Share a file into a chat, and save one back — with the label it carries #80
@@ -340,8 +340,8 @@ the messenger rather than staying separate apps.
|
||||
| Files engine: KDF and identity record | ✅ an identity written by the browser unlocks here |
|
||||
| Local vault: add, organise, delete | ✅ index, folders, both storage modes, bulk delete with its report |
|
||||
| Files screen: set up, unlock, browse, add, folders, delete, promote | ✅ ⚠️ **not yet run on a device** — see below |
|
||||
| Bell–LaPadula labels and clearance | 🟡 lattice, encoding and clearance in Kotlin, pinned to independently-computed vectors; the ★-property is unenforced on **both** clients — android#15 |
|
||||
| Share a file into a chat or group | ⚪ |
|
||||
| The security lattice (labels, clearance) | ✅ encoding and clearance in Kotlin, pinned to independently-computed vectors. ⚠️ **Not Bell–LaPadula** — the ★-property is deliberately unenforced on both clients; see android#15 |
|
||||
| Share a file into a chat or group | ✅ both directions — send from the vault, save a received one back at the label it arrived with |
|
||||
| Wallet engine: BIP-39, Base58, SLIP-0010 | ✅ pinned to the published vectors |
|
||||
| Wallet engine: address derivation and signing | ✅ BIP-44 path, Base58 address, and the engine's own RFC 8032 signs — no API-33 floor |
|
||||
| Wallet: BIP-39 seed, create and restore | ✅ create, import, restore, sealed at rest, with the phrase shown once and explained |
|
||||
@@ -365,6 +365,22 @@ inner one for convenience would be a real reduction and not a refactor — a vau
|
||||
that opens because the phone is open is a folder with a lock drawn on it.
|
||||
|
||||
|
||||
🔴 **Files is NOT a mandatory access control system, and nothing should say it
|
||||
is.** The sharing path forced the question android#15 asked, and the answer was
|
||||
already written on the wire format: *the label is a MARKING, not a permission.*
|
||||
The content key travels in the same envelope as the file — by design, because
|
||||
that is what makes sending work — so no client-side refusal is a control. There
|
||||
is no trusted computing base: the person holds every key, on a device they
|
||||
control, running a client they could modify. **A suggestion dressed as a control
|
||||
is worse than no control**, because it is the one people plan around.
|
||||
|
||||
What Files does provide, and what may be claimed: cryptographic read separation
|
||||
(no label key, no plaintext — enforced by mathematics, not by a check), and a
|
||||
classification that travels with a file and is preserved on the recipient's
|
||||
phone. Bell–LaPadula's ★-property is deliberately absent on both clients, and
|
||||
the test in `LabelTest` asserts that absence so it fails loudly if one platform
|
||||
implements it alone.
|
||||
|
||||
🔴 **The Files crypto is held to `vectors/files-v1.json`, which the JavaScript
|
||||
engine in the browser produced — a third implementation, not the Swift one.**
|
||||
Checking Kotlin against Swift would only establish that the two agree, and two
|
||||
|
||||
@@ -1974,6 +1974,9 @@ fun ColumnScope.ChatScreen(
|
||||
// this screen that did not belong to that row.
|
||||
var showStickers by remember { mutableStateOf(false) }
|
||||
var showEmoji by remember { mutableStateOf(false) }
|
||||
var showAttach by remember { mutableStateOf(false) }
|
||||
/** The Files picker, opened from the attach panel. */
|
||||
var pickingFile by remember { mutableStateOf(false) }
|
||||
|
||||
var micGranted by remember {
|
||||
mutableStateOf(
|
||||
@@ -2074,8 +2077,19 @@ fun ColumnScope.ChatScreen(
|
||||
verticalAlignment = Alignment.CenterVertically,
|
||||
horizontalArrangement = Arrangement.spacedBy(Space.sm),
|
||||
) {
|
||||
IconAction(icon = KitIcon.Attach, label = "Attach a photo", tag = "attach",
|
||||
onClick = { pickImage.launch("image/*") })
|
||||
// 🔴 **A choice, not a shortcut to the photo picker.** This was labelled
|
||||
// "Attach a photo" and launched the gallery — which is also exactly what
|
||||
// the camera button beside it does, so the row had two controls doing
|
||||
// one thing and no way at all to send a document. Opening a small panel
|
||||
// keeps the kit's row at its four controls while giving the second kind
|
||||
// of attachment somewhere to live.
|
||||
IconAction(icon = KitIcon.Attach,
|
||||
label = if (showAttach) "Close attachments" else "Attach",
|
||||
tag = "attach",
|
||||
onClick = {
|
||||
showAttach = !showAttach
|
||||
if (showAttach) { showEmoji = false; showStickers = false }
|
||||
})
|
||||
|
||||
// ⚠️ `BasicTextField` inside our own pill rather than a Material text
|
||||
// field with its shape overridden: `OutlinedTextField` reserves room
|
||||
@@ -2186,6 +2200,25 @@ fun ColumnScope.ChatScreen(
|
||||
}
|
||||
}
|
||||
|
||||
if (showAttach) {
|
||||
AttachPanel(
|
||||
model = model,
|
||||
onPhoto = { showAttach = false; pickImage.launch("image/*") },
|
||||
onFiles = { showAttach = false; pickingFile = true },
|
||||
)
|
||||
}
|
||||
|
||||
if (pickingFile) {
|
||||
PickFileToSendSheet(
|
||||
model = model,
|
||||
onCancel = { pickingFile = false },
|
||||
onPick = { entry ->
|
||||
pickingFile = false
|
||||
model.sendFileFromVault(entry, chat)
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
if (showStickers) {
|
||||
StickerPicker { sticker ->
|
||||
// A sticker IS the message. There is nothing to add it to and
|
||||
@@ -2408,7 +2441,10 @@ private fun Bubble(
|
||||
io.flamenet.e2e.Attachment.AUDIO -> VoiceBubble(ref, model)
|
||||
// A document, not a picture: AttachedImage would download
|
||||
// a PDF and draw nothing.
|
||||
io.flamenet.e2e.Attachment.FILE -> FileBubble(ref, line.mine)
|
||||
io.flamenet.e2e.Attachment.FILE -> FileBubble(
|
||||
ref, line.mine,
|
||||
onSave = if (line.mine) null else { { model.saveAttachmentToFiles(ref) } },
|
||||
)
|
||||
else -> AttachedImage(ref, model)
|
||||
}
|
||||
}
|
||||
@@ -3783,7 +3819,11 @@ fun ColumnScope.MailboxesSection(
|
||||
* other half is built.
|
||||
*/
|
||||
@Composable
|
||||
private fun FileBubble(ref: io.flamenet.e2e.Attachment.Ref, mine: Boolean) {
|
||||
private fun FileBubble(
|
||||
ref: io.flamenet.e2e.Attachment.Ref,
|
||||
mine: Boolean,
|
||||
onSave: (() -> Unit)? = null,
|
||||
) {
|
||||
val onColour = if (mine) MaterialTheme.colorScheme.onPrimary
|
||||
else MaterialTheme.colorScheme.onSurface
|
||||
Row(
|
||||
@@ -3835,6 +3875,22 @@ private fun FileBubble(ref: io.flamenet.e2e.Attachment.Ref, mine: Boolean) {
|
||||
)
|
||||
}
|
||||
}
|
||||
// 🔴 **Offered on a received file only.** Saving something already
|
||||
// in the vault back into it would make a second, unrelated copy at
|
||||
// whatever label this bubble happens to carry — which is how one
|
||||
// document quietly becomes two at different classifications.
|
||||
if (onSave != null) {
|
||||
Text(
|
||||
"Save to Files",
|
||||
fontSize = 12.sp,
|
||||
fontWeight = FontWeight.Medium,
|
||||
color = onColour,
|
||||
modifier = Modifier
|
||||
.clickable(onClick = onSave)
|
||||
.padding(top = 2.dp)
|
||||
.testTag("chat.file.save"),
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -3844,14 +3900,19 @@ private fun FileBubble(ref: io.flamenet.e2e.Attachment.Ref, mine: Boolean) {
|
||||
* ask on either side any more. An ordinal outside the set is shown as itself
|
||||
* rather than guessed at — inventing "Secret" for a level this deployment calls
|
||||
* something else would be worse than a number.
|
||||
*
|
||||
* 🔴 **One vocabulary, not two.** This was a second `when` listing the same
|
||||
* four names — agreeing with [FileLevels] by coincidence, with nothing making
|
||||
* them agree. Two places to change is how one of them gets changed: rename a
|
||||
* level for the Files screen and the chat bubble keeps showing the old word for
|
||||
* the same number, on the same phone, in the same conversation.
|
||||
*
|
||||
* ⚠️ It matters more than a rename. The ORDINAL is what travels on the wire,
|
||||
* so the name is the only thing telling somebody what a number means — and two
|
||||
* answers to that is worse than none.
|
||||
*/
|
||||
private fun classificationName(ordinal: Int): String = when (ordinal) {
|
||||
0 -> "Unclassified"
|
||||
1 -> "Internal"
|
||||
2 -> "Confidential"
|
||||
3 -> "Restricted"
|
||||
else -> "Level $ordinal"
|
||||
}
|
||||
private fun classificationName(ordinal: Int): String =
|
||||
FileLevels.levelName(ordinal.toShort())
|
||||
|
||||
/**
|
||||
* What is being typed after an unfinished `@`, or null when there isn't one.
|
||||
|
||||
@@ -539,3 +539,115 @@ private fun ColumnScope.LevelPicker(selected: Short, onPick: (Short) -> Unit) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ---- Into and out of a conversation --------------------------------------
|
||||
|
||||
/**
|
||||
* What can be attached to a message.
|
||||
*
|
||||
* ⚠️ Two kinds, and they are not variations of one thing: a photo comes from
|
||||
* the gallery and is re-encoded for sending; a document comes from the vault
|
||||
* and carries a classification with it.
|
||||
*/
|
||||
@Composable
|
||||
fun ColumnScope.AttachPanel(
|
||||
model: MessengerViewModel,
|
||||
onPhoto: () -> Unit,
|
||||
onFiles: () -> Unit,
|
||||
) {
|
||||
Column(
|
||||
modifier = Modifier
|
||||
.fillMaxWidth()
|
||||
.clip(RoundedCornerShape(Radius.small))
|
||||
.background(Palette.SurfaceAlt)
|
||||
.padding(Space.md)
|
||||
.testTag("attach-panel"),
|
||||
verticalArrangement = Arrangement.spacedBy(Space.sm),
|
||||
) {
|
||||
KitSecondaryButton(text = "Photo", onClick = onPhoto,
|
||||
modifier = Modifier.fillMaxWidth(), tag = "attach-photo")
|
||||
KitSecondaryButton(
|
||||
text = if (model.filesUnlocked()) "From Files" else "From Files (locked)",
|
||||
onClick = onFiles,
|
||||
modifier = Modifier.fillMaxWidth(), tag = "attach-files",
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Choose a document from the vault, from inside a conversation.
|
||||
*
|
||||
* 🔴 **Sending is a downgrade, and the sheet says so before the tap.** The
|
||||
* content key travels in the same envelope as the message, so a classification
|
||||
* does not stop the recipient opening it — it goes so their phone files it the
|
||||
* same way. Every word here has to carry that, because the alternative is a
|
||||
* person believing "Restricted" did something on the way.
|
||||
*
|
||||
* ⚠️ **Never asks for the Files passphrase.** A conversation that prompted for
|
||||
* one would be a conversation that has started collecting one, and Files goes
|
||||
* out of its way not to hold it. Locked says so and points at the Files screen.
|
||||
*/
|
||||
@Composable
|
||||
fun ColumnScope.PickFileToSendSheet(
|
||||
model: MessengerViewModel,
|
||||
onCancel: () -> Unit,
|
||||
onPick: (LocalVault.Entry) -> Unit,
|
||||
) {
|
||||
val unlocked = model.filesUnlocked()
|
||||
// Read once when the sheet opens: the vault does not change underneath it,
|
||||
// and re-reading on every recomposition means decrypting every filename
|
||||
// again for each frame.
|
||||
val entries = remember(unlocked) { if (unlocked) model.filesForSending() else emptyList() }
|
||||
|
||||
Column(
|
||||
modifier = Modifier
|
||||
.fillMaxWidth()
|
||||
.clip(RoundedCornerShape(Radius.small))
|
||||
.background(Palette.SurfaceAlt)
|
||||
.padding(Space.md)
|
||||
.testTag("pick-file-sheet"),
|
||||
) {
|
||||
Text("Send a file", fontWeight = FontWeight.Medium, fontSize = 16.sp)
|
||||
Spacer(Modifier.height(Space.sm))
|
||||
|
||||
if (!unlocked) {
|
||||
Text(
|
||||
"Files is locked. Open Files from your account and unlock it, "
|
||||
+ "then come back — your passphrase isn't asked for here.",
|
||||
fontSize = 13.sp, color = Palette.SecondaryText,
|
||||
)
|
||||
} else if (entries.isEmpty()) {
|
||||
Text("Nothing in your files yet.", fontSize = 13.sp, color = Palette.SecondaryText)
|
||||
} else {
|
||||
Text(
|
||||
"Whoever you send this to will be able to open it. The "
|
||||
+ "classification travels with the file so it's filed the "
|
||||
+ "same way on their phone — it doesn't stop them reading it.",
|
||||
fontSize = 12.sp, color = Palette.SecondaryText,
|
||||
)
|
||||
Spacer(Modifier.height(Space.sm))
|
||||
for (entry in entries) {
|
||||
Row(
|
||||
modifier = Modifier
|
||||
.fillMaxWidth()
|
||||
.clickable { onPick(entry) }
|
||||
.padding(vertical = Space.sm)
|
||||
.testTag("pick-file-row"),
|
||||
verticalAlignment = Alignment.CenterVertically,
|
||||
) {
|
||||
Column(Modifier.weight(1f)) {
|
||||
Text(entry.name ?: "Unnamed", fontSize = 15.sp,
|
||||
maxLines = 1, overflow = TextOverflow.Ellipsis)
|
||||
Text(
|
||||
FileLevels.levelName(entry.label.classification),
|
||||
fontSize = 11.sp, color = Palette.SecondaryText,
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Spacer(Modifier.height(Space.sm))
|
||||
KitSecondaryButton(text = "Cancel", onClick = onCancel,
|
||||
modifier = Modifier.fillMaxWidth(), tag = "pick-file-cancel")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1649,6 +1649,112 @@ class MessengerViewModel(app: Application) : AndroidViewModel(app) {
|
||||
)
|
||||
}
|
||||
|
||||
// -- Files, into and out of a conversation --------------------------------
|
||||
|
||||
/**
|
||||
* Whether a conversation can offer to send from Files right now.
|
||||
*
|
||||
* ⚠️ **A chat never asks for the Files passphrase.** A conversation that
|
||||
* prompted for one would be a conversation that has started collecting one,
|
||||
* and Files goes out of its way not to hold it. Locked means the picker says
|
||||
* so and points at the Files screen.
|
||||
*/
|
||||
fun filesUnlocked(): Boolean = filesVault != null
|
||||
|
||||
/** Everything sendable, anywhere in the tree. */
|
||||
fun filesForSending(): List<LocalVault.Entry> =
|
||||
filesVault?.let { runCatching { it.allFiles() }.getOrDefault(emptyList()) } ?: emptyList()
|
||||
|
||||
/**
|
||||
* Send a document from the vault into this conversation.
|
||||
*
|
||||
* 🔴 **This is a downgrade, and the screen says so before the tap rather
|
||||
* than after.** The content key goes in the same envelope, so the
|
||||
* classification does not stop the recipient reading it — it travels so
|
||||
* their phone files it the same way. Nothing here refuses on the label,
|
||||
* because nothing here could: refusing in a client whose user holds the
|
||||
* keys is a suggestion, and one dressed as a control is worse than none.
|
||||
*/
|
||||
fun sendFileFromVault(entry: LocalVault.Entry, chat: Phase.Chat) =
|
||||
viewModelScope.launch {
|
||||
val open = filesVault ?: return@launch
|
||||
val live = session ?: return@launch
|
||||
filesUpdate { it.copy(busy = "Sending…", problem = null, notice = null) }
|
||||
val done = withContext(Dispatchers.IO) {
|
||||
runCatching {
|
||||
val bytes = open.contents(entry.node)
|
||||
val name = entry.name ?: "file"
|
||||
val label = entry.label
|
||||
val group = chat.group
|
||||
if (group != null) {
|
||||
live.sendGroupFile(group, bytes, name,
|
||||
label.classification.toInt(), label.compartments.sorted())
|
||||
} else {
|
||||
live.sendFile(chat.peerId ?: return@runCatching,
|
||||
bytes, name,
|
||||
label.classification.toInt(), label.compartments.sorted())
|
||||
}
|
||||
}
|
||||
}
|
||||
done.fold(
|
||||
onSuccess = {
|
||||
filesUpdate { it.copy(busy = null) }
|
||||
update {
|
||||
it.copy(openChat = it.openChat?.copy(lines = live.history(chat.threadId)))
|
||||
}
|
||||
},
|
||||
onFailure = { e ->
|
||||
filesUpdate {
|
||||
it.copy(busy = null,
|
||||
problem = "Couldn't send that file. ${e.message ?: ""}".trim())
|
||||
}
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Save a received document into the vault.
|
||||
*
|
||||
* 🔴 **Always an encrypted copy, never a link.** There is no file on this
|
||||
* phone to point at — the bytes arrived over the wire — so the two storage
|
||||
* modes are not a choice here.
|
||||
*
|
||||
* ⚠️ **Filed under the label it arrived with, not under one this device
|
||||
* chose.** Re-labelling somebody else's document on receipt would quietly
|
||||
* launder its classification, and the number is the only thing that survived
|
||||
* the trip.
|
||||
*/
|
||||
fun saveAttachmentToFiles(ref: io.flamenet.e2e.Attachment.Ref) = viewModelScope.launch {
|
||||
val open = filesVault
|
||||
if (open == null) {
|
||||
filesUpdate {
|
||||
it.copy(problem = "Files is locked. Open Files and unlock it, then "
|
||||
+ "come back — your passphrase isn't asked for here.")
|
||||
}
|
||||
return@launch
|
||||
}
|
||||
val live = session ?: return@launch
|
||||
filesUpdate { it.copy(busy = "Saving…", problem = null, notice = null) }
|
||||
val done = withContext(Dispatchers.IO) {
|
||||
runCatching {
|
||||
val bytes = live.attachmentBytes(ref, getApplication<Application>().cacheDir)
|
||||
val name = ref.filename.ifEmpty { "Received file" }
|
||||
open.add(bytes, name,
|
||||
Label(ref.classification.toShort(), ref.compartments.toSet()))
|
||||
name
|
||||
}
|
||||
}
|
||||
done.fold(
|
||||
onSuccess = { name -> filesUpdate { it.copy(busy = null, notice = "Saved $name to Files.") } },
|
||||
onFailure = { e ->
|
||||
filesUpdate {
|
||||
it.copy(busy = null,
|
||||
problem = "Couldn't save that file. ${e.message ?: ""}".trim())
|
||||
}
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
fun filesClearMessages() = filesUpdate { it.copy(problem = null, notice = null) }
|
||||
|
||||
private fun finishFilesWork(result: Result<*>, notice: String?) {
|
||||
|
||||
@@ -360,6 +360,61 @@ class Session(
|
||||
return sent
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a document from the Files vault.
|
||||
*
|
||||
* 🔴 **The label travels; it does not gate.** The content key is in the same
|
||||
* envelope as the message, so the recipient can open this whatever their
|
||||
* clearance — the classification goes so their phone files it the same way,
|
||||
* and every sentence on the way to this call has to say that rather than
|
||||
* implying a control. See `Attachment.FILE`.
|
||||
*
|
||||
* ⚠️ `application/octet-stream` and not a guess from the extension. A
|
||||
* document announced as `image/png` renders as a broken image rather than a
|
||||
* file somebody can save, and the vault stores no MIME type to be right
|
||||
* with.
|
||||
*/
|
||||
fun sendFile(
|
||||
peerUserId: Long,
|
||||
bytes: ByteArray,
|
||||
name: String,
|
||||
classification: Int,
|
||||
compartments: List<Int>,
|
||||
): io.flamenet.client.Conversations.Sent {
|
||||
val sent = conversations.sendAttachment(
|
||||
peerUserId, bytes, "application/octet-stream", Attachment.FILE,
|
||||
filename = name, classification = classification, compartments = compartments)
|
||||
record(Vault.threadForUser(peerUserId), "", mine = true,
|
||||
attachment = sent.attachment,
|
||||
delivery = if (sent.reachedSomeone) Delivery.DELIVERED else Delivery.PENDING)
|
||||
return sent
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a document to a group.
|
||||
*
|
||||
* ⚠️ **Sealed and uploaded once, then fanned out** — one blob, one key, one
|
||||
* upload, referenced by every member's envelope. And the count is worth
|
||||
* saying out loud before tapping: a Restricted file into a group of eleven
|
||||
* hands the key to eleven people.
|
||||
*/
|
||||
fun sendGroupFile(
|
||||
group: RelayClient.Group,
|
||||
bytes: ByteArray,
|
||||
name: String,
|
||||
classification: Int,
|
||||
compartments: List<Int>,
|
||||
): Conversations.Sent {
|
||||
val sent = conversations.sendGroupAttachment(
|
||||
group, userId, bytes, "application/octet-stream", width = 0, height = 0,
|
||||
kind = Attachment.FILE, filename = name,
|
||||
classification = classification, compartments = compartments)
|
||||
record(Vault.threadForGroup(group.id), "", mine = true,
|
||||
attachment = sent.attachment, author = userId,
|
||||
delivery = if (sent.reachedSomeone) Delivery.DELIVERED else Delivery.PENDING)
|
||||
return sent
|
||||
}
|
||||
|
||||
/** Bytes for an attachment, cached on disk after the first fetch. */
|
||||
fun attachmentBytes(ref: Attachment.Ref, cacheDir: java.io.File): ByteArray {
|
||||
val cached = java.io.File(cacheDir, "att-" + ref.id.replace('/', '_'))
|
||||
|
||||
@@ -0,0 +1,109 @@
|
||||
package io.flamenet.messenger.app
|
||||
|
||||
import io.flamenet.e2e.Attachment
|
||||
import io.flamenet.e2e.Content
|
||||
import kotlin.test.Test
|
||||
import kotlin.test.assertEquals
|
||||
import kotlin.test.assertNotNull
|
||||
import kotlin.test.assertTrue
|
||||
|
||||
/**
|
||||
* What a document sent from Files actually puts on the wire.
|
||||
*
|
||||
* 🔴 **The classification is the only thing that survives the trip.** The
|
||||
* recipient's phone files the document at whatever number arrives — there is
|
||||
* nothing else to consult and no server to ask — so a label dropped in transit
|
||||
* does not error anywhere: the file simply arrives Unclassified and gets filed
|
||||
* that way, on the most permissive setting it could possibly have.
|
||||
*
|
||||
* ⚠️ These check the ENVELOPE. `Session.sendFile` needs a relay and a vault, so
|
||||
* the send itself is covered on device; the shape that crosses to the other app
|
||||
* is what an interop bug would live in, and it is checkable here.
|
||||
*/
|
||||
class FileShareWireTest {
|
||||
|
||||
private fun ref(classification: Int, compartments: List<Int>, name: String = "Q3.txt") =
|
||||
Attachment.Ref(
|
||||
kind = Attachment.FILE, id = "blob-1",
|
||||
key = ByteArray(32) { 1 }, digest = ByteArray(32) { 2 },
|
||||
bytes = 4096, mime = "application/octet-stream",
|
||||
filename = name, classification = classification, compartments = compartments,
|
||||
)
|
||||
|
||||
private fun roundTrip(r: Attachment.Ref): Attachment.Ref {
|
||||
val parsed = assertNotNull(Content.parse(Content.attachment(r)))
|
||||
return assertNotNull(parsed.attachment, "the attachment did not survive the envelope")
|
||||
}
|
||||
|
||||
@Test
|
||||
fun `a file keeps its classification and its compartments`() {
|
||||
val back = roundTrip(ref(3, listOf(1, 2)))
|
||||
assertEquals(3, back.classification, "the classification was lost in the envelope")
|
||||
assertEquals(listOf(1, 2), back.compartments)
|
||||
assertEquals("Q3.txt", back.filename)
|
||||
}
|
||||
|
||||
/**
|
||||
* 🔴 **Unclassified must round-trip as a real value, not as an absence.**
|
||||
* Zero is the default for a missing field, so a sender that dropped the key
|
||||
* and a sender that meant zero are indistinguishable at the other end. This
|
||||
* pins that the zero case still parses as a file rather than as something
|
||||
* the recipient has to guess about.
|
||||
*/
|
||||
@Test
|
||||
fun `an unclassified file is still a file, not a missing label`() {
|
||||
val back = roundTrip(ref(0, emptyList()))
|
||||
assertEquals(0, back.classification)
|
||||
assertTrue(back.compartments.isEmpty())
|
||||
assertEquals(Attachment.FILE, back.kind)
|
||||
}
|
||||
|
||||
/**
|
||||
* ⚠️ A file envelope always carries a caption, even when nobody wrote one.
|
||||
* Builds predating this attachment kind show the caption and drop the rest,
|
||||
* so an empty one reaches them as "[unsupported attachment]" with no clue
|
||||
* what was sent.
|
||||
*/
|
||||
@Test
|
||||
fun `a file with no caption still says what it is to an older build`() {
|
||||
val parsed = assertNotNull(Content.parse(Content.attachment(ref(1, emptyList()))))
|
||||
assertTrue(
|
||||
parsed.text.contains("Q3.txt"),
|
||||
"an older build would render this as an unsupported attachment: '${parsed.text}'",
|
||||
)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun `a caption somebody wrote is not replaced by the filename`() {
|
||||
val parsed = assertNotNull(
|
||||
Content.parse(Content.attachment(ref(1, emptyList()), caption = "the numbers")))
|
||||
assertEquals("the numbers", parsed.text)
|
||||
}
|
||||
|
||||
/**
|
||||
* ⚠️ Compartment order is normalised on the way out, so two senders who
|
||||
* chose the same areas produce the same bytes. Unsorted, the label would
|
||||
* still be *correct* and would still encode differently — which matters
|
||||
* because the canonical encoding is authenticated data elsewhere.
|
||||
*/
|
||||
@Test
|
||||
fun `compartments arrive in a stable order`() {
|
||||
assertEquals(listOf(1, 2, 5), roundTrip(ref(2, listOf(5, 1, 2))).compartments.sorted())
|
||||
}
|
||||
|
||||
/**
|
||||
* 🔴 An image must NOT gain a label. `label` is written only for the file
|
||||
* kind — a photo carrying `cls: 0` would tell the other end there is a
|
||||
* classification here to respect, and there is not.
|
||||
*/
|
||||
@Test
|
||||
fun `an image carries no label at all`() {
|
||||
val image = Attachment.Ref(
|
||||
kind = Attachment.IMAGE, id = "b", key = ByteArray(32), digest = ByteArray(32),
|
||||
bytes = 10, mime = "image/jpeg", width = 4, height = 4,
|
||||
)
|
||||
val json = org.json.JSONObject(Content.attachment(image))
|
||||
assertTrue(!json.has("cls"), "an image envelope is claiming a classification")
|
||||
assertTrue(!json.has("cmp"), "an image envelope is claiming compartments")
|
||||
}
|
||||
}
|
||||
@@ -270,6 +270,18 @@ class Conversations(
|
||||
height: Int = 0,
|
||||
duration: Double = 0.0,
|
||||
groupId: String? = null,
|
||||
/** File only: the document's own name. */
|
||||
filename: String = "",
|
||||
/**
|
||||
* File only: the label it was filed under.
|
||||
*
|
||||
* 🔴 **A MARKING, not a permission.** The content key rides in the same
|
||||
* envelope, so whoever can read the message can read the file. This
|
||||
* travels so the recipient can file it the same way — it must never be
|
||||
* described, here or on screen, as something that stops them opening it.
|
||||
*/
|
||||
classification: Int = 0,
|
||||
compartments: List<Int> = emptyList(),
|
||||
): Sent {
|
||||
val sealed = Attachment.seal(data)
|
||||
val id = relay.uploadAttachment(sealed.blob)
|
||||
@@ -277,6 +289,8 @@ class Conversations(
|
||||
kind = kind, id = id, key = sealed.key, digest = sealed.digest,
|
||||
bytes = sealed.blob.size, mime = mime,
|
||||
width = width, height = height, duration = duration,
|
||||
filename = filename, classification = classification,
|
||||
compartments = compartments.sorted(),
|
||||
)
|
||||
return sendPlaintext(
|
||||
toUserId,
|
||||
@@ -301,12 +315,19 @@ class Conversations(
|
||||
width: Int,
|
||||
height: Int,
|
||||
caption: String? = null,
|
||||
kind: String = Attachment.IMAGE,
|
||||
filename: String = "",
|
||||
/** See the note on [sendAttachment]: a marking, not a permission. */
|
||||
classification: Int = 0,
|
||||
compartments: List<Int> = emptyList(),
|
||||
): Sent {
|
||||
val sealed = Attachment.seal(data)
|
||||
val id = relay.uploadAttachment(sealed.blob)
|
||||
val ref = Attachment.Ref(
|
||||
kind = Attachment.IMAGE, id = id, key = sealed.key, digest = sealed.digest,
|
||||
kind = kind, id = id, key = sealed.key, digest = sealed.digest,
|
||||
bytes = sealed.blob.size, mime = mime, width = width, height = height,
|
||||
filename = filename, classification = classification,
|
||||
compartments = compartments.sorted(),
|
||||
)
|
||||
val body = Content.attachment(ref, caption, group.id,
|
||||
groupName = vault.groupName(group.id))
|
||||
|
||||
@@ -344,6 +344,28 @@ class LocalVault(
|
||||
found
|
||||
}
|
||||
|
||||
/**
|
||||
* Every file in the whole tree, for a picker that has no business showing
|
||||
* folders.
|
||||
*
|
||||
* 🔴 **The whole tree, not the top of it.** iOS's picker lists `list(nil)`,
|
||||
* so a document filed into a folder cannot be sent from a conversation at
|
||||
* all — and nothing says so; the file is simply absent from the list, which
|
||||
* reads as "it isn't there". Filed as ios#68.
|
||||
*
|
||||
* ⚠️ Unreadable and missing rows are dropped here rather than shown
|
||||
* disabled. Everywhere else this class insists on showing a row you cannot
|
||||
* open — because hiding it would leave somebody unable to see that anything
|
||||
* is there. A picker is the exception: its only purpose is choosing
|
||||
* something to send, and a row that can never be chosen is furniture.
|
||||
*/
|
||||
fun allFiles(): List<Entry> = lock.withLock {
|
||||
nodes.filter { !it.isFolder }
|
||||
.map { Entry(it, nameOf(it), isMissing = isMissing(it)) }
|
||||
.filter { it.name != null && !it.isMissing }
|
||||
.sortedWith(compareBy(String.CASE_INSENSITIVE_ORDER) { it.name ?: "" })
|
||||
}
|
||||
|
||||
fun contents(of: Node): ByteArray = lock.withLock { readContents(of) }
|
||||
|
||||
private fun readContents(node: Node): ByteArray {
|
||||
|
||||
@@ -468,6 +468,52 @@ class LocalVaultTest {
|
||||
assertEquals(listOf("b.txt"), reopen().list(null).map { it.name })
|
||||
}
|
||||
|
||||
// ---- The picker ------------------------------------------------------
|
||||
|
||||
/**
|
||||
* 🔴 **The whole tree, not the top of it.** iOS's picker lists the root
|
||||
* only, so a document filed into a folder cannot be sent from a
|
||||
* conversation at all — and nothing says so: the file is simply absent,
|
||||
* which reads as "it isn't there". Filed as ios#68.
|
||||
*/
|
||||
@Test
|
||||
fun `everything sendable is offered, however deep it is filed`() {
|
||||
val folder = vault.createFolder("Reports", open)
|
||||
val inner = vault.createFolder("2026", open, parentId = folder.id)
|
||||
vault.add("a".toByteArray(), "top.txt", open)
|
||||
vault.add("b".toByteArray(), "buried.txt", secret, parentId = inner.id)
|
||||
|
||||
assertEquals(listOf("buried.txt", "top.txt"), vault.allFiles().map { it.name })
|
||||
}
|
||||
|
||||
/** Folders are places, not files. Sending one means nothing. */
|
||||
@Test
|
||||
fun `folders are not offered`() {
|
||||
vault.createFolder("Reports", open)
|
||||
assertTrue(vault.allFiles().isEmpty())
|
||||
}
|
||||
|
||||
/**
|
||||
* ⚠️ **The one place this class hides a row it cannot read.** Everywhere
|
||||
* else an unreadable row is shown, because hiding it would leave somebody
|
||||
* unable to see that anything is there. A picker's only purpose is choosing
|
||||
* something to send, and a row that can never be chosen is furniture.
|
||||
*/
|
||||
@Test
|
||||
fun `rows that could never be sent are left out of the picker`() {
|
||||
refs.files["doc://gone"] = "x".toByteArray()
|
||||
vault.reference("doc://gone", "vanished.pdf", open)
|
||||
vault.add("readable".toByteArray(), "fine.txt", open)
|
||||
refs.files.remove("doc://gone")
|
||||
|
||||
assertEquals(listOf("fine.txt"), vault.allFiles().map { it.name },
|
||||
"a file that has moved was offered as sendable")
|
||||
|
||||
val stranger = LocalVault(root, ByteArray(32) { 99 }, refs).also { it.load() }
|
||||
assertTrue(stranger.allFiles().isEmpty(),
|
||||
"a row this device cannot decrypt was offered as sendable")
|
||||
}
|
||||
|
||||
// ---- The tree --------------------------------------------------------
|
||||
|
||||
@Test
|
||||
|
||||
Reference in New Issue
Block a user