Post a story to a group
Android half of ios#55, spec §6.24. An ordinary story envelope carrying `gid`, fanned out to the members and recorded in the story set. 🔴 `Vault.groupStoryReach` returns the overlap rather than a warning: who is excluded by this account's story audience and who is not a contact at all, counted separately. The roster decides either way — those are two different lists making two different statements and they will disagree — so a disclosure that cannot name the consequence is not one. 🔴 The group label is adopted only from an actual member. The roster check that guards group messages runs after the story branch, so without this a sender could attach the id of a group they are not in and have their story shown as having come from it. Dropped to null rather than refusing the story: the story is legitimately theirs, and only the claim about where it was posted is unverified. The story branch already sat before group routing, which is what keeps a group story out of the conversation — filed there it would be a story that is a message, and one that never expires out of the thread. That ordering is now written down rather than incidental. ⚠️ `gid` is persisted, or a reload forgets which story went where. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Paul Hitt
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
6b2896db86
commit
b43be1b780
@@ -28,6 +28,15 @@ import javax.crypto.spec.GCMParameterSpec
|
||||
*/
|
||||
class Vault(private val storage: Storage, private val key: SecretKey) {
|
||||
|
||||
/** What a group story will actually reach (§6.24). */
|
||||
data class GroupStoryReach(
|
||||
val recipients: List<Long>,
|
||||
/** Members this account excluded from its stories, who get it anyway. */
|
||||
val excludedByAudience: List<Long>,
|
||||
/** Members who are not contacts at all. */
|
||||
val notContacts: List<Long>,
|
||||
)
|
||||
|
||||
/** Wherever bytes live. A directory on a phone, a map in a test. */
|
||||
interface Storage {
|
||||
fun read(name: String): ByteArray?
|
||||
@@ -213,6 +222,42 @@ class Vault(private val storage: Storage, private val key: SecretKey) {
|
||||
return order.map { key -> sets.getValue(key).sortedBy { it.set?.i ?: 0 } }
|
||||
}
|
||||
|
||||
/**
|
||||
* Who a group story will reach, and who among them this account has
|
||||
* excluded from its stories (§6.24).
|
||||
*
|
||||
* 🔴 **The roster decides; the story audience does not apply.** Those
|
||||
* are two different lists making two different statements, and they
|
||||
* will disagree. This returns the overlap rather than a warning,
|
||||
* because a sender who believes their story audience still applies is
|
||||
* being misled by the interface, and a disclosure that cannot name the
|
||||
* consequence is not one.
|
||||
*
|
||||
* ⚠️ The two categories do not double-count. Somebody who is not a
|
||||
* contact is not "excluded from your stories" — they were never on
|
||||
* that list at all.
|
||||
*/
|
||||
fun groupStoryReach(
|
||||
members: List<Long>,
|
||||
me: Long,
|
||||
/**
|
||||
* Who this account's story audience would have allowed, already
|
||||
* resolved. Passed in rather than an audience type: the audience
|
||||
* lives in the app layer and this module has no dependency on it.
|
||||
*/
|
||||
allowedByAudience: Set<Long>,
|
||||
contacts: List<Long>,
|
||||
): GroupStoryReach {
|
||||
val recipients = members.filter { it != me }
|
||||
val allowed = allowedByAudience
|
||||
val contactSet = contacts.toSet()
|
||||
return GroupStoryReach(
|
||||
recipients = recipients,
|
||||
excludedByAudience = recipients.filter { it in contactSet && it !in allowed },
|
||||
notContacts = recipients.filter { it !in contactSet },
|
||||
)
|
||||
}
|
||||
|
||||
fun threadForUser(userId: Long) = "user:$userId"
|
||||
fun threadForGroup(groupId: String) = "group:$groupId"
|
||||
|
||||
@@ -547,6 +592,16 @@ class Vault(private val storage: Storage, private val key: SecretKey) {
|
||||
|
||||
/** Which sequence this story belongs to (§6.23), if any. */
|
||||
val set: Content.StorySet? = null,
|
||||
|
||||
/**
|
||||
* The group this story was posted to (§6.24), if any.
|
||||
*
|
||||
* ⚠️ Names the AUDIENCE, not a destination thread. A group story
|
||||
* belongs in the story surface; rendering it into the group's messages
|
||||
* would make a story into a message, which it is not — and one that
|
||||
* never expires out of the conversation.
|
||||
*/
|
||||
val gid: String? = null,
|
||||
) {
|
||||
/**
|
||||
* When this story stops rendering, unix seconds. 0 = never.
|
||||
@@ -796,6 +851,8 @@ class Vault(private val storage: Storage, private val key: SecretKey) {
|
||||
background = if (o.has("bg")) o.optInt("bg") else null,
|
||||
|
||||
set = o.optJSONObject("set")?.let { Content.StorySet.fromJson(it) },
|
||||
|
||||
gid = o.optString("gid").takeIf { it.isNotEmpty() },
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -829,6 +886,8 @@ class Vault(private val storage: Storage, private val key: SecretKey) {
|
||||
.put("caption", story.caption)
|
||||
.put("at", story.postedAt)
|
||||
.also { j -> story.set?.let { j.put("set", it.toJson()) } }
|
||||
|
||||
.also { j -> story.gid?.let { j.put("gid", it) } }
|
||||
.put("seen", story.seen))
|
||||
}
|
||||
return array
|
||||
|
||||
@@ -0,0 +1,95 @@
|
||||
package io.flamenet.e2e
|
||||
|
||||
import kotlin.test.Test
|
||||
import kotlin.test.assertEquals
|
||||
import kotlin.test.assertTrue
|
||||
|
||||
/**
|
||||
* Stories posted to a group (spec §6.24, ios#55).
|
||||
*
|
||||
* 🔴 **The group's roster is the audience, and the sender's story audience does
|
||||
* not apply.** Two different lists making two different statements — who may
|
||||
* see this account's stories, and who is in a conversation. They will disagree,
|
||||
* and the roster wins.
|
||||
*/
|
||||
class GroupStoryTest {
|
||||
|
||||
@Test
|
||||
fun `every member but yourself is a recipient`() {
|
||||
val reach = Vault.groupStoryReach(
|
||||
members = listOf(1, 2, 3), me = 1,
|
||||
allowedByAudience = setOf(2, 3), contacts = listOf(2, 3))
|
||||
assertEquals(listOf(2L, 3L), reach.recipients)
|
||||
}
|
||||
|
||||
/**
|
||||
* 🔴 The hazard the disclosure exists for: somebody excluded from this
|
||||
* account's stories still receives a story posted to a group they are in.
|
||||
*/
|
||||
@Test
|
||||
fun `a member excluded from your stories still receives a group story`() {
|
||||
val reach = Vault.groupStoryReach(
|
||||
members = listOf(1, 2, 3), me = 1,
|
||||
allowedByAudience = setOf(2), contacts = listOf(2, 3))
|
||||
assertEquals(listOf(2L, 3L), reach.recipients)
|
||||
assertEquals(listOf(3L), reach.excludedByAudience)
|
||||
}
|
||||
|
||||
/** The other half: a member who is not a contact at all. */
|
||||
@Test
|
||||
fun `a member who is not a contact is named separately`() {
|
||||
val reach = Vault.groupStoryReach(
|
||||
members = listOf(1, 2, 9), me = 1,
|
||||
allowedByAudience = setOf(2), contacts = listOf(2))
|
||||
assertEquals(listOf(9L), reach.notContacts)
|
||||
assertTrue(reach.excludedByAudience.isEmpty())
|
||||
}
|
||||
|
||||
/**
|
||||
* ⚠️ The categories must not double-count. Somebody who is not a contact
|
||||
* is not "excluded from your stories" — they were never on that list.
|
||||
*/
|
||||
@Test
|
||||
fun `a non-contact is not also counted as excluded`() {
|
||||
val reach = Vault.groupStoryReach(
|
||||
members = listOf(1, 9), me = 1,
|
||||
allowedByAudience = emptySet(), contacts = emptyList())
|
||||
assertEquals(listOf(9L), reach.notContacts)
|
||||
assertTrue(reach.excludedByAudience.isEmpty())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun `nothing is disclosed when the lists agree`() {
|
||||
val reach = Vault.groupStoryReach(
|
||||
members = listOf(1, 2), me = 1,
|
||||
allowedByAudience = setOf(2), contacts = listOf(2))
|
||||
assertTrue(reach.excludedByAudience.isEmpty())
|
||||
assertTrue(reach.notContacts.isEmpty())
|
||||
}
|
||||
|
||||
// -- Storage --------------------------------------------------------------
|
||||
|
||||
private class MapStorage : Vault.Storage {
|
||||
val records = LinkedHashMap<String, ByteArray>()
|
||||
override fun read(name: String) = records[name]
|
||||
override fun write(name: String, bytes: ByteArray) { records[name] = bytes }
|
||||
override fun delete(name: String) { records.remove(name) }
|
||||
override fun names() = records.keys.toList()
|
||||
}
|
||||
|
||||
/** ⚠️ Without persisting `gid`, a reload forgets which story went where. */
|
||||
@Test
|
||||
fun `the group survives the vault round trip`() {
|
||||
val vault = Vault(MapStorage(),
|
||||
javax.crypto.KeyGenerator.getInstance("AES").apply { init(256) }.generateKey())
|
||||
val now = System.currentTimeMillis() / 1000.0
|
||||
vault.saveStories(listOf(Vault.Story(
|
||||
id = "s1", authorId = 7, mine = false,
|
||||
ref = Attachment.Ref(
|
||||
kind = Attachment.STORY, id = "b1", key = ByteArray(32),
|
||||
digest = ByteArray(32), bytes = 1, mime = "image/jpeg",
|
||||
width = 1, height = 1, duration = 0.0, expires = now + 600),
|
||||
caption = "", postedAt = 1, gid = "g1")), now)
|
||||
assertEquals("g1", vault.loadStories().single().gid)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user