that parent or change deployment policy. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz>
1536 lines
53 KiB
Dart
1536 lines
53 KiB
Dart
import 'package:buzz/features/pairing/pairing_page.dart';
|
||
import 'package:buzz/shared/theme/theme.dart';
|
||
import 'package:flutter/material.dart';
|
||
import 'package:buzz/shared/community/paired_community_landing.dart';
|
||
import 'dart:async';
|
||
import 'dart:convert';
|
||
|
||
import 'package:flutter_test/flutter_test.dart';
|
||
import 'package:hooks_riverpod/hooks_riverpod.dart';
|
||
import 'package:local_auth/local_auth.dart';
|
||
import 'package:nostr/nostr.dart' as nostr;
|
||
import 'package:buzz/features/pairing/pairing_crypto.dart';
|
||
import 'package:buzz/features/pairing/pairing_provider.dart';
|
||
import 'package:buzz/features/pairing/pairing_socket.dart';
|
||
import 'package:buzz/shared/auth/auth.dart';
|
||
import 'package:buzz/shared/crypto/ecdh.dart';
|
||
import 'package:buzz/shared/crypto/nip44.dart';
|
||
import 'package:buzz/shared/relay/relay.dart';
|
||
import 'package:buzz/shared/security/sensitive_action_authorizer.dart';
|
||
|
||
/// Exercises payload validation, credential import, and cancellation across
|
||
/// pairing and credential-validation socket lifetimes.
|
||
void main() {
|
||
group('PairingNotifier', () {
|
||
late ProviderContainer container;
|
||
late FakeAuthNotifier fakeAuth;
|
||
|
||
ProviderContainer createContainer() {
|
||
fakeAuth = FakeAuthNotifier();
|
||
return ProviderContainer(
|
||
overrides: [authProvider.overrideWith(() => fakeAuth)],
|
||
);
|
||
}
|
||
|
||
tearDown(() => container.dispose());
|
||
|
||
test(
|
||
'reset closes legacy validation and rejects its late success',
|
||
() async {
|
||
final socket = _PendingValidationSocket();
|
||
final auth = FakeAuthNotifier();
|
||
final notifier = PairingNotifier(
|
||
validationSocketFactory:
|
||
({
|
||
required wsUrl,
|
||
required nsec,
|
||
required onMessage,
|
||
required onConnected,
|
||
required onDisconnected,
|
||
}) => socket,
|
||
);
|
||
container = ProviderContainer(
|
||
overrides: [
|
||
pairingProvider.overrideWith(() => notifier),
|
||
authProvider.overrideWith(() => auth),
|
||
],
|
||
);
|
||
final input = base64Url.encode(
|
||
utf8.encode(
|
||
jsonEncode({
|
||
'relayUrl': 'https://relay.example',
|
||
'nsec': 'pending-key',
|
||
}),
|
||
),
|
||
);
|
||
final pending = container.read(pairingProvider.notifier).pair(input);
|
||
notifier.reset();
|
||
expect(socket.disposed, isTrue);
|
||
socket.connection.complete();
|
||
await pending;
|
||
expect(auth.lastCommunity, isNull);
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
},
|
||
);
|
||
|
||
test(
|
||
'legacy validation rejects failed connection before saving, then retries',
|
||
() async {
|
||
final auth = FakeAuthNotifier();
|
||
var connected = false;
|
||
final notifier = PairingNotifier(
|
||
validationSocketFactory:
|
||
({
|
||
required wsUrl,
|
||
required nsec,
|
||
required onMessage,
|
||
required onConnected,
|
||
required onDisconnected,
|
||
}) => _ValidationOutcomeSocket(() => connected),
|
||
);
|
||
container = ProviderContainer(
|
||
overrides: [
|
||
pairingProvider.overrideWith(() => notifier),
|
||
authProvider.overrideWith(() => auth),
|
||
],
|
||
);
|
||
final input = base64Url.encode(
|
||
utf8.encode(
|
||
jsonEncode({
|
||
'relayUrl': 'https://relay.example',
|
||
'nsec': nostr.Keys.generate().nsec,
|
||
}),
|
||
),
|
||
);
|
||
await container.read(pairingProvider.notifier).pair(input);
|
||
expect(container.read(pairingProvider).status, PairingStatus.error);
|
||
expect(auth.lastCommunity, isNull);
|
||
connected = true;
|
||
await notifier.pair(input);
|
||
expect(container.read(pairingProvider).status, PairingStatus.success);
|
||
expect(auth.lastCommunity, isNotNull);
|
||
},
|
||
);
|
||
|
||
test('starts in idle state', () {
|
||
container = createContainer();
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.idle);
|
||
expect(state.errorMessage, isNull);
|
||
});
|
||
|
||
test(
|
||
'disconnect during connect does not null-dereference the socket',
|
||
() async {
|
||
final notifier = PairingNotifier(
|
||
socketFactory:
|
||
({
|
||
required wsUrl,
|
||
required ephemeralPrivkey,
|
||
required onMessage,
|
||
required void Function(Object? error) onDisconnected,
|
||
}) => _DisconnectingSocket(disconnectCallback: onDisconnected),
|
||
);
|
||
container = ProviderContainer(
|
||
overrides: [pairingProvider.overrideWith(() => notifier)],
|
||
);
|
||
const code =
|
||
'nostrpair://62287897da61e3fa294b4570575f7db8bea147d6631150f2e4656714c645fb1e'
|
||
'?secret=abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789'
|
||
'&relay=wss%3A%2F%2Fpairing.buzz.xyz&v=1';
|
||
|
||
await container.read(pairingProvider.notifier).pair(code);
|
||
|
||
expect(container.read(pairingProvider).status, PairingStatus.error);
|
||
expect(
|
||
container.read(pairingProvider).errorMessage,
|
||
contains('Lost connection to pairing relay'),
|
||
);
|
||
},
|
||
);
|
||
|
||
test('payload missing nsec errors before contacting relay', () async {
|
||
container = createContainer();
|
||
|
||
// Valid payload shape but no nsec — provider should refuse without
|
||
// attempting any network call.
|
||
final code = _encodePairingCode();
|
||
await container.read(pairingProvider.notifier).pair(code);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
expect(state.errorMessage, contains('missing nsec'));
|
||
expect(fakeAuth.lastCommunity, isNull);
|
||
});
|
||
|
||
test('accepts buzz scheme prefix', () async {
|
||
container = createContainer();
|
||
|
||
final code = 'buzz://${_encodePairingCode()}';
|
||
await container.read(pairingProvider.notifier).pair(code);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
expect(state.errorMessage, contains('missing nsec'));
|
||
expect(fakeAuth.lastCommunity, isNull);
|
||
});
|
||
|
||
test('invalid base64 sets format error', () async {
|
||
container = createContainer();
|
||
|
||
await container.read(pairingProvider.notifier).pair('not-valid!!!');
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
expect(state.errorMessage, contains('Invalid pairing code'));
|
||
});
|
||
|
||
test('base64 with valid JSON but missing fields errors', () async {
|
||
container = createContainer();
|
||
|
||
final code = base64Url.encode(utf8.encode(jsonEncode({'foo': 'bar'})));
|
||
await container.read(pairingProvider.notifier).pair(code);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
expect(state.errorMessage, contains('Missing relayUrl'));
|
||
});
|
||
|
||
test('empty input errors', () async {
|
||
container = createContainer();
|
||
|
||
await container.read(pairingProvider.notifier).pair('');
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
});
|
||
|
||
test('rejects private IP relay URLs (SSRF)', () async {
|
||
container = createContainer();
|
||
|
||
for (final ip in [
|
||
'10.0.0.1',
|
||
'172.16.0.1',
|
||
'192.168.1.1',
|
||
'169.254.169.254',
|
||
]) {
|
||
final code = _encodePairingCode(relayUrl: 'http://$ip:3000');
|
||
await container.read(pairingProvider.notifier).pair(code);
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error, reason: 'should reject $ip');
|
||
expect(state.errorMessage, contains('private network'));
|
||
container.read(pairingProvider.notifier).reset();
|
||
}
|
||
});
|
||
|
||
test('rejects non-http/https schemes', () async {
|
||
container = createContainer();
|
||
|
||
final code = _encodePairingCode(relayUrl: 'file:///etc/passwd');
|
||
await container.read(pairingProvider.notifier).pair(code);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
expect(state.errorMessage, contains('Invalid pairing code'));
|
||
});
|
||
|
||
test('rejects JSON array payload', () async {
|
||
container = createContainer();
|
||
|
||
final code = base64Url.encode(utf8.encode(jsonEncode([1, 2, 3])));
|
||
await container.read(pairingProvider.notifier).pair(code);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
expect(state.errorMessage, contains('not a JSON object'));
|
||
});
|
||
|
||
test('reset returns to idle from error state', () async {
|
||
container = createContainer();
|
||
|
||
// Trigger an error.
|
||
await container.read(pairingProvider.notifier).pair('not-valid!!!');
|
||
expect(container.read(pairingProvider).status, PairingStatus.error);
|
||
|
||
container.read(pairingProvider.notifier).reset();
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
});
|
||
|
||
group('identity import protection', () {
|
||
const sourceSecret =
|
||
'09b3065e3570a3a4054660dccd66e12774a99a904fdb0ca02dbc6c3136249506';
|
||
const sessionSecretHex =
|
||
'abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789';
|
||
late _ControllableSocket socket;
|
||
late PairingNotifier notifier;
|
||
late FakeAuthNotifier importAuth;
|
||
late _FakeSensitiveActionAuthorizer authorizer;
|
||
late Completer<void> validation;
|
||
late String pairingCode;
|
||
|
||
setUp(() {
|
||
final source = nostr.Keys(sourceSecret);
|
||
pairingCode =
|
||
'nostrpair://${source.public}'
|
||
'?secret=$sessionSecretHex'
|
||
'&relay=wss%3A%2F%2Fpairing.buzz.xyz&v=1';
|
||
validation = Completer<void>();
|
||
importAuth = FakeAuthNotifier();
|
||
authorizer = _FakeSensitiveActionAuthorizer();
|
||
notifier = PairingNotifier(
|
||
credentialValidator:
|
||
({required String relayUrl, required String? nsec}) =>
|
||
validation.future,
|
||
socketFactory:
|
||
({
|
||
required wsUrl,
|
||
required ephemeralPrivkey,
|
||
required onMessage,
|
||
required onDisconnected,
|
||
}) {
|
||
socket = _ControllableSocket(
|
||
ephemeralPrivkey: ephemeralPrivkey,
|
||
onMessage: onMessage,
|
||
onDisconnected: onDisconnected,
|
||
);
|
||
return socket;
|
||
},
|
||
);
|
||
container = ProviderContainer(
|
||
overrides: [
|
||
pairingProvider.overrideWith(() => notifier),
|
||
authProvider.overrideWith(() => importAuth),
|
||
sensitiveActionAuthorizerProvider.overrideWithValue(authorizer),
|
||
],
|
||
);
|
||
container.read(pairingProvider);
|
||
notifier = container.read(pairingProvider.notifier);
|
||
});
|
||
|
||
Future<void> beginImport({required bool protected}) async {
|
||
await notifier.pair(pairingCode);
|
||
notifier.setProtectSensitiveActions(protected);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
if (protected && authorizer.result != DeviceAuthResult.success) return;
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {
|
||
'type': 'payload',
|
||
'payload_type': 'credentials',
|
||
'payload': jsonEncode({
|
||
'relayUrl': 'https://relay.test',
|
||
'pubkey': nostr.Keys(sourceSecret).public,
|
||
'nsec': nostr.Keys(sourceSecret).nsec,
|
||
}),
|
||
},
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
expect(container.read(pairingProvider).status, PairingStatus.storing);
|
||
}
|
||
|
||
testWidgets('early input is submitted when desktop negotiation arrives', (
|
||
tester,
|
||
) async {
|
||
final pairing = notifier.pair(pairingCode);
|
||
await tester.pump();
|
||
await tester.pump(const Duration(milliseconds: 500));
|
||
await pairing;
|
||
await tester.pumpWidget(
|
||
UncontrolledProviderScope(
|
||
container: container,
|
||
child: MaterialApp(
|
||
theme: AppTheme.light(),
|
||
home: const PairingPage(),
|
||
),
|
||
),
|
||
);
|
||
final localCode = container.read(pairingProvider).sasCode;
|
||
final code = localCode == '111111' ? '222222' : '111111';
|
||
await tester.enterText(
|
||
find.byKey(const Key('pairing-code-input')),
|
||
code,
|
||
);
|
||
await tester.pump();
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.where((m) => m['type'] == 'code-submit'),
|
||
isEmpty,
|
||
);
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'desktop-code'},
|
||
);
|
||
await tester.pump();
|
||
await tester.pump();
|
||
final submissions = socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.where((m) => m['type'] == 'code-submit')
|
||
.toList();
|
||
expect(submissions, hasLength(1));
|
||
expect(submissions.single['code'], code);
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await tester.pump();
|
||
expect(find.text('Enter pairing code'), findsNothing);
|
||
expect(find.text('Protect your identity'), findsOneWidget);
|
||
notifier.reset();
|
||
await tester.pumpWidget(const SizedBox.shrink());
|
||
});
|
||
|
||
testWidgets(
|
||
'delayed desktop responses retain one attempt and leave code entry',
|
||
(tester) async {
|
||
final pairing = notifier.pair(pairingCode);
|
||
await tester.pump();
|
||
await tester.pump(const Duration(milliseconds: 500));
|
||
await pairing;
|
||
expect(socket.published.single['tags'], hasLength(1));
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.single['confirmation'],
|
||
'desktop-code-v1',
|
||
);
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'desktop-code'},
|
||
);
|
||
expect(container.read(pairingProvider).requiresDesktopCode, isTrue);
|
||
final wrong = notifier.verifyDesktopCode('111111');
|
||
final first = socket.decryptedPublishedMessages(sourceSecret).last;
|
||
expect(first['type'], 'code-submit');
|
||
expect(first['code'], '111111');
|
||
bool? wrongResult;
|
||
unawaited(wrong.then((value) => wrongResult = value));
|
||
await tester.pump(const Duration(seconds: 11));
|
||
expect(wrongResult, isNull);
|
||
expect(await notifier.verifyDesktopCode('111111'), isFalse);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.where((m) => m['type'] == 'code-submit'),
|
||
hasLength(1),
|
||
);
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {
|
||
'type': 'code-rejected',
|
||
'request_id': first['request_id'],
|
||
'remaining_attempts': 4,
|
||
},
|
||
);
|
||
expect(await wrong, isFalse);
|
||
expect(importAuth.lastCommunity, isNull);
|
||
await tester.pumpWidget(
|
||
UncontrolledProviderScope(
|
||
container: container,
|
||
child: MaterialApp(
|
||
theme: AppTheme.light(),
|
||
home: const PairingPage(),
|
||
),
|
||
),
|
||
);
|
||
await tester.enterText(
|
||
find.byKey(const Key('pairing-code-input')),
|
||
'222222',
|
||
);
|
||
await tester.pump(const Duration(seconds: 11));
|
||
expect(find.text('Enter pairing code'), findsOneWidget);
|
||
expect(
|
||
find.text('Couldn’t check the code. Try again.'),
|
||
findsNothing,
|
||
);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.where((m) => m['type'] == 'code-submit'),
|
||
hasLength(2),
|
||
);
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {
|
||
'type': 'payload',
|
||
'payload_type': 'credentials',
|
||
'payload': jsonEncode({
|
||
'relayUrl': 'https://relay.test',
|
||
'pubkey': nostr.Keys(sourceSecret).public,
|
||
'nsec': nostr.Keys(sourceSecret).nsec,
|
||
}),
|
||
},
|
||
);
|
||
await tester.pump();
|
||
expect(find.text('Enter pairing code'), findsNothing);
|
||
expect(find.text('Protect your identity'), findsOneWidget);
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.confirmingSas,
|
||
);
|
||
expect(importAuth.lastCommunity, isNull);
|
||
notifier.setProtectSensitiveActions(false);
|
||
notifier.confirmSas();
|
||
await tester.pump();
|
||
expect(container.read(pairingProvider).status, PairingStatus.storing);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.where((m) => m['type'] == 'sas-confirm'),
|
||
isEmpty,
|
||
);
|
||
notifier.reset();
|
||
await tester.pumpWidget(const SizedBox.shrink());
|
||
},
|
||
);
|
||
|
||
testWidgets(
|
||
'delayed final rejection exits the session and reset cancels pending verification',
|
||
(tester) async {
|
||
final pairing = notifier.pair(pairingCode);
|
||
await tester.pump();
|
||
await tester.pump(const Duration(milliseconds: 500));
|
||
await pairing;
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'desktop-code'},
|
||
);
|
||
final result = notifier.verifyDesktopCode('111111');
|
||
final request = socket.decryptedPublishedMessages(sourceSecret).last;
|
||
await tester.pump(const Duration(seconds: 11));
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {
|
||
'type': 'code-rejected',
|
||
'request_id': request['request_id'],
|
||
'remaining_attempts': 0,
|
||
},
|
||
);
|
||
expect(await result, isFalse);
|
||
expect(container.read(pairingProvider).status, PairingStatus.error);
|
||
expect(importAuth.lastCommunity, isNull);
|
||
notifier.reset();
|
||
final nextPairing = notifier.pair(pairingCode);
|
||
await tester.pump();
|
||
await tester.pump(const Duration(milliseconds: 500));
|
||
await nextPairing;
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'desktop-code'},
|
||
);
|
||
final pending = notifier.verifyDesktopCode('222222');
|
||
notifier.reset();
|
||
expect(await pending, isFalse);
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
},
|
||
);
|
||
|
||
test(
|
||
'a rejected offer exits code entry instead of silently waiting',
|
||
() async {
|
||
await notifier.pair(pairingCode);
|
||
socket.relayMessageCallback([
|
||
'OK',
|
||
socket.published.single['id'],
|
||
false,
|
||
'event must have exactly one p tag',
|
||
]);
|
||
expect(container.read(pairingProvider).status, PairingStatus.error);
|
||
expect(
|
||
container.read(pairingProvider).errorMessage,
|
||
contains('Scan a new desktop QR code'),
|
||
);
|
||
expect(socket.isConnected, isFalse);
|
||
},
|
||
);
|
||
|
||
test('admission rejection never reports a successful transfer', () async {
|
||
importAuth.authentication = Completer<void>();
|
||
importAuth.entered = Completer<void>();
|
||
final finished = Completer<void>();
|
||
container.listen(pairingProvider, (_, next) {
|
||
if (next.status == PairingStatus.error && !finished.isCompleted) {
|
||
finished.complete();
|
||
}
|
||
});
|
||
await beginImport(protected: false);
|
||
validation.complete();
|
||
await importAuth.entered!.future;
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.where((message) => message['type'] == 'complete'),
|
||
isEmpty,
|
||
);
|
||
importAuth.authentication!.completeError(
|
||
StateError('Admission refused'),
|
||
);
|
||
await finished.future;
|
||
final completions = socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.where((message) => message['type'] == 'complete')
|
||
.toList();
|
||
expect(completions, hasLength(1));
|
||
expect(completions.single['success'], isFalse);
|
||
expect(container.read(pairedCommunityLandingProvider), isNull);
|
||
});
|
||
|
||
test('unchecked protection persists on a successful import', () async {
|
||
await beginImport(protected: false);
|
||
|
||
validation.complete();
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(
|
||
importAuth.lastCommunity?.sensitiveActionPolicy,
|
||
SensitiveActionPolicy.disabledByUser,
|
||
);
|
||
expect(container.read(pairingProvider).status, PairingStatus.success);
|
||
expect(
|
||
container.read(pairedCommunityLandingProvider),
|
||
importAuth.lastCommunity,
|
||
);
|
||
});
|
||
|
||
test('checked protection persists on a successful import', () async {
|
||
await beginImport(protected: true);
|
||
|
||
expect(authorizer.calls, 1);
|
||
validation.complete();
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(
|
||
importAuth.lastCommunity?.sensitiveActionPolicy,
|
||
SensitiveActionPolicy.enabled,
|
||
);
|
||
});
|
||
|
||
test('unenrolled biometrics prevent a protected import', () async {
|
||
authorizer.result = DeviceAuthResult.unavailable;
|
||
|
||
await beginImport(protected: true);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(authorizer.calls, 1);
|
||
expect(state.status, PairingStatus.confirmingSas);
|
||
expect(state.userConfirmedSas, isFalse);
|
||
expect(state.errorMessage, contains('Enroll Face ID or biometrics'));
|
||
expect(importAuth.lastCommunity, isNull);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any((message) => message['type'] == 'complete'),
|
||
isFalse,
|
||
);
|
||
});
|
||
|
||
test('reset during NIP-AB connection retires its continuation', () async {
|
||
final pending = notifier.pair(pairingCode);
|
||
notifier.reset();
|
||
await pending;
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
expect(socket.isConnected, isFalse);
|
||
expect(socket.decryptedPublishedMessages(sourceSecret), isEmpty);
|
||
});
|
||
|
||
test('reset during NIP-AB offer delay prevents a late offer', () async {
|
||
final pending = notifier.pair(pairingCode);
|
||
await Future<void>.delayed(Duration.zero);
|
||
notifier.reset();
|
||
await pending;
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
expect(socket.isConnected, isFalse);
|
||
expect(socket.decryptedPublishedMessages(sourceSecret), isEmpty);
|
||
});
|
||
|
||
test('stale biometric approval cannot advance a reset import', () async {
|
||
final pendingAuthorization = Completer<DeviceAuthResult>();
|
||
authorizer.pending = pendingAuthorization;
|
||
await notifier.pair(pairingCode);
|
||
notifier.setProtectSensitiveActions(true);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
expect(authorizer.calls, 1);
|
||
|
||
notifier.reset();
|
||
pendingAuthorization.complete(DeviceAuthResult.success);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
expect(importAuth.lastCommunity, isNull);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any((message) => message['type'] == 'complete'),
|
||
isFalse,
|
||
);
|
||
});
|
||
|
||
test('reset invalidates pending authentication persistence', () async {
|
||
importAuth.authentication = Completer<void>();
|
||
await beginImport(protected: false);
|
||
|
||
validation.complete();
|
||
await Future<void>.delayed(Duration.zero);
|
||
expect(importAuth.lastCommunity, isNotNull);
|
||
|
||
notifier.reset();
|
||
importAuth.authentication!.complete();
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
expect(
|
||
container.read(authProvider).value!.status,
|
||
AuthStatus.unauthenticated,
|
||
);
|
||
expect(socket.isConnected, isFalse);
|
||
});
|
||
|
||
test('reset invalidates pending credential validation', () async {
|
||
await beginImport(protected: false);
|
||
|
||
notifier.reset();
|
||
validation.complete();
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(importAuth.lastCommunity, isNull);
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any((message) => message['type'] == 'complete'),
|
||
isFalse,
|
||
);
|
||
});
|
||
});
|
||
|
||
group('desktop identity recovery', () {
|
||
const sourceSecret =
|
||
'09b3065e3570a3a4054660dccd66e12774a99a904fdb0ca02dbc6c3136249506';
|
||
const sessionSecretHex =
|
||
'abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789';
|
||
late _ControllableSocket socket;
|
||
late PairingNotifier notifier;
|
||
late String recoveryCode;
|
||
late _FakeSensitiveActionAuthorizer authorizer;
|
||
late DateTime now;
|
||
|
||
setUp(() async {
|
||
final source = nostr.Keys(sourceSecret);
|
||
recoveryCode =
|
||
'nostrpair://${source.public}'
|
||
'?secret=$sessionSecretHex'
|
||
'&relay=wss%3A%2F%2Fpairing.buzz.xyz&v=1&mode=recover';
|
||
authorizer = _FakeSensitiveActionAuthorizer();
|
||
now = DateTime.utc(2026, 8, 6);
|
||
notifier = PairingNotifier(
|
||
socketFactory:
|
||
({
|
||
required wsUrl,
|
||
required ephemeralPrivkey,
|
||
required onMessage,
|
||
required onDisconnected,
|
||
}) {
|
||
socket = _ControllableSocket(
|
||
ephemeralPrivkey: ephemeralPrivkey,
|
||
onMessage: onMessage,
|
||
onDisconnected: onDisconnected,
|
||
);
|
||
return socket;
|
||
},
|
||
);
|
||
container = ProviderContainer(
|
||
overrides: [
|
||
pairingProvider.overrideWith(() => notifier),
|
||
relayConfigProvider.overrideWith(_RecoveryRelayConfig.new),
|
||
sensitiveActionAuthorizerProvider.overrideWithValue(authorizer),
|
||
identityExportClockProvider.overrideWithValue(() => now),
|
||
],
|
||
);
|
||
container.read(pairingProvider);
|
||
notifier = container.read(pairingProvider.notifier);
|
||
});
|
||
|
||
test('recovery authorization honors biometric protection', () async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.enabled),
|
||
),
|
||
isTrue,
|
||
);
|
||
expect(authorizer.calls, 1);
|
||
expect(authorizer.lastIdentityBiometricOnly, isTrue);
|
||
|
||
await notifier.pair(recoveryCode);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.confirmingSas);
|
||
expect(state.sendsIdentityToDesktop, isTrue);
|
||
expect(
|
||
socket.published.first['tags'],
|
||
isNot(contains(equals(['confirmation', 'code-entry']))),
|
||
);
|
||
notifier.confirmSas();
|
||
expect(
|
||
socket.decryptedPublishedMessages(sourceSecret).map((m) => m['type']),
|
||
['offer'],
|
||
);
|
||
expect(state.sasCode, hasLength(6));
|
||
});
|
||
|
||
test('reset invalidates pending preflight authorization', () async {
|
||
final pendingAuthorization = Completer<DeviceAuthResult>();
|
||
authorizer.pending = pendingAuthorization;
|
||
|
||
final authorization = notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
);
|
||
expect(container.read(pairingProvider).authorizationInProgress, isTrue);
|
||
|
||
notifier.reset();
|
||
pendingAuthorization.complete(DeviceAuthResult.success);
|
||
|
||
expect(await authorization, isFalse);
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
await notifier.pair(recoveryCode);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any((message) => message['type'] == 'payload'),
|
||
isFalse,
|
||
);
|
||
});
|
||
|
||
test('concurrent preflight requests start one authentication', () async {
|
||
final pendingAuthorization = Completer<DeviceAuthResult>();
|
||
authorizer.pending = pendingAuthorization;
|
||
final community = _exportCommunity(
|
||
SensitiveActionPolicy.disabledByUser,
|
||
);
|
||
|
||
final first = notifier.authorizeIdentityExport(community: community);
|
||
final second = notifier.authorizeIdentityExport(community: community);
|
||
|
||
expect(await second, isFalse);
|
||
expect(authorizer.calls, 1);
|
||
pendingAuthorization.complete(DeviceAuthResult.success);
|
||
expect(await first, isTrue);
|
||
});
|
||
|
||
test('unchecked protection allows device passcode fallback', () async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isTrue,
|
||
);
|
||
|
||
expect(authorizer.lastIdentityBiometricOnly, isFalse);
|
||
});
|
||
|
||
for (final padded in [false, true]) {
|
||
test(
|
||
'matching SAS exports normalized nsec (padded: $padded)',
|
||
() async {
|
||
final community =
|
||
_exportCommunity(SensitiveActionPolicy.disabledByUser).copyWith(
|
||
nsec: padded
|
||
? ' \n${_RecoveryRelayConfig.nsec}\t '
|
||
: _RecoveryRelayConfig.nsec,
|
||
);
|
||
container
|
||
.read(relayConfigProvider.notifier)
|
||
.update(baseUrl: community.relayUrl, nsec: community.nsec);
|
||
expect(
|
||
await notifier.authorizeIdentityExport(community: community),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
notifier.confirmSas();
|
||
expect(container.read(pairingProvider).userConfirmedSas, isTrue);
|
||
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.transferring,
|
||
);
|
||
expect(container.read(pairingProvider).errorMessage, isNull);
|
||
expect(authorizer.calls, 1);
|
||
final sentMessages = socket.decryptedPublishedMessages(
|
||
sourceSecret,
|
||
);
|
||
final payloads = sentMessages.where(
|
||
(message) => message['type'] == 'payload',
|
||
);
|
||
expect(payloads, hasLength(1));
|
||
expect(payloads.single['payload_type'], 'nsec');
|
||
expect(payloads.single['payload'], _RecoveryRelayConfig.nsec);
|
||
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'complete', 'success': true},
|
||
);
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.success,
|
||
);
|
||
},
|
||
);
|
||
}
|
||
|
||
test(
|
||
'malformed payload invalidates authorization before another session',
|
||
() async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'payload', 'payload_type': 'nsec'},
|
||
);
|
||
expect(container.read(pairingProvider).status, PairingStatus.error);
|
||
|
||
await notifier.pair(recoveryCode);
|
||
final replacementSocket = socket;
|
||
notifier.confirmSas();
|
||
replacementSocket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.confirmingSas);
|
||
expect(state.userConfirmedSas, isFalse);
|
||
expect(state.errorMessage, contains('active community changed'));
|
||
expect(authorizer.calls, 1);
|
||
expect(
|
||
replacementSocket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any((message) => message['type'] == 'payload'),
|
||
isFalse,
|
||
);
|
||
},
|
||
);
|
||
|
||
test('skipped preflight authorization sends no identity', () async {
|
||
await notifier.pair(recoveryCode);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(authorizer.calls, 0);
|
||
expect(state.status, PairingStatus.confirmingSas);
|
||
expect(state.userConfirmedSas, isFalse);
|
||
expect(state.errorMessage, contains('active community changed'));
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any((message) => message['type'] == 'payload'),
|
||
isFalse,
|
||
);
|
||
});
|
||
|
||
test(
|
||
'failed transfer reauthorization publishes no identity payload',
|
||
() async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
now = now.add(identityExportAuthorizationTtl);
|
||
authorizer.result = DeviceAuthResult.cancelled;
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(authorizer.calls, 2);
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.confirmingSas);
|
||
expect(state.userConfirmedSas, isFalse);
|
||
expect(state.errorMessage, contains('cancelled'));
|
||
final sentMessages = socket.decryptedPublishedMessages(sourceSecret);
|
||
expect(
|
||
sentMessages.any((message) => message['type'] == 'payload'),
|
||
isFalse,
|
||
);
|
||
},
|
||
);
|
||
|
||
test(
|
||
'stale authorization cannot advance a replacement pairing session',
|
||
() async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
now = now.add(identityExportAuthorizationTtl);
|
||
final firstSocket = socket;
|
||
final pendingAuthorization = Completer<DeviceAuthResult>();
|
||
authorizer.pending = pendingAuthorization;
|
||
notifier.confirmSas();
|
||
firstSocket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
expect(authorizer.calls, 2);
|
||
|
||
notifier.reset();
|
||
await notifier.pair(recoveryCode);
|
||
final replacementSocket = socket;
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.confirmingSas,
|
||
);
|
||
expect(container.read(pairingProvider).userConfirmedSas, isFalse);
|
||
|
||
pendingAuthorization.complete(DeviceAuthResult.success);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.confirmingSas);
|
||
expect(state.userConfirmedSas, isFalse);
|
||
for (final pairingSocket in [firstSocket, replacementSocket]) {
|
||
final sentMessages = pairingSocket.decryptedPublishedMessages(
|
||
sourceSecret,
|
||
);
|
||
expect(
|
||
sentMessages.any((message) => message['type'] == 'payload'),
|
||
isFalse,
|
||
);
|
||
}
|
||
},
|
||
);
|
||
|
||
test('clock rollback invalidates the export authorization', () async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
now = now.subtract(const Duration(minutes: 1));
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(authorizer.calls, 2);
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.transferring,
|
||
);
|
||
});
|
||
|
||
test(
|
||
'websocket relay origin remains bound after canonicalization',
|
||
() async {
|
||
final community = _exportCommunity(
|
||
SensitiveActionPolicy.disabledByUser,
|
||
).copyWith(relayUrl: 'wss://relay.test');
|
||
container
|
||
.read(relayConfigProvider.notifier)
|
||
.update(baseUrl: community.relayUrl, nsec: community.nsec);
|
||
expect(
|
||
await notifier.authorizeIdentityExport(community: community),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.transferring,
|
||
);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any(
|
||
(message) =>
|
||
message['type'] == 'payload' &&
|
||
message['payload'] == community.nsec,
|
||
),
|
||
isTrue,
|
||
);
|
||
},
|
||
);
|
||
|
||
for (final change in ['community', 'key']) {
|
||
for (final expired in [false, true]) {
|
||
test(
|
||
'$change switch aborts ${expired ? 'expired' : 'fresh'} export grant',
|
||
() async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(
|
||
SensitiveActionPolicy.disabledByUser,
|
||
),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
if (expired) now = now.add(identityExportAuthorizationTtl);
|
||
container
|
||
.read(relayConfigProvider.notifier)
|
||
.update(
|
||
baseUrl: change == 'community'
|
||
? 'https://other-relay.test'
|
||
: 'https://relay.test',
|
||
nsec: change == 'community'
|
||
? _RecoveryRelayConfig.nsec
|
||
: nostr.Keys(
|
||
'2222222222222222222222222222222222222222222222222222222222222222',
|
||
).nsec,
|
||
);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.confirmingSas);
|
||
expect(state.userConfirmedSas, isFalse);
|
||
expect(state.errorMessage, contains('active community changed'));
|
||
expect(authorizer.calls, 1);
|
||
expect(
|
||
socket
|
||
.decryptedPublishedMessages(sourceSecret)
|
||
.any((message) => message['type'] == 'payload'),
|
||
isFalse,
|
||
);
|
||
},
|
||
);
|
||
}
|
||
}
|
||
|
||
test('expired biometric-only authorization preserves its mode', () async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.enabled),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
now = now.add(identityExportAuthorizationTtl);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(authorizer.calls, 2);
|
||
expect(authorizer.lastIdentityBiometricOnly, isTrue);
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.transferring,
|
||
);
|
||
});
|
||
|
||
test(
|
||
'expired passcode-fallback authorization preserves its mode',
|
||
() async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
now = now.add(identityExportAuthorizationTtl);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
|
||
expect(authorizer.calls, 2);
|
||
expect(authorizer.lastIdentityBiometricOnly, isFalse);
|
||
expect(
|
||
container.read(pairingProvider).status,
|
||
PairingStatus.transferring,
|
||
);
|
||
},
|
||
);
|
||
|
||
test('cancelled authorization prevents pairing from starting', () async {
|
||
authorizer.result = DeviceAuthResult.cancelled;
|
||
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isFalse,
|
||
);
|
||
|
||
expect(authorizer.calls, 1);
|
||
expect(container.read(pairingProvider).status, PairingStatus.idle);
|
||
expect(
|
||
container.read(pairingProvider).errorMessage,
|
||
contains('cancelled'),
|
||
);
|
||
});
|
||
|
||
test('desktop storage failure surfaces an error', () async {
|
||
expect(
|
||
await notifier.authorizeIdentityExport(
|
||
community: _exportCommunity(SensitiveActionPolicy.disabledByUser),
|
||
),
|
||
isTrue,
|
||
);
|
||
await notifier.pair(recoveryCode);
|
||
notifier.confirmSas();
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'sas-confirm'},
|
||
includeTranscriptHash: true,
|
||
);
|
||
await Future<void>.delayed(Duration.zero);
|
||
socket.sendSourceMessage(
|
||
sourceSecret: sourceSecret,
|
||
sessionSecretHex: sessionSecretHex,
|
||
message: {'type': 'complete', 'success': false},
|
||
);
|
||
|
||
final state = container.read(pairingProvider);
|
||
expect(state.status, PairingStatus.error);
|
||
expect(state.errorMessage, contains('could not store'));
|
||
});
|
||
});
|
||
});
|
||
}
|
||
|
||
/// Encode a credentials payload the same way the desktop app would.
|
||
String _encodePairingCode({
|
||
String relayUrl = 'http://test:3000',
|
||
String? pubkey,
|
||
String? nsec,
|
||
}) {
|
||
final json = <String, dynamic>{
|
||
'relayUrl': relayUrl,
|
||
// ignore: use_null_aware_elements
|
||
if (pubkey != null) 'pubkey': pubkey,
|
||
// ignore: use_null_aware_elements
|
||
if (nsec != null) 'nsec': nsec,
|
||
};
|
||
return base64Url.encode(utf8.encode(jsonEncode(json)));
|
||
}
|
||
|
||
/// A fake [AuthNotifier] that records calls instead of touching secure storage.
|
||
class FakeAuthNotifier extends AsyncNotifier<AuthState>
|
||
implements AuthNotifier {
|
||
Community? lastCommunity;
|
||
Completer<void>? authentication;
|
||
Completer<void>? entered;
|
||
bool signedOut = false;
|
||
|
||
@override
|
||
Future<AuthState> build() async =>
|
||
const AuthState(status: AuthStatus.unauthenticated);
|
||
|
||
@override
|
||
Future<void> signOut() async {
|
||
signedOut = true;
|
||
state = const AsyncData(AuthState(status: AuthStatus.unauthenticated));
|
||
}
|
||
|
||
@override
|
||
Future<void> authenticateWithCommunity(
|
||
Community community, {
|
||
bool Function()? shouldContinue,
|
||
bool activate = true,
|
||
}) async {
|
||
if (shouldContinue != null && !shouldContinue()) return;
|
||
lastCommunity = community;
|
||
entered?.complete();
|
||
await authentication?.future;
|
||
if (shouldContinue != null && !shouldContinue()) return;
|
||
state = AsyncData(
|
||
AuthState(status: AuthStatus.authenticated, community: community),
|
||
);
|
||
}
|
||
}
|
||
|
||
class _DisconnectingSocket extends PairingSocket {
|
||
final void Function(Object? error) disconnectCallback;
|
||
|
||
_DisconnectingSocket({required this.disconnectCallback})
|
||
: super(
|
||
wsUrl: 'ws://unused',
|
||
ephemeralPrivkey:
|
||
'09b3065e3570a3a4054660dccd66e12774a99a904fdb0ca02dbc6c3136249506',
|
||
onMessage: (_) {},
|
||
onDisconnected: (_) {},
|
||
);
|
||
|
||
@override
|
||
Future<void> connect() async {
|
||
disconnectCallback(Exception('Connection closed'));
|
||
}
|
||
}
|
||
|
||
Community _exportCommunity(SensitiveActionPolicy policy) => Community(
|
||
id: 'export-community',
|
||
name: 'Export',
|
||
relayUrl: 'https://relay.test',
|
||
nsec: _RecoveryRelayConfig.nsec,
|
||
sensitiveActionPolicy: policy,
|
||
addedAt: DateTime.utc(2026),
|
||
);
|
||
|
||
class _RecoveryRelayConfig extends RelayConfigNotifier {
|
||
static final nsec = nostr.Keys(
|
||
'1111111111111111111111111111111111111111111111111111111111111111',
|
||
).nsec;
|
||
|
||
@override
|
||
RelayConfig build() => RelayConfig(baseUrl: 'https://relay.test', nsec: nsec);
|
||
}
|
||
|
||
class _FakeSensitiveActionAuthorizer implements SensitiveActionAuthorizer {
|
||
DeviceAuthResult result = DeviceAuthResult.success;
|
||
Completer<DeviceAuthResult>? pending;
|
||
int calls = 0;
|
||
bool? lastIdentityBiometricOnly;
|
||
|
||
@override
|
||
Future<DeviceAuthResult> authorizeIdentityAction({
|
||
required bool biometricOnly,
|
||
}) async {
|
||
calls++;
|
||
lastIdentityBiometricOnly = biometricOnly;
|
||
return pending?.future ?? result;
|
||
}
|
||
|
||
@override
|
||
Future<DeviceAuthResult> authorizeBiometricProtection() async {
|
||
calls++;
|
||
return pending?.future ?? result;
|
||
}
|
||
|
||
@override
|
||
Future<List<BiometricType>> enrolledBiometrics() async => const [];
|
||
}
|
||
|
||
class _ControllableSocket extends PairingSocket {
|
||
final String ephemeralPrivkey;
|
||
final void Function(List<dynamic> message) relayMessageCallback;
|
||
final List<Map<String, dynamic>> published = [];
|
||
bool _connected = false;
|
||
int _eventSequence = 0;
|
||
|
||
_ControllableSocket({
|
||
required this.ephemeralPrivkey,
|
||
required super.onMessage,
|
||
required super.onDisconnected,
|
||
}) : relayMessageCallback = onMessage,
|
||
super(wsUrl: 'ws://unused', ephemeralPrivkey: ephemeralPrivkey);
|
||
|
||
@override
|
||
bool get isConnected => _connected;
|
||
|
||
@override
|
||
Future<void> connect() async => _connected = true;
|
||
|
||
@override
|
||
void subscribe(String subId, int kind, String pubkeyHex) {}
|
||
|
||
@override
|
||
void publishEvent(Map<String, dynamic> event) => published.add(event);
|
||
|
||
@override
|
||
void dispose() => _connected = false;
|
||
|
||
List<Map<String, dynamic>> decryptedPublishedMessages(String sourceSecret) {
|
||
final key = getConversationKey(
|
||
sourceSecret,
|
||
nostr.Keys(ephemeralPrivkey).public,
|
||
);
|
||
return published
|
||
.map(
|
||
(event) =>
|
||
jsonDecode(nip44Decrypt(key, event['content'] as String))
|
||
as Map<String, dynamic>,
|
||
)
|
||
.toList();
|
||
}
|
||
|
||
void sendSourceMessage({
|
||
required String sourceSecret,
|
||
required String sessionSecretHex,
|
||
required Map<String, dynamic> message,
|
||
bool includeTranscriptHash = false,
|
||
}) {
|
||
final source = nostr.Keys(sourceSecret);
|
||
final targetPubkey = nostr.Keys(ephemeralPrivkey).public;
|
||
final sessionSecret = hexToBytes(sessionSecretHex);
|
||
final body = Map<String, dynamic>.from(message);
|
||
if (includeTranscriptHash) {
|
||
final shared = ecdhSharedSecret(sourceSecret, targetPubkey);
|
||
final (_, sasInput) = deriveSas(shared, sessionSecret);
|
||
body['transcript_hash'] = bytesToHex(
|
||
deriveTranscriptHash(
|
||
deriveSessionId(sessionSecret),
|
||
hexToBytes(source.public),
|
||
hexToBytes(targetPubkey),
|
||
sasInput,
|
||
sessionSecret,
|
||
),
|
||
);
|
||
}
|
||
final key = getConversationKey(sourceSecret, targetPubkey);
|
||
final event = nostr.Event.from(
|
||
kind: 24134,
|
||
content: nip44Encrypt(key, jsonEncode(body)),
|
||
tags: [
|
||
['p', targetPubkey],
|
||
],
|
||
secretKey: sourceSecret,
|
||
createdAt: 1_700_000_000 + _eventSequence++,
|
||
);
|
||
relayMessageCallback(['EVENT', 'pair', event.toMap()]);
|
||
}
|
||
}
|
||
|
||
class _PendingValidationSocket extends RelaySocket {
|
||
_PendingValidationSocket()
|
||
: super(
|
||
wsUrl: 'wss://relay.example',
|
||
nsec: null,
|
||
onMessage: (_) {},
|
||
onConnected: () {},
|
||
onDisconnected: (_) {},
|
||
);
|
||
final connection = Completer<void>();
|
||
bool disposed = false;
|
||
@override
|
||
Future<void> connect() => connection.future;
|
||
@override
|
||
void dispose() => disposed = true;
|
||
@override
|
||
Future<void> disconnect() async => disposed = true;
|
||
}
|
||
|
||
class _ValidationOutcomeSocket extends RelaySocket {
|
||
_ValidationOutcomeSocket(this.connected)
|
||
: super(
|
||
wsUrl: 'wss://relay.example',
|
||
nsec: null,
|
||
onMessage: (_) {},
|
||
onConnected: () {},
|
||
onDisconnected: (_) {},
|
||
);
|
||
final bool Function() connected;
|
||
@override
|
||
SocketState get state =>
|
||
connected() ? SocketState.connected : SocketState.disconnected;
|
||
@override
|
||
Future<void> connect() async {}
|
||
@override
|
||
Future<void> disconnect() async {}
|
||
}
|