Post a story to a group

Android half of ios#55, spec §6.24. An ordinary story envelope carrying `gid`, fanned out to the members and recorded in the story set. 🔴 `Vault.groupStoryReach` returns the overlap rather than a warning: who is excluded by this account's story audience and who is not a contact at all, counted separately. The roster decides either way — those are two different lists making two different statements and they will disagree — so a disclosure that cannot name the consequence is not one. 🔴 The group label is adopted only from an actual member. The roster check that guards group messages runs after the story branch, so without this a sender could attach the id of a group they are not in and have their story shown as having come from it. Dropped to null rather than refusing the story: the story is legitimately theirs, and only the claim about where it was posted is unverified. The story branch already sat before group routing, which is what keeps a group story out of the conversation — filed there it would be a story that is a message, and one that never expires out of the thread. That ordering is now written down rather than incidental. ⚠️ `gid` is persisted, or a reload forgets which story went where. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-02 17:53:48 -04:00
parent 6b2896db86
commit b43be1b780
5 changed files with 251 additions and 1 deletions
@@ -0,0 +1,95 @@
+package io.flamenet.e2e
+
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue
+
+/**
+ * Stories posted to a group (spec §6.24, ios#55).
+ *
+ * 🔴 **The group's roster is the audience, and the sender's story audience does
+ * not apply.** Two different lists making two different statements — who may
+ * see this account's stories, and who is in a conversation. They will disagree,
+ * and the roster wins.
+ */
+class GroupStoryTest {
+
+    @Test
+    fun `every member but yourself is a recipient`() {
+        val reach = Vault.groupStoryReach(
+            members = listOf(1, 2, 3), me = 1,
+            allowedByAudience = setOf(2, 3), contacts = listOf(2, 3))
+        assertEquals(listOf(2L, 3L), reach.recipients)
+    }
+
+    /**
+     * 🔴 The hazard the disclosure exists for: somebody excluded from this
+     * account's stories still receives a story posted to a group they are in.
+     */
+    @Test
+    fun `a member excluded from your stories still receives a group story`() {
+        val reach = Vault.groupStoryReach(
+            members = listOf(1, 2, 3), me = 1,
+            allowedByAudience = setOf(2), contacts = listOf(2, 3))
+        assertEquals(listOf(2L, 3L), reach.recipients)
+        assertEquals(listOf(3L), reach.excludedByAudience)
+    }
+
+    /** The other half: a member who is not a contact at all. */
+    @Test
+    fun `a member who is not a contact is named separately`() {
+        val reach = Vault.groupStoryReach(
+            members = listOf(1, 2, 9), me = 1,
+            allowedByAudience = setOf(2), contacts = listOf(2))
+        assertEquals(listOf(9L), reach.notContacts)
+        assertTrue(reach.excludedByAudience.isEmpty())
+    }
+
+    /**
+     * ⚠️ The categories must not double-count. Somebody who is not a contact
+     * is not "excluded from your stories" — they were never on that list.
+     */
+    @Test
+    fun `a non-contact is not also counted as excluded`() {
+        val reach = Vault.groupStoryReach(
+            members = listOf(1, 9), me = 1,
+            allowedByAudience = emptySet(), contacts = emptyList())
+        assertEquals(listOf(9L), reach.notContacts)
+        assertTrue(reach.excludedByAudience.isEmpty())
+    }
+
+    @Test
+    fun `nothing is disclosed when the lists agree`() {
+        val reach = Vault.groupStoryReach(
+            members = listOf(1, 2), me = 1,
+            allowedByAudience = setOf(2), contacts = listOf(2))
+        assertTrue(reach.excludedByAudience.isEmpty())
+        assertTrue(reach.notContacts.isEmpty())
+    }
+
+    // -- Storage --------------------------------------------------------------
+
+    private class MapStorage : Vault.Storage {
+        val records = LinkedHashMap<String, ByteArray>()
+        override fun read(name: String) = records[name]
+        override fun write(name: String, bytes: ByteArray) { records[name] = bytes }
+        override fun delete(name: String) { records.remove(name) }
+        override fun names() = records.keys.toList()
+    }
+
+    /** ⚠️ Without persisting `gid`, a reload forgets which story went where. */
+    @Test
+    fun `the group survives the vault round trip`() {
+        val vault = Vault(MapStorage(),
+            javax.crypto.KeyGenerator.getInstance("AES").apply { init(256) }.generateKey())
+        val now = System.currentTimeMillis() / 1000.0
+        vault.saveStories(listOf(Vault.Story(
+            id = "s1", authorId = 7, mine = false,
+            ref = Attachment.Ref(
+                kind = Attachment.STORY, id = "b1", key = ByteArray(32),
+                digest = ByteArray(32), bytes = 1, mime = "image/jpeg",
+                width = 1, height = 1, duration = 0.0, expires = now + 600),
+            caption = "", postedAt = 1, gid = "g1")), now)
+        assertEquals("g1", vault.loadStories().single().gid)
+    }
+}