diff --git a/.gitignore b/.gitignore index 45ed4c3c..0986ac74 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,7 @@ build/ !*/build/intermediates/ local.properties .gradle/ +.kotlin/ captures/ .externalNativeBuild/ debug_keystore/ @@ -40,6 +41,11 @@ dependency-reduced-pom.xml # Linters .lint/ +# Python test tooling +**/__pycache__/ +*.py[cod] +release-gate-results/ + # Other *.log .cxx/ diff --git a/app/src/main/java/com/bitchat/android/MainActivity.kt b/app/src/main/java/com/bitchat/android/MainActivity.kt index e6344efa..2ae6bab4 100644 --- a/app/src/main/java/com/bitchat/android/MainActivity.kt +++ b/app/src/main/java/com/bitchat/android/MainActivity.kt @@ -21,6 +21,7 @@ import androidx.lifecycle.repeatOnLifecycle import androidx.lifecycle.Lifecycle import com.bitchat.android.mesh.BluetoothMeshService import com.bitchat.android.mesh.MeshService +import com.bitchat.android.geohash.LocationChannelManager import com.bitchat.android.onboarding.BluetoothCheckScreen import com.bitchat.android.onboarding.BluetoothStatus import com.bitchat.android.onboarding.BluetoothStatusManager @@ -743,6 +744,9 @@ class MainActivity : OrientationAwareActivity() { override fun onResume() { super.onResume() + // Revoke stale live-location work before any resumed UI can use cached channels. + LocationChannelManager.getInstance(applicationContext).syncPermissionState() + // Check Bluetooth and Location status on resume and handle accordingly if (mainViewModel.onboardingState.value == OnboardingState.COMPLETE) { // Reattach mesh delegate to new ChatViewModel instance after Activity recreation @@ -817,7 +821,7 @@ class MainActivity : OrientationAwareActivity() { val geohash = intent.getStringExtra(com.bitchat.android.ui.NotificationManager.EXTRA_GEOHASH) if (geohash != null) { - Log.d("MainActivity", "Opening geohash chat #$geohash from notification") + Log.d("MainActivity", "Opening geohash chat from notification") // Switch to the geohash channel - create appropriate geohash channel level val level = when (geohash.length) { diff --git a/app/src/main/java/com/bitchat/android/geohash/AndroidGeocoderProvider.kt b/app/src/main/java/com/bitchat/android/geohash/AndroidGeocoderProvider.kt index 670d4cfc..a6c72852 100644 --- a/app/src/main/java/com/bitchat/android/geohash/AndroidGeocoderProvider.kt +++ b/app/src/main/java/com/bitchat/android/geohash/AndroidGeocoderProvider.kt @@ -14,27 +14,53 @@ class AndroidGeocoderProvider(context: Context) : GeocoderProvider { private val geocoder = Geocoder(context, Locale.getDefault()) private val TAG = "AndroidGeocoderProvider" - override suspend fun getFromLocation(latitude: Double, longitude: Double, maxResults: Int): List
{ + override suspend fun getFromLocation( + latitude: Double, + longitude: Double, + maxResults: Int, + liveLocationToken: Long? + ): List
{ return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) { suspendCancellableCoroutine { cont -> try { - geocoder.getFromLocation( - latitude, - longitude, - maxResults, - object : Geocoder.GeocodeListener { - override fun onGeocode(addresses: MutableList
) { - if (cont.isActive) cont.resume(addresses) - } + val startRequest = { + geocoder.getFromLocation( + latitude, + longitude, + maxResults, + object : Geocoder.GeocodeListener { + override fun onGeocode(addresses: MutableList
) { + if (cont.isActive) { + val result = if (liveLocationToken == null || + LiveLocationPrivacyGate.accepts(liveLocationToken) + ) { + addresses + } else { + emptyList() + } + cont.resume(result) + } + } - override fun onError(errorMessage: String?) { - if (cont.isActive) { - Log.e(TAG, "Geocode error: $errorMessage") - cont.resume(emptyList()) + override fun onError(errorMessage: String?) { + if (cont.isActive) { + Log.e(TAG, "Geocode error") + cont.resume(emptyList()) + } } } - } - ) + ) + } + val started = if (liveLocationToken == null) { + startRequest() + true + } else { + LiveLocationPrivacyGate.runIfAllowed( + liveLocationToken, + startRequest + ) + } + if (!started && cont.isActive) cont.resume(emptyList()) } catch (e: Exception) { if (cont.isActive) cont.resumeWithException(e) } @@ -42,9 +68,27 @@ class AndroidGeocoderProvider(context: Context) : GeocoderProvider { } else { @Suppress("DEPRECATION") try { - geocoder.getFromLocation(latitude, longitude, maxResults) ?: emptyList() + if (liveLocationToken != null && + !LiveLocationPrivacyGate.accepts(liveLocationToken) + ) return emptyList() + + // This legacy API blocks and cannot be cancelled. Never hold the privacy + // gate's read lock across the call: revocation must remain immediate. + val addresses = geocoder.getFromLocation( + latitude, + longitude, + maxResults + ) ?: emptyList() + + if (liveLocationToken == null || + LiveLocationPrivacyGate.accepts(liveLocationToken) + ) { + addresses + } else { + emptyList() + } } catch (e: Exception) { - Log.e(TAG, "Geocode failed", e) + Log.e(TAG, "Geocode failed") emptyList() } } diff --git a/app/src/main/java/com/bitchat/android/geohash/FusedLocationProvider.kt b/app/src/main/java/com/bitchat/android/geohash/FusedLocationProvider.kt index b6d29c90..06439c80 100644 --- a/app/src/main/java/com/bitchat/android/geohash/FusedLocationProvider.kt +++ b/app/src/main/java/com/bitchat/android/geohash/FusedLocationProvider.kt @@ -9,8 +9,9 @@ import android.os.Looper import android.util.Log import androidx.core.app.ActivityCompat import com.google.android.gms.location.* +import com.google.android.gms.tasks.CancellationTokenSource -class FusedLocationProvider(private val context: Context) : LocationProvider { +internal class FusedLocationProvider(private val context: Context) : LocationProvider { companion object { private const val TAG = "FusedLocationProvider" @@ -20,10 +21,13 @@ class FusedLocationProvider(private val context: Context) : LocationProvider { // Map to keep track of callbacks to remove them later private val activeCallbacks = mutableMapOf<(Location) -> Unit, LocationCallback>() + private val activeCurrentLocationRequests = mutableSetOf() private fun hasLocationPermission(): Boolean { - return ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED || + return LiveLocationPrivacyGate.isEnabled && + (ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED || ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION) == PackageManager.PERMISSION_GRANTED + ) } @SuppressLint("MissingPermission") @@ -36,14 +40,14 @@ class FusedLocationProvider(private val context: Context) : LocationProvider { try { fusedLocationClient.lastLocation .addOnSuccessListener { location -> - callback(location) + callback(location.takeIf { LiveLocationPrivacyGate.isEnabled }) } .addOnFailureListener { e -> - Log.e(TAG, "Error getting last known fused location: ${e.message}") + Log.e(TAG, "Error getting last-known fused location") callback(null) } } catch (e: Exception) { - Log.e(TAG, "Exception getting last known fused location: ${e.message}") + Log.e(TAG, "Exception getting last-known fused location") callback(null) } } @@ -60,17 +64,27 @@ class FusedLocationProvider(private val context: Context) : LocationProvider { .setPriority(Priority.PRIORITY_HIGH_ACCURACY) .setDurationMillis(30000) .build() + val cancellation = CancellationTokenSource() - fusedLocationClient.getCurrentLocation(request, null) + synchronized(activeCurrentLocationRequests) { + activeCurrentLocationRequests.add(cancellation) + } + + fusedLocationClient.getCurrentLocation(request, cancellation.token) .addOnSuccessListener { location -> - callback(location) + callback(location.takeIf { LiveLocationPrivacyGate.isEnabled }) } .addOnFailureListener { e -> - Log.e(TAG, "Error getting fresh fused location: ${e.message}") + Log.e(TAG, "Error getting fresh fused location") callback(null) } + .addOnCompleteListener { + synchronized(activeCurrentLocationRequests) { + activeCurrentLocationRequests.remove(cancellation) + } + } } catch (e: Exception) { - Log.e(TAG, "Exception getting fresh fused location: ${e.message}") + Log.e(TAG, "Exception getting fresh fused location") callback(null) } } @@ -91,7 +105,9 @@ class FusedLocationProvider(private val context: Context) : LocationProvider { val locationCallback = object : LocationCallback() { override fun onLocationResult(result: LocationResult) { - result.lastLocation?.let { callback(it) } + if (LiveLocationPrivacyGate.isEnabled) { + result.lastLocation?.let { callback(it) } + } } } @@ -107,7 +123,7 @@ class FusedLocationProvider(private val context: Context) : LocationProvider { Log.d(TAG, "Registered fused updates") } catch (e: Exception) { - Log.e(TAG, "Error requesting fused updates: ${e.message}") + Log.e(TAG, "Error requesting fused updates") } } @@ -122,21 +138,25 @@ class FusedLocationProvider(private val context: Context) : LocationProvider { Log.d(TAG, "Removed fused updates") } } catch (e: Exception) { - Log.e(TAG, "Error removing fused updates: ${e.message}") + Log.e(TAG, "Error removing fused updates") } } override fun cancel() { try { synchronized(activeCallbacks) { - for ((callback, locationCallback) in activeCallbacks) { + for ((_, locationCallback) in activeCallbacks) { fusedLocationClient.removeLocationUpdates(locationCallback) } activeCallbacks.clear() } + synchronized(activeCurrentLocationRequests) { + activeCurrentLocationRequests.forEach { it.cancel() } + activeCurrentLocationRequests.clear() + } Log.d(TAG, "Cancelled all fused updates") } catch (e: Exception) { - Log.e(TAG, "Error cancelling fused provider: ${e.message}") + Log.e(TAG, "Error cancelling fused provider") } } } diff --git a/app/src/main/java/com/bitchat/android/geohash/GeocoderProvider.kt b/app/src/main/java/com/bitchat/android/geohash/GeocoderProvider.kt index bb4d69c2..34197565 100644 --- a/app/src/main/java/com/bitchat/android/geohash/GeocoderProvider.kt +++ b/app/src/main/java/com/bitchat/android/geohash/GeocoderProvider.kt @@ -9,5 +9,10 @@ interface GeocoderProvider { /** * Get a list of Address objects from latitude and longitude. */ - suspend fun getFromLocation(latitude: Double, longitude: Double, maxResults: Int): List
+ suspend fun getFromLocation( + latitude: Double, + longitude: Double, + maxResults: Int, + liveLocationToken: Long? = null + ): List
} diff --git a/app/src/main/java/com/bitchat/android/geohash/GeohashBookmarksStore.kt b/app/src/main/java/com/bitchat/android/geohash/GeohashBookmarksStore.kt index 81d83b79..92e237cb 100644 --- a/app/src/main/java/com/bitchat/android/geohash/GeohashBookmarksStore.kt +++ b/app/src/main/java/com/bitchat/android/geohash/GeohashBookmarksStore.kt @@ -112,7 +112,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) { _bookmarks.value = ordered } } catch (e: Exception) { - Log.e(TAG, "Failed to load bookmarks: ${e.message}") + Log.e(TAG, "Failed to load bookmarks") } try { val namesJson = prefs.getString(NAMES_STORE_KEY, null) @@ -122,7 +122,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) { _bookmarkNames.value = dict } } catch (e: Exception) { - Log.e(TAG, "Failed to load bookmark names: ${e.message}") + Log.e(TAG, "Failed to load bookmark names") } } @@ -155,7 +155,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) { resolving.clear() Log.i(TAG, "Cleared all geohash bookmarks and names") } catch (e: Exception) { - Log.e(TAG, "Failed to clear geohash bookmarks: ${e.message}") + Log.e(TAG, "Failed to clear geohash bookmarks") } } @@ -213,7 +213,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) { persistNames(current) } } catch (e: Exception) { - Log.w(TAG, "Name resolution failed for #$gh: ${e.message}") + Log.w(TAG, "Bookmark name resolution failed") } finally { resolving.remove(gh) } diff --git a/app/src/main/java/com/bitchat/android/geohash/GeohashNostrPrivacyPolicy.kt b/app/src/main/java/com/bitchat/android/geohash/GeohashNostrPrivacyPolicy.kt new file mode 100644 index 00000000..26b9fd3c --- /dev/null +++ b/app/src/main/java/com/bitchat/android/geohash/GeohashNostrPrivacyPolicy.kt @@ -0,0 +1,24 @@ +package com.bitchat.android.geohash + +internal object GeohashNostrPrivacyPolicy { + fun livePresenceTargets( + availableChannels: Collection, + liveLocationEnabled: Boolean, + ): Set { + if (!liveLocationEnabled) return emptySet() + return availableChannels + .asSequence() + .filter { it.level.precision <= GeohashChannelLevel.CITY.precision } + .map { it.geohash } + .toSet() + } + + fun samplingTargets( + liveLocationGeohashes: Collection, + userSelectedGeohashes: Collection, + liveLocationEnabled: Boolean, + ): Set = buildSet { + addAll(userSelectedGeohashes) + if (liveLocationEnabled) addAll(liveLocationGeohashes) + } +} diff --git a/app/src/main/java/com/bitchat/android/geohash/LiveLocationPrivacyGate.kt b/app/src/main/java/com/bitchat/android/geohash/LiveLocationPrivacyGate.kt new file mode 100644 index 00000000..5a4f30fb --- /dev/null +++ b/app/src/main/java/com/bitchat/android/geohash/LiveLocationPrivacyGate.kt @@ -0,0 +1,119 @@ +package com.bitchat.android.geohash + +import java.util.concurrent.CopyOnWriteArraySet +import java.util.concurrent.atomic.AtomicLong +import java.util.concurrent.locks.ReentrantReadWriteLock +import kotlin.concurrent.read +import kotlin.concurrent.write +import kotlinx.coroutines.flow.MutableStateFlow +import kotlinx.coroutines.flow.StateFlow +import kotlinx.coroutines.flow.asStateFlow + +/** + * Process-wide, fail-closed consent gate for accessing live device location. + * + * A generation token prevents callbacks that were started under an older consent + * state from being accepted after location access is disabled or re-enabled. + */ +internal class LiveLocationAccessPolicy( + initialEnabled: Boolean = DEFAULT_LIVE_LOCATION_ENABLED, +) { + private val accessLock = ReentrantReadWriteLock() + private val generation = AtomicLong(0L) + private val _enabled = MutableStateFlow(initialEnabled) + private var accessAvailable = initialEnabled + + val enabled: StateFlow = _enabled.asStateFlow() + val isEnabled: Boolean + get() = _enabled.value + + fun update(enabled: Boolean) { + accessLock.write { + generation.incrementAndGet() + _enabled.value = enabled + accessAvailable = enabled + } + } + + fun invalidate() { + accessLock.write { + generation.incrementAndGet() + accessAvailable = false + } + } + + fun resumeAccess() { + accessLock.write { + if (_enabled.value && !accessAvailable) { + generation.incrementAndGet() + accessAvailable = true + } + } + } + + fun captureToken(): Long? = + accessLock.read { + val capturedGeneration = generation.get() + capturedGeneration.takeIf { + _enabled.value && + accessAvailable && + generation.get() == capturedGeneration + } + } + + fun accepts(token: Long): Boolean = + accessLock.read { + _enabled.value && accessAvailable && generation.get() == token + } + + fun runIfAllowed(token: Long, action: () -> Unit): Boolean = + accessLock.read { + if (!_enabled.value || !accessAvailable || generation.get() != token) { + false + } else { + action() + true + } + } +} + +internal const val DEFAULT_LIVE_LOCATION_ENABLED = false + +internal object LiveLocationPrivacyGate { + private val policy = LiveLocationAccessPolicy() + private val revocationListeners = CopyOnWriteArraySet<() -> Unit>() + + val enabled: StateFlow = policy.enabled + val isEnabled: Boolean + get() = policy.isEnabled + + fun update(enabled: Boolean) { + policy.update(enabled) + notifyRevoked() + } + + fun invalidate() { + policy.invalidate() + notifyRevoked() + } + + fun captureToken(): Long? = policy.captureToken() + fun resumeAccess() = policy.resumeAccess() + fun accepts(token: Long): Boolean = policy.accepts(token) + fun runIfAllowed(token: Long, action: () -> Unit): Boolean = + policy.runIfAllowed(token, action) + + fun addRevocationListener(listener: () -> Unit) { + revocationListeners.add(listener) + } + + fun removeRevocationListener(listener: () -> Unit) { + revocationListeners.remove(listener) + } + + private fun notifyRevoked() { + revocationListeners.forEach { listener -> + runCatching(listener) + } + } +} diff --git a/app/src/main/java/com/bitchat/android/geohash/LocationChannelManager.kt b/app/src/main/java/com/bitchat/android/geohash/LocationChannelManager.kt index 6c91c32e..46f05950 100644 --- a/app/src/main/java/com/bitchat/android/geohash/LocationChannelManager.kt +++ b/app/src/main/java/com/bitchat/android/geohash/LocationChannelManager.kt @@ -4,16 +4,14 @@ import android.Manifest import android.content.Context import android.content.IntentFilter import android.content.pm.PackageManager -import android.location.Geocoder import android.location.Location import android.location.LocationManager -import android.os.Bundle import android.util.Log import androidx.core.app.ActivityCompat import com.google.android.gms.common.ConnectionResult import com.google.android.gms.common.GoogleApiAvailability +import com.bitchat.android.nostr.NostrIdentityBridge import kotlinx.coroutines.* -import java.util.* import com.google.gson.Gson import com.google.gson.JsonSyntaxException import kotlinx.coroutines.flow.MutableStateFlow @@ -47,13 +45,19 @@ class LocationChannelManager private constructor(private val context: Context) { AUTHORIZED } + enum class LocationSelectionSource { + NEARBY, + MANUAL + } + private val locationManager: LocationManager = context.getSystemService(Context.LOCATION_SERVICE) as LocationManager private val locationProvider: LocationProvider private val geocoderProvider: GeocoderProvider = GeocoderFactory.get(context) - private var lastLocation: Location? = null private var geocodingJob: Job? = null private val gson = Gson() private var dataManager: com.bitchat.android.ui.DataManager? = null + private var selectedLocationSource: LocationSelectionSource? = null + private var activeLocationUpdateCallback: ((Location) -> Unit)? = null private fun checkSystemLocationEnabled(): Boolean { return try { @@ -70,14 +74,13 @@ class LocationChannelManager private constructor(private val context: Context) { val isEnabled = checkSystemLocationEnabled() Log.d(TAG, "System location state changed: $isEnabled") _systemLocationEnabled.value = isEnabled + if (!isEnabled) { + clearLiveLocationState() + } } } } - private val locationUpdateCallback: (Location) -> Unit = { location -> - onLocationUpdated(location) - } - // Published state for UI bindings (matching iOS @Published properties) private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate) @@ -99,8 +102,7 @@ class LocationChannelManager private constructor(private val context: Context) { private val _isLoadingLocation = MutableStateFlow(false) val isLoadingLocation: StateFlow = _isLoadingLocation - private val _locationServicesEnabled = MutableStateFlow(false) - val locationServicesEnabled: StateFlow = _locationServicesEnabled + val locationServicesEnabled: StateFlow = LiveLocationPrivacyGate.enabled private val _systemLocationEnabled = MutableStateFlow(checkSystemLocationEnabled()) val systemLocationEnabled: StateFlow = _systemLocationEnabled @@ -127,12 +129,14 @@ class LocationChannelManager private constructor(private val context: Context) { Log.i(TAG, "Using SystemLocationProvider (Native LocationManager)") SystemLocationProvider(context) } + LiveLocationPrivacyGate.addRevocationListener(::cancelLiveLocationWork) - checkAndSyncPermission() // Initialize DataManager and load persisted settings dataManager = com.bitchat.android.ui.DataManager(context) - loadPersistedChannelSelection() loadLocationServicesState() + syncPermissionState() + if (!_systemLocationEnabled.value) clearLiveLocationState() + loadPersistedChannelSelection() // Register for system location changes context.registerReceiver(locationStateReceiver, IntentFilter(LocationManager.PROVIDERS_CHANGED_ACTION)) @@ -145,17 +149,13 @@ class LocationChannelManager private constructor(private val context: Context) { * UNIFIED: Only requests location if location services are enabled by user */ fun enableLocationChannels() { - if (!_locationServicesEnabled.value || !_systemLocationEnabled.value) { + if (!LiveLocationPrivacyGate.isEnabled || !_systemLocationEnabled.value) { Log.w(TAG, "Location services disabled (app or system) - not requesting location") return } - - if (getCurrentPermissionStatus() == PermissionState.AUTHORIZED) { - _permissionState.value = PermissionState.AUTHORIZED + if (syncPermissionState() == PermissionState.AUTHORIZED) { requestOneShotLocation() - } else { - _permissionState.value = PermissionState.DENIED } } @@ -163,7 +163,7 @@ class LocationChannelManager private constructor(private val context: Context) { * Refresh available channels from current location */ fun refreshChannels() { - if (_permissionState.value == PermissionState.AUTHORIZED && isLocationServicesEnabled()) { + if (syncPermissionState() == PermissionState.AUTHORIZED && isLocationServicesEnabled()) { requestOneShotLocation() } } @@ -173,7 +173,7 @@ class LocationChannelManager private constructor(private val context: Context) { * Uses requestLocationUpdates for continuous updates, plus a one-shot to prime state immediately */ fun beginLiveRefresh(interval: Long = 5000L) { - if (_permissionState.value != PermissionState.AUTHORIZED) { + if (syncPermissionState() != PermissionState.AUTHORIZED) { Log.w(TAG, "Cannot start live refresh - permission not authorized") return } @@ -183,12 +183,28 @@ class LocationChannelManager private constructor(private val context: Context) { return } + endLiveRefresh() + LiveLocationPrivacyGate.resumeAccess() + val token = LiveLocationPrivacyGate.captureToken() ?: return + val callback: (Location) -> Unit = { location -> + if (canUseLiveLocation(token)) { + onLocationUpdated(location, token) + } + } + activeLocationUpdateCallback = callback + // Register for continuous updates from available provider - locationProvider.requestLocationUpdates( - intervalMs = interval, - minDistanceMeters = 5f, - callback = locationUpdateCallback - ) + val started = LiveLocationPrivacyGate.runIfAllowed(token) { + locationProvider.requestLocationUpdates( + intervalMs = interval, + minDistanceMeters = 5f, + callback = callback + ) + } + if (!started) { + activeLocationUpdateCallback = null + return + } // Prime state immediately with last known / current location requestOneShotLocation() @@ -198,53 +214,56 @@ class LocationChannelManager private constructor(private val context: Context) { * Stop periodic refreshes when selector UI is dismissed */ fun endLiveRefresh() { - locationProvider.removeLocationUpdates(locationUpdateCallback) + activeLocationUpdateCallback?.let(locationProvider::removeLocationUpdates) + activeLocationUpdateCallback = null } /** - * Select a channel + * Generic selection is intentionally treated as manual. GPS-derived selections must use + * [selectNearby] so their provenance can be revoked when live location is disabled. */ fun select(channel: ChannelID) { - Log.d(TAG, "Selected channel: ${channel.displayName}") - // Use synchronous set to avoid race with background recomputation - _selectedChannel.value = channel - saveChannelSelection(channel) - - // Immediately recompute teleported status against the latest known location - lastLocation?.let { location -> - when (channel) { - is ChannelID.Mesh -> { - _teleported.value = false - } - is ChannelID.Location -> { - val currentGeohash = Geohash.encode( - latitude = location.latitude, - longitude = location.longitude, - precision = channel.channel.level.precision - ) - val isTeleportedNow = currentGeohash != channel.channel.geohash - _teleported.value = isTeleportedNow - } - } + when (channel) { + ChannelID.Mesh -> selectInternal(ChannelID.Mesh, source = null, teleported = false) + is ChannelID.Location -> selectManual(channel.channel) } } - - /** - * Set teleported status (for manual geohash teleportation) - */ - fun setTeleported(teleported: Boolean) { - _teleported.value = teleported + + fun selectNearby(channel: GeohashChannel): Boolean { + val isCurrentNearbyChannel = _availableChannels.value.contains(channel) + if (!isCurrentNearbyChannel || !isLocationServicesEnabled() || + syncPermissionState() != PermissionState.AUTHORIZED + ) { + Log.w(TAG, "Blocked nearby channel selection without live-location access") + return false + } + selectInternal( + ChannelID.Location(channel), + source = LocationSelectionSource.NEARBY, + teleported = false + ) + return true + } + + fun selectManual(channel: GeohashChannel, teleported: Boolean = true) { + selectInternal( + ChannelID.Location(channel), + source = LocationSelectionSource.MANUAL, + teleported = teleported || !LiveLocationPrivacyGate.isEnabled + ) } /** * Enable location services (user-controlled toggle) */ fun enableLocationServices() { - _locationServicesEnabled.value = true - saveLocationServicesState(true) + if (!LiveLocationPrivacyGate.isEnabled) { + LiveLocationPrivacyGate.update(true) + saveLocationServicesState(true) + } // If we have permission and system location is on, start location operations - if (_permissionState.value == PermissionState.AUTHORIZED && systemLocationEnabled.value) { + if (syncPermissionState() == PermissionState.AUTHORIZED && systemLocationEnabled.value) { requestOneShotLocation() } } @@ -253,20 +272,9 @@ class LocationChannelManager private constructor(private val context: Context) { * Disable location services (user-controlled toggle) */ fun disableLocationServices() { - _locationServicesEnabled.value = false + LiveLocationPrivacyGate.update(false) saveLocationServicesState(false) - - // Stop any ongoing location operations - endLiveRefresh() - - // Clear available channels when location is disabled - _availableChannels.value = emptyList() - _locationNames.value = emptyMap() - - // If user had a location channel selected, switch back to mesh - if (_selectedChannel.value is ChannelID.Location) { - select(ChannelID.Mesh) - } + clearLiveLocationState(invalidateAccess = false) } /** @@ -276,70 +284,163 @@ class LocationChannelManager private constructor(private val context: Context) { * Check if both the app toggle and system location are enabled */ fun isLocationServicesEnabled(): Boolean { - return _locationServicesEnabled.value && _systemLocationEnabled.value + return LiveLocationPrivacyGate.isEnabled && _systemLocationEnabled.value + } + + fun canUseSelectedLocationChannel(channel: GeohashChannel): Boolean { + if (_selectedChannel.value != ChannelID.Location(channel)) return false + return selectedLocationSource == LocationSelectionSource.MANUAL || + LiveLocationPrivacyGate.captureToken() != null + } + + fun isSelectedChannelLiveDerived(channel: GeohashChannel): Boolean = + _selectedChannel.value == ChannelID.Location(channel) && + selectedLocationSource == LocationSelectionSource.NEARBY + + fun liveLocationTokenForSelectedChannel(channel: GeohashChannel): Long? { + if (!isSelectedChannelLiveDerived(channel)) return null + return LiveLocationPrivacyGate.captureToken() + } + + private fun selectInternal( + channel: ChannelID, + source: LocationSelectionSource?, + teleported: Boolean + ) { + selectedLocationSource = source + _teleported.value = when (channel) { + ChannelID.Mesh -> false + is ChannelID.Location -> teleported + } + _selectedChannel.value = channel + saveChannelSelection(channel, source) + } + + /** + * Revokes all GPS-derived in-memory state and pending work. This deliberately does not + * change the persisted soft setting when Android's hard permission or system provider is + * temporarily unavailable. + */ + private fun clearLiveLocationState(invalidateAccess: Boolean = true) { + if (invalidateAccess) LiveLocationPrivacyGate.invalidate() + cancelLiveLocationWork() + _isLoadingLocation.value = false + NostrIdentityBridge.clearGeohashIdentityCache( + _availableChannels.value.map { it.geohash } + ) + _availableChannels.value = emptyList() + _locationNames.value = emptyMap() + + when { + _selectedChannel.value is ChannelID.Location && + selectedLocationSource == LocationSelectionSource.NEARBY -> { + selectInternal(ChannelID.Mesh, source = null, teleported = false) + } + _selectedChannel.value is ChannelID.Location -> { + // Manual channels remain usable for teleports, bookmarks, and DMs. Never use + // a previously retained GPS fix to classify them while live access is off. + selectedLocationSource = LocationSelectionSource.MANUAL + _teleported.value = true + saveChannelSelection(_selectedChannel.value, selectedLocationSource) + } + } + } + + private fun cancelLiveLocationWork() { + locationProvider.cancel() + activeLocationUpdateCallback = null + geocodingJob?.cancel() + geocodingJob = null } // MARK: - Location Operations private fun requestOneShotLocation() { - if (!checkAndSyncPermission()) { + if (!isLocationServicesEnabled() || + syncPermissionState() != PermissionState.AUTHORIZED + ) { Log.w(TAG, "No location permission for one-shot request") return } - // Set loading state initially + LiveLocationPrivacyGate.resumeAccess() + val token = LiveLocationPrivacyGate.captureToken() ?: return _isLoadingLocation.value = true - locationProvider.getLastKnownLocation { cached -> - // If we have a cached location and it's reasonably recent (e.g. < 5 mins), use it - // For now, we just use it if it exists, similar to previous logic - if (cached != null) { - onLocationUpdated(cached) - } else { - locationProvider.requestFreshLocation { fresh -> - if (fresh != null) { - onLocationUpdated(fresh) - } else { - Log.w(TAG, "Failed to get fresh location") - _isLoadingLocation.value = false + val started = LiveLocationPrivacyGate.runIfAllowed(token) { + locationProvider.getLastKnownLocation { cached -> + if (!canUseLiveLocation(token)) return@getLastKnownLocation + + if (cached != null) { + onLocationUpdated(cached, token) + } else { + LiveLocationPrivacyGate.runIfAllowed(token) { + locationProvider.requestFreshLocation { fresh -> + if (!canUseLiveLocation(token)) return@requestFreshLocation + + if (fresh != null) { + onLocationUpdated(fresh, token) + } else { + Log.w(TAG, "Failed to get fresh location") + _isLoadingLocation.value = false + } + } } } } } + if (!started) _isLoadingLocation.value = false } - private fun onLocationUpdated(location: Location) { - lastLocation = location - _isLoadingLocation.value = false - computeChannels(location) - reverseGeocodeIfNeeded(location) + private fun onLocationUpdated(location: Location, token: Long) { + LiveLocationPrivacyGate.runIfAllowed(token) { + if (!_systemLocationEnabled.value || !hasRuntimeLocationPermission()) return@runIfAllowed + _isLoadingLocation.value = false + computeChannels(location, token) + reverseGeocodeIfNeeded(location, token) + } } // MARK: - Helpers - private fun getCurrentPermissionStatus(): PermissionState { - return if (checkAndSyncPermission()) { + private fun hasRuntimeLocationPermission(): Boolean { + return ActivityCompat.checkSelfPermission( + context, + Manifest.permission.ACCESS_FINE_LOCATION + ) == PackageManager.PERMISSION_GRANTED || + ActivityCompat.checkSelfPermission( + context, + Manifest.permission.ACCESS_COARSE_LOCATION + ) == PackageManager.PERMISSION_GRANTED + } + + fun syncPermissionState(): PermissionState { + val newState = if (hasRuntimeLocationPermission()) { PermissionState.AUTHORIZED } else { PermissionState.DENIED } - } - - private fun checkAndSyncPermission(): Boolean { - val hasPermission = ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED || - ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION) == PackageManager.PERMISSION_GRANTED - - val newState = if (hasPermission) PermissionState.AUTHORIZED else PermissionState.DENIED if (_permissionState.value != newState) { _permissionState.value = newState } - return hasPermission + if (newState == PermissionState.DENIED) { + clearLiveLocationState() + } + return newState } - private fun computeChannels(location: Location) { + private fun canUseLiveLocation(token: Long): Boolean { + return LiveLocationPrivacyGate.accepts(token) && + _systemLocationEnabled.value && + hasRuntimeLocationPermission() + } + + private fun computeChannels(location: Location, token: Long) { + if (!canUseLiveLocation(token)) return + val levels = GeohashChannelLevel.allCases() val result = mutableListOf() @@ -351,47 +452,55 @@ class LocationChannelManager private constructor(private val context: Context) { ) result.add(GeohashChannel(level = level, geohash = geohash)) } - + + if (!canUseLiveLocation(token)) return _availableChannels.value = result - // Recompute teleported status based on current location vs selected channel val selectedChannelValue = _selectedChannel.value - when (selectedChannelValue) { - is ChannelID.Mesh -> { - _teleported.value = false - } - is ChannelID.Location -> { - val currentGeohash = Geohash.encode( - latitude = location.latitude, - longitude = location.longitude, - precision = selectedChannelValue.channel.level.precision - ) - val isTeleported = currentGeohash != selectedChannelValue.channel.geohash - _teleported.value = isTeleported - } + if (selectedChannelValue is ChannelID.Location && + selectedLocationSource == LocationSelectionSource.NEARBY + ) { + val currentGeohash = Geohash.encode( + latitude = location.latitude, + longitude = location.longitude, + precision = selectedChannelValue.channel.level.precision + ) + _teleported.value = currentGeohash != selectedChannelValue.channel.geohash + } else if (selectedChannelValue is ChannelID.Mesh) { + _teleported.value = false } } - private fun reverseGeocodeIfNeeded(location: Location) { - // Cancel any pending geocoding job to avoid race conditions + private fun reverseGeocodeIfNeeded(location: Location, token: Long) { + if (!canUseLiveLocation(token)) return geocodingJob?.cancel() geocodingJob = scope.launch(Dispatchers.IO) { try { - val addresses = geocoderProvider.getFromLocation(location.latitude, location.longitude, 1) + if (!canUseLiveLocation(token)) return@launch + val addresses = geocoderProvider.getFromLocation( + location.latitude, + location.longitude, + 1, + liveLocationToken = token + ) - if (!isActive) return@launch + if (!isActive || !canUseLiveLocation(token)) return@launch if (addresses.isNotEmpty()) { val address = addresses[0] val names = namesByLevel(address) - _locationNames.value = names + LiveLocationPrivacyGate.runIfAllowed(token) { + if (_systemLocationEnabled.value && hasRuntimeLocationPermission()) { + _locationNames.value = names + } + } } else { Log.w(TAG, "No reverse geocoding results") } } catch (e: Exception) { if (e !is CancellationException) { - Log.e(TAG, "Reverse geocoding failed: ${e.message}") + Log.e(TAG, "Reverse geocoding failed") } } } @@ -445,7 +554,10 @@ class LocationChannelManager private constructor(private val context: Context) { /** * Save current channel selection to persistent storage */ - private fun saveChannelSelection(channel: ChannelID) { + private fun saveChannelSelection( + channel: ChannelID, + source: LocationSelectionSource? + ) { try { val channelData = when (channel) { is ChannelID.Mesh -> gson.toJson(PersistedChannel(mesh = true)) @@ -453,13 +565,14 @@ class LocationChannelManager private constructor(private val context: Context) { PersistedChannel( mesh = false, level = channel.channel.level.name, - geohash = channel.channel.geohash + geohash = channel.channel.geohash, + source = source?.name ) ) } dataManager?.saveLastGeohashChannel(channelData) } catch (e: Exception) { - Log.e(TAG, "Failed to save channel selection: ${e.message}") + Log.e(TAG, "Failed to save channel selection") } } @@ -472,27 +585,44 @@ class LocationChannelManager private constructor(private val context: Context) { if (!channelData.isNullOrBlank()) { val persisted = gson.fromJson(channelData, PersistedChannel::class.java) val channel = persisted?.toChannel() - if (channel != null) { + val source = persisted?.selectionSource() + val canRestore = channel !is ChannelID.Location || + source == LocationSelectionSource.MANUAL || + (LiveLocationPrivacyGate.isEnabled && + _systemLocationEnabled.value && + _permissionState.value == PermissionState.AUTHORIZED) + + if (channel != null && canRestore) { _selectedChannel.value = channel + selectedLocationSource = if (channel is ChannelID.Location) source else null + _teleported.value = channel is ChannelID.Location && + source == LocationSelectionSource.MANUAL } else { _selectedChannel.value = ChannelID.Mesh + selectedLocationSource = null + _teleported.value = false + saveChannelSelection(ChannelID.Mesh, source = null) } } else { _selectedChannel.value = ChannelID.Mesh + selectedLocationSource = null } } catch (e: JsonSyntaxException) { - Log.e(TAG, "Failed to parse persisted channel data: ${e.message}") + Log.e(TAG, "Failed to parse persisted channel data") _selectedChannel.value = ChannelID.Mesh + selectedLocationSource = null } catch (e: Exception) { - Log.e(TAG, "Failed to load persisted channel: ${e.message}") + Log.e(TAG, "Failed to load persisted channel") _selectedChannel.value = ChannelID.Mesh + selectedLocationSource = null } } data class PersistedChannel( val mesh: Boolean, val level: String? = null, - val geohash: String? = null + val geohash: String? = null, + val source: String? = null ) { fun toChannel(): ChannelID? { return if (mesh) { @@ -503,6 +633,13 @@ class LocationChannelManager private constructor(private val context: Context) { ChannelID.Location.fromPersisted(levelName, gh) } } + + fun selectionSource(): LocationSelectionSource? { + if (mesh) return null + return source?.let { + runCatching { LocationSelectionSource.valueOf(it) }.getOrNull() + } ?: LocationSelectionSource.NEARBY + } } /** @@ -511,6 +648,7 @@ class LocationChannelManager private constructor(private val context: Context) { fun clearPersistedChannel() { dataManager?.clearLastGeohashChannel() _selectedChannel.value = ChannelID.Mesh + selectedLocationSource = null _teleported.value = false } @@ -523,7 +661,7 @@ class LocationChannelManager private constructor(private val context: Context) { try { dataManager?.saveLocationServicesEnabled(enabled) } catch (e: Exception) { - Log.e(TAG, "Failed to save location services state: ${e.message}") + Log.e(TAG, "Failed to save location services state") } } @@ -533,10 +671,10 @@ class LocationChannelManager private constructor(private val context: Context) { private fun loadLocationServicesState() { try { val enabled = dataManager?.isLocationServicesEnabled() ?: false - _locationServicesEnabled.value = enabled + LiveLocationPrivacyGate.update(enabled) } catch (e: Exception) { - Log.e(TAG, "Failed to load location services state: ${e.message}") - _locationServicesEnabled.value = false + Log.e(TAG, "Failed to load location services state") + LiveLocationPrivacyGate.update(false) } } diff --git a/app/src/main/java/com/bitchat/android/geohash/LocationProvider.kt b/app/src/main/java/com/bitchat/android/geohash/LocationProvider.kt index 0ead523d..f46837bd 100644 --- a/app/src/main/java/com/bitchat/android/geohash/LocationProvider.kt +++ b/app/src/main/java/com/bitchat/android/geohash/LocationProvider.kt @@ -6,7 +6,7 @@ import android.location.Location * Abstraction for location providers to support both * System (LocationManager) and Google Play Services (FusedLocationProvider). */ -interface LocationProvider { +internal interface LocationProvider { /** * Get the last known location from cache. * @param callback Called with the location or null if not found/error. diff --git a/app/src/main/java/com/bitchat/android/geohash/OpenStreetMapGeocoderProvider.kt b/app/src/main/java/com/bitchat/android/geohash/OpenStreetMapGeocoderProvider.kt index 587d2970..11be053e 100644 --- a/app/src/main/java/com/bitchat/android/geohash/OpenStreetMapGeocoderProvider.kt +++ b/app/src/main/java/com/bitchat/android/geohash/OpenStreetMapGeocoderProvider.kt @@ -4,53 +4,79 @@ import android.location.Address import android.util.Log import com.bitchat.android.net.OkHttpProvider import com.google.gson.Gson +import java.io.IOException +import kotlinx.coroutines.suspendCancellableCoroutine +import okhttp3.Call +import okhttp3.Callback import okhttp3.Request +import okhttp3.Response import java.util.Locale -import kotlinx.coroutines.Dispatchers -import kotlinx.coroutines.withContext +import kotlin.coroutines.resume class OpenStreetMapGeocoderProvider : GeocoderProvider { private val TAG = "OSMGeocoderProvider" private val gson = Gson() private val userAgent = "Bitchat-Android/1.0" - override suspend fun getFromLocation(latitude: Double, longitude: Double, maxResults: Int): List
{ - return withContext(Dispatchers.IO) { + override suspend fun getFromLocation( + latitude: Double, + longitude: Double, + maxResults: Int, + liveLocationToken: Long? + ): List
{ + return suspendCancellableCoroutine { continuation -> val lang = Locale.getDefault().toLanguageTag() - // Using format=jsonv2 for structured address breakdown val url = "https://nominatim.openstreetmap.org/reverse?format=jsonv2&lat=$latitude&lon=$longitude&zoom=18&addressdetails=1&accept-language=$lang" + val request = Request.Builder() + .url(url) + .header("User-Agent", userAgent) + .build() + val call = OkHttpProvider.httpClient().newCall(request) - try { - val request = Request.Builder() - .url(url) - .header("User-Agent", userAgent) - .build() - - val response = OkHttpProvider.httpClient().newCall(request).execute() - if (!response.isSuccessful) { - Log.e(TAG, "OSM Request failed: ${response.code}") - response.close() - return@withContext emptyList
() + continuation.invokeOnCancellation { call.cancel() } + val enqueueRequest = { + call.enqueue(object : Callback { + override fun onFailure(call: Call, e: IOException) { + if (continuation.isActive) { + Log.w(TAG, "OSM geocoding request failed") + continuation.resume(emptyList()) + } } - val body = response.body?.string() - response.close() + override fun onResponse(call: Call, response: Response) { + val addresses = response.use { + if (!it.isSuccessful) { + Log.w(TAG, "OSM geocoding request returned ${it.code}") + return@use emptyList() + } - if (body.isNullOrEmpty()) return@withContext emptyList
() + val body = it.body?.string() + if (body.isNullOrEmpty()) return@use emptyList() - try { - val osmResponse = gson.fromJson(body, OsmResponse::class.java) - if (osmResponse?.address == null) return@withContext emptyList
() - - val address = mapToAddress(osmResponse, latitude, longitude) - listOf(address) - } catch (e: Exception) { - Log.e(TAG, "OSM Parse failed: ${e.message}") - emptyList
() + runCatching { + val osmResponse = gson.fromJson(body, OsmResponse::class.java) + if (osmResponse?.address == null) emptyList() + else listOf(mapToAddress(osmResponse, latitude, longitude)) + }.getOrElse { + Log.w(TAG, "OSM geocoding response could not be parsed") + emptyList() + } + } + if (continuation.isActive) continuation.resume(addresses) } - } catch (e: Exception) { - Log.e(TAG, "OSM Geocoding failed", e) - emptyList
() + }) + } + val started = if (liveLocationToken == null) { + enqueueRequest() + true + } else { + LiveLocationPrivacyGate.runIfAllowed( + liveLocationToken, + enqueueRequest + ) + } + if (!started && continuation.isActive) { + continuation.resume(emptyList()) } } } diff --git a/app/src/main/java/com/bitchat/android/geohash/SystemLocationProvider.kt b/app/src/main/java/com/bitchat/android/geohash/SystemLocationProvider.kt index 61c9d267..80bbbe4a 100644 --- a/app/src/main/java/com/bitchat/android/geohash/SystemLocationProvider.kt +++ b/app/src/main/java/com/bitchat/android/geohash/SystemLocationProvider.kt @@ -9,10 +9,11 @@ import android.location.LocationListener import android.location.LocationManager import android.os.Build import android.os.Bundle +import android.os.CancellationSignal import android.util.Log import androidx.core.app.ActivityCompat -class SystemLocationProvider(private val context: Context) : LocationProvider { +internal class SystemLocationProvider(private val context: Context) : LocationProvider { companion object { private const val TAG = "SystemLocationProvider" @@ -25,10 +26,13 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { private val activeListeners = mutableMapOf<(Location) -> Unit, LocationListener>() private val activeOneShotListeners = mutableMapOf<(Location?) -> Unit, LocationListener>() private val activeOneShotRunnables = mutableMapOf<(Location?) -> Unit, Runnable>() + private val activeOneShotCancellationSignals = mutableMapOf<(Location?) -> Unit, CancellationSignal>() private fun hasLocationPermission(): Boolean { - return ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED || + return LiveLocationPrivacyGate.isEnabled && + (ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED || ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION) == PackageManager.PERMISSION_GRANTED + ) } @SuppressLint("MissingPermission") @@ -49,9 +53,9 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { } } } - callback(bestLocation) + callback(bestLocation.takeIf { LiveLocationPrivacyGate.isEnabled }) } catch (e: Exception) { - Log.e(TAG, "Error getting last known location: ${e.message}") + Log.e(TAG, "Error getting last-known location") callback(null) } } @@ -76,12 +80,27 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { Log.d(TAG, "Requesting fresh location from $provider") if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) { - locationManager.getCurrentLocation( - provider, - null, - context.mainExecutor - ) { location -> - callback(location) + val cancellationSignal = CancellationSignal() + synchronized(activeOneShotCancellationSignals) { + activeOneShotCancellationSignals[callback] = cancellationSignal + } + try { + locationManager.getCurrentLocation( + provider, + cancellationSignal, + context.mainExecutor + ) { location -> + synchronized(activeOneShotCancellationSignals) { + activeOneShotCancellationSignals.remove(callback) + } + callback(location.takeIf { LiveLocationPrivacyGate.isEnabled }) + } + } catch (e: Exception) { + synchronized(activeOneShotCancellationSignals) { + activeOneShotCancellationSignals.remove(callback) + } + cancellationSignal.cancel() + throw e } } else { // For older versions, use requestSingleUpdate with timeout mechanism @@ -94,7 +113,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { try { locationManager.removeUpdates(listener) } catch (e: Exception) { - Log.e(TAG, "Error removing timed out listener: ${e.message}") + Log.e(TAG, "Error removing timed-out listener") } } } @@ -113,9 +132,9 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { try { locationManager.removeUpdates(this) } catch (e: Exception) { - Log.e(TAG, "Error removing updates in callback: ${e.message}") + Log.e(TAG, "Error removing updates in callback") } - callback(location) + callback(location.takeIf { LiveLocationPrivacyGate.isEnabled }) } override fun onStatusChanged(provider: String?, status: Int, extras: Bundle?) {} override fun onProviderEnabled(provider: String) {} @@ -140,7 +159,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { callback(null) } } catch (e: Exception) { - Log.e(TAG, "Error requesting fresh location: ${e.message}") + Log.e(TAG, "Error requesting fresh location") callback(null) } } @@ -156,7 +175,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { try { val listener = object : LocationListener { override fun onLocationChanged(location: Location) { - callback(location) + if (LiveLocationPrivacyGate.isEnabled) callback(location) } override fun onStatusChanged(provider: String?, status: Int, extras: Bundle?) {} override fun onProviderEnabled(provider: String) {} @@ -189,7 +208,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { } } catch (e: Exception) { - Log.e(TAG, "Error requesting location updates: ${e.message}") + Log.e(TAG, "Error requesting location updates") } } @@ -204,7 +223,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { Log.d(TAG, "Removed location updates") } } catch (e: Exception) { - Log.e(TAG, "Error removing updates: ${e.message}") + Log.e(TAG, "Error removing updates") } } @@ -230,9 +249,13 @@ class SystemLocationProvider(private val context: Context) : LocationProvider { } activeOneShotRunnables.clear() } + synchronized(activeOneShotCancellationSignals) { + activeOneShotCancellationSignals.values.forEach { it.cancel() } + activeOneShotCancellationSignals.clear() + } Log.d(TAG, "Cancelled all system location requests") } catch (e: Exception) { - Log.e(TAG, "Error cancelling system provider: ${e.message}") + Log.e(TAG, "Error cancelling system provider") } } } diff --git a/app/src/main/java/com/bitchat/android/model/BitchatMessage.kt b/app/src/main/java/com/bitchat/android/model/BitchatMessage.kt index 8e1731b1..528a269e 100644 --- a/app/src/main/java/com/bitchat/android/model/BitchatMessage.kt +++ b/app/src/main/java/com/bitchat/android/model/BitchatMessage.kt @@ -69,7 +69,15 @@ data class BitchatMessage( val encryptedContent: ByteArray? = null, val isEncrypted: Boolean = false, val deliveryStatus: DeliveryStatus? = null, - val powDifficulty: Int? = null + val powDifficulty: Int? = null, + /** + * Full canonical Nostr public key supplied by the local Nostr bridge. + * + * This is local identity metadata, not part of the Bitchat binary wire format. It lets UI + * surfaces color the sender by the same stable key while [senderPeerID] remains available for + * mesh IDs and private-chat routing aliases. + */ + val senderNostrPubkey: String? = null ) : Parcelable { /** @@ -355,4 +363,3 @@ data class BitchatMessage( } } - diff --git a/app/src/main/java/com/bitchat/android/nostr/GeohashMessageHandler.kt b/app/src/main/java/com/bitchat/android/nostr/GeohashMessageHandler.kt index 1c4896f3..1fc802d9 100644 --- a/app/src/main/java/com/bitchat/android/nostr/GeohashMessageHandler.kt +++ b/app/src/main/java/com/bitchat/android/nostr/GeohashMessageHandler.kt @@ -96,6 +96,7 @@ class GeohashMessageHandler( isRelay = false, originalSender = repo.displayNameForNostrPubkey(pubkey), senderPeerID = "nostr:${pubkey.take(8)}", + senderNostrPubkey = pubkey, mentions = null, channel = "#$subscribedGeohash", powDifficulty = try { diff --git a/app/src/main/java/com/bitchat/android/nostr/LocationNotesInitializer.kt b/app/src/main/java/com/bitchat/android/nostr/LocationNotesInitializer.kt index bed29902..d725f3e1 100644 --- a/app/src/main/java/com/bitchat/android/nostr/LocationNotesInitializer.kt +++ b/app/src/main/java/com/bitchat/android/nostr/LocationNotesInitializer.kt @@ -28,25 +28,33 @@ object LocationNotesInitializer { return@initialize id // Return subscription ID even on error } - Log.d(TAG, "📍 Location Notes subscribing to geohash: $geohashFromFilter") - + val token = com.bitchat.android.geohash.LiveLocationPrivacyGate + .captureToken() ?: return@initialize id NostrRelayManager.getInstance(context).subscribeForGeohash( geohash = geohashFromFilter, filter = filter, id = id, handler = handler, includeDefaults = true, - nRelays = 5 + nRelays = 5, + liveLocationToken = token ) }, unsubscribe = { id -> NostrRelayManager.getInstance(context).unsubscribe(id) }, - sendEvent = { event, relayUrls -> + sendEvent = { event, relayUrls, token -> if (relayUrls != null) { - NostrRelayManager.getInstance(context).sendEvent(event, relayUrls) + NostrRelayManager.getInstance(context).sendEvent( + event, + relayUrls, + liveLocationToken = token + ) } else { - NostrRelayManager.getInstance(context).sendEvent(event) + NostrRelayManager.getInstance(context).sendEvent( + event, + liveLocationToken = token + ) } }, deriveIdentity = { geohash -> diff --git a/app/src/main/java/com/bitchat/android/nostr/LocationNotesManager.kt b/app/src/main/java/com/bitchat/android/nostr/LocationNotesManager.kt index 2fa962ef..a6927d71 100644 --- a/app/src/main/java/com/bitchat/android/nostr/LocationNotesManager.kt +++ b/app/src/main/java/com/bitchat/android/nostr/LocationNotesManager.kt @@ -2,10 +2,12 @@ package com.bitchat.android.nostr import android.util.Log import androidx.annotation.MainThread +import com.bitchat.android.geohash.LiveLocationPrivacyGate import kotlinx.coroutines.* import kotlinx.coroutines.flow.MutableStateFlow import kotlinx.coroutines.flow.StateFlow import kotlinx.coroutines.flow.asStateFlow +import java.util.UUID /** * Manages location notes (kind=1 text notes with geohash tags) @@ -89,13 +91,18 @@ class LocationNotesManager private constructor() { private var relayLookup: (() -> NostrRelayManager)? = null private var subscribeFunc: ((NostrFilter, String, (NostrEvent) -> Unit) -> String)? = null private var unsubscribeFunc: ((String) -> Unit)? = null - private var sendEventFunc: ((NostrEvent, List?) -> Unit)? = null + private var sendEventFunc: ((NostrEvent, List?, Long) -> Unit)? = null private var deriveIdentityFunc: ((String) -> NostrIdentity)? = null // Coroutine scope for background operations private val scope = CoroutineScope(Dispatchers.Main + SupervisorJob()) + private var liveLocationToken: Long? = null private var subscribeRetryJob: Job? = null private var initialLoadJob: Job? = null + + init { + LiveLocationPrivacyGate.addRevocationListener(::stop) + } /** * Initialize dependencies @@ -104,7 +111,7 @@ class LocationNotesManager private constructor() { relayManager: () -> NostrRelayManager, subscribe: (NostrFilter, String, (NostrEvent) -> Unit) -> String, unsubscribe: (String) -> Unit, - sendEvent: (NostrEvent, List?) -> Unit, + sendEvent: (NostrEvent, List?, Long) -> Unit, deriveIdentity: (String) -> NostrIdentity ) { this.relayLookup = relayManager @@ -119,23 +126,28 @@ class LocationNotesManager private constructor() { * iOS: Validates building-level precision (8 characters) */ fun setGeohash(newGeohash: String) { + val token = LiveLocationPrivacyGate.captureToken() ?: run { + stop() + return + } val normalized = newGeohash.lowercase() - if (_geohash.value == normalized) { - Log.d(TAG, "Geohash unchanged, skipping: $normalized") + if (_geohash.value == normalized && + liveLocationToken?.let(LiveLocationPrivacyGate::accepts) == true + ) { return } // Validate geohash (building-level precision: 8 chars) - matches iOS if (!isValidBuildingGeohash(normalized)) { - Log.w(TAG, "LocationNotesManager: rejecting invalid geohash '$normalized' (expected 8 valid base32 chars)") + Log.w(TAG, "LocationNotesManager rejected an invalid building geohash") return } - - Log.d(TAG, "Setting geohash: $normalized") - + // Cancel existing subscription cancel() + if (!LiveLocationPrivacyGate.accepts(token)) return + liveLocationToken = token // Set loading state before clearing to prevent empty state flicker (iOS pattern) _state.value = State.LOADING @@ -154,7 +166,7 @@ class LocationNotesManager private constructor() { subscribedGeohashes = (neighbors + normalized).toSet() // Start new subscriptions for all cells - subscribeAll() + subscribeAll(token) } /** @@ -170,16 +182,20 @@ class LocationNotesManager private constructor() { * Refresh notes for current geohash */ fun refresh() { + val token = LiveLocationPrivacyGate.captureToken() ?: run { + stop() + return + } val currentGeohash = _geohash.value if (currentGeohash == null) { Log.w(TAG, "Cannot refresh - no geohash set") return } - Log.d(TAG, "Refreshing notes for geohash: $currentGeohash") - // Cancel and restart subscriptions for current ±1 set cancel() + if (!LiveLocationPrivacyGate.accepts(token)) return + liveLocationToken = token _notes.value = emptyList() noteIDs.clear() _initialLoadComplete.value = false @@ -188,13 +204,17 @@ class LocationNotesManager private constructor() { com.bitchat.android.geohash.Geohash.neighborsSamePrecision(currentGeohash) } catch (_: Exception) { emptySet() } subscribedGeohashes = (neighbors + currentGeohash).toSet() - subscribeAll() + subscribeAll(token) } /** * Send a new location note */ fun send(content: String, nickname: String?) { + val token = LiveLocationPrivacyGate.captureToken() ?: run { + stop() + return + } val currentGeohash = _geohash.value if (currentGeohash == null) { Log.w(TAG, "Cannot send note - no geohash set") @@ -209,16 +229,22 @@ class LocationNotesManager private constructor() { // CRITICAL FIX: Get geo-specific relays for sending (matching iOS pattern) // iOS: let relays = dependencies.relayLookup(geohash, TransportConfig.nostrGeoRelayCount) - val relays = try { - com.bitchat.android.nostr.RelayDirectory.closestRelaysForGeohash(currentGeohash, 5) + var relays: List = emptyList() + try { + LiveLocationPrivacyGate.runIfAllowed(token) { + relays = RelayDirectory.closestRelaysForGeohash(currentGeohash, 5) + } } catch (e: Exception) { - Log.e(TAG, "Failed to lookup relays for geohash $currentGeohash: ${e.message}") - emptyList() + Log.e(TAG, "Failed to look up location-note relays") + } + if (!LiveLocationPrivacyGate.accepts(token)) { + stop() + return } // Check if we have relays (iOS pattern: guard !relays.isEmpty()) if (relays.isEmpty()) { - Log.w(TAG, "Send blocked - no geo relays for geohash: $currentGeohash") + Log.w(TAG, "Location-note send blocked because no relays are available") _state.value = State.NO_RELAYS _errorMessage.value = "No relays available" return @@ -231,34 +257,40 @@ class LocationNotesManager private constructor() { return } - Log.d(TAG, "Sending note to geohash: $currentGeohash via ${relays.size} geo relays") - scope.launch { try { - val identity = withContext(Dispatchers.IO) { - deriveIdentity(currentGeohash) + var identity: NostrIdentity? = null + val identityPrepared = withContext(Dispatchers.IO) { + LiveLocationPrivacyGate.runIfAllowed(token) { + identity = deriveIdentity(currentGeohash) + } } - - val event = withContext(Dispatchers.IO) { + val preparedIdentity = identity + if (!identityPrepared || preparedIdentity == null || + !LiveLocationPrivacyGate.accepts(token) + ) return@launch + + val preparedEvent = withContext(Dispatchers.IO) { NostrProtocol.createGeohashTextNote( - content = trimmed, - geohash = currentGeohash, - senderIdentity = identity, - nickname = nickname - ) + content = trimmed, + geohash = currentGeohash, + senderIdentity = preparedIdentity, + nickname = nickname + ) } - + if (!LiveLocationPrivacyGate.accepts(token)) return@launch + // Optimistic local echo - add note immediately to UI val localNote = Note( - id = event.id, - pubkey = event.pubkey, + id = preparedEvent.id, + pubkey = preparedEvent.pubkey, content = trimmed, - createdAt = event.createdAt, + createdAt = preparedEvent.createdAt, nickname = nickname ) - if (!noteIDs.contains(event.id)) { - noteIDs.add(event.id) + if (!noteIDs.contains(preparedEvent.id)) { + noteIDs.add(preparedEvent.id) val currentNotes = _notes.value ?: emptyList() _notes.value = (currentNotes + localNote).sortedByDescending { it.createdAt } @@ -270,11 +302,12 @@ class LocationNotesManager private constructor() { // CRITICAL FIX: Send to geo-specific relays (matching iOS pattern) // iOS: dependencies.sendEvent(event, relays) - withContext(Dispatchers.IO) { - sendEventFunc?.invoke(event, relays) + val sent = withContext(Dispatchers.IO) { + LiveLocationPrivacyGate.runIfAllowed(token) { + sendEventFunc?.invoke(preparedEvent, relays, token) + } } - - Log.d(TAG, "✅ Note sent successfully to ${relays.size} geo relays: ${event.id.take(16)}...") + if (!sent) return@launch // Clear any error messages on successful send _errorMessage.value = null @@ -290,12 +323,16 @@ class LocationNotesManager private constructor() { /** * Subscribe to location notes for current geohash */ - private fun subscribeAll() { + private fun subscribeAll(token: Long) { subscribeRetryJob?.cancel() subscribeRetryJob = null initialLoadJob?.cancel() initialLoadJob = null + if (!LiveLocationPrivacyGate.accepts(token)) { + stop() + return + } val currentGeohash = _geohash.value if (currentGeohash == null) { Log.w(TAG, "Cannot subscribe - no geohash set") @@ -310,17 +347,20 @@ class LocationNotesManager private constructor() { // Retry a few times in case initialization is racing the sheet open subscribeRetryJob = scope.launch { var attempts = 0 - while (attempts < 10 && subscribeFunc == null) { + while (attempts < 10 && + subscribeFunc == null && + LiveLocationPrivacyGate.accepts(token) + ) { delay(300) attempts++ } val subNow = subscribeFunc - if (subNow != null) { + if (subNow != null && LiveLocationPrivacyGate.accepts(token)) { // Try again now that dependencies are ready - subscribeAll() + subscribeAll(token) } else { // Give UI a chance to show empty state rather than spinner forever - if (!_initialLoadComplete.value!!) { + if (!_initialLoadComplete.value) { _initialLoadComplete.value = true _state.value = State.READY } @@ -333,28 +373,33 @@ class LocationNotesManager private constructor() { // Subscribe for each geohash in the ±1 set subscribedGeohashes.forEach { gh -> + if (!LiveLocationPrivacyGate.accepts(token)) return val filter = NostrFilter.geohashNotes( geohash = gh, since = null, limit = 200 ) - val subId = "location-notes-$gh" - Log.d(TAG, "📡 Subscribing to location notes: $subId") + val subId = "location-notes-${UUID.randomUUID()}" try { - val id = subscribe(filter, subId) { event -> handleEvent(event) } - subscriptionIDs[gh] = id + var id: String? = null + LiveLocationPrivacyGate.runIfAllowed(token) { + id = subscribe(filter, subId) { event -> handleEvent(event) } + } + id?.let { subscriptionIDs[gh] = it } } catch (e: Exception) { - Log.e(TAG, "Failed to subscribe for $gh: ${e.message}") + Log.e(TAG, "Failed to subscribe to location notes") } } // Mark initial load complete after brief delay to allow relay responses initialLoadJob = scope.launch { delay(2000) // Wait 2 seconds for initial batch - if (_geohash.value == currentGeohash && !_initialLoadComplete.value) { + if (_geohash.value == currentGeohash && + LiveLocationPrivacyGate.accepts(token) && + !_initialLoadComplete.value + ) { _initialLoadComplete.value = true _state.value = State.READY - Log.d(TAG, "Initial load complete for geohash: $currentGeohash (${noteIDs.size} notes)") } } } @@ -363,6 +408,9 @@ class LocationNotesManager private constructor() { * Handle incoming event from subscription */ private fun handleEvent(event: NostrEvent) { + val token = liveLocationToken + if (token == null || !LiveLocationPrivacyGate.accepts(token)) return + // Validate event if (event.kind != NostrKind.TEXT_NOTE) { Log.v(TAG, "Ignoring non-text-note event: kind=${event.kind}") @@ -379,7 +427,6 @@ class LocationNotesManager private constructor() { // Check if matches current geohash val eventGeohash = geohashTag[1] if (!subscribedGeohashes.contains(eventGeohash)) { - Log.v(TAG, "Ignoring event for non-subscribed geohash: $eventGeohash") return } @@ -406,8 +453,6 @@ class LocationNotesManager private constructor() { val currentNotes = _notes.value ?: emptyList() _notes.value = (currentNotes + note).sortedByDescending { it.createdAt } - Log.d(TAG, "Added note from ${note.displayName}") - // Trim if exceeds max if (noteIDs.size > MAX_NOTES_IN_MEMORY) { trimOldestNotes() @@ -456,7 +501,6 @@ class LocationNotesManager private constructor() { if (subscriptionIDs.isNotEmpty()) { subscriptionIDs.values.forEach { subId -> try { - Log.d(TAG, "🚫 Canceling subscription: $subId") unsubscribeFunc?.invoke(subId) } catch (_: Exception) { } } @@ -473,9 +517,10 @@ class LocationNotesManager private constructor() { */ fun stop() { cancel() + liveLocationToken = null + _geohash.value = null _notes.value = emptyList() noteIDs.clear() - _geohash.value = null _initialLoadComplete.value = false _errorMessage.value = null } diff --git a/app/src/main/java/com/bitchat/android/nostr/NostrBackgroundRuntime.kt b/app/src/main/java/com/bitchat/android/nostr/NostrBackgroundRuntime.kt index 8abb4d6a..9e3bf785 100644 --- a/app/src/main/java/com/bitchat/android/nostr/NostrBackgroundRuntime.kt +++ b/app/src/main/java/com/bitchat/android/nostr/NostrBackgroundRuntime.kt @@ -3,8 +3,11 @@ package com.bitchat.android.nostr import android.app.Application import android.util.Log import com.bitchat.android.geohash.ChannelID +import com.bitchat.android.geohash.GeohashNostrPrivacyPolicy +import com.bitchat.android.geohash.LiveLocationPrivacyGate import com.bitchat.android.geohash.LocationChannelManager import com.bitchat.android.mesh.PowerManager +import kotlinx.coroutines.CancellationException import kotlinx.coroutines.CoroutineScope import kotlinx.coroutines.Dispatchers import kotlinx.coroutines.SupervisorJob @@ -44,6 +47,7 @@ object NostrBackgroundRuntime { @Volatile private var handlers: Handlers? = null @Volatile private var initialized = false @Volatile private var activeGeohash: String? = null + @Volatile private var activeGeohashLiveToken: Long? = null @Volatile private var conversationGeohash: String? = null private lateinit var application: Application private lateinit var subscriptions: NostrSubscriptionManager @@ -83,7 +87,9 @@ object NostrBackgroundRuntime { // Let CLOSE frames be queued before replacing the deterministic IDs. delay(100) subscribeAccountDm() - activeGeohash?.let(::subscribeSelectedGeohash) + activeGeohash?.let { geohash -> + subscribeSelectedGeohash(geohash, activeGeohashLiveToken) + } } } @@ -91,7 +97,11 @@ object NostrBackgroundRuntime { if (!initialized || geohash == activeGeohash || geohash == conversationGeohash) return conversationGeohash?.let { subscriptions.unsubscribe("geo-dm-conversation-$it") } conversationGeohash = geohash - subscribeGeohashDm(geohash, "geo-dm-conversation-$geohash") + subscribeGeohashDm( + geohash = geohash, + subscriptionId = "geo-dm-conversation-$geohash", + liveLocationToken = null + ) } private fun subscribeAccountDm() { @@ -110,42 +120,67 @@ object NostrBackgroundRuntime { scope.launch { locationChannels.selectedChannel.collectLatest { channel -> val next = (channel as? ChannelID.Location)?.channel?.geohash + val nextToken = (channel as? ChannelID.Location)?.let { + locationChannels.liveLocationTokenForSelectedChannel(it.channel) + } val previous = activeGeohash - if (previous == next) return@collectLatest + if (previous == next && activeGeohashLiveToken == nextToken) { + return@collectLatest + } previous?.let { subscriptions.unsubscribe("geohash-$it") subscriptions.unsubscribe("geo-dm-$it") } activeGeohash = next + activeGeohashLiveToken = nextToken if (conversationGeohash == next) { subscriptions.unsubscribe("geo-dm-conversation-$next") conversationGeohash = null } - next?.let(::subscribeSelectedGeohash) + next?.let { geohash -> + val isLiveDerived = (channel as? ChannelID.Location)?.let { + locationChannels.isSelectedChannelLiveDerived(it.channel) + } == true + if (!isLiveDerived || nextToken != null) { + subscribeSelectedGeohash(geohash, nextToken) + } + } } } } - private fun subscribeSelectedGeohash(geohash: String) { + private fun subscribeSelectedGeohash( + geohash: String, + liveLocationToken: Long? + ) { subscriptions.subscribeGeohashMessages( geohash = geohash, sinceMs = System.currentTimeMillis() - 3_600_000L, limit = 200, id = "geohash-$geohash", - handler = { event -> dispatch { it.geohashMessage(event, geohash) } } + handler = { event -> dispatch { it.geohashMessage(event, geohash) } }, + liveLocationToken = liveLocationToken ) - subscribeGeohashDm(geohash, "geo-dm-$geohash") + subscribeGeohashDm(geohash, "geo-dm-$geohash", liveLocationToken) } - private fun subscribeGeohashDm(geohash: String, subscriptionId: String) { + private fun subscribeGeohashDm( + geohash: String, + subscriptionId: String, + liveLocationToken: Long? + ) { scope.launch { + if (liveLocationToken != null && + !LiveLocationPrivacyGate.accepts(liveLocationToken) + ) return@launch val identity = NostrIdentityBridge.deriveIdentity(geohash, application) subscriptions.subscribeGiftWraps( pubkey = identity.publicKeyHex, sinceMs = System.currentTimeMillis() - 172_800_000L, id = subscriptionId, - handler = { event -> dispatch { it.geohashDm(event, geohash, identity) } } + handler = { event -> dispatch { it.geohashDm(event, geohash, identity) } }, + liveLocationToken = liveLocationToken ) GeohashAliasRegistry.put( "nostr_${identity.publicKeyHex.take(16)}", @@ -160,11 +195,15 @@ object NostrBackgroundRuntime { val nostrSchedule = powerManager.profile .map { it.nostr } .distinctUntilChanged() - combine(locationChannels.availableChannels, nostrSchedule) { channels, schedule -> - val targets = channels - .filter { it.level.precision <= 5 } - .map { it.geohash } - .distinct() + combine( + locationChannels.availableChannels, + LiveLocationPrivacyGate.enabled, + nostrSchedule + ) { channels, liveLocationEnabled, schedule -> + val targets = GeohashNostrPrivacyPolicy.livePresenceTargets( + availableChannels = channels, + liveLocationEnabled = liveLocationEnabled + ) targets to schedule }.collectLatest { (targets, schedule) -> if (targets.isEmpty()) return@collectLatest @@ -182,14 +221,35 @@ object NostrBackgroundRuntime { // Send every target in one wake window; do not spread the batch over seconds. targets.forEach { geohash -> try { - val identity = NostrIdentityBridge.deriveIdentity(geohash, application) - val event = NostrProtocol.createGeohashPresenceEvent(geohash, identity) - NostrRelayManager.getInstance(application).sendEventToGeohash( - event, + val token = LiveLocationPrivacyGate.captureToken() + ?: return@forEach + if (geohash !in GeohashNostrPrivacyPolicy.livePresenceTargets( + availableChannels = locationChannels.availableChannels.value, + liveLocationEnabled = true + ) + ) return@forEach + + var identity: NostrIdentity? = null + LiveLocationPrivacyGate.runIfAllowed(token) { + identity = NostrIdentityBridge.deriveIdentity(geohash, application) + } + val preparedIdentity = identity ?: return@forEach + if (!LiveLocationPrivacyGate.accepts(token)) return@forEach + val event = NostrProtocol.createGeohashPresenceEvent( geohash, - includeDefaults = false, - nRelays = 5 + preparedIdentity ) + LiveLocationPrivacyGate.runIfAllowed(token) { + NostrRelayManager.getInstance(application).sendEventToGeohash( + event = event, + geohash = geohash, + includeDefaults = false, + nRelays = 5, + liveLocationToken = token + ) + } + } catch (e: CancellationException) { + throw e } catch (e: Exception) { Log.w(TAG, "Presence heartbeat failed for $geohash: ${e.message}") } diff --git a/app/src/main/java/com/bitchat/android/nostr/NostrClient.kt b/app/src/main/java/com/bitchat/android/nostr/NostrClient.kt index a4803157..c1488037 100644 --- a/app/src/main/java/com/bitchat/android/nostr/NostrClient.kt +++ b/app/src/main/java/com/bitchat/android/nostr/NostrClient.kt @@ -180,7 +180,7 @@ class NostrClient private constructor(private val context: Context) { relayManager.sendEvent(event) - Log.i(TAG, "📤 Sent geohash message to #$geohash") + Log.i(TAG, "📤 Sent geohash message") onSuccess?.invoke() } catch (e: Exception) { @@ -209,7 +209,7 @@ class NostrClient private constructor(private val context: Context) { } }) - Log.i(TAG, "🌍 Subscribed to geohash channel: #$geohash") + Log.i(TAG, "🌍 Subscribed to geohash channel") } /** @@ -217,7 +217,7 @@ class NostrClient private constructor(private val context: Context) { */ fun unsubscribeFromGeohash(geohash: String) { relayManager.unsubscribe("geohash-$geohash") - Log.i(TAG, "Unsubscribed from geohash channel: #$geohash") + Log.i(TAG, "Unsubscribed from geohash channel") } /** diff --git a/app/src/main/java/com/bitchat/android/nostr/NostrDirectMessageHandler.kt b/app/src/main/java/com/bitchat/android/nostr/NostrDirectMessageHandler.kt index 9d8ae8af..7a49057d 100644 --- a/app/src/main/java/com/bitchat/android/nostr/NostrDirectMessageHandler.kt +++ b/app/src/main/java/com/bitchat/android/nostr/NostrDirectMessageHandler.kt @@ -148,6 +148,7 @@ class NostrDirectMessageHandler( isPrivate = true, recipientNickname = state.getNicknameValue(), senderPeerID = conversationID, + senderNostrPubkey = senderPubkey, deliveryStatus = DeliveryStatus.Delivered(to = state.getNicknameValue() ?: "Unknown", at = Date()) ) @@ -201,7 +202,8 @@ class NostrDirectMessageHandler( isRelay = false, isPrivate = true, recipientNickname = state.getNicknameValue(), - senderPeerID = conversationID + senderPeerID = conversationID, + senderNostrPubkey = senderPubkey ) Log.d(TAG, "📄 Saved Nostr encrypted incoming file to $savedPath (msgId=$uniqueMsgId)") withContext(Dispatchers.Main) { diff --git a/app/src/main/java/com/bitchat/android/nostr/NostrIdentity.kt b/app/src/main/java/com/bitchat/android/nostr/NostrIdentity.kt index 7b8552be..665bfd50 100644 --- a/app/src/main/java/com/bitchat/android/nostr/NostrIdentity.kt +++ b/app/src/main/java/com/bitchat/android/nostr/NostrIdentity.kt @@ -6,6 +6,7 @@ import com.bitchat.android.favorites.FavoritesPersistenceService import com.bitchat.android.identity.SecureIdentityStateManager import java.security.MessageDigest import java.security.SecureRandom +import java.util.concurrent.ConcurrentHashMap /** * Manages Nostr identity (secp256k1 keypair) for NIP-17 private messaging @@ -100,7 +101,7 @@ object NostrIdentityBridge { private const val DEVICE_SEED_KEY = "nostr_device_seed" // Cache for derived geohash identities to avoid repeated crypto operations - private val geohashIdentityCache = mutableMapOf() + private val geohashIdentityCache = ConcurrentHashMap() /** * Get or create the current Nostr identity @@ -157,7 +158,7 @@ object NostrIdentityBridge { // Cache the result for future UI responsiveness geohashIdentityCache[forGeohash] = identity - Log.d(TAG, "Derived geohash identity for $forGeohash (iteration $i)") + Log.d(TAG, "Derived geohash identity") return identity } } @@ -172,7 +173,7 @@ object NostrIdentityBridge { // Cache the fallback result too geohashIdentityCache[forGeohash] = fallbackIdentity - Log.d(TAG, "Used fallback identity derivation for $forGeohash") + Log.d(TAG, "Used fallback geohash identity derivation") return fallbackIdentity } @@ -219,6 +220,10 @@ object NostrIdentityBridge { Log.e(TAG, "Failed to clear Nostr data: ${e.message}") } } + + fun clearGeohashIdentityCache(geohashes: Collection) { + geohashes.forEach(geohashIdentityCache::remove) + } // MARK: - Private Methods diff --git a/app/src/main/java/com/bitchat/android/nostr/NostrLiveSubscriptionPrivacy.kt b/app/src/main/java/com/bitchat/android/nostr/NostrLiveSubscriptionPrivacy.kt new file mode 100644 index 00000000..77f27387 --- /dev/null +++ b/app/src/main/java/com/bitchat/android/nostr/NostrLiveSubscriptionPrivacy.kt @@ -0,0 +1,13 @@ +package com.bitchat.android.nostr + +internal object NostrLiveSubscriptionPrivacy { + fun closeTargets( + liveSubscriptionIds: Set, + subscriptionsByRelay: Map>, + ): Map> = buildMap { + subscriptionsByRelay.forEach { (relayUrl, relaySubscriptionIds) -> + val matchingIds = relaySubscriptionIds.intersect(liveSubscriptionIds) + if (matchingIds.isNotEmpty()) put(relayUrl, matchingIds) + } + } +} diff --git a/app/src/main/java/com/bitchat/android/nostr/NostrRelayManager.kt b/app/src/main/java/com/bitchat/android/nostr/NostrRelayManager.kt index 20a1ce18..d361ec49 100644 --- a/app/src/main/java/com/bitchat/android/nostr/NostrRelayManager.kt +++ b/app/src/main/java/com/bitchat/android/nostr/NostrRelayManager.kt @@ -1,6 +1,7 @@ package com.bitchat.android.nostr import android.util.Log +import com.bitchat.android.geohash.LiveLocationPrivacyGate import com.google.gson.Gson import kotlinx.coroutines.flow.MutableStateFlow import kotlinx.coroutines.flow.StateFlow @@ -9,6 +10,7 @@ import com.google.gson.JsonArray import com.google.gson.JsonParser import kotlinx.coroutines.* import okhttp3.* +import java.util.UUID import java.util.concurrent.ConcurrentHashMap import java.util.concurrent.TimeUnit import java.util.concurrent.atomic.AtomicBoolean @@ -104,8 +106,9 @@ class NostrRelayManager private constructor() { val handler: (NostrEvent) -> Unit, val targetRelayUrls: Set? = null, // null means all relays val createdAt: Long = System.currentTimeMillis(), - val originGeohash: String? = null, // used for logging and grouping - val owner: String = OWNER_LEGACY + val originGeohash: String? = null, + val owner: String = OWNER_LEGACY, + val liveLocationToken: Long? = null ) // Event deduplication system @@ -114,8 +117,10 @@ class NostrRelayManager private constructor() { // Message queue for reliability private data class QueuedEvent( val event: NostrEvent, - val pendingRelayUrls: MutableSet + val pendingRelayUrls: MutableSet, + val liveLocationToken: Long? = null ) + private val messageQueue = mutableListOf() private val messageQueueLock = Any() @@ -136,27 +141,49 @@ class NostrRelayManager private constructor() { // Per-geohash relay selection private val geohashToRelays = ConcurrentHashMap>() // geohash -> relay URLs + private val liveGeohashTokens = ConcurrentHashMap() + private val liveLocationRelayTokens = ConcurrentHashMap() + private val nonLiveRelayUrls = ConcurrentHashMap.newKeySet() + private val liveLocationConnectionJobs = ConcurrentHashMap.newKeySet() // --- Public API for geohash-specific operation --- /** * Compute and connect to relays for a given geohash (nearest + optional defaults), cache the mapping. */ - fun ensureGeohashRelaysConnected(geohash: String, nRelays: Int = 5, includeDefaults: Boolean = false) { + fun ensureGeohashRelaysConnected( + geohash: String, + nRelays: Int = 5, + includeDefaults: Boolean = false, + liveLocationToken: Long? = null + ) { + if (!isNetworkActionAllowed(liveLocationToken)) return try { val nearest = RelayDirectory.closestRelaysForGeohash(geohash, nRelays) val selected = if (includeDefaults) { (nearest + Companion.defaultRelays()).toSet() } else nearest.toSet() if (selected.isEmpty()) { - Log.w(TAG, "No relays selected for geohash=$geohash") + Log.w(TAG, "No relays selected for a geohash") return } - geohashToRelays[geohash] = selected - Log.d(TAG, "Geohash $geohash using ${selected.size} relays") - ensureConnectionsFor(selected) + runNetworkAction(liveLocationToken) { + geohashToRelays[geohash] = selected + if (liveLocationToken == null) { + liveGeohashTokens.remove(geohash) + nonLiveRelayUrls.addAll(selected) + } else { + liveGeohashTokens[geohash] = liveLocationToken + selected.forEach { relayUrl -> + if (relayUrl !in nonLiveRelayUrls) { + liveLocationRelayTokens[relayUrl] = liveLocationToken + } + } + } + ensureConnectionsFor(selected, liveLocationToken) + } } catch (e: Exception) { - Log.e(TAG, "Failed to ensure relays for $geohash: ${e.message}") + Log.e(TAG, "Failed to ensure geohash relays") } } @@ -177,20 +204,29 @@ class NostrRelayManager private constructor() { handler: (NostrEvent) -> Unit, includeDefaults: Boolean = false, nRelays: Int = 5, - owner: String = OWNER_LEGACY + owner: String = OWNER_LEGACY, + liveLocationToken: Long? = null ): String { - ensureGeohashRelaysConnected(geohash, nRelays, includeDefaults) + if (!isNetworkActionAllowed(liveLocationToken)) return id + ensureGeohashRelaysConnected( + geohash, + nRelays, + includeDefaults, + liveLocationToken + ) + if (!isNetworkActionAllowed(liveLocationToken)) return id val relayUrls = getRelaysForGeohash(geohash) return subscribe( filter = filter, id = id, handler = handler, targetRelayUrls = relayUrls, - owner = owner - ).also { - // update origin geohash for this subscription - activeSubscriptions[it]?.let { sub -> - activeSubscriptions[it] = sub.copy(originGeohash = geohash) + owner = owner, + liveLocationToken = liveLocationToken + ).also { subscriptionId -> + activeSubscriptions[subscriptionId]?.let { subscription -> + activeSubscriptions[subscriptionId] = + subscription.copy(originGeohash = geohash) } } } @@ -198,20 +234,111 @@ class NostrRelayManager private constructor() { /** * Send an event specifically to a geohash's relays (+ optional defaults). */ - fun sendEventToGeohash(event: NostrEvent, geohash: String, includeDefaults: Boolean = false, nRelays: Int = 5) { - ensureGeohashRelaysConnected(geohash, nRelays, includeDefaults) + fun sendEventToGeohash( + event: NostrEvent, + geohash: String, + includeDefaults: Boolean = false, + nRelays: Int = 5, + liveLocationToken: Long? = null + ) { + if (!isNetworkActionAllowed(liveLocationToken)) return + ensureGeohashRelaysConnected( + geohash, + nRelays, + includeDefaults, + liveLocationToken + ) + if (!isNetworkActionAllowed(liveLocationToken)) return val relayUrls = getRelaysForGeohash(geohash) if (relayUrls.isEmpty()) { - Log.w(TAG, "No target relays to send event for geohash=$geohash; falling back to defaults") - sendEvent(event, Companion.defaultRelays()) + Log.w(TAG, "No target relays for geohash event; falling back to defaults") + sendEvent(event, Companion.defaultRelays(), liveLocationToken) return } - sendEvent(event, relayUrls) + sendEvent(event, relayUrls, liveLocationToken) } // --- Internal helpers --- - private fun ensureConnectionsFor(relayUrls: Set) { + private fun isNetworkActionAllowed(liveLocationToken: Long?): Boolean = + liveLocationToken == null || LiveLocationPrivacyGate.accepts(liveLocationToken) + + private fun runNetworkAction( + liveLocationToken: Long?, + action: () -> Unit + ): Boolean = if (liveLocationToken == null) { + action() + true + } else { + LiveLocationPrivacyGate.runIfAllowed(liveLocationToken, action) + } + + /** + * Privacy teardown is allowed to bypass an already-revoked token solely to stop + * server-side delivery. Live subscription IDs are opaque, so CLOSE carries no + * geohash. If a CLOSE cannot be queued, fail closed by dropping that socket. + */ + private fun closeSubscriptionsOnConnectedRelays(subscriptionIds: Set) { + if (subscriptionIds.isEmpty()) return + + val closeTargets = NostrLiveSubscriptionPrivacy.closeTargets( + liveSubscriptionIds = subscriptionIds, + subscriptionsByRelay = subscriptions, + ) + closeTargets.forEach { (relayUrl, relaySubscriptionIds) -> + val webSocket = connections[relayUrl] ?: return@forEach + relaySubscriptionIds.forEach { subscriptionId -> + val request = NostrRequest.Close(subscriptionId) + val message = gson.toJson(request, NostrRequest::class.java) + val closeQueued = runCatching { webSocket.send(message) } + .getOrDefault(false) + if (!closeQueued) { + connections.remove(relayUrl, webSocket) + webSocket.cancel() + } + } + } + } + + private fun revokeLiveLocationAccess() { + liveLocationConnectionJobs.forEach(Job::cancel) + liveLocationConnectionJobs.clear() + + val liveSubscriptionIds = activeSubscriptions.values + .filter { it.liveLocationToken != null } + .mapTo(mutableSetOf()) { it.id } + closeSubscriptionsOnConnectedRelays(liveSubscriptionIds) + liveSubscriptionIds.forEach { id -> + activeSubscriptions.remove(id) + messageHandlers.remove(id) + } + subscriptions.replaceAll { _, ids -> ids - liveSubscriptionIds } + + synchronized(messageQueueLock) { + messageQueue.removeAll { it.liveLocationToken != null } + } + + liveGeohashTokens.keys.forEach(geohashToRelays::remove) + liveGeohashTokens.clear() + + val liveOnlyRelayUrls = liveLocationRelayTokens.keys + .filterNotTo(mutableSetOf()) { it in nonLiveRelayUrls } + liveOnlyRelayUrls.forEach { relayUrl -> + connections.remove(relayUrl)?.cancel() + } + synchronized(relaysList) { + relaysList.removeAll { it.url in liveOnlyRelayUrls } + } + liveLocationRelayTokens.clear() + updateRelaysList() + updateConnectionStatus() + } + + private fun ensureConnectionsFor( + relayUrls: Set, + liveLocationToken: Long? = null + ) { + if (!isNetworkActionAllowed(liveLocationToken)) return // Ensure relays are tracked for UI/status relayUrls.forEach { url -> if (relaysList.none { it.url == url }) { @@ -221,15 +348,25 @@ class NostrRelayManager private constructor() { updateRelaysList() if (!desiredConnected.get()) return - scope.launch { + val job = scope.launch { + if (!desiredConnected.get() || + !isNetworkActionAllowed(liveLocationToken) + ) return@launch relayUrls.forEach { relayUrl -> launch { - if (!connections.containsKey(relayUrl)) { - connectToRelay(relayUrl) + if (desiredConnected.get() && + !connections.containsKey(relayUrl) && + isNetworkActionAllowed(liveLocationToken) + ) { + connectToRelay(relayUrl, liveLocationToken) } } } } + if (liveLocationToken != null) { + liveLocationConnectionJobs.add(job) + job.invokeOnCompletion { liveLocationConnectionJobs.remove(job) } + } } init { @@ -242,8 +379,10 @@ class NostrRelayManager private constructor() { "wss://nostr21.com" ) relaysList.addAll(defaultRelayUrls.map { Relay(it) }) + nonLiveRelayUrls.addAll(defaultRelayUrls) _relays.value = relaysList.toList() updateConnectionStatus() + LiveLocationPrivacyGate.addRevocationListener(::revokeLiveLocationAccess) } catch (e: Exception) { Log.e(TAG, "Failed to initialize NostrRelayManager: ${e.message}", e) // Initialize with empty list as fallback @@ -258,11 +397,14 @@ class NostrRelayManager private constructor() { fun connect() { desiredConnected.set(true) Log.i(TAG, "Connecting to ${relaysList.size} Nostr relays") - scope.launch { relaysList.forEach { relay -> launch { - connectToRelay(relay.url) + val liveToken = liveLocationRelayTokens[relay.url] + ?.takeIf { relay.url !in nonLiveRelayUrls } + if (liveToken == null || LiveLocationPrivacyGate.accepts(liveToken)) { + connectToRelay(relay.url, liveToken) + } } } } @@ -277,18 +419,20 @@ class NostrRelayManager private constructor() { fun disconnect() { Log.i(TAG, "Disconnecting from all Nostr relays") desiredConnected.set(false) - + // Stop subscription validation stopSubscriptionValidation() - reconnectJobs.values.forEach { it.cancel() } + reconnectJobs.values.forEach(Job::cancel) reconnectJobs.clear() - + liveLocationConnectionJobs.forEach(Job::cancel) + liveLocationConnectionJobs.clear() + val sockets = connections.values.toList() connections.clear() sockets.forEach { webSocket -> webSocket.close(1000, "Manual disconnect") } - + // Preserve logical subscriptions for controlled resets, but forget per-socket state. subscriptions.clear() relaysList.forEach { @@ -302,26 +446,39 @@ class NostrRelayManager private constructor() { /** * Send an event to specified relays (or all if none specified) */ - fun sendEvent(event: NostrEvent, relayUrls: List? = null) { + fun sendEvent( + event: NostrEvent, + relayUrls: List? = null, + liveLocationToken: Long? = null + ) { val targetRelays = relayUrls ?: relaysList.map { it.url } - - // Add to queue for reliability - synchronized(messageQueueLock) { - if (messageQueue.size >= MAX_QUEUED_EVENTS) messageQueue.removeAt(0) - messageQueue.add(QueuedEvent(event, targetRelays.toMutableSet())) - } - - // Attempt immediate send - scope.launch { - targetRelays.forEach { relayUrl -> - val webSocket = connections[relayUrl] - if (webSocket != null) { - if (sendToRelay(event, webSocket, relayUrl)) { - markQueuedRelayDelivered(event.id, relayUrl) + + val queued = runNetworkAction(liveLocationToken) { + synchronized(messageQueueLock) { + if (messageQueue.size >= MAX_QUEUED_EVENTS) { + messageQueue.removeAt(0) + } + messageQueue.add( + QueuedEvent( + event = event, + pendingRelayUrls = targetRelays.toMutableSet(), + liveLocationToken = liveLocationToken + ) + ) + } + scope.launch { + if (!isNetworkActionAllowed(liveLocationToken)) return@launch + targetRelays.forEach { relayUrl -> + val webSocket = connections[relayUrl] + if (webSocket != null) { + if (sendToRelay(event, webSocket, relayUrl, liveLocationToken)) { + markQueuedRelayDelivered(event.id, relayUrl) + } } } } } + if (!queued) return } /** @@ -333,22 +490,23 @@ class NostrRelayManager private constructor() { id: String = generateSubscriptionId(), handler: (NostrEvent) -> Unit, targetRelayUrls: List? = null, - owner: String = OWNER_LEGACY + owner: String = OWNER_LEGACY, + liveLocationToken: Long? = null ): String { - // Store subscription info for persistent tracking val subscriptionInfo = SubscriptionInfo( id = id, filter = filter, handler = handler, targetRelayUrls = targetRelayUrls?.toSet(), - owner = owner + owner = owner, + liveLocationToken = liveLocationToken ) - activeSubscriptions[id] = subscriptionInfo - messageHandlers[id] = handler - - // Send subscription to appropriate relays - sendSubscriptionToRelays(subscriptionInfo) + runNetworkAction(liveLocationToken) { + activeSubscriptions[id] = subscriptionInfo + messageHandlers[id] = handler + sendSubscriptionToRelays(subscriptionInfo) + } return id } @@ -357,32 +515,38 @@ class NostrRelayManager private constructor() { * Send a subscription to the appropriate relays */ private fun sendSubscriptionToRelays(subscriptionInfo: SubscriptionInfo) { + if (!isNetworkActionAllowed(subscriptionInfo.liveLocationToken)) return val request = NostrRequest.Subscribe(subscriptionInfo.id, listOf(subscriptionInfo.filter)) val message = gson.toJson(request, NostrRequest::class.java) scope.launch { + if (!isNetworkActionAllowed(subscriptionInfo.liveLocationToken)) return@launch val targetRelays = subscriptionInfo.targetRelayUrls?.toList() ?: connections.keys.toList() targetRelays.forEach { relayUrl -> val webSocket = connections[relayUrl] if (webSocket != null) { try { - val success = webSocket.send(message) - if (success) { - // Track subscription for this relay - val currentSubs = subscriptions[relayUrl] ?: emptySet() - subscriptions[relayUrl] = currentSubs + subscriptionInfo.id - } else { - Log.w(TAG, "Failed to send subscription to $relayUrl: WebSocket send failed") + var success = false + runNetworkAction(subscriptionInfo.liveLocationToken) { + success = webSocket.send(message) + if (success) { + val currentSubs = subscriptions[relayUrl] ?: emptySet() + subscriptions[relayUrl] = + currentSubs + subscriptionInfo.id + } + } + if (!success) { + Log.w(TAG, "Failed to send subscription: WebSocket send failed") } } catch (e: Exception) { - Log.e(TAG, "Failed to send subscription to $relayUrl: ${e.message}") + Log.e(TAG, "Failed to send subscription") } } } if (connections.isEmpty()) { - Log.w(TAG, "No relay connections available for subscription, will retry on reconnection") + Log.w(TAG, "⚠️ No relay connections available for subscription, will retry on reconnection") } } } @@ -396,7 +560,14 @@ class NostrRelayManager private constructor() { messageHandlers.remove(id) if (subscriptionInfo == null) { - Log.w(TAG, "Attempted to unsubscribe from unknown subscription: $id") + return + } + + if (subscriptionInfo.liveLocationToken != null && + !isNetworkActionAllowed(subscriptionInfo.liveLocationToken) + ) { + closeSubscriptionsOnConnectedRelays(setOf(id)) + subscriptions.replaceAll { _, ids -> ids - id } return } @@ -404,14 +575,21 @@ class NostrRelayManager private constructor() { val message = gson.toJson(request, NostrRequest::class.java) scope.launch { + if (!isNetworkActionAllowed(subscriptionInfo.liveLocationToken)) { + closeSubscriptionsOnConnectedRelays(setOf(id)) + subscriptions.replaceAll { _, ids -> ids - id } + return@launch + } connections.forEach { (relayUrl, webSocket) -> val currentSubs = subscriptions[relayUrl] if (currentSubs?.contains(id) == true) { try { - webSocket.send(message) + runNetworkAction(subscriptionInfo.liveLocationToken) { + webSocket.send(message) + } subscriptions[relayUrl] = currentSubs - id } catch (e: Exception) { - Log.e(TAG, "Failed to unsubscribe from $relayUrl: ${e.message}") + Log.e(TAG, "Failed to unsubscribe from relay") } } } @@ -431,6 +609,9 @@ class NostrRelayManager private constructor() { fun retryConnection(relayUrl: String) { val relay = relaysList.find { it.url == relayUrl } ?: return desiredConnected.set(true) + val liveToken = liveLocationRelayTokens[relayUrl] + ?.takeIf { relayUrl !in nonLiveRelayUrls } + if (!isNetworkActionAllowed(liveToken)) return // Reset reconnection attempts relay.reconnectAttempts = 0 @@ -442,7 +623,7 @@ class NostrRelayManager private constructor() { // Attempt immediate reconnection scope.launch { - connectToRelay(relayUrl) + connectToRelay(relayUrl, liveToken) } } @@ -596,7 +777,7 @@ class NostrRelayManager private constructor() { try { val report = validateSubscriptionConsistency() if (!report.isConsistent && report.connectedRelayCount > 0) { - Log.w(TAG, "Subscription inconsistencies detected: ${report.inconsistencies}") + Log.w(TAG, "Nostr subscription inconsistencies detected") // Auto-repair: re-establish subscriptions for relays with missing ones connections.forEach { (relayUrl, webSocket) -> @@ -608,7 +789,7 @@ class NostrRelayManager private constructor() { val missingSubs = expectedSubs - currentSubs if (missingSubs.isNotEmpty()) { - Log.i(TAG, "Auto-repairing ${missingSubs.size} missing subscriptions for $relayUrl") + Log.i(TAG, "Auto-repairing ${missingSubs.size} missing subscriptions") restoreSubscriptionsForRelay(relayUrl, webSocket) } } @@ -618,6 +799,7 @@ class NostrRelayManager private constructor() { } } } + } /** @@ -630,8 +812,14 @@ class NostrRelayManager private constructor() { // MARK: - Private Methods - private suspend fun connectToRelay(urlString: String) { + private suspend fun connectToRelay( + urlString: String, + liveLocationToken: Long? = null + ) { if (!desiredConnected.get()) return + val connectionToken = liveLocationToken + ?.takeIf { urlString !in nonLiveRelayUrls } + if (!isNetworkActionAllowed(connectionToken)) return // Skip if we already have a connection if (connections.containsKey(urlString)) { return @@ -642,27 +830,43 @@ class NostrRelayManager private constructor() { .url(urlString) .build() - val webSocket = httpClient.newWebSocket(request, RelayWebSocketListener(urlString)) - val existing = connections.putIfAbsent(urlString, webSocket) - if (existing != null) { - webSocket.close(1000, "Duplicate connection") - } else if (!desiredConnected.get()) { - connections.remove(urlString, webSocket) - webSocket.close(1000, "Connection no longer desired") + val started = runNetworkAction(connectionToken) { + val webSocket = httpClient.newWebSocket( + request, + RelayWebSocketListener(urlString, connectionToken) + ) + val existing = connections.putIfAbsent(urlString, webSocket) + when { + existing != null -> webSocket.close(1000, "Duplicate connection") + !desiredConnected.get() -> { + connections.remove(urlString, webSocket) + webSocket.close(1000, "Connection no longer desired") + } + } } + if (!started) return } catch (e: Exception) { - Log.e(TAG, "Failed to create WebSocket connection to $urlString: ${e.message}") - handleConnectionCreationFailure(urlString, e) + Log.e(TAG, "Failed to create WebSocket connection") + handleConnectionCreationFailure(urlString, e, connectionToken) } } - private fun sendToRelay(event: NostrEvent, webSocket: WebSocket, relayUrl: String): Boolean { + private fun sendToRelay( + event: NostrEvent, + webSocket: WebSocket, + relayUrl: String, + liveLocationToken: Long? = null + ): Boolean { + if (!isNetworkActionAllowed(liveLocationToken)) return false return try { val request = NostrRequest.Event(event) val message = gson.toJson(request, NostrRequest::class.java) - val success = webSocket.send(message) + var success = false + runNetworkAction(liveLocationToken) { + success = webSocket.send(message) + } if (success) { // Update relay stats val relay = relaysList.find { it.url == relayUrl } @@ -670,11 +874,11 @@ class NostrRelayManager private constructor() { updateRelaysList() true } else { - Log.e(TAG, "Failed to send event to $relayUrl: WebSocket send failed") + Log.e(TAG, "Failed to send event: WebSocket send failed") false } } catch (e: Exception) { - Log.e(TAG, "Failed to send event to $relayUrl: ${e.message}") + Log.e(TAG, "Failed to send event") false } } @@ -695,7 +899,7 @@ class NostrRelayManager private constructor() { try { val jsonElement = JsonParser.parseString(message) if (!jsonElement.isJsonArray) { - Log.w(TAG, "Received non-array message from $relayUrl") + Log.w(TAG, "Received non-array message from relay") return } @@ -709,7 +913,10 @@ class NostrRelayManager private constructor() { updateRelaysList() // CLIENT-SIDE FILTER ENFORCEMENT: Ensure this event matches the subscription's filter - activeSubscriptions[response.subscriptionId]?.let { subInfo -> + val subscriptionInfo = activeSubscriptions[response.subscriptionId] + ?: return + if (!isNetworkActionAllowed(subscriptionInfo.liveLocationToken)) return + subscriptionInfo.let { subInfo -> val matches = try { subInfo.filter.matches(response.event) } catch (e: Exception) { true } if (!matches) { // Do NOT call deduplicator here to allow the correct subscription to process it later @@ -723,12 +930,15 @@ class NostrRelayManager private constructor() { val handler = messageHandlers[response.subscriptionId] if (handler != null) { scope.launch(Dispatchers.Main) { - handler(event) + if (isNetworkActionAllowed(subscriptionInfo.liveLocationToken)) { + handler(event) + } } } else { - Log.d(TAG, "No handler for subscription ${response.subscriptionId}") + Log.w(TAG, "⚠️ No handler for Nostr subscription") } } + } is NostrResponse.EndOfStoredEvents -> { @@ -739,39 +949,57 @@ class NostrRelayManager private constructor() { val wasGiftWrap = pendingGiftWrapIDs.remove(response.eventId) if (!response.accepted) { val level = if (wasGiftWrap) Log.WARN else Log.ERROR - Log.println(level, TAG, "Event rejected by relay $relayUrl: ${response.message ?: "no reason"}") + Log.println(level, TAG, "Event rejected by relay: ${response.message ?: "no reason"}") } } is NostrResponse.Notice -> { - Log.d(TAG, "Notice from $relayUrl: ${response.message}") + // No action needed } is NostrResponse.Unknown -> { - Log.d(TAG, "Unknown message type from $relayUrl") + // No action needed } } } catch (e: Exception) { - Log.e(TAG, "Failed to parse message from $relayUrl: ${e.message}") + Log.e(TAG, "Failed to parse relay message") } } - private fun handleDisconnection(relayUrl: String, webSocket: WebSocket, error: Throwable) { - // A close/failure from an intentionally closed or replaced socket is stale. In particular, - // it must not remove a newer socket or schedule a reconnect after manual disconnect. + private fun handleDisconnection( + relayUrl: String, + webSocket: WebSocket, + error: Throwable, + liveLocationToken: Long? = null + ) { + // Ignore callbacks from intentionally closed or replaced sockets. They must not remove a + // newer socket or schedule a reconnect after a controlled disconnect/privacy revocation. if (!connections.remove(relayUrl, webSocket)) return subscriptions.remove(relayUrl) - handleCurrentDisconnection(relayUrl, error) + handleCurrentDisconnection(relayUrl, error, liveLocationToken) } - private fun handleConnectionCreationFailure(relayUrl: String, error: Throwable) { + private fun handleConnectionCreationFailure( + relayUrl: String, + error: Throwable, + liveLocationToken: Long? + ) { if (!desiredConnected.get()) return - handleCurrentDisconnection(relayUrl, error) + handleCurrentDisconnection(relayUrl, error, liveLocationToken) } - private fun handleCurrentDisconnection(relayUrl: String, error: Throwable) { + private fun handleCurrentDisconnection( + relayUrl: String, + error: Throwable, + liveLocationToken: Long? + ) { + val connectionToken = liveLocationToken + ?.takeIf { relayUrl !in nonLiveRelayUrls } + updateRelayStatus(relayUrl, false, error) - if (!desiredConnected.get()) return + if (!desiredConnected.get() || + !isNetworkActionAllowed(connectionToken) + ) return // Check if this is a DNS error val errorMessage = error.message?.lowercase() ?: "" @@ -781,7 +1009,7 @@ class NostrRelayManager private constructor() { val relay = relaysList.find { it.url == relayUrl } if (relay?.lastError == null) { - Log.w(TAG, "Nostr relay DNS failure for $relayUrl - not retrying") + Log.w(TAG, "Nostr relay DNS failure; not retrying") } return } @@ -792,7 +1020,7 @@ class NostrRelayManager private constructor() { // Stop attempting after max attempts if (relay.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) { - Log.w(TAG, "Max reconnection attempts ($MAX_RECONNECT_ATTEMPTS) reached for $relayUrl") + Log.w(TAG, "Max Nostr relay reconnection attempts reached") return } @@ -804,15 +1032,21 @@ class NostrRelayManager private constructor() { relay.nextReconnectTime = System.currentTimeMillis() + backoffInterval - Log.d(TAG, "Scheduling reconnection to $relayUrl in ${backoffInterval / 1000}s (attempt ${relay.reconnectAttempts})") + Log.d(TAG, "Scheduling Nostr relay reconnection") reconnectJobs.remove(relayUrl)?.cancel() val reconnectJob = scope.launch { delay(backoffInterval) - if (desiredConnected.get()) connectToRelay(relayUrl) + if (desiredConnected.get() && + isNetworkActionAllowed(connectionToken) + ) { + connectToRelay(relayUrl, connectionToken) + } } reconnectJobs[relayUrl] = reconnectJob - reconnectJob.invokeOnCompletion { reconnectJobs.remove(relayUrl, reconnectJob) } + reconnectJob.invokeOnCompletion { + reconnectJobs.remove(relayUrl, reconnectJob) + } } private fun updateRelayStatus(url: String, isConnected: Boolean, error: Throwable? = null) { @@ -843,7 +1077,7 @@ class NostrRelayManager private constructor() { } private fun generateSubscriptionId(): String { - return "sub-${System.currentTimeMillis()}-${(Math.random() * 1000).toInt()}" + return "sub-${UUID.randomUUID()}" } /** @@ -852,30 +1086,34 @@ class NostrRelayManager private constructor() { private fun restoreSubscriptionsForRelay(relayUrl: String, webSocket: WebSocket) { val subscriptionsToRestore = activeSubscriptions.values.filter { subscriptionInfo -> // Include subscription if it targets all relays or specifically targets this relay - subscriptionInfo.targetRelayUrls == null || subscriptionInfo.targetRelayUrls.contains(relayUrl) + isNetworkActionAllowed(subscriptionInfo.liveLocationToken) && + (subscriptionInfo.targetRelayUrls == null || + subscriptionInfo.targetRelayUrls.contains(relayUrl)) } if (subscriptionsToRestore.isEmpty()) { return } - Log.d(TAG, "Restoring ${subscriptionsToRestore.size} subscriptions for relay: $relayUrl") - subscriptionsToRestore.forEach { subscriptionInfo -> try { val request = NostrRequest.Subscribe(subscriptionInfo.id, listOf(subscriptionInfo.filter)) val message = gson.toJson(request, NostrRequest::class.java) - val success = webSocket.send(message) - if (success) { - // Track subscription for this relay - val currentSubs = subscriptions[relayUrl] ?: emptySet() - subscriptions[relayUrl] = currentSubs + subscriptionInfo.id - } else { - Log.w(TAG, "Failed to restore subscription '${subscriptionInfo.id}' to $relayUrl: WebSocket send failed") + var success = false + runNetworkAction(subscriptionInfo.liveLocationToken) { + success = webSocket.send(message) + if (success) { + val currentSubs = subscriptions[relayUrl] ?: emptySet() + subscriptions[relayUrl] = + currentSubs + subscriptionInfo.id + } + } + if (!success) { + Log.w(TAG, "Failed to restore subscription: WebSocket send failed") } } catch (e: Exception) { - Log.e(TAG, "Failed to restore subscription '${subscriptionInfo.id}' to $relayUrl: ${e.message}") + Log.e(TAG, "Failed to restore subscription") } } } @@ -883,15 +1121,21 @@ class NostrRelayManager private constructor() { /** * WebSocket listener for relay connections */ - private inner class RelayWebSocketListener(private val relayUrl: String) : WebSocketListener() { + private inner class RelayWebSocketListener( + private val relayUrl: String, + private val liveLocationToken: Long? + ) : WebSocketListener() { override fun onOpen(webSocket: WebSocket, response: Response) { - if (!desiredConnected.get() || connections[relayUrl] !== webSocket) { + if (!desiredConnected.get() || + connections[relayUrl] !== webSocket || + !isNetworkActionAllowed(liveLocationToken) + ) { + connections.remove(relayUrl, webSocket) webSocket.close(1000, "Stale connection") return } reconnectJobs.remove(relayUrl)?.cancel() - Log.i(TAG, "Connected to Nostr relay: $relayUrl") updateRelayStatus(relayUrl, true) // Restore all active subscriptions for this relay @@ -900,11 +1144,14 @@ class NostrRelayManager private constructor() { // Process only events still pending for this relay, outside the queue lock. val queuedForRelay = synchronized(messageQueueLock) { messageQueue - .filter { relayUrl in it.pendingRelayUrls } - .map { it.event } + .filter { + relayUrl in it.pendingRelayUrls && + isNetworkActionAllowed(it.liveLocationToken) + } + .map { it.event to it.liveLocationToken } } - queuedForRelay.forEach { event -> - if (sendToRelay(event, webSocket, relayUrl)) { + queuedForRelay.forEach { (event, token) -> + if (sendToRelay(event, webSocket, relayUrl, token)) { markQueuedRelayDelivered(event.id, relayUrl) } } @@ -920,14 +1167,13 @@ class NostrRelayManager private constructor() { } override fun onClosed(webSocket: WebSocket, code: Int, reason: String) { - Log.i(TAG, "Disconnected from Nostr relay $relayUrl: $code $reason") val error = Exception("WebSocket closed: $code $reason") - handleDisconnection(relayUrl, webSocket, error) + handleDisconnection(relayUrl, webSocket, error, liveLocationToken) } override fun onFailure(webSocket: WebSocket, t: Throwable, response: Response?) { - Log.e(TAG, "WebSocket failure for $relayUrl: ${t.message}") - handleDisconnection(relayUrl, webSocket, t) + Log.e(TAG, "Nostr WebSocket failure") + handleDisconnection(relayUrl, webSocket, t, liveLocationToken) } } } diff --git a/app/src/main/java/com/bitchat/android/nostr/NostrSubscriptionManager.kt b/app/src/main/java/com/bitchat/android/nostr/NostrSubscriptionManager.kt index 601e885c..e378e31e 100644 --- a/app/src/main/java/com/bitchat/android/nostr/NostrSubscriptionManager.kt +++ b/app/src/main/java/com/bitchat/android/nostr/NostrSubscriptionManager.kt @@ -2,6 +2,7 @@ package com.bitchat.android.nostr import android.app.Application import android.util.Log +import com.bitchat.android.geohash.LiveLocationPrivacyGate import kotlinx.coroutines.CoroutineScope import kotlinx.coroutines.launch @@ -21,16 +22,41 @@ class NostrSubscriptionManager( fun connect() = scope.launch { runCatching { relayManager.connect() }.onFailure { Log.e(TAG, "connect failed: ${it.message}") } } fun disconnect() = scope.launch { runCatching { relayManager.disconnect() }.onFailure { Log.e(TAG, "disconnect failed: ${it.message}") } } - fun subscribeGiftWraps(pubkey: String, sinceMs: Long, id: String, handler: (NostrEvent) -> Unit) { + fun subscribeGiftWraps( + pubkey: String, + sinceMs: Long, + id: String, + handler: (NostrEvent) -> Unit, + liveLocationToken: Long? = null + ) { scope.launch { + if (liveLocationToken != null && + !LiveLocationPrivacyGate.accepts(liveLocationToken) + ) return@launch val filter = NostrFilter.giftWrapsFor(pubkey, sinceMs) - relayManager.subscribe(filter, id, handler, owner = owner) + relayManager.subscribe( + filter = filter, + id = id, + handler = handler, + owner = owner, + liveLocationToken = liveLocationToken + ) } } /** Subscribe to geohash chat messages only (kind 20000) — low-volume, kept alive in background. */ - fun subscribeGeohashMessages(geohash: String, sinceMs: Long, limit: Int, id: String, handler: (NostrEvent) -> Unit) { + fun subscribeGeohashMessages( + geohash: String, + sinceMs: Long, + limit: Int, + id: String, + handler: (NostrEvent) -> Unit, + liveLocationToken: Long? = null + ) { scope.launch { + if (liveLocationToken != null && + !LiveLocationPrivacyGate.accepts(liveLocationToken) + ) return@launch val filter = NostrFilter.geohashMessages(geohash, sinceMs, limit) relayManager.subscribeForGeohash( geohash, @@ -39,14 +65,25 @@ class NostrSubscriptionManager( handler, includeDefaults = false, nRelays = 5, - owner = owner + owner = owner, + liveLocationToken = liveLocationToken ) } } /** Subscribe to geohash presence heartbeats only (kind 20001) — high-volume, paused in background. */ - fun subscribeGeohashPresence(geohash: String, sinceMs: Long, limit: Int, id: String, handler: (NostrEvent) -> Unit) { + fun subscribeGeohashPresence( + geohash: String, + sinceMs: Long, + limit: Int, + id: String, + handler: (NostrEvent) -> Unit, + liveLocationToken: Long? = null + ) { scope.launch { + if (liveLocationToken != null && + !LiveLocationPrivacyGate.accepts(liveLocationToken) + ) return@launch val filter = NostrFilter.geohashPresence(geohash, sinceMs, limit) relayManager.subscribeForGeohash( geohash, @@ -55,13 +92,13 @@ class NostrSubscriptionManager( handler, includeDefaults = false, nRelays = 5, - owner = owner + owner = owner, + liveLocationToken = liveLocationToken ) } } fun unsubscribe(id: String) { scope.launch { runCatching { relayManager.unsubscribe(id) } } } - fun unsubscribeAllOwned() { scope.launch { runCatching { relayManager.unsubscribeOwner(owner) } } } diff --git a/app/src/main/java/com/bitchat/android/nostr/RelayDirectory.kt b/app/src/main/java/com/bitchat/android/nostr/RelayDirectory.kt index f591b2b8..980b95ef 100644 --- a/app/src/main/java/com/bitchat/android/nostr/RelayDirectory.kt +++ b/app/src/main/java/com/bitchat/android/nostr/RelayDirectory.kt @@ -92,7 +92,7 @@ object RelayDirectory { val c = com.bitchat.android.geohash.Geohash.decodeToCenter(geohash) c } catch (e: Exception) { - Log.e(TAG, "Failed to decode geohash '$geohash': ${e.message}") + Log.e(TAG, "Failed to decode geohash") return emptyList() } @@ -300,4 +300,3 @@ object RelayDirectory { } } } - diff --git a/app/src/main/java/com/bitchat/android/ui/ChatHeader.kt b/app/src/main/java/com/bitchat/android/ui/ChatHeader.kt index 8993b3ea..af38ea1d 100644 --- a/app/src/main/java/com/bitchat/android/ui/ChatHeader.kt +++ b/app/src/main/java/com/bitchat/android/ui/ChatHeader.kt @@ -42,6 +42,9 @@ import androidx.compose.ui.unit.dp import androidx.compose.ui.unit.sp import androidx.lifecycle.compose.collectAsStateWithLifecycle import com.bitchat.android.ui.theme.BitchatFontFamily +import androidx.annotation.DrawableRes +import androidx.compose.ui.text.style.TextOverflow +import androidx.compose.foundation.layout.RowScope import com.bitchat.android.R import com.bitchat.android.core.ui.component.button.BitChatBrandButton import com.bitchat.android.net.ArtiTorManager @@ -80,6 +83,15 @@ private val HeaderTapTarget = 44.dp /** Corner radius for the header's tappable label+icon clusters. */ private val HeaderClusterShape = RoundedCornerShape(8.dp) +/** + * Edge insets for the bar. + * + * Asymmetric because the leading glyph sits in a 44.dp tap target whose padding already supplies + * some optical inset, while the trailing action's does the same on the other side. + */ +internal val HeaderInsetStart = 12.dp +internal val HeaderInsetEnd = 8.dp + /** * A minimum-48x40 tap target wrapping a small icon. * @@ -273,39 +285,151 @@ fun NoiseSessionIcon( // The pre-redesign colours for the first two states were `0x87878700`, i.e. alpha 0x87 with // an all-but-transparent RGB - the icons were effectively invisible. They now use the // palette's secondary text colour. - val (icon, color, contentDescription) = when (sessionState) { + val (iconRes, color, contentDescription) = when (sessionState) { "uninitialized" -> Triple( - Icons.Outlined.NoEncryption, + R.drawable.ic_spec_lock_open, colorScheme.onSurfaceVariant, stringResource(R.string.cd_ready_for_handshake) ) "handshaking" -> Triple( - Icons.Outlined.Sync, + R.drawable.ic_spec_sync, colorScheme.onSurfaceVariant, stringResource(R.string.cd_handshake_in_progress) ) "established" -> Triple( - Icons.Filled.Lock, - palette.accentOrange, + R.drawable.ic_spec_lock, + colorScheme.primary, stringResource(R.string.cd_encrypted) ) else -> { // "failed" or any other state Triple( - Icons.Outlined.Warning, + R.drawable.ic_spec_warning, colorScheme.error, stringResource(R.string.cd_handshake_failed) ) } } - + Icon( - imageVector = icon, + painter = painterResource(iconRes), contentDescription = contentDescription, modifier = modifier, tint = color ) } +/** + * Reachability glyph for a conversation, drawn from the same spec set the main header uses. + * + * Mirrors the main header's channel button: a globe for anything reached over the internet, the + * range mark for the local mesh, and the more specific transport glyph when we know it. + */ +@DrawableRes +internal fun conversationTransportIcon( + isReachedOverInternet: Boolean, + isWifiAware: Boolean, + isDirect: Boolean +): Int = when { + isReachedOverInternet -> R.drawable.ic_spec_globe + isWifiAware -> R.drawable.ic_spec_wifi + isDirect -> R.drawable.ic_spec_bluetooth + else -> R.drawable.ic_spec_routed +} + +/** + * The shared chrome for a conversation header — private chats and channels alike. + * + * Deliberately built from the same tokens as [MainHeader] rather than from `TopAppBar`: identical + * height, identical 12/8.dp edge insets, the leading glyph in a [HeaderTapTarget]-sized slot so it + * lands exactly where the brand mark does, the same -6.dp optical nudge pulling the title toward + * that glyph, and the same [HeaderTextSize]. Anything less and the header visibly shifts as you + * move between the main timeline and a conversation. + * + * Actions are right-aligned and unweighted, so a long title yields space to them rather than + * pushing them off screen. + */ +@Composable +fun ConversationHeader( + @DrawableRes leadingIconRes: Int, + leadingIconTint: Color, + title: String, + modifier: Modifier = Modifier, + onTitleClick: (() -> Unit)? = null, + leadingContentDescription: String? = null, + actions: @Composable RowScope.() -> Unit = {} +) { + val colorScheme = MaterialTheme.colorScheme + + Row( + modifier = modifier + .fillMaxWidth() + .height(ChatHeaderHeight) + .padding(start = HeaderInsetStart, end = HeaderInsetEnd), + verticalAlignment = Alignment.CenterVertically + ) { + Row( + modifier = Modifier.weight(1f), + verticalAlignment = Alignment.CenterVertically + ) { + Box( + modifier = Modifier.size(HeaderTapTarget), + contentAlignment = Alignment.Center + ) { + Icon( + painter = painterResource(leadingIconRes), + contentDescription = leadingContentDescription, + modifier = Modifier.size(HeaderIconSize), + tint = leadingIconTint + ) + } + + // Same optical correction as the main header: the 44.dp tap target leaves more gap + // than the design wants between glyph and label. + Text( + text = title, + style = MaterialTheme.typography.bodyMedium, + fontSize = HeaderTextSize, + fontWeight = FontWeight.Medium, + color = colorScheme.primary, + maxLines = 1, + overflow = TextOverflow.Ellipsis, + modifier = Modifier + .offset(x = (-6).dp) + .then( + if (onTitleClick != null) { + Modifier + .clip(HeaderClusterShape) + .pressScaleClickable(onClick = onTitleClick) + .padding(horizontal = 6.dp, vertical = 4.dp) + } else { + Modifier + } + ) + ) + } + + Row( + verticalAlignment = Alignment.CenterVertically, + horizontalArrangement = Arrangement.spacedBy(2.dp), + content = actions + ) + } +} + +/** An action slot in a [ConversationHeader], matching the main header's icon buttons. */ +@Composable +fun ConversationHeaderAction( + onClick: () -> Unit, + contentDescription: String?, + modifier: Modifier = Modifier, + content: @Composable () -> Unit +) = HeaderIconButton( + onClick = onClick, + contentDescription = contentDescription, + modifier = modifier, + content = content +) + @Composable fun NicknameEditor( value: String, @@ -486,51 +610,27 @@ private fun ChannelHeader( ) { val colorScheme = MaterialTheme.colorScheme - Box(modifier = Modifier.fillMaxWidth()) { - // Back: a chevron alone is unambiguous here and buys back ~40.dp of title space that - // the old "< back" label consumed. - HeaderIconButton( + // No back affordance: the close action on the right is the way out, exactly as in a private + // chat. Leaving the channel outright lives on its row in the network sheet, so it does not + // need a second, easily-mistaken home next to the exit. + ConversationHeader( + leadingIconRes = R.drawable.ic_spec_chat_bubbles, + leadingIconTint = colorScheme.primary, + leadingContentDescription = null, + title = "#$channel", + onTitleClick = onSidebarClick + ) { + ConversationHeaderAction( onClick = onBackClick, - contentDescription = stringResource(R.string.back), - modifier = Modifier.align(Alignment.CenterStart) + contentDescription = stringResource(R.string.close_plain) ) { Icon( - imageVector = Icons.AutoMirrored.Filled.ArrowBack, - contentDescription = stringResource(R.string.back), + painter = painterResource(R.drawable.ic_spec_close), + contentDescription = stringResource(R.string.close_plain), modifier = Modifier.size(HeaderIconSize), - tint = colorScheme.primary + tint = colorScheme.onSurfaceVariant ) } - - // Title - perfectly centered regardless of other elements - Text( - text = "#$channel", - style = MaterialTheme.typography.titleMedium, - fontSize = HeaderTextSize, - color = colorScheme.primary, - modifier = Modifier - .align(Alignment.Center) - .clip(HeaderClusterShape) - .pressScaleClickable(onClick = onSidebarClick) - .heightIn(min = HeaderTapTarget) - .wrapContentHeight(Alignment.CenterVertically) - .padding(horizontal = 10.dp) - ) - - // Leave button - positioned on the right - Text( - text = stringResource(R.string.chat_leave), - style = MaterialTheme.typography.labelMedium, - fontSize = 15.sp, - color = colorScheme.error, - modifier = Modifier - .align(Alignment.CenterEnd) - .clip(HeaderClusterShape) - .pressScaleClickable(onClick = onLeaveChannel) - .heightIn(min = HeaderTapTarget) - .wrapContentHeight(Alignment.CenterVertically) - .padding(horizontal = 10.dp) - ) } } @@ -556,7 +656,10 @@ private fun MainHeader( val geohashPeople by viewModel.geohashPeople.collectAsStateWithLifecycle() Row( - modifier = Modifier.fillMaxWidth(), + modifier = Modifier + .fillMaxWidth() + .height(ChatHeaderHeight) + .padding(start = HeaderInsetStart, end = HeaderInsetEnd), verticalAlignment = Alignment.CenterVertically ) { // MARK: - Identity cluster. @@ -615,7 +718,7 @@ private fun MainHeader( contentDescription = stringResource(R.string.cd_unread_private_messages) ) { Icon( - imageVector = Icons.Filled.Email, + painter = painterResource(R.drawable.ic_spec_envelope), contentDescription = stringResource(R.string.cd_unread_private_messages), modifier = Modifier.size(HeaderIconSize), tint = palette.accentOrange diff --git a/app/src/main/java/com/bitchat/android/ui/ChatScreen.kt b/app/src/main/java/com/bitchat/android/ui/ChatScreen.kt index 60fd7d4a..e9c8e343 100644 --- a/app/src/main/java/com/bitchat/android/ui/ChatScreen.kt +++ b/app/src/main/java/com/bitchat/android/ui/ChatScreen.kt @@ -62,6 +62,8 @@ fun ChatScreen(viewModel: ChatViewModel) { val colorScheme = MaterialTheme.colorScheme val messages by viewModel.messages.collectAsStateWithLifecycle() val connectedPeers by viewModel.connectedPeers.collectAsStateWithLifecycle() + val peerNicknames by viewModel.peerNicknames.collectAsStateWithLifecycle() + val geohashPeople by viewModel.geohashPeople.collectAsStateWithLifecycle() val nickname by viewModel.nickname.collectAsStateWithLifecycle() val selectedPrivatePeer by viewModel.selectedPrivateChatPeer.collectAsStateWithLifecycle() val currentChannel by viewModel.currentChannel.collectAsStateWithLifecycle() @@ -197,6 +199,33 @@ fun ChatScreen(viewModel: ChatViewModel) { } } + val mentionPeerIdentities = remember( + displayMessages, + currentChannel, + selectedLocationChannel, + connectedPeers, + peerNicknames, + geohashPeople, + ) { + val knownPeers = if ( + currentChannel == null && selectedLocationChannel is ChannelID.Location + ) { + val duplicateNames = duplicateGeohashBaseNames(geohashPeople) + geohashPeople.mapNotNull { person -> + if (isUnannouncedNickname(person.displayName)) return@mapNotNull null + val displayName = disambiguatedGeohashDisplayName(person, duplicateNames) + displayName to PeerIdentity.nostr(person.id) + } + } else { + connectedPeers.mapNotNull { peerID -> + peerNicknames[peerID]?.let { displayName -> + displayName to PeerIdentity.mesh(peerID) + } + } + } + buildMentionPeerIdentityMap(displayMessages, knownPeers) + } + // Determine whether to show media buttons (only hide in geohash location chats) val showMediaButtons = when { currentChannel != null -> true @@ -238,6 +267,7 @@ fun ChatScreen(viewModel: ChatViewModel) { messages = displayMessages, currentUserNickname = nickname, meshService = viewModel.meshServiceFacade, + mentionPeerIdentities = mentionPeerIdentities, modifier = Modifier.fillMaxSize(), conversationKey = conversationKey, contentPadding = PaddingValues( @@ -350,6 +380,7 @@ fun ChatScreen(viewModel: ChatViewModel) { commandSuggestions = commandSuggestions, showMentionSuggestions = showMentionSuggestions, mentionSuggestions = mentionSuggestions, + mentionPeerIdentities = mentionPeerIdentities, onCommandSuggestionClick = { suggestion: CommandSuggestion -> val commandText = viewModel.selectCommandSuggestion(suggestion) messageText = TextFieldValue( @@ -375,7 +406,6 @@ fun ChatScreen(viewModel: ChatViewModel) { // Floating header - positioned absolutely at top, ignores keyboard ChatFloatingHeader( - headerHeight = headerHeight, selectedPrivatePeer = null, currentChannel = currentChannel, nickname = nickname, @@ -558,6 +588,7 @@ fun ChatInputSection( commandSuggestions: List, showMentionSuggestions: Boolean, mentionSuggestions: List, + mentionPeerIdentities: Map = emptyMap(), onCommandSuggestionClick: (CommandSuggestion) -> Unit, onMentionSuggestionClick: (String) -> Unit, selectedPrivatePeer: String?, @@ -624,6 +655,7 @@ fun ChatInputSection( Column { MentionSuggestionsBox( suggestions = displayedMentionSuggestions, + mentionPeerIdentities = mentionPeerIdentities, onSuggestionClick = onMentionSuggestionClick, modifier = Modifier.fillMaxWidth() ) @@ -641,6 +673,7 @@ fun ChatInputSection( currentChannel = currentChannel, nickname = nickname, showMediaButtons = showMediaButtons, + mentionPeerIdentities = mentionPeerIdentities, modifier = Modifier.fillMaxWidth() ) } @@ -664,7 +697,6 @@ private const val BarBackgroundAlpha = 0.88f private const val HeaderOpaqueStop = 0.72f @Composable private fun ChatFloatingHeader( - headerHeight: Dp, selectedPrivatePeer: String?, currentChannel: String?, nickname: String, @@ -696,38 +728,31 @@ private fun ChatFloatingHeader( ) .windowInsetsPadding(WindowInsets.statusBars) // Extend into status bar area ) { - // A plain Row rather than M3's TopAppBar. TopAppBar silently injects a 4.dp horizontal - // pad plus a 12.dp title inset and applies its own minimum heights, which made the - // header's spacing impossible to specify exactly. - Row( - modifier = Modifier - .fillMaxWidth() - .height(headerHeight) - .padding(start = 12.dp, end = 8.dp), - verticalAlignment = Alignment.CenterVertically - ) { - ChatHeaderContent( - selectedPrivatePeer = selectedPrivatePeer, - currentChannel = currentChannel, - nickname = nickname, - viewModel = viewModel, - onBackClick = { - when { - selectedPrivatePeer != null -> viewModel.endPrivateChat() - currentChannel != null -> viewModel.switchToChannel(null) - } - }, - onSidebarClick = onSidebarToggle, - onTripleClick = onPanicClear, - onShowAppInfo = onShowAppInfo, - onLocationChannelsClick = onLocationChannelsClick, - onLocationNotesClick = { - // Ensure location is loaded before showing sheet - locationManager.refreshChannels() - onLocationNotesClick() + // No TopAppBar: it silently injects a 4.dp horizontal pad plus a 12.dp title inset and + // applies its own minimum heights, which made the header's spacing impossible to specify + // exactly. Height and edge insets belong to each header variant, so that a conversation + // header rendered here and one rendered in a sheet are laid out identically. + ChatHeaderContent( + selectedPrivatePeer = selectedPrivatePeer, + currentChannel = currentChannel, + nickname = nickname, + viewModel = viewModel, + onBackClick = { + when { + selectedPrivatePeer != null -> viewModel.endPrivateChat() + currentChannel != null -> viewModel.switchToChannel(null) } - ) - } + }, + onSidebarClick = onSidebarToggle, + onTripleClick = onPanicClear, + onShowAppInfo = onShowAppInfo, + onLocationChannelsClick = onLocationChannelsClick, + onLocationNotesClick = { + // Ensure location is loaded before showing sheet + locationManager.refreshChannels() + onLocationNotesClick() + } + ) } } diff --git a/app/src/main/java/com/bitchat/android/ui/ChatUIUtils.kt b/app/src/main/java/com/bitchat/android/ui/ChatUIUtils.kt index 14676d07..d2ab06d3 100644 --- a/app/src/main/java/com/bitchat/android/ui/ChatUIUtils.kt +++ b/app/src/main/java/com/bitchat/android/ui/ChatUIUtils.kt @@ -10,7 +10,7 @@ import com.bitchat.android.model.BitchatMessage import com.bitchat.android.ui.theme.BASE_FONT_SIZE import com.bitchat.android.ui.theme.BitchatPalette import com.bitchat.android.ui.theme.ChatVisualTokens -import com.bitchat.android.ui.theme.colorForPeerSeed +import com.bitchat.android.ui.theme.colorForPeer import java.text.SimpleDateFormat import java.util.* @@ -31,6 +31,15 @@ internal const val MENTION_CHIP_ALPHA = ChatVisualTokens.HighlightAlpha /** Background opacity for a mention chip referring to you. Slightly stronger to catch the eye. */ internal const val MENTION_CHIP_ALPHA_SELF = ChatVisualTokens.HighlightAlpha +/** + * Mention token grammar shared by rendered messages and the composer. + * + * The optional `#abcd` suffix is part of the mention because it disambiguates peers that use the + * same nickname. Keeping one regex prevents the composer from styling only `@name` while the + * rendered transcript styles the complete token. + */ +internal val MENTION_TOKEN_REGEX = Regex("@([\\p{L}0-9_]+(?:#[a-fA-F0-9]{4})?)") + /** * Get RSSI-based color for signal strength visualization */ @@ -61,7 +70,7 @@ fun formatTextMessageSender( val senderColor = if (isSelf) { palette.accentOrange } else { - colorForPeerSeed(peerColorSeedForMessage(message), palette) + colorForPeer(peerIdentityForMessage(message), palette) } val senderWeight = FontWeight.SemiBold val (baseName, suffix) = splitSuffix(message.sender) @@ -193,6 +202,7 @@ fun formatTextMessageBody( palette: BitchatPalette, contentColor: Color, linkColor: Color, + mentionPeerIdentities: Map = emptyMap(), timeFormatter: SimpleDateFormat = SimpleDateFormat(CHAT_TIMESTAMP_PATTERN, Locale.getDefault()), includeTimestamp: Boolean = true ): AnnotatedString { @@ -205,6 +215,7 @@ fun formatTextMessageBody( palette = palette, contentColor = contentColor, linkColor = linkColor, + mentionPeerIdentities = mentionPeerIdentities, ) if (includeTimestamp) { @@ -267,7 +278,7 @@ fun formatMessageHeaderAnnotatedString( val baseColor = if (isSelf) { palette.accentOrange } else { - colorForPeerSeed(peerColorSeedForMessage(message), palette) + colorForPeer(peerIdentityForMessage(message), palette) } val (baseName, suffix) = splitSuffix(message.sender) @@ -326,6 +337,71 @@ fun splitSuffix(name: String): Pair { return Pair(name, "") } +/** + * Build a case-insensitive mention-token lookup from canonical peer identities. + * + * Suffixed names such as `alice#04af` resolve exactly. Their unsuffixed base is only retained when + * it identifies one peer; ambiguous bases are deliberately omitted rather than coloring a mention + * as the wrong person. + */ +internal fun buildMentionPeerIdentityMap( + messages: List, + knownPeers: List> = emptyList(), +): Map { + val candidates = linkedMapOf>() + + fun add(displayName: String, identity: PeerIdentity) { + val normalizedName = displayName.trim().removePrefix("@") + if (normalizedName.isEmpty()) return + + val (baseName, suffix) = splitSuffix(normalizedName) + val exactKey = normalizedName.lowercase(Locale.ROOT) + candidates.getOrPut(exactKey) { linkedSetOf() }.add(identity) + + if (suffix.isNotEmpty()) { + val baseKey = baseName.lowercase(Locale.ROOT) + candidates.getOrPut(baseKey) { linkedSetOf() }.add(identity) + } + } + + messages + .asSequence() + .filterNot { it.sender == "system" } + .forEach { add(it.sender, peerIdentityForMessage(it)) } + knownPeers.forEach { (displayName, identity) -> add(displayName, identity) } + + return candidates.mapNotNull { (token, identities) -> + identities.singleOrNull()?.let { token to it } + }.toMap() +} + +internal fun resolveMentionPeerIdentity( + mention: String, + mentionPeerIdentities: Map, +): PeerIdentity? { + val mentionWithoutAt = mention.trim().removePrefix("@") + val baseName = splitSuffix(mentionWithoutAt).first + return mentionPeerIdentities[mentionWithoutAt.lowercase(Locale.ROOT)] + ?: mentionPeerIdentities[baseName.lowercase(Locale.ROOT)] +} + +/** + * Resolve the deterministic color for a mention on every surface that displays one. + * + * Exact suffixed tokens win; an unsuffixed nickname is only present in the identity map when it is + * unambiguous. The nickname fallback preserves the legacy behavior for peers with no stable ID. + */ +internal fun colorForMention( + mention: String, + mentionPeerIdentities: Map, + palette: BitchatPalette, +): Color { + val mentionWithoutAt = mention.trim().removePrefix("@") + val identity = resolveMentionPeerIdentity(mentionWithoutAt, mentionPeerIdentities) + ?: PeerIdentity.nickname(mentionWithoutAt) + return colorForPeer(identity, palette) +} + /** * A bare `anon` label means the geohash heartbeat has not announced a username yet. The transport * may append a `#abcd` disambiguator, which does not turn it into an announced name. Names such as @@ -356,13 +432,12 @@ private fun appendIOSFormattedContent( palette: BitchatPalette, contentColor: Color, linkColor: Color, + mentionPeerIdentities: Map, ) { - // iOS-style patterns: allow optional '#abcd' suffix in mentions val hashtagPattern = "#([a-zA-Z0-9_]+)".toRegex() - val mentionPattern = "@([\\p{L}0-9_]+(?:#[a-fA-F0-9]{4})?)".toRegex() val hashtagMatches = hashtagPattern.findAll(content).toList() - val mentionMatches = mentionPattern.findAll(content).toList() + val mentionMatches = MENTION_TOKEN_REGEX.findAll(content).toList() // Combine and sort matches, but exclude hashtags that overlap with mentions val mentionRanges = mentionMatches.map { it.range } @@ -462,10 +537,10 @@ private fun appendIOSFormattedContent( val mentionColor = if (isMentionToMe) { palette.accentOrange } else { - // Tint by the *mentioned* peer so a given name looks identical everywhere. - colorForPeerSeed( - PeerColorSeed(mentionWithoutAt.lowercase(Locale.ROOT)), - palette + colorForMention( + mention = mentionWithoutAt, + mentionPeerIdentities = mentionPeerIdentities, + palette = palette, ) } val chipAlpha = if (isMentionToMe) MENTION_CHIP_ALPHA_SELF else MENTION_CHIP_ALPHA diff --git a/app/src/main/java/com/bitchat/android/ui/ChatViewModel.kt b/app/src/main/java/com/bitchat/android/ui/ChatViewModel.kt index 87e6104e..72507d8b 100644 --- a/app/src/main/java/com/bitchat/android/ui/ChatViewModel.kt +++ b/app/src/main/java/com/bitchat/android/ui/ChatViewModel.kt @@ -355,17 +355,9 @@ class ChatViewModel( /** * Ensure Nostr DM subscription for a geohash conversation key if known - * Minimal-change approach: reflectively access GeohashViewModel internals to reuse pipeline */ private fun ensureGeohashDMSubscriptionIfNeeded(convKey: String) { - try { - val gh = geohashViewModel.conversationGeohash(convKey) - if (!gh.isNullOrEmpty()) { - com.bitchat.android.nostr.NostrBackgroundRuntime.ensureConversationDm(gh) - } - } catch (e: Exception) { - Log.w(TAG, "ensureGeohashDMSubscriptionIfNeeded failed: ${e.message}") - } + geohashViewModel.ensureGeohashDMSubscriptionForConversation(convKey) } // MARK: - Channel Management (delegated) @@ -931,6 +923,11 @@ class ChatViewModel( fun panicClearAllData() { Log.w(TAG, "🚨 PANIC MODE ACTIVATED - Clearing all sensitive data") + try { + com.bitchat.android.geohash.LocationChannelManager + .getInstance(getApplication()) + .disableLocationServices() + } catch (_: Exception) { } // A pending one-shot downgrade confirmation must not survive panic or // become actionable against the fresh post-wipe identity. @@ -1074,8 +1071,14 @@ class ChatViewModel( /** * Begin sampling multiple geohashes for participant activity */ - fun beginGeohashSampling(geohashes: List) { - geohashViewModel.beginGeohashSampling(geohashes) + fun beginGeohashSampling( + liveLocationGeohashes: Collection, + userSelectedGeohashes: Collection, + ) { + geohashViewModel.beginGeohashSampling( + liveLocationGeohashes = liveLocationGeohashes, + userSelectedGeohashes = userSelectedGeohashes + ) } /** @@ -1166,17 +1169,17 @@ class ChatViewModel( } } - // MARK: - iOS-Compatible Color System + // MARK: - Canonical peer identities /** - * Get consistent color for a mesh peer by ID (iOS-compatible) + * Return the stable identity used by every UI surface to color a mesh peer. */ - fun peerColorSeedForMeshPeer(peerID: String): PeerColorSeed = meshPeerColorSeed(peerID) + fun peerIdentityForMeshPeer(peerID: String): PeerIdentity = PeerIdentity.mesh(peerID) /** - * Get consistent color for a Nostr pubkey (iOS-compatible) + * Return the stable identity used by every UI surface to color a Nostr peer. */ - fun peerColorSeedForNostrPubkey(pubkeyHex: String): PeerColorSeed = - geohashViewModel.peerColorSeedForNostrPubkey(pubkeyHex) + fun peerIdentityForNostrPubkey(pubkeyHex: String): PeerIdentity = + geohashViewModel.peerIdentityForNostrPubkey(pubkeyHex) } diff --git a/app/src/main/java/com/bitchat/android/ui/CommandProcessor.kt b/app/src/main/java/com/bitchat/android/ui/CommandProcessor.kt index 4ac9344a..34b205af 100644 --- a/app/src/main/java/com/bitchat/android/ui/CommandProcessor.kt +++ b/app/src/main/java/com/bitchat/android/ui/CommandProcessor.kt @@ -457,11 +457,20 @@ class CommandProcessor( // Location channel: use geohash participants with collision-resistant suffixes val geohashPeople = viewModel.geohashPeople.value val currentNickname = state.getNicknameValue() + val duplicateNames = duplicateGeohashBaseNames(geohashPeople) geohashPeople.mapNotNull { person -> - val displayName = person.displayName - // Exclude self from suggestions - if (displayName.startsWith("${currentNickname}#")) { + val baseName = splitSuffix(person.displayName).first + val hasNicknameCollision = + baseName.lowercase(Locale.ROOT) in duplicateNames + val displayName = disambiguatedGeohashDisplayName(person, duplicateNames) + // A unique local nickname can be excluded directly. If it collides, the + // nickname alone cannot identify which row is self, so keep the suffixed + // rows rather than accidentally hiding the other user. + if ( + !hasNicknameCollision && + baseName.equals(currentNickname, ignoreCase = true) + ) { null } else { displayName diff --git a/app/src/main/java/com/bitchat/android/ui/DataManager.kt b/app/src/main/java/com/bitchat/android/ui/DataManager.kt index b338c864..4f37d47a 100644 --- a/app/src/main/java/com/bitchat/android/ui/DataManager.kt +++ b/app/src/main/java/com/bitchat/android/ui/DataManager.kt @@ -3,6 +3,7 @@ package com.bitchat.android.ui import android.content.Context import android.content.SharedPreferences import android.util.Log +import com.bitchat.android.geohash.DEFAULT_LIVE_LOCATION_ENABLED import com.google.gson.Gson import kotlin.random.Random @@ -54,7 +55,7 @@ class DataManager(private val context: Context) { fun saveLastGeohashChannel(channelData: String) { prefs.edit().putString("last_geohash_channel", channelData).apply() - Log.d(TAG, "Saved last geohash channel: $channelData") + Log.d(TAG, "Saved last geohash channel") } fun clearLastGeohashChannel() { @@ -65,12 +66,12 @@ class DataManager(private val context: Context) { // MARK: - Location Services State fun saveLocationServicesEnabled(enabled: Boolean) { - prefs.edit().putBoolean("location_services_enabled", enabled).apply() + prefs.edit().putBoolean("location_services_enabled", enabled).commit() Log.d(TAG, "Saved location services enabled state: $enabled") } fun isLocationServicesEnabled(): Boolean { - return prefs.getBoolean("location_services_enabled", true) // Default to enabled + return prefs.getBoolean("location_services_enabled", DEFAULT_LIVE_LOCATION_ENABLED) } // MARK: - Channel Data Management diff --git a/app/src/main/java/com/bitchat/android/ui/GeohashPeopleList.kt b/app/src/main/java/com/bitchat/android/ui/GeohashPeopleList.kt index 8f65bbb1..0cf88b74 100644 --- a/app/src/main/java/com/bitchat/android/ui/GeohashPeopleList.kt +++ b/app/src/main/java/com/bitchat/android/ui/GeohashPeopleList.kt @@ -17,7 +17,7 @@ import androidx.compose.ui.res.stringResource import androidx.compose.ui.res.painterResource import androidx.lifecycle.compose.collectAsStateWithLifecycle import com.bitchat.android.ui.theme.BitchatFontFamily -import com.bitchat.android.ui.theme.colorForPeerSeed +import com.bitchat.android.ui.theme.colorForPeer import com.bitchat.android.R import com.bitchat.android.ui.theme.LocalBitchatPalette import java.util.* @@ -91,13 +91,8 @@ fun GeohashPeopleList( val teleportedPersonIds = remember(sections.teleportedIn) { sections.teleportedIn.mapTo(mutableSetOf()) { it.id.lowercase(Locale.ROOT) } } - val baseNameCounts = remember(displayedPeople) { - buildMap { - displayedPeople.forEach { person -> - val baseName = splitSuffix(person.displayName).first - put(baseName, (get(baseName) ?: 0) + 1) - } - } + val duplicateBaseNames = remember(displayedPeople) { + duplicateGeohashBaseNames(displayedPeople) } Column(modifier = modifier) { @@ -141,7 +136,9 @@ fun GeohashPeopleList( hasUnreadDM = unreadPrivateMessages.contains("nostr_${person.id.take(16)}"), isTeleported = personIsTeleported, viewModel = viewModel, - showHashSuffix = (baseNameCounts[splitSuffix(person.displayName).first] ?: 0) > 1, + showHashSuffix = splitSuffix(person.displayName) + .first + .lowercase(Locale.ROOT) in duplicateBaseNames, onTap = { if (!isMe) { viewModel.startGeohashDM(person.id) @@ -175,6 +172,39 @@ internal data class GeohashPeopleSections( val teleportedIn: List ) +/** + * Names that require a short identity suffix, calculated across both people sections. + * + * Matching is case-insensitive to mirror geohash chat's nickname collision handling. + */ +internal fun duplicateGeohashBaseNames(people: List): Set = + people + .groupingBy { splitSuffix(it.displayName).first.lowercase(Locale.ROOT) } + .eachCount() + .filterValues { it > 1 } + .keys + +/** + * The same `#abcd` disambiguator used by geohash chat. + * + * Presence rows normally carry only a base nickname, so derive the suffix from the full Nostr + * public key when a collision exists. Preserve an already-announced suffix for compatibility. + */ +internal fun geohashIdentitySuffix(person: GeoPerson, showHashSuffix: Boolean): String { + if (!showHashSuffix) return "" + val announcedSuffix = splitSuffix(person.displayName).second + return announcedSuffix.ifEmpty { "#${person.id.takeLast(4)}" } +} + +internal fun disambiguatedGeohashDisplayName( + person: GeoPerson, + duplicateBaseNames: Set, +): String { + val baseName = splitSuffix(person.displayName).first + val showSuffix = baseName.lowercase(Locale.ROOT) in duplicateBaseNames + return baseName + geohashIdentitySuffix(person, showSuffix) +} + /** * Split announced identities by how they entered this geohash. Bare `anon` heartbeat identities * are omitted, while announced names such as `anon1234` remain ordinary participants. Self is @@ -249,11 +279,11 @@ private fun GeohashPersonItem( if (isTeleported) R.drawable.ic_spec_teleport else R.drawable.ic_spec_on_location_person - val (baseNameRaw, suffixRaw) = splitSuffix(person.displayName) + val (baseNameRaw, _) = splitSuffix(person.displayName) val baseName = truncateNickname(baseNameRaw) - val suffix = if (showHashSuffix) suffixRaw else "" - val assignedColor = colorForPeerSeed( - viewModel.peerColorSeedForNostrPubkey(person.id), + val suffix = geohashIdentitySuffix(person, showHashSuffix) + val assignedColor = colorForPeer( + viewModel.peerIdentityForNostrPubkey(person.id), palette ) val baseColor = if (isMe) palette.accentOrange else assignedColor @@ -314,7 +344,7 @@ private fun GeohashPersonItem( text = suffix, fontFamily = BitchatFontFamily, fontSize = 14.sp, - fontWeight = if (isMe) FontWeight.Bold else FontWeight.Medium, + fontWeight = FontWeight.Normal, color = baseColor.copy(alpha = SUFFIX_ALPHA) ) } diff --git a/app/src/main/java/com/bitchat/android/ui/GeohashViewModel.kt b/app/src/main/java/com/bitchat/android/ui/GeohashViewModel.kt index 2e74f3e0..dbc312b5 100644 --- a/app/src/main/java/com/bitchat/android/ui/GeohashViewModel.kt +++ b/app/src/main/java/com/bitchat/android/ui/GeohashViewModel.kt @@ -8,10 +8,12 @@ import androidx.lifecycle.Lifecycle import androidx.lifecycle.LifecycleOwner import androidx.lifecycle.ProcessLifecycleOwner import androidx.lifecycle.viewModelScope +import com.bitchat.android.geohash.GeohashNostrPrivacyPolicy +import com.bitchat.android.geohash.LiveLocationPrivacyGate import com.bitchat.android.nostr.GeohashMessageHandler import com.bitchat.android.nostr.GeohashRepository -import com.bitchat.android.nostr.NostrDirectMessageHandler import com.bitchat.android.nostr.NostrBackgroundRuntime +import com.bitchat.android.nostr.NostrDirectMessageHandler import com.bitchat.android.nostr.NostrIdentityBridge import com.bitchat.android.nostr.NostrProtocol import com.bitchat.android.nostr.NostrRelayManager @@ -25,7 +27,7 @@ import kotlinx.coroutines.flow.StateFlow import kotlinx.coroutines.launch import java.util.Date import kotlinx.coroutines.isActive -import kotlinx.coroutines.Dispatchers +import java.util.UUID class GeohashViewModel( application: Application, @@ -69,6 +71,19 @@ class GeohashViewModel( private var geoTimer: Job? = null private var locationChannelManager: com.bitchat.android.geohash.LocationChannelManager? = null private val activeSamplingGeohashes = mutableSetOf() + private val samplingSubscriptionIds = mutableMapOf() + private val liveSamplingSubscriptionGeohashes = mutableSetOf() + private var requestedLiveSamplingGeohashes: Set = emptySet() + private var requestedUserSamplingGeohashes: Set = emptySet() + private val liveLocationRevocationListener: () -> Unit = { + val revokedLiveGeohashes = liveSamplingSubscriptionGeohashes.toSet() + revokedLiveGeohashes.forEach { geohash -> + samplingSubscriptionIds.remove(geohash) + activeSamplingGeohashes.remove(geohash) + } + liveSamplingSubscriptionGeohashes.clear() + requestedLiveSamplingGeohashes = emptySet() + } // Geohash of the currently selected Location channel (null for Mesh/none). private var activeChannelGeohash: String? = null @@ -77,6 +92,10 @@ class GeohashViewModel( val geohashParticipantCounts: StateFlow> = state.geohashParticipantCounts val selectedLocationChannel: StateFlow = state.selectedLocationChannel + init { + LiveLocationPrivacyGate.addRevocationListener(liveLocationRevocationListener) + } + fun initialize() { // Observe process lifecycle to manage background sampling kotlin.runCatching { @@ -86,8 +105,12 @@ class GeohashViewModel( locationChannelManager = com.bitchat.android.geohash.LocationChannelManager.getInstance(getApplication()) NostrBackgroundRuntime.attachHandlers( NostrBackgroundRuntime.Handlers( - accountDm = { event, identity -> dmHandler.onGiftWrap(event, "", identity) }, - geohashMessage = { event, geohash -> geohashMessageHandler.onEvent(event, geohash) }, + accountDm = { event, identity -> + dmHandler.onGiftWrap(event, "", identity) + }, + geohashMessage = { event, geohash -> + geohashMessageHandler.onEvent(event, geohash) + }, geohashDm = { event, geohash, identity -> dmHandler.onGiftWrap(event, geohash, identity) } @@ -127,6 +150,17 @@ class GeohashViewModel( fun sendGeohashMessage(content: String, channel: com.bitchat.android.geohash.GeohashChannel, myPeerID: String, nickname: String?) { viewModelScope.launch { try { + val canUseChannel = locationChannelManager + ?.canUseSelectedLocationChannel(channel) == true + if (!canUseChannel) { + Log.w(TAG, "Blocked message to a stale live-location channel") + return@launch + } + val isLiveDerived = locationChannelManager + ?.isSelectedChannelLiveDerived(channel) == true + val liveLocationToken = locationChannelManager + ?.liveLocationTokenForSelectedChannel(channel) + if (isLiveDerived && liveLocationToken == null) return@launch val tempId = "temp_${System.currentTimeMillis()}_${kotlin.random.Random.nextInt(1000)}" val pow = PoWPreferenceManager.getCurrentSettings() val localMsg = com.bitchat.android.model.BitchatMessage( @@ -140,40 +174,73 @@ class GeohashViewModel( powDifficulty = if (pow.enabled) pow.difficulty else null ) messageManager.addChannelMessage("geo:${channel.geohash}", localMsg) - val identity = NostrIdentityBridge.deriveIdentity(forGeohash = channel.geohash, context = getApplication()) - val teleported = state.isTeleported.value - val event = NostrProtocol.createEphemeralGeohashEvent(content, channel.geohash, identity, nickname, teleported) + val identity = NostrIdentityBridge.deriveIdentity( + forGeohash = channel.geohash, + context = getApplication() + ) + val teleported = locationChannelManager?.teleported?.value + ?: state.isTeleported.value + val event = NostrProtocol.createEphemeralGeohashEvent( + content, + channel.geohash, + identity, + nickname, + teleported + ) val relayManager = NostrRelayManager.getInstance(getApplication()) - relayManager.sendEventToGeohash(event, channel.geohash, includeDefaults = false, nRelays = 5) + relayManager.sendEventToGeohash( + event, + channel.geohash, + includeDefaults = false, + nRelays = 5, + liveLocationToken = liveLocationToken + ) } catch (e: Exception) { Log.e(TAG, "Failed to send geohash message: ${e.message}") } } } - fun beginGeohashSampling(geohashes: List) { - if (geohashes.isEmpty()) { - endGeohashSampling() - return - } - - // Diffing logic to avoid redundant REQ and leaks + fun beginGeohashSampling( + liveLocationGeohashes: Collection, + userSelectedGeohashes: Collection, + ) { + requestedLiveSamplingGeohashes = liveLocationGeohashes.toSet() + requestedUserSamplingGeohashes = userSelectedGeohashes.toSet() + reconcileSamplingSubscriptions() + } + + private fun reconcileSamplingSubscriptions() { val currentSet = activeSamplingGeohashes.toSet() - val newSet = geohashes.toSet() + val newSet = GeohashNostrPrivacyPolicy.samplingTargets( + liveLocationGeohashes = requestedLiveSamplingGeohashes, + userSelectedGeohashes = requestedUserSamplingGeohashes, + liveLocationEnabled = LiveLocationPrivacyGate.isEnabled + ) val toRemove = currentSet - newSet val toAdd = newSet - currentSet + val toPromoteToUserSelection = currentSet + .intersect(requestedUserSamplingGeohashes) + .intersect(liveSamplingSubscriptionGeohashes) - if (toAdd.isEmpty() && toRemove.isEmpty()) return + if (toAdd.isEmpty() && toRemove.isEmpty() && toPromoteToUserSelection.isEmpty()) return Log.d(TAG, "🌍 Updating sampling: +${toAdd.size} new, -${toRemove.size} removed") // Remove old subscriptions toRemove.forEach { geohash -> - subscriptionManager.unsubscribe("sampling-$geohash") + unsubscribeSampling(geohash) activeSamplingGeohashes.remove(geohash) } + // A bookmark must remain functional after live access is revoked. Replace a + // live-tagged subscription with an untagged manual subscription immediately. + toPromoteToUserSelection.forEach { geohash -> + unsubscribeSampling(geohash) + if (isAppInForeground()) performSubscribeSampling(geohash) + } + // Add new subscriptions activeSamplingGeohashes.addAll(toAdd) if (isAppInForeground()) { @@ -184,11 +251,13 @@ class GeohashViewModel( } fun endGeohashSampling() { + requestedLiveSamplingGeohashes = emptySet() + requestedUserSamplingGeohashes = emptySet() if (activeSamplingGeohashes.isEmpty()) return Log.d(TAG, "🌍 Ending geohash sampling (cleaning up ${activeSamplingGeohashes.size} subs)") activeSamplingGeohashes.toList().forEach { geohash -> - subscriptionManager.unsubscribe("sampling-$geohash") + unsubscribeSampling(geohash) } activeSamplingGeohashes.clear() } @@ -206,7 +275,7 @@ class GeohashViewModel( GeohashConversationRegistry.set(convKey, gh) } onStartPrivateChat(convKey) - Log.d(TAG, "🗨️ Started geohash DM with ${pubkeyHex} -> ${convKey} (geohash=${gh})") + Log.d(TAG, "🗨️ Started geohash DM") } fun startGeohashDMByNickname(nickname: String, onStartPrivateChat: (String) -> Unit) { @@ -259,12 +328,18 @@ class GeohashViewModel( locationChannelManager?.select(channel) ?: run { Log.w(TAG, "Cannot select location channel - not initialized") } } + fun ensureGeohashDMSubscriptionForConversation(conversationKey: String) { + val geohash = repo.getConversationGeohash(conversationKey) ?: return + NostrBackgroundRuntime.ensureConversationDm(geohash) + } + fun displayNameForNostrPubkeyUI(pubkeyHex: String): String = repo.displayNameForNostrPubkeyUI(pubkeyHex) fun displayNameForGeohashConversation(pubkeyHex: String, sourceGeohash: String): String = repo.displayNameForGeohashConversation(pubkeyHex, sourceGeohash) - fun conversationGeohash(conversationKey: String): String? = repo.getConversationGeohash(conversationKey) + fun conversationGeohash(conversationKey: String): String? = + repo.getConversationGeohash(conversationKey) - fun peerColorSeedForNostrPubkey(pubkeyHex: String): PeerColorSeed = - nostrPeerColorSeed(pubkeyHex) + fun peerIdentityForNostrPubkey(pubkeyHex: String): PeerIdentity = + PeerIdentity.nostr(pubkeyHex) private fun switchLocationChannel(channel: com.bitchat.android.geohash.ChannelID?) { geoTimer?.cancel(); geoTimer = null @@ -280,7 +355,12 @@ class GeohashViewModel( repo.refreshGeohashPeople() } is com.bitchat.android.geohash.ChannelID.Location -> { - Log.d(TAG, "📍 Switching to geohash channel: ${channel.channel.geohash}") + if (locationChannelManager?.canUseSelectedLocationChannel(channel.channel) != true) { + Log.w(TAG, "Ignoring a stale live-location channel selection") + switchLocationChannel(com.bitchat.android.geohash.ChannelID.Mesh) + return + } + Log.d(TAG, "📍 Switching to geohash channel") activeChannelGeohash = channel.channel.geohash repo.setCurrentGeohash(channel.channel.geohash) repo.refreshGeohashPeople() @@ -291,16 +371,19 @@ class GeohashViewModel( try { val identity = NostrIdentityBridge.deriveIdentity(channel.channel.geohash, getApplication()) // We don't update participant here anymore; presence loop handles it via Kind 20001 - val teleported = state.isTeleported.value + val teleported = locationChannelManager?.teleported?.value + ?: state.isTeleported.value if (teleported) repo.markTeleported(identity.publicKeyHex) } catch (e: Exception) { Log.w(TAG, "Failed identity setup: ${e.message}") } startGeoParticipantsTimer() + val liveLocationToken = locationChannelManager + ?.liveLocationTokenForSelectedChannel(channel.channel) // Presence heartbeat firehose (kind 20001) is the high-volume data hog; only // run it in the foreground. It is restored in onStart() and torn down in onStop(). if (isAppInForeground()) { - subscribeChannelPresence(channel.channel.geohash) + subscribeChannelPresence(channel.channel.geohash, liveLocationToken) } } null -> { @@ -316,14 +399,18 @@ class GeohashViewModel( * High-volume; only used to refresh the participant list, so it is torn down in * onStop() and restored in onStart() to cut background mobile data. */ - private fun subscribeChannelPresence(geohash: String) { - val subId = "geohash-presence-$geohash"; currentGeohashPresenceSubId = subId + private fun subscribeChannelPresence( + geohash: String, + liveLocationToken: Long? + ) { + val subId = "geohash-presence-${UUID.randomUUID()}"; currentGeohashPresenceSubId = subId subscriptionManager.subscribeGeohashPresence( geohash = geohash, sinceMs = System.currentTimeMillis() - 3600000L, limit = 200, id = subId, - handler = { event -> geohashMessageHandler.onEvent(event, geohash) } + handler = { event -> geohashMessageHandler.onEvent(event, geohash) }, + liveLocationToken = liveLocationToken ) } @@ -343,16 +430,34 @@ class GeohashViewModel( fun shutdownUiSubscriptions() { subscriptionManager.unsubscribeAllOwned() + geoTimer?.cancel() + geoTimer = null kotlin.runCatching { ProcessLifecycleOwner.get().lifecycle.removeObserver(this) } + LiveLocationPrivacyGate.removeRevocationListener(liveLocationRevocationListener) } override fun onStart(owner: LifecycleOwner) { Log.d(TAG, "🌍 App foregrounded: resuming Nostr streaming") + // Android permission may have changed while backgrounded. Invalidate the + // process-wide token before restoring any subscription or heartbeat. + locationChannelManager?.syncPermissionState() + // Restore the presence heartbeat firehose for the selected geohash channel. // (The chat message stream is kept alive in the background, so it is not restored here.) - activeChannelGeohash?.let { subscribeChannelPresence(it) } + val selected = locationChannelManager?.selectedChannel?.value + val selectedLocation = selected as? com.bitchat.android.geohash.ChannelID.Location + if (selectedLocation != null && + selectedLocation.channel.geohash == activeChannelGeohash && + locationChannelManager?.canUseSelectedLocationChannel(selectedLocation.channel) == true + ) { + subscribeChannelPresence( + selectedLocation.channel.geohash, + locationChannelManager + ?.liveLocationTokenForSelectedChannel(selectedLocation.channel) + ) + } // Resume geohash sampling subscriptions activeSamplingGeohashes.forEach { performSubscribeSampling(it) } // Resume the participant-refresh polling timer if a geohash is selected @@ -367,22 +472,55 @@ class GeohashViewModel( // The chat message stream (kind 20000) is intentionally left active so messages still arrive. currentGeohashPresenceSubId?.let { subscriptionManager.unsubscribe(it); currentGeohashPresenceSubId = null } // Drop geohash sampling subscriptions - activeSamplingGeohashes.forEach { subscriptionManager.unsubscribe("sampling-$it") } + activeSamplingGeohashes.forEach(::unsubscribeSampling) // Stop participant-refresh polling geoTimer?.cancel(); geoTimer = null // Process-owned message and DM subscriptions remain active. } private fun performSubscribeSampling(geohash: String) { + val subscriptionId = samplingSubscriptionIds.getOrPut(geohash) { + "sampling-${UUID.randomUUID()}" + } // Sampling only needs participant counts, never message bodies, so it subscribes to // presence heartbeats only (kind 20001) to keep the payload small. - subscriptionManager.subscribeGeohashPresence( - geohash = geohash, - sinceMs = System.currentTimeMillis() - 86400000L, - limit = 200, - id = "sampling-$geohash", - handler = { event -> geohashMessageHandler.onEvent(event, geohash) } - ) + val subscribe = { + liveSamplingSubscriptionGeohashes.remove(geohash) + subscriptionManager.subscribeGeohashPresence( + geohash = geohash, + sinceMs = System.currentTimeMillis() - 86400000L, + limit = 200, + id = subscriptionId, + handler = { event -> geohashMessageHandler.onEvent(event, geohash) } + ) + } + + if (geohash in requestedUserSamplingGeohashes) { + subscribe() + } else if (geohash in requestedLiveSamplingGeohashes) { + val isCurrentLiveTarget = locationChannelManager + ?.availableChannels + ?.value + ?.any { it.geohash == geohash } == true + if (!isCurrentLiveTarget) return + val token = LiveLocationPrivacyGate.captureToken() ?: return + LiveLocationPrivacyGate.runIfAllowed(token) { + liveSamplingSubscriptionGeohashes.add(geohash) + subscriptionManager.subscribeGeohashPresence( + geohash = geohash, + sinceMs = System.currentTimeMillis() - 86400000L, + limit = 200, + id = subscriptionId, + handler = { event -> geohashMessageHandler.onEvent(event, geohash) }, + liveLocationToken = token + ) + } + } + } + + private fun unsubscribeSampling(geohash: String) { + samplingSubscriptionIds.remove(geohash)?.let(subscriptionManager::unsubscribe) + liveSamplingSubscriptionGeohashes.remove(geohash) } private fun isAppInForeground(): Boolean { diff --git a/app/src/main/java/com/bitchat/android/ui/InputComponents.kt b/app/src/main/java/com/bitchat/android/ui/InputComponents.kt index a732b8e8..7302379b 100644 --- a/app/src/main/java/com/bitchat/android/ui/InputComponents.kt +++ b/app/src/main/java/com/bitchat/android/ui/InputComponents.kt @@ -50,7 +50,6 @@ import androidx.compose.ui.graphics.SolidColor import androidx.compose.ui.res.stringResource import androidx.compose.ui.text.AnnotatedString import androidx.compose.ui.text.SpanStyle -import androidx.compose.ui.text.buildAnnotatedString import androidx.compose.ui.text.font.FontWeight import androidx.compose.ui.text.input.ImeAction import androidx.compose.ui.text.input.TextFieldValue @@ -65,8 +64,8 @@ import androidx.compose.ui.focus.onFocusChanged import androidx.compose.ui.focus.FocusRequester import androidx.compose.ui.focus.focusRequester import androidx.compose.ui.platform.LocalSoftwareKeyboardController -import androidx.compose.ui.text.withStyle import com.bitchat.android.ui.theme.BASE_FONT_SIZE +import com.bitchat.android.ui.theme.BitchatPalette import com.bitchat.android.ui.theme.BitchatMotion import com.bitchat.android.ui.theme.LocalBitchatPalette import com.bitchat.android.features.voice.normalizeAmplitudeSample @@ -90,38 +89,22 @@ class SlashCommandVisualTransformation( ) : VisualTransformation { override fun filter(text: AnnotatedString): TransformedText { val slashCommandRegex = Regex("(/\\w+)(?=\\s|$)") - val annotatedString = buildAnnotatedString { - var lastIndex = 0 - - slashCommandRegex.findAll(text.text).forEach { match -> - // Add text before the match - if (match.range.first > lastIndex) { - append(text.text.substring(lastIndex, match.range.first)) - } - - // Add the styled slash command - withStyle( - style = SpanStyle( - color = commandColor, - fontFamily = BitchatFontFamily, - fontWeight = FontWeight.Medium, - background = commandBackground - ) - ) { - append(match.value) - } - - lastIndex = match.range.last + 1 - } - - // Add remaining text - if (lastIndex < text.text.length) { - append(text.text.substring(lastIndex)) - } + val builder = AnnotatedString.Builder(text) + slashCommandRegex.findAll(text.text).forEach { match -> + builder.addStyle( + style = SpanStyle( + color = commandColor, + fontFamily = BitchatFontFamily, + fontWeight = FontWeight.Medium, + background = commandBackground + ), + start = match.range.first, + end = match.range.last + 1, + ) } return TransformedText( - text = annotatedString, + text = builder.toAnnotatedString(), offsetMapping = OffsetMapping.Identity ) } @@ -132,45 +115,55 @@ class SlashCommandVisualTransformation( * while preserving cursor positioning and click handling */ class MentionVisualTransformation( - private val mentionColor: Color, - private val mentionBackground: Color, + private val mentionPeerIdentities: Map, + private val palette: BitchatPalette, ) : VisualTransformation { override fun filter(text: AnnotatedString): TransformedText { - val mentionRegex = Regex("@([a-zA-Z0-9_]+)") - val annotatedString = buildAnnotatedString { - var lastIndex = 0 - - mentionRegex.findAll(text.text).forEach { match -> - // Add text before the match - if (match.range.first > lastIndex) { - append(text.text.substring(lastIndex, match.range.first)) - } - - // Add the styled mention - withStyle( + val builder = AnnotatedString.Builder(text) + + MENTION_TOKEN_REGEX.findAll(text.text).forEach { match -> + val start = match.range.first + val end = match.range.last + 1 + val suffixOffset = match.value.lastIndexOf('#').takeIf { it > 0 } + val suffixStart = suffixOffset?.let(start::plus) ?: end + val mentionColor = colorForMention( + mention = match.value, + mentionPeerIdentities = mentionPeerIdentities, + palette = palette, + ) + + // Keep the whole token on one continuous color-derived chip. + builder.addStyle( + style = SpanStyle( + background = mentionColor.copy(alpha = MENTION_CHIP_ALPHA), + ), + start = start, + end = end, + ) + builder.addStyle( + style = SpanStyle( + color = mentionColor, + fontFamily = BitchatFontFamily, + fontWeight = FontWeight.SemiBold, + ), + start = start, + end = suffixStart, + ) + if (suffixStart < end) { + builder.addStyle( style = SpanStyle( - color = mentionColor, + color = mentionColor.copy(alpha = SUFFIX_ALPHA), fontFamily = BitchatFontFamily, fontWeight = FontWeight.SemiBold, - // Mirrors the mention chip used in rendered messages, so what you type - // looks like what everyone will see. - background = mentionBackground - ) - ) { - append(match.value) - } - - lastIndex = match.range.last + 1 - } - - // Add remaining text - if (lastIndex < text.text.length) { - append(text.text.substring(lastIndex)) + ), + start = suffixStart, + end = end, + ) } } return TransformedText( - text = annotatedString, + text = builder.toAnnotatedString(), offsetMapping = OffsetMapping.Identity ) } @@ -312,6 +305,7 @@ fun MessageInput( currentChannel: String?, nickname: String, showMediaButtons: Boolean, + mentionPeerIdentities: Map = emptyMap(), modifier: Modifier = Modifier ) { val palette = LocalBitchatPalette.current @@ -385,7 +379,11 @@ fun MessageInput( }), // Cap the growth so a pasted wall of text cannot swallow the message list. maxLines = 6, - visualTransformation = remember(palette) { + visualTransformation = remember( + palette, + colorScheme.primary, + mentionPeerIdentities, + ) { CombinedVisualTransformation( listOf( SlashCommandVisualTransformation( @@ -393,8 +391,8 @@ fun MessageInput( commandBackground = colorScheme.primary.copy(alpha = 0.14f), ), MentionVisualTransformation( - mentionColor = palette.accentOrange, - mentionBackground = palette.accentOrange.copy(alpha = MENTION_CHIP_ALPHA), + mentionPeerIdentities = mentionPeerIdentities, + palette = palette, ), ) ) @@ -709,10 +707,12 @@ fun CommandSuggestionItem( @Composable fun MentionSuggestionsBox( suggestions: List, + mentionPeerIdentities: Map, onSuggestionClick: (String) -> Unit, modifier: Modifier = Modifier ) { val colorScheme = MaterialTheme.colorScheme + val palette = LocalBitchatPalette.current LazyColumn( modifier = modifier @@ -734,6 +734,11 @@ fun MentionSuggestionsBox( ) { suggestion -> MentionSuggestionItem( suggestion = suggestion, + userColor = colorForMention( + mention = suggestion, + mentionPeerIdentities = mentionPeerIdentities, + palette = palette, + ), onClick = { onSuggestionClick(suggestion) }, modifier = Modifier.animateItem( fadeInSpec = tween( @@ -754,6 +759,7 @@ fun MentionSuggestionsBox( @Composable fun MentionSuggestionItem( suggestion: String, + userColor: Color, onClick: () -> Unit, modifier: Modifier = Modifier ) { @@ -762,7 +768,7 @@ fun MentionSuggestionItem( val isPressed by interactionSource.collectIsPressedAsState() val pressedBackground by animateColorAsState( targetValue = if (isPressed) { - palette.accentOrange.copy(alpha = 0.10f) + userColor.copy(alpha = 0.10f) } else { Color.Transparent }, @@ -798,7 +804,7 @@ fun MentionSuggestionItem( fontFamily = BitchatFontFamily, fontWeight = FontWeight.SemiBold ), - color = palette.accentOrange, + color = userColor, fontSize = (BASE_FONT_SIZE - 2).sp, maxLines = 1, overflow = TextOverflow.Ellipsis, diff --git a/app/src/main/java/com/bitchat/android/ui/LocationChannelsSheet.kt b/app/src/main/java/com/bitchat/android/ui/LocationChannelsSheet.kt index ca5fd26e..19156485 100644 --- a/app/src/main/java/com/bitchat/android/ui/LocationChannelsSheet.kt +++ b/app/src/main/java/com/bitchat/android/ui/LocationChannelsSheet.kt @@ -118,6 +118,8 @@ fun LocationChannelsSheet( val notesRevealed by NearbyNotesController.shared.revealed.collectAsStateWithLifecycle() val selectedChannel by locationManager.selectedChannel.collectAsStateWithLifecycle() val locationNames by locationManager.locationNames.collectAsStateWithLifecycle() + val appLocationEnabled by locationManager.locationServicesEnabled.collectAsStateWithLifecycle() + val systemLocationEnabled by locationManager.systemLocationEnabled.collectAsStateWithLifecycle() val locationServicesEnabled by locationManager.effectiveLocationEnabled.collectAsStateWithLifecycle() val bookmarks by bookmarksStore.bookmarks.collectAsStateWithLifecycle() @@ -331,10 +333,12 @@ fun LocationChannelsSheet( onClick = { val inRegional = availableChannels.any { it.geohash == gh } - locationManager.setTeleported( - !inRegional && availableChannels.isNotEmpty() + locationManager.selectManual( + channel = channel, + teleported = !appLocationEnabled || + availableChannels.isEmpty() || + !inRegional ) - locationManager.select(ChannelID.Location(channel)) onDismiss() } ) @@ -428,9 +432,9 @@ fun LocationChannelsSheet( ) }, onClick = { - locationManager.setTeleported(false) - locationManager.select(ChannelID.Location(channel)) - onDismiss() + if (locationManager.selectNearby(channel)) { + onDismiss() + } } ) } @@ -473,8 +477,7 @@ fun LocationChannelsSheet( if (validateGeohash(normalized)) { val level = levelForLength(normalized.length) val channel = GeohashChannel(level = level, geohash = normalized) - locationManager.setTeleported(true) - locationManager.select(ChannelID.Location(channel)) + locationManager.selectManual(channel) onDismiss() } else { customError = context.getString(R.string.invalid_geohash) @@ -560,14 +563,14 @@ fun LocationChannelsSheet( item(key = "location_toggle") { SheetDestructiveButton( - text = if (locationServicesEnabled) { + text = if (appLocationEnabled) { stringResource(R.string.disable_location_services) } else { stringResource(R.string.enable_location_services) }, - isDestructive = locationServicesEnabled, + isDestructive = appLocationEnabled, onClick = { - if (locationServicesEnabled) { + if (appLocationEnabled) { locationManager.disableLocationServices() } else { locationManager.enableLocationServices() @@ -595,27 +598,43 @@ fun LocationChannelsSheet( } } - LifecycleResumeEffect(isPresented, locationServicesEnabled) { - if (isPresented && locationServicesEnabled) { - locationManager.enableLocationChannels() - if (locationManager.permissionState.value == - LocationChannelManager.PermissionState.AUTHORIZED + LifecycleResumeEffect(isPresented, appLocationEnabled, systemLocationEnabled) { + if (isPresented) { + val currentPermission = locationManager.syncPermissionState() + if (appLocationEnabled && + systemLocationEnabled && + currentPermission == LocationChannelManager.PermissionState.AUTHORIZED ) { + // Retain the redesign branch's immediate refresh when the sheet resumes while + // honoring main's independent app/system privacy gates. + locationManager.enableLocationChannels() locationManager.beginLiveRefresh() } } - onPauseOrDispose { locationManager.endLiveRefresh() } + + onPauseOrDispose { + locationManager.endLiveRefresh() + } } // Sampling management: update sampling when channels/bookmarks change - LaunchedEffect(isPresented, availableChannels, bookmarks, notesRevealed) { + LaunchedEffect( + isPresented, + availableChannels, + bookmarks, + appLocationEnabled, + notesRevealed + ) { if (isPresented) { - val geohashes = geohashesForSampling( + val liveLocationGeohashes = geohashesForSampling( availableChannels = availableChannels, - bookmarks = bookmarks, + bookmarks = emptyList(), notesRevealed = notesRevealed, ) - viewModel.beginGeohashSampling(geohashes) + viewModel.beginGeohashSampling( + liveLocationGeohashes = liveLocationGeohashes, + userSelectedGeohashes = bookmarks + ) } else { viewModel.endGeohashSampling() } diff --git a/app/src/main/java/com/bitchat/android/ui/MeshPeerListSheet.kt b/app/src/main/java/com/bitchat/android/ui/MeshPeerListSheet.kt index 4bb36ecc..d9a8d035 100644 --- a/app/src/main/java/com/bitchat/android/ui/MeshPeerListSheet.kt +++ b/app/src/main/java/com/bitchat/android/ui/MeshPeerListSheet.kt @@ -38,6 +38,7 @@ import androidx.lifecycle.compose.collectAsStateWithLifecycle import com.bitchat.android.core.ui.component.button.CloseButton import com.bitchat.android.core.ui.component.sheet.BitchatBottomSheet import com.bitchat.android.core.ui.component.sheet.BitchatSheetCenterTopBar +import com.bitchat.android.core.ui.component.sheet.LocalSheetDismiss import com.bitchat.android.core.ui.component.sheet.BitchatSheetTitle import com.bitchat.android.core.ui.component.sheet.BitchatSheetTopBar import com.bitchat.android.favorites.FavoriteRelationship @@ -47,7 +48,7 @@ import com.bitchat.android.identity.SecureIdentityStateManager import com.bitchat.android.ui.theme.BASE_FONT_SIZE import com.bitchat.android.ui.theme.BitchatMotion import com.bitchat.android.ui.theme.LocalBitchatPalette -import com.bitchat.android.ui.theme.colorForPeerSeed +import com.bitchat.android.ui.theme.colorForPeer import com.bitchat.android.nostr.GeohashAliasRegistry import com.bitchat.android.nostr.GeohashConversationRegistry import com.bitchat.android.services.ContactDirectory @@ -589,8 +590,8 @@ private fun PeerItem( // Get consistent peer color (iOS-compatible) val palette = LocalBitchatPalette.current - val assignedColor = colorForPeerSeed( - viewModel.peerColorSeedForMeshPeer(peerID), + val assignedColor = colorForPeer( + viewModel.peerIdentityForMeshPeer(peerID), palette ) val baseColor = if (isMe) palette.accentOrange else assignedColor @@ -614,7 +615,7 @@ private fun PeerItem( ) } else if (hasUnreadDM) { Icon( - imageVector = Icons.Filled.Email, + painter = painterResource(R.drawable.ic_spec_envelope), contentDescription = stringResource(R.string.cd_unread_message), modifier = Modifier.size(PeerRowIconSize), tint = palette.accentOrange @@ -635,11 +636,13 @@ private fun PeerItem( ) } else { Icon( - imageVector = when { - isWifiAware -> Icons.Filled.Wifi - isDirect -> Icons.Outlined.Bluetooth - else -> Icons.Filled.Route - }, + painter = painterResource( + conversationTransportIcon( + isReachedOverInternet = false, + isWifiAware = isWifiAware, + isDirect = isDirect + ) + ), contentDescription = when { isWifiAware -> "Direct Wi-Fi Aware" isDirect -> "Direct Bluetooth" @@ -680,7 +683,7 @@ private fun PeerItem( if (isVerified) { Icon( - imageVector = Icons.Filled.Verified, + painter = painterResource(R.drawable.ic_spec_check), contentDescription = stringResource(R.string.verify_title), modifier = Modifier.size(16.dp), tint = colorScheme.primary @@ -861,12 +864,7 @@ fun PrivateChatSheet( viewModel.isPeerVerified(peerID, verifiedFingerprints) } - val securityModifier = if (!isNostrPeer && !isNostrReachableFavorite) { - Modifier.clickable { viewModel.showSecurityVerificationSheet() } - } else { - Modifier - } - + val palette = LocalBitchatPalette.current val sheetState = rememberModalBottomSheetState( skipPartiallyExpanded = true ) @@ -880,7 +878,7 @@ fun PrivateChatSheet( Column( modifier = Modifier.fillMaxSize() ) { - Spacer(modifier = Modifier.height(64.dp)) + Spacer(modifier = Modifier.height(ChatHeaderHeight)) HorizontalDivider(thickness = 1.dp, color = colorScheme.outlineVariant) @@ -948,118 +946,97 @@ fun PrivateChatSheet( ) } - // TopBar (fixed at top, iOS-style) - BitchatSheetCenterTopBar( - onClose = onDismiss, + // Header. Built from the same tokens as the main chat header rather than a + // TopAppBar, so moving between the timeline and a conversation does not shift the + // bar's height, insets or type. + Surface( modifier = Modifier.align(Alignment.TopCenter), - navigationIcon = { - IconButton( - onClick = onDismiss, - modifier = Modifier - .align(Alignment.CenterStart) - .padding(start = 16.dp) - .size(32.dp) + color = colorScheme.background + ) { + ConversationHeader( + leadingIconRes = conversationTransportIcon( + isReachedOverInternet = isNostrPeer || isNostrReachableFavorite, + isWifiAware = isWifiAware, + isDirect = isDirect + ), + leadingIconTint = colorScheme.primary, + leadingContentDescription = when { + isNostrPeer || isNostrReachableFavorite -> + stringResource(R.string.cd_nostr_reachable) + else -> null + }, + title = titleText + ) { + ConversationHeaderAction( + onClick = { viewModel.toggleFavorite(peerID) }, + contentDescription = if (isFavorite) { + stringResource(R.string.cd_remove_favorite) + } else { + stringResource(R.string.cd_add_favorite) + } ) { Icon( - imageVector = Icons.AutoMirrored.Filled.ArrowBack, - contentDescription = stringResource(R.string.chat_back), - tint = colorScheme.onSurface + painter = painterResource( + if (isFavorite) { + R.drawable.ic_spec_star_filled + } else { + R.drawable.ic_spec_star + } + ), + contentDescription = null, + modifier = Modifier.size(HeaderIconSize), + tint = if (isFavorite) { + palette.accentOrange + } else { + colorScheme.onSurfaceVariant + } ) } - }, - title = { - // Center content: connection status + name + encryption - Row( - modifier = Modifier.align(Alignment.Center), - verticalAlignment = Alignment.CenterVertically, - horizontalArrangement = Arrangement.spacedBy(6.dp) - ) { - when { - isNostrPeer || isNostrReachableFavorite -> { - Icon( - painter = painterResource(R.drawable.ic_spec_globe), - contentDescription = stringResource(R.string.cd_nostr_reachable), - modifier = Modifier.size(14.dp), - tint = Color(0xFF9C27B0) - ) - } - isWifiAware -> { - Icon( - imageVector = Icons.Filled.Wifi, - contentDescription = "Direct Wi-Fi Aware", - modifier = Modifier.size(14.dp), - tint = colorScheme.onSurface.copy(alpha = 0.6f) - ) - } - isDirect -> { - Icon( - imageVector = Icons.Outlined.Bluetooth, - contentDescription = "Direct Bluetooth", - modifier = Modifier.size(14.dp), - tint = colorScheme.onSurface.copy(alpha = 0.6f) - ) - } - isConnected -> { - Icon( - imageVector = Icons.Filled.Route, - contentDescription = "Routed", - modifier = Modifier.size(14.dp), - tint = colorScheme.onSurface.copy(alpha = 0.6f) - ) - } - } - Text( - text = titleText, - style = MaterialTheme.typography.titleMedium.copy( - fontWeight = FontWeight.Bold, - fontFamily = BitchatFontFamily - ), - color = if (isNostrPeer || isNostrReachableFavorite) Color(0xFFFF9500) else colorScheme.onSurface - ) - - Row( - verticalAlignment = Alignment.CenterVertically, - modifier = Modifier.then(securityModifier) + // Encryption state, and the verification badge that qualifies it. Both are + // read-only for Nostr peers, which have no Noise session at all. + if (!isNostrPeer && !isNostrReachableFavorite) { + ConversationHeaderAction( + onClick = { viewModel.showSecurityVerificationSheet() }, + contentDescription = stringResource(R.string.verify_title) ) { - if (!isNostrPeer && !isNostrReachableFavorite) { + Box(contentAlignment = Alignment.Center) { NoiseSessionIcon( sessionState = sessionState, - modifier = Modifier.size(14.dp) - ) - } - - if (isVerified) { - Spacer(modifier = Modifier.width(4.dp)) - Icon( - imageVector = Icons.Filled.Verified, - contentDescription = stringResource(R.string.verify_title), - modifier = Modifier.size(14.dp), - tint = Color(0xFF32D74B) // iOS Green + modifier = Modifier.size(HeaderIconSize) ) } } + } - IconButton( - onClick = { viewModel.toggleFavorite(peerID) }, - modifier = Modifier.size(28.dp) + if (isVerified) { + Box( + modifier = Modifier.size(HeaderIconSize), + contentAlignment = Alignment.Center ) { Icon( - painter = painterResource( - if (isFavorite) { - R.drawable.ic_spec_star_filled - } else { - R.drawable.ic_spec_star - } - ), - contentDescription = if (isFavorite) stringResource(R.string.cd_remove_favorite) else stringResource(R.string.cd_add_favorite), - modifier = Modifier.size(16.dp), - tint = if (isFavorite) Color(0xFFFFD700) else colorScheme.onSurface.copy(alpha = 0.6f) + painter = painterResource(R.drawable.ic_spec_check), + contentDescription = stringResource(R.string.verify_title), + modifier = Modifier.size(HeaderIconSize), + tint = colorScheme.primary ) } } + + val dismiss = LocalSheetDismiss.current + ConversationHeaderAction( + onClick = { dismiss?.invoke() ?: onDismiss() }, + contentDescription = stringResource(R.string.close_plain) + ) { + Icon( + painter = painterResource(R.drawable.ic_spec_close), + contentDescription = null, + modifier = Modifier.size(HeaderIconSize), + tint = colorScheme.onSurfaceVariant + ) + } } - ) + } } } } diff --git a/app/src/main/java/com/bitchat/android/ui/MessageComponents.kt b/app/src/main/java/com/bitchat/android/ui/MessageComponents.kt index c8e05af0..16c7f63d 100644 --- a/app/src/main/java/com/bitchat/android/ui/MessageComponents.kt +++ b/app/src/main/java/com/bitchat/android/ui/MessageComponents.kt @@ -182,6 +182,7 @@ fun MessagesList( currentUserNickname: String, meshService: MeshService, modifier: Modifier = Modifier, + mentionPeerIdentities: Map? = null, /** * Extra inset on top of the list's own gutters. * @@ -204,6 +205,10 @@ fun MessagesList( onCancelTransfer: ((BitchatMessage) -> Unit)? = null, onImageClick: ((String, List, Int) -> Unit)? = null ) { + val resolvedMentionPeerIdentities = remember(messages, mentionPeerIdentities) { + mentionPeerIdentities ?: buildMentionPeerIdentityMap(messages) + } + // A fresh scroll position per conversation. Sharing one state meant a switch inherited the // previous channel's offset and then had to correct itself, which is what the jump was. // @@ -331,6 +336,7 @@ fun MessagesList( messages = messages, currentUserNickname = currentUserNickname, meshService = meshService, + mentionPeerIdentities = resolvedMentionPeerIdentities, showSender = !isGrouped, topSpacing = MessageGrouping.topSpacingFor( isGrouped = isGrouped, @@ -363,6 +369,7 @@ fun MessageItem( currentUserNickname: String, meshService: MeshService, messages: List = emptyList(), + mentionPeerIdentities: Map = emptyMap(), showSender: Boolean = true, topSpacing: Dp = 0.dp, onNicknameClick: ((String) -> Unit)? = null, @@ -394,6 +401,7 @@ fun MessageItem( messages = messages, currentUserNickname = currentUserNickname, meshService = meshService, + mentionPeerIdentities = mentionPeerIdentities, colorScheme = colorScheme, timeFormatter = timeFormatter, showSender = showSender, @@ -432,6 +440,7 @@ fun MessageItem( messages: List, currentUserNickname: String, meshService: MeshService, + mentionPeerIdentities: Map, colorScheme: ColorScheme, timeFormatter: SimpleDateFormat, showSender: Boolean, @@ -623,6 +632,7 @@ fun MessageItem( message = message, currentUserNickname = currentUserNickname, meshService = meshService, + mentionPeerIdentities = mentionPeerIdentities, colorScheme = colorScheme, timeFormatter = timeFormatter, showSender = showSender, @@ -638,6 +648,7 @@ internal fun TextMessageLayout( message: BitchatMessage, currentUserNickname: String, meshService: MeshService, + mentionPeerIdentities: Map = emptyMap(), colorScheme: ColorScheme, timeFormatter: SimpleDateFormat, onNicknameClick: ((String) -> Unit)?, @@ -667,6 +678,7 @@ internal fun TextMessageLayout( palette, colorScheme.onSurface, colorScheme.secondary, + mentionPeerIdentities, timeFormatter ) { formatTextMessageBody( @@ -675,6 +687,7 @@ internal fun TextMessageLayout( palette = palette, contentColor = colorScheme.onSurface, linkColor = colorScheme.secondary, + mentionPeerIdentities = mentionPeerIdentities, timeFormatter = timeFormatter, ) } diff --git a/app/src/main/java/com/bitchat/android/ui/MessageInteractionUtils.kt b/app/src/main/java/com/bitchat/android/ui/MessageInteractionUtils.kt index 275dbaf8..2caff0fe 100644 --- a/app/src/main/java/com/bitchat/android/ui/MessageInteractionUtils.kt +++ b/app/src/main/java/com/bitchat/android/ui/MessageInteractionUtils.kt @@ -3,7 +3,6 @@ package com.bitchat.android.ui import android.content.Context import android.content.Intent import androidx.core.net.toUri -import com.bitchat.android.geohash.ChannelID import com.bitchat.android.geohash.GeohashChannel import com.bitchat.android.geohash.GeohashChannelLevel import com.bitchat.android.geohash.LocationChannelManager @@ -48,6 +47,5 @@ internal fun channelForGeohash(geohash: String): GeohashChannel { internal fun navigateToGeohash(context: Context, geohash: String): Boolean = runCatching { val locationManager = LocationChannelManager.getInstance(context) - locationManager.setTeleported(true) - locationManager.select(ChannelID.Location(channelForGeohash(geohash))) + locationManager.selectManual(channelForGeohash(geohash)) }.isSuccess diff --git a/app/src/main/java/com/bitchat/android/ui/NotificationManager.kt b/app/src/main/java/com/bitchat/android/ui/NotificationManager.kt index 69e84ff5..f15ada44 100644 --- a/app/src/main/java/com/bitchat/android/ui/NotificationManager.kt +++ b/app/src/main/java/com/bitchat/android/ui/NotificationManager.kt @@ -138,7 +138,7 @@ class NotificationManager( */ fun setCurrentGeohash(geohash: String?) { currentGeohash = geohash - Log.d(TAG, "Current geohash changed: $geohash") + Log.d(TAG, "Current geohash changed") } /** @@ -446,11 +446,11 @@ class NotificationManager( val shouldNotify = isAppInBackground || (!isAppInBackground && currentGeohash != geohash) if (!shouldNotify) { - Log.d(TAG, "Skipping geohash notification - app in foreground and viewing geohash $geohash") + Log.d(TAG, "Skipping geohash notification while viewing the channel") return } - Log.d(TAG, "Showing geohash notification for $geohash from $senderNickname (mention: $isMention, first: $isFirstMessage)") + Log.d(TAG, "Showing geohash notification (mention: $isMention, first: $isFirstMessage)") val notification = GeohashNotification( geohash = geohash, @@ -652,7 +652,7 @@ class NotificationManager( showGeohashSummaryNotification() } - Log.d(TAG, "Cleared notifications for geohash: $geohash") + Log.d(TAG, "Cleared notifications for geohash") } /** diff --git a/app/src/main/java/com/bitchat/android/ui/PeerIdentity.kt b/app/src/main/java/com/bitchat/android/ui/PeerIdentity.kt new file mode 100644 index 00000000..47dd5629 --- /dev/null +++ b/app/src/main/java/com/bitchat/android/ui/PeerIdentity.kt @@ -0,0 +1,71 @@ +package com.bitchat.android.ui + +import com.bitchat.android.model.BitchatMessage +import java.util.Locale + +/** + * Canonical, presentation-neutral identity used to derive a peer hue. + * + * Callers cannot construct arbitrary color seeds. Every identity is normalized and namespaced + * here so the same mesh or Nostr user resolves to the same color on every surface. + */ +@JvmInline +value class PeerIdentity private constructor(internal val stableKey: String) { + companion object { + fun mesh(peerID: String): PeerIdentity = + PeerIdentity("noise:${normalize(peerID)}") + + /** + * Preserve the established geohash-chat color mapping while accepting a full public key. + * + * Older chat rendering hashed `nostr:nostr:`. Keeping that visual + * key here avoids recoloring existing conversations; the important change is that every + * surface now derives it from the same canonical Nostr identity. + */ + fun nostr(pubkeyHex: String): PeerIdentity { + val normalized = normalizeNostrIdentifier(pubkeyHex) + return PeerIdentity("nostr:nostr:${normalized.take(8)}") + } + + /** + * Last-resort identity for legacy messages and mentions that carry no stable peer ID. + */ + fun nickname(nickname: String): PeerIdentity = + PeerIdentity(normalize(nickname)) + + private fun normalize(value: String): String = + value.trim().lowercase(Locale.ROOT) + + private fun normalizeNostrIdentifier(value: String): String { + var normalized = normalize(value) + while (normalized.startsWith("nostr:") || normalized.startsWith("nostr_")) { + normalized = normalized.removePrefix("nostr:").removePrefix("nostr_") + } + return normalized + } + } +} + +/** + * Resolve the canonical identity attached to a rendered message. + * + * Full Nostr keys take precedence over routing aliases such as `nostr_abcd…`; aliases remain a + * compatibility fallback for messages saved by older app versions. + */ +fun peerIdentityForMessage(message: BitchatMessage): PeerIdentity { + message.senderNostrPubkey?.takeIf { it.isNotBlank() }?.let { + return PeerIdentity.nostr(it) + } + + val senderPeerID = message.senderPeerID + return when { + senderPeerID?.startsWith("nostr:", ignoreCase = true) == true || + senderPeerID?.startsWith("nostr_", ignoreCase = true) == true -> { + PeerIdentity.nostr(senderPeerID) + } + senderPeerID?.length == 16 || senderPeerID?.length == 64 -> { + PeerIdentity.mesh(senderPeerID) + } + else -> PeerIdentity.nickname(message.sender) + } +} diff --git a/app/src/main/java/com/bitchat/android/ui/theme/PeerColors.kt b/app/src/main/java/com/bitchat/android/ui/theme/PeerColors.kt index 2a0e0a38..b0f1ed7d 100644 --- a/app/src/main/java/com/bitchat/android/ui/theme/PeerColors.kt +++ b/app/src/main/java/com/bitchat/android/ui/theme/PeerColors.kt @@ -1,18 +1,18 @@ package com.bitchat.android.ui.theme import androidx.compose.ui.graphics.Color -import com.bitchat.android.ui.PeerColorSeed +import com.bitchat.android.ui.PeerIdentity import kotlin.math.abs /** - * Resolve a peer's stable seed using the active Bitchat theme's explicit chroma tokens. + * The single identity-to-color boundary used by chat, people sheets, and mentions. * * The djb2 hash and hue adjustment are byte-identical to the iOS implementation. Orange is * avoided because it is reserved for the current user. */ -fun colorForPeerSeed(seed: PeerColorSeed, palette: BitchatPalette): Color { +fun colorForPeer(identity: PeerIdentity, palette: BitchatPalette): Color { var hash = 5381UL - for (byte in seed.value.toByteArray()) { + for (byte in identity.stableKey.toByteArray()) { hash = ((hash shl 5) + hash) + byte.toUByte().toULong() } diff --git a/app/src/main/res/drawable/ic_spec_bluetooth.xml b/app/src/main/res/drawable/ic_spec_bluetooth.xml new file mode 100644 index 00000000..8c1ed7ae --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_bluetooth.xml @@ -0,0 +1,9 @@ + + + + + diff --git a/app/src/main/res/drawable/ic_spec_check.xml b/app/src/main/res/drawable/ic_spec_check.xml new file mode 100644 index 00000000..16eb9e1c --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_check.xml @@ -0,0 +1,7 @@ + + + diff --git a/app/src/main/res/drawable/ic_spec_close.xml b/app/src/main/res/drawable/ic_spec_close.xml new file mode 100644 index 00000000..e0fbc4ea --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_close.xml @@ -0,0 +1,8 @@ + + + + diff --git a/app/src/main/res/drawable/ic_spec_envelope.xml b/app/src/main/res/drawable/ic_spec_envelope.xml new file mode 100644 index 00000000..15552d37 --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_envelope.xml @@ -0,0 +1,8 @@ + + + + diff --git a/app/src/main/res/drawable/ic_spec_lock_open.xml b/app/src/main/res/drawable/ic_spec_lock_open.xml new file mode 100644 index 00000000..11d69821 --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_lock_open.xml @@ -0,0 +1,13 @@ + + + + + + + + diff --git a/app/src/main/res/drawable/ic_spec_routed.xml b/app/src/main/res/drawable/ic_spec_routed.xml new file mode 100644 index 00000000..36e271d7 --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_routed.xml @@ -0,0 +1,11 @@ + + + + + + + diff --git a/app/src/main/res/drawable/ic_spec_sync.xml b/app/src/main/res/drawable/ic_spec_sync.xml new file mode 100644 index 00000000..1ab434e5 --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_sync.xml @@ -0,0 +1,10 @@ + + + + + + diff --git a/app/src/main/res/drawable/ic_spec_warning.xml b/app/src/main/res/drawable/ic_spec_warning.xml new file mode 100644 index 00000000..ffb64e3c --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_warning.xml @@ -0,0 +1,9 @@ + + + + + diff --git a/app/src/main/res/drawable/ic_spec_wifi.xml b/app/src/main/res/drawable/ic_spec_wifi.xml new file mode 100644 index 00000000..4757653f --- /dev/null +++ b/app/src/main/res/drawable/ic_spec_wifi.xml @@ -0,0 +1,9 @@ + + + + + diff --git a/app/src/main/res/values-ar/strings.xml b/app/src/main/res/values-ar/strings.xml index f78c1a95..13c8d51c 100644 --- a/app/src/main/res/values-ar/strings.xml +++ b/app/src/main/res/values-ar/strings.xml @@ -71,8 +71,6 @@ إضافة إشارة مرجعية - رجوع - مغادرة يمكن الوصول عبر Nostr رسائل خاصة غير مقروءة تم الانتقال diff --git a/app/src/main/res/values-bn/strings.xml b/app/src/main/res/values-bn/strings.xml index 30abcfbd..7c2617a4 100644 --- a/app/src/main/res/values-bn/strings.xml +++ b/app/src/main/res/values-bn/strings.xml @@ -71,8 +71,6 @@ বুকমার্ক যোগ করুন - ফিরে যান - ছেড়ে দিন Nostr এর মাধ্যমে পৌঁছানো যায় অপঠিত ব্যক্তিগত বার্তা টেলিপোর্ট করা হয়েছে diff --git a/app/src/main/res/values-de/strings.xml b/app/src/main/res/values-de/strings.xml index d8338a41..b13fb001 100644 --- a/app/src/main/res/values-de/strings.xml +++ b/app/src/main/res/values-de/strings.xml @@ -71,8 +71,6 @@ Lesezeichen hinzufügen - zurück - verlassen Über Nostr erreichbar Ungelesene private Nachrichten Teleportiert diff --git a/app/src/main/res/values-es/strings.xml b/app/src/main/res/values-es/strings.xml index eefb901b..e1ac2c2b 100644 --- a/app/src/main/res/values-es/strings.xml +++ b/app/src/main/res/values-es/strings.xml @@ -71,8 +71,6 @@ Agregar marcador - atrás - salir Accesible vía Nostr Mensajes privados sin leer Teletransportado diff --git a/app/src/main/res/values-fa/strings.xml b/app/src/main/res/values-fa/strings.xml index 8f1d0bf0..a3e81d29 100644 --- a/app/src/main/res/values-fa/strings.xml +++ b/app/src/main/res/values-fa/strings.xml @@ -71,8 +71,6 @@ افزودن نشانک - بازگشت - خروج قابل دسترس از طریق Nostr پیام‌های خصوصی خوانده‌نشده انتقال مکانی diff --git a/app/src/main/res/values-fil/strings.xml b/app/src/main/res/values-fil/strings.xml index 89724eb6..1da03f06 100644 --- a/app/src/main/res/values-fil/strings.xml +++ b/app/src/main/res/values-fil/strings.xml @@ -71,8 +71,6 @@ Mag‑bookmark - bumalik - umalis Maabot sa Nostr Hindi nabasang pribadong mensahe Naiteleport diff --git a/app/src/main/res/values-fr/strings.xml b/app/src/main/res/values-fr/strings.xml index 66f653ce..e632bdb8 100644 --- a/app/src/main/res/values-fr/strings.xml +++ b/app/src/main/res/values-fr/strings.xml @@ -71,8 +71,6 @@ Ajouter un signet - retour - quitter Joignable via Nostr Messages privés non lus Téléporté diff --git a/app/src/main/res/values-hi/strings.xml b/app/src/main/res/values-hi/strings.xml index 87948601..1a393f38 100644 --- a/app/src/main/res/values-hi/strings.xml +++ b/app/src/main/res/values-hi/strings.xml @@ -71,8 +71,6 @@ बुकमार्क जोड़ें - वापस - छोड़ें Nostr के माध्यम से उपलब्ध अपठित निजी संदेश टेलीपोर्ट हुआ diff --git a/app/src/main/res/values-id/strings.xml b/app/src/main/res/values-id/strings.xml index 1a11487c..934556e4 100644 --- a/app/src/main/res/values-id/strings.xml +++ b/app/src/main/res/values-id/strings.xml @@ -71,8 +71,6 @@ Tambah bookmark - kembali - keluar Dapat dijangkau melalui Nostr Pesan pribadi yang belum dibaca Diteleportasi diff --git a/app/src/main/res/values-it/strings.xml b/app/src/main/res/values-it/strings.xml index 36feb8cf..7e67de6d 100644 --- a/app/src/main/res/values-it/strings.xml +++ b/app/src/main/res/values-it/strings.xml @@ -71,8 +71,6 @@ Aggiungi segnalibro - indietro - esci Raggiungibile via Nostr Messaggi privati non letti Teletrasportato diff --git a/app/src/main/res/values-ja/strings.xml b/app/src/main/res/values-ja/strings.xml index 9b2844c2..1e7da71d 100644 --- a/app/src/main/res/values-ja/strings.xml +++ b/app/src/main/res/values-ja/strings.xml @@ -71,8 +71,6 @@ ブックマークに追加 - 戻る - 退出 Nostr 経由で到達可能 未読のプライベートメッセージ テレポート済み diff --git a/app/src/main/res/values-ka/strings.xml b/app/src/main/res/values-ka/strings.xml index d1d19dad..4994f9cc 100644 --- a/app/src/main/res/values-ka/strings.xml +++ b/app/src/main/res/values-ka/strings.xml @@ -71,8 +71,6 @@ სანიშნეს დამატება - უკან - გასვლა მისაწვდომია Nostr-ით წაუკითხავი პირადი შეტყობინებები ტელეპორტირებული diff --git a/app/src/main/res/values-ko/strings.xml b/app/src/main/res/values-ko/strings.xml index d72df76f..7327257a 100644 --- a/app/src/main/res/values-ko/strings.xml +++ b/app/src/main/res/values-ko/strings.xml @@ -71,8 +71,6 @@ 북마크 추가 - 뒤로 - 나가기 Nostr로 연결 가능 읽지 않은 개인 메시지 텔레포트됨 diff --git a/app/src/main/res/values-mg/strings.xml b/app/src/main/res/values-mg/strings.xml index a15540b1..168eebe7 100644 --- a/app/src/main/res/values-mg/strings.xml +++ b/app/src/main/res/values-mg/strings.xml @@ -71,8 +71,6 @@ Hanampy bookmark - miverina - hiala Azo tratrarina amin\'ny alalan\'ny Nostr Hafatra manokana tsy voavaky Nafindra toerana diff --git a/app/src/main/res/values-ne/strings.xml b/app/src/main/res/values-ne/strings.xml index b9df0f99..48a7afbd 100644 --- a/app/src/main/res/values-ne/strings.xml +++ b/app/src/main/res/values-ne/strings.xml @@ -71,8 +71,6 @@ बुकमार्क थप्नुहोस् - पछाडि - छोड्नुहोस् Nostr मार्फत पुग्न सकिने नपढिएका निजी सन्देश टेलिपोर्ट भयो diff --git a/app/src/main/res/values-nl/strings.xml b/app/src/main/res/values-nl/strings.xml index 8328b8ff..0eeaec55 100644 --- a/app/src/main/res/values-nl/strings.xml +++ b/app/src/main/res/values-nl/strings.xml @@ -71,8 +71,6 @@ Bladwijzer toevoegen - terug - verlaten Bereikbaar via Nostr Ongelezen privéberichten Geteleporteerd diff --git a/app/src/main/res/values-pa-rPK/strings.xml b/app/src/main/res/values-pa-rPK/strings.xml index 4079133a..5f5f5f75 100644 --- a/app/src/main/res/values-pa-rPK/strings.xml +++ b/app/src/main/res/values-pa-rPK/strings.xml @@ -71,8 +71,6 @@ بُک مارک پاؤ - واپس - باہر آؤ Nostr راہین پہنچ ممکن اے انہ پڑھیا ذاتی پیغام ٹیلپورٹ کیتا گیا diff --git a/app/src/main/res/values-pt-rBR/strings.xml b/app/src/main/res/values-pt-rBR/strings.xml index 2bf02cb5..fd4901ef 100644 --- a/app/src/main/res/values-pt-rBR/strings.xml +++ b/app/src/main/res/values-pt-rBR/strings.xml @@ -71,8 +71,6 @@ Adicionar favorito - voltar - sair Acessível via Nostr Mensagens privadas não lidas Teletransportado diff --git a/app/src/main/res/values-pt/strings.xml b/app/src/main/res/values-pt/strings.xml index e45c26a6..5247916e 100644 --- a/app/src/main/res/values-pt/strings.xml +++ b/app/src/main/res/values-pt/strings.xml @@ -71,8 +71,6 @@ Adicionar marcador - voltar - sair Alcançável via Nostr Mensagens privadas não lidas Teletransportado diff --git a/app/src/main/res/values-ru/strings.xml b/app/src/main/res/values-ru/strings.xml index 1230f4be..4dc08928 100644 --- a/app/src/main/res/values-ru/strings.xml +++ b/app/src/main/res/values-ru/strings.xml @@ -63,8 +63,6 @@ Убрать из избранного Добавить закладку - назад - выйти Доступен через Nostr Непрочитанные личные Телепортировано diff --git a/app/src/main/res/values-sv/strings.xml b/app/src/main/res/values-sv/strings.xml index 17cc2963..dcfda208 100644 --- a/app/src/main/res/values-sv/strings.xml +++ b/app/src/main/res/values-sv/strings.xml @@ -63,8 +63,6 @@ Ta bort favorit Lägg till bokmärke - tillbaka - lämna Nås via Nostr Olästa privata meddelanden Teleporterad diff --git a/app/src/main/res/values-th/strings.xml b/app/src/main/res/values-th/strings.xml index 53dc6610..7e1fc05a 100644 --- a/app/src/main/res/values-th/strings.xml +++ b/app/src/main/res/values-th/strings.xml @@ -71,8 +71,6 @@ เพิ่มที่คั่นหน้า - กลับ - ออก ติดต่อได้ผ่าน Nostr ข้อความส่วนตัวยังไม่ได้อ่าน เทเลพอร์ตแล้ว diff --git a/app/src/main/res/values-tr/strings.xml b/app/src/main/res/values-tr/strings.xml index e7eb1b09..b81fdd08 100644 --- a/app/src/main/res/values-tr/strings.xml +++ b/app/src/main/res/values-tr/strings.xml @@ -63,8 +63,6 @@ Sık kullanılandan kaldır Yer imi ekle - geri - ayrıl Nostr üzerinden ulaşılabilir Okunmamış özel mesaj Teleport edildi diff --git a/app/src/main/res/values-ur/strings.xml b/app/src/main/res/values-ur/strings.xml index 6bc67120..36c5265d 100644 --- a/app/src/main/res/values-ur/strings.xml +++ b/app/src/main/res/values-ur/strings.xml @@ -71,8 +71,6 @@ بک مارک شامل کریں - واپس - چھوڑیں Nostr کے ذریعے رسائی غیر پڑھے ہوئے نجی پیغامات ٹیلی پورٹ diff --git a/app/src/main/res/values-vi/strings.xml b/app/src/main/res/values-vi/strings.xml index 7e1c9ef3..20028f38 100644 --- a/app/src/main/res/values-vi/strings.xml +++ b/app/src/main/res/values-vi/strings.xml @@ -71,8 +71,6 @@ Thêm bookmark - quay lại - rời khỏi Có thể tiếp cận qua Nostr Tin nhắn riêng chưa đọc Đã dịch chuyển diff --git a/app/src/main/res/values-zh/strings.xml b/app/src/main/res/values-zh/strings.xml index a5758b89..d6eada8c 100644 --- a/app/src/main/res/values-zh/strings.xml +++ b/app/src/main/res/values-zh/strings.xml @@ -71,8 +71,6 @@ 添加书签 - 返回 - 离开 可通过 Nostr 联系 未读私信 已传送 diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml index 5ee5c4c1..02393f74 100644 --- a/app/src/main/res/values/strings.xml +++ b/app/src/main/res/values/strings.xml @@ -72,8 +72,6 @@ Add bookmark - Back - Leave Nostr reachable Unread private messages Location notes diff --git a/app/src/test/java/com/bitchat/android/geohash/GeohashNostrPrivacyPolicyTest.kt b/app/src/test/java/com/bitchat/android/geohash/GeohashNostrPrivacyPolicyTest.kt new file mode 100644 index 00000000..3c6217af --- /dev/null +++ b/app/src/test/java/com/bitchat/android/geohash/GeohashNostrPrivacyPolicyTest.kt @@ -0,0 +1,46 @@ +package com.bitchat.android.geohash + +import org.junit.Assert.assertEquals +import org.junit.Test + +class GeohashNostrPrivacyPolicyTest { + @Test + fun `disabled live location retains only user-selected sampling targets`() { + val targets = GeohashNostrPrivacyPolicy.samplingTargets( + liveLocationGeohashes = listOf("live-city", "shared"), + userSelectedGeohashes = listOf("bookmark", "shared"), + liveLocationEnabled = false + ) + + assertEquals(setOf("bookmark", "shared"), targets) + } + + @Test + fun `enabled live location combines and deduplicates sampling targets`() { + val targets = GeohashNostrPrivacyPolicy.samplingTargets( + liveLocationGeohashes = listOf("live-city", "shared"), + userSelectedGeohashes = listOf("bookmark", "shared"), + liveLocationEnabled = true + ) + + assertEquals(setOf("live-city", "bookmark", "shared"), targets) + } + + @Test + fun `presence excludes live channels when disabled`() { + val channels = listOf( + GeohashChannel(GeohashChannelLevel.REGION, "region"), + GeohashChannel(GeohashChannelLevel.CITY, "city"), + GeohashChannel(GeohashChannelLevel.NEIGHBORHOOD, "neighborhood") + ) + + assertEquals( + emptySet(), + GeohashNostrPrivacyPolicy.livePresenceTargets(channels, false) + ) + assertEquals( + setOf("region", "city"), + GeohashNostrPrivacyPolicy.livePresenceTargets(channels, true) + ) + } +} diff --git a/app/src/test/java/com/bitchat/android/geohash/LiveLocationAccessPolicyTest.kt b/app/src/test/java/com/bitchat/android/geohash/LiveLocationAccessPolicyTest.kt new file mode 100644 index 00000000..93cef8ca --- /dev/null +++ b/app/src/test/java/com/bitchat/android/geohash/LiveLocationAccessPolicyTest.kt @@ -0,0 +1,48 @@ +package com.bitchat.android.geohash + +import org.junit.Assert.assertFalse +import org.junit.Assert.assertNull +import org.junit.Assert.assertTrue +import org.junit.Test + +class LiveLocationAccessPolicyTest { + @Test + fun `live location is disabled by default`() { + val policy = LiveLocationAccessPolicy() + + assertFalse(policy.isEnabled) + assertNull(policy.captureToken()) + } + + @Test + fun `disable and re-enable never revives old work`() { + val policy = LiveLocationAccessPolicy(initialEnabled = true) + val oldToken = requireNotNull(policy.captureToken()) + + policy.update(false) + assertFalse(policy.accepts(oldToken)) + + policy.update(true) + val newToken = requireNotNull(policy.captureToken()) + + assertFalse(policy.accepts(oldToken)) + assertTrue(policy.accepts(newToken)) + } + + @Test + fun `invalidation prevents a queued action from running`() { + val policy = LiveLocationAccessPolicy(initialEnabled = true) + val token = requireNotNull(policy.captureToken()) + var ran = false + + policy.invalidate() + val accepted = policy.runIfAllowed(token) { ran = true } + + assertFalse(accepted) + assertFalse(ran) + assertNull(policy.captureToken()) + + policy.resumeAccess() + assertTrue(policy.captureToken() != null) + } +} diff --git a/app/src/test/java/com/bitchat/android/nostr/NostrLiveSubscriptionPrivacyTest.kt b/app/src/test/java/com/bitchat/android/nostr/NostrLiveSubscriptionPrivacyTest.kt new file mode 100644 index 00000000..a964a686 --- /dev/null +++ b/app/src/test/java/com/bitchat/android/nostr/NostrLiveSubscriptionPrivacyTest.kt @@ -0,0 +1,37 @@ +package com.bitchat.android.nostr + +import org.junit.Assert.assertEquals +import org.junit.Test + +class NostrLiveSubscriptionPrivacyTest { + @Test + fun `teardown closes live subscriptions on shared relays`() { + val targets = NostrLiveSubscriptionPrivacy.closeTargets( + liveSubscriptionIds = setOf("live-a", "live-b"), + subscriptionsByRelay = mapOf( + "shared-relay" to setOf("dm", "live-a"), + "live-relay" to setOf("live-a", "live-b"), + "dm-relay" to setOf("dm"), + ), + ) + + assertEquals( + mapOf( + "shared-relay" to setOf("live-a"), + "live-relay" to setOf("live-a", "live-b"), + ), + targets, + ) + } + + @Test + fun `teardown ignores relays without live subscriptions`() { + assertEquals( + emptyMap>(), + NostrLiveSubscriptionPrivacy.closeTargets( + liveSubscriptionIds = emptySet(), + subscriptionsByRelay = mapOf("default-relay" to setOf("dm")), + ), + ) + } +} diff --git a/app/src/test/java/com/bitchat/android/ui/ChatUIUtilsTest.kt b/app/src/test/java/com/bitchat/android/ui/ChatUIUtilsTest.kt index 59f0eb73..e64448c3 100644 --- a/app/src/test/java/com/bitchat/android/ui/ChatUIUtilsTest.kt +++ b/app/src/test/java/com/bitchat/android/ui/ChatUIUtilsTest.kt @@ -1,6 +1,7 @@ package com.bitchat.android.ui import androidx.compose.ui.graphics.Color +import androidx.compose.ui.text.AnnotatedString import androidx.compose.ui.text.SpanStyle import androidx.compose.ui.text.font.FontWeight import androidx.compose.ui.unit.sp @@ -13,11 +14,12 @@ import com.bitchat.android.ui.theme.LightBitchatColorScheme import com.bitchat.android.ui.theme.LightBitchatPalette import com.bitchat.android.ui.theme.MessageBodyTextStyle import com.bitchat.android.ui.theme.MessageSenderTextStyle -import com.bitchat.android.ui.theme.colorForPeerSeed +import com.bitchat.android.ui.theme.colorForPeer import java.text.SimpleDateFormat import java.util.Date import java.util.Locale import org.junit.Assert.assertEquals +import org.junit.Assert.assertFalse import org.junit.Assert.assertNotNull import org.junit.Assert.assertTrue import org.junit.Test @@ -221,19 +223,90 @@ class ChatUIUtilsTest { @Test fun `mention of another user is tinted by that user's own peer color`() { + val pubkey = "0123456789abcdef".repeat(4) + val identity = PeerIdentity.nostr(pubkey) + val mentionPeerIdentities = buildMentionPeerIdentityMap( + messages = listOf( + BitchatMessage( + sender = "carol#04af", + content = "hello", + timestamp = Date(0), + senderPeerID = "nostr:${pubkey.take(8)}", + senderNostrPubkey = pubkey, + ) + ) + ) val body = formatTextMessageBody( message = message("cc @carol#04af"), currentUserNickname = "bob", palette = palette, contentColor = colorScheme.onSurface, linkColor = colorScheme.secondary, + mentionPeerIdentities = mentionPeerIdentities, timeFormatter = timeFormatter, includeTimestamp = false, ) - val expected = colorForPeerSeed(PeerColorSeed("carol#04af"), palette) + val expected = colorForPeer(identity, palette) val chip = mentionChipSpans(body).single() assertEquals(expected.copy(alpha = MENTION_CHIP_ALPHA), chip.item.background) + assertTrue(body.spanStyles.any { it.item.color == expected }) + } + + @Test + fun `composer colors nickname and hash suffix from the mentioned peer identity`() { + val pubkey = "0123456789abcdef".repeat(4) + val identity = PeerIdentity.nostr(pubkey) + val token = "@carol#04af" + val input = "ping $token now" + val transformed = MentionVisualTransformation( + mentionPeerIdentities = mapOf("carol#04af" to identity), + palette = palette, + ).filter(AnnotatedString(input)).text + + val expectedColor = colorForPeer(identity, palette) + val tokenStart = input.indexOf(token) + val suffixStart = input.indexOf("#04af") + val tokenEnd = tokenStart + token.length + + assertEquals(input, transformed.text) + assertTrue(transformed.spanStyles.any { + it.start == tokenStart && + it.end == tokenEnd && + it.item.background == expectedColor.copy(alpha = MENTION_CHIP_ALPHA) + }) + assertTrue(transformed.spanStyles.any { + it.start == tokenStart && + it.end == suffixStart && + it.item.color == expectedColor + }) + assertTrue(transformed.spanStyles.any { + it.start == suffixStart && + it.end == tokenEnd && + it.item.color == expectedColor.copy(alpha = SUFFIX_ALPHA) + }) + } + + @Test + fun `ambiguous base nickname is not assigned to the wrong peer`() { + val firstIdentity = PeerIdentity.nostr("11111111".repeat(8)) + val secondIdentity = PeerIdentity.nostr("22222222".repeat(8)) + val identities = buildMentionPeerIdentityMap( + messages = emptyList(), + knownPeers = listOf( + "alice#1111" to firstIdentity, + "alice#2222" to secondIdentity, + ) + ) + + assertEquals(firstIdentity, identities["alice#1111"]) + assertEquals(secondIdentity, identities["alice#2222"]) + assertFalse(identities.containsKey("alice")) + assertEquals( + firstIdentity, + resolveMentionPeerIdentity("@alice#1111", identities) + ) + assertEquals(null, resolveMentionPeerIdentity("@alice", identities)) } @Test @@ -349,24 +422,33 @@ class ChatUIUtilsTest { // MARK: - Peer colors @Test - fun `peer seed factories normalize identities without resolving UI colors`() { + fun `peer identity factories normalize stable IDs without resolving UI colors`() { assertEquals( - PeerColorSeed("noise:abcdef"), - meshPeerColorSeed("ABCDEF") + PeerIdentity.mesh("abcdef"), + PeerIdentity.mesh("ABCDEF") ) assertEquals( - PeerColorSeed("nostr:abcdef"), - nostrPeerColorSeed("ABCDEF") + PeerIdentity.nostr("abcdef"), + PeerIdentity.nostr("ABCDEF") ) + assertEquals( + PeerIdentity.nostr("abcdef"), + PeerIdentity.nostr("nostr:nostr_ABCDEF") + ) + assertEquals( + "nostr:nostr:abcdef01", + PeerIdentity.nostr("ABCDEF0123456789").stableKey + ) + assertEquals("alice#1234", PeerIdentity.nickname("ALICE#1234").stableKey) } @Test fun `peer color hue is stable across light and dark, only chroma differs`() { // Hue derivation must stay byte-identical to iOS; only saturation/value are tuned for // the redesigned neutral message body. - val seed = PeerColorSeed("noise:abc") - val dark = colorForPeerSeed(seed, DarkBitchatPalette) - val light = colorForPeerSeed(seed, LightBitchatPalette) + val identity = PeerIdentity.mesh("abc") + val dark = colorForPeer(identity, DarkBitchatPalette) + val light = colorForPeer(identity, LightBitchatPalette) val darkHsv = FloatArray(3) val lightHsv = FloatArray(3) @@ -384,8 +466,8 @@ class ChatUIUtilsTest { fun `peer color avoids the orange hue reserved for self`() { // Sweep a range of seeds; none may land within the reserved orange band. repeat(500) { i -> - val color = colorForPeerSeed( - PeerColorSeed("noise:seed$i"), + val color = colorForPeer( + PeerIdentity.mesh("seed$i"), DarkBitchatPalette ) val hsv = FloatArray(3) @@ -407,6 +489,59 @@ class ChatUIUtilsTest { ) } + @Test + fun `geohash chat and people sheet resolve the same full Nostr identity`() { + val pubkey = "ABCDEF0123456789".repeat(4) + val peopleIdentity = PeerIdentity.nostr(pubkey) + val chatIdentity = peerIdentityForMessage( + BitchatMessage( + sender = "alice#1234", + content = "hello", + timestamp = Date(0), + senderPeerID = "nostr:${pubkey.take(8)}", + senderNostrPubkey = pubkey, + ) + ) + + assertEquals(peopleIdentity, chatIdentity) + assertEquals( + colorForPeer(peopleIdentity, palette), + colorForPeer(chatIdentity, palette) + ) + } + + @Test + fun `mesh chat and people sheet resolve the same peer identity`() { + val peerID = "ABCDEF0123456789" + val peopleIdentity = PeerIdentity.mesh(peerID) + val chatIdentity = peerIdentityForMessage( + BitchatMessage( + sender = "alice#1234", + content = "hello", + timestamp = Date(0), + senderPeerID = peerID, + ) + ) + + assertEquals(peopleIdentity, chatIdentity) + } + + @Test + fun `full Nostr identity wins over a truncated routing alias`() { + val pubkey = "0123456789ABCDEF".repeat(4) + val identity = peerIdentityForMessage( + BitchatMessage( + sender = "alice", + content = "hello", + timestamp = Date(0), + senderPeerID = "nostr_${pubkey.take(16)}", + senderNostrPubkey = pubkey, + ) + ) + + assertEquals(PeerIdentity.nostr(pubkey), identity) + } + private fun rgbToHsv(r: Float, g: Float, b: Float, out: FloatArray) { val max = maxOf(r, g, b) val min = minOf(r, g, b) diff --git a/app/src/test/java/com/bitchat/android/ui/GeohashPresenceGroupingTest.kt b/app/src/test/java/com/bitchat/android/ui/GeohashPresenceGroupingTest.kt index 3c655f44..869ae924 100644 --- a/app/src/test/java/com/bitchat/android/ui/GeohashPresenceGroupingTest.kt +++ b/app/src/test/java/com/bitchat/android/ui/GeohashPresenceGroupingTest.kt @@ -80,4 +80,51 @@ class GeohashPresenceGroupingTest { assertTrue(sections.onLocation.isEmpty()) assertEquals(listOf("ABCDEF"), sections.teleportedIn.map { it.id }) } + + @Test + fun `duplicate nicknames are detected across case and sections`() { + val duplicates = duplicateGeohashBaseNames( + listOf( + person("first", "Alice"), + person("second", "alice"), + person("third", "bob") + ) + ) + + assertEquals(setOf("alice"), duplicates) + } + + @Test + fun `duplicate nickname gets the same last-four ID suffix as chat`() { + assertEquals( + "#cdef", + geohashIdentitySuffix(person("0123456789abcdef", "alice"), showHashSuffix = true) + ) + assertEquals( + "", + geohashIdentitySuffix(person("0123456789abcdef", "alice"), showHashSuffix = false) + ) + } + + @Test + fun `existing chat-style suffix is preserved`() { + assertEquals( + "#04af", + geohashIdentitySuffix(person("0123456789abcdef", "alice#04af"), showHashSuffix = true) + ) + } + + @Test + fun `disambiguated display name matches the mention token used by chat`() { + val alice = person("0123456789abcdef", "alice") + + assertEquals( + "alice#cdef", + disambiguatedGeohashDisplayName(alice, duplicateBaseNames = setOf("alice")) + ) + assertEquals( + "alice", + disambiguatedGeohashDisplayName(alice, duplicateBaseNames = emptySet()) + ) + } } diff --git a/app/src/test/kotlin/com/bitchat/android/contracts/ClientRewriteWireContractTest.kt b/app/src/test/kotlin/com/bitchat/android/contracts/ClientRewriteWireContractTest.kt new file mode 100644 index 00000000..d1381170 --- /dev/null +++ b/app/src/test/kotlin/com/bitchat/android/contracts/ClientRewriteWireContractTest.kt @@ -0,0 +1,301 @@ +package com.bitchat.android.contracts + +import com.bitchat.android.model.BitchatFilePacket +import com.bitchat.android.model.BitchatMessage +import com.bitchat.android.model.FragmentPayload +import com.bitchat.android.model.IdentityAnnouncement +import com.bitchat.android.model.NoisePayload +import com.bitchat.android.model.NoisePayloadType +import com.bitchat.android.model.PeerCapabilities +import com.bitchat.android.model.PrivateMessagePacket +import com.bitchat.android.model.RequestSyncPacket +import com.bitchat.android.model.UnknownAnnouncementTLV +import com.bitchat.android.protocol.BinaryProtocol +import com.bitchat.android.protocol.BitchatPacket +import com.bitchat.android.protocol.MessageType +import org.junit.Assert.assertArrayEquals +import org.junit.Assert.assertEquals +import org.junit.Assert.assertFalse +import org.junit.Assert.assertNotNull +import org.junit.Assert.assertNull +import org.junit.Assert.assertTrue +import org.junit.Test +import java.util.Date + +/** + * Golden wire vectors for formats that a from-scratch client must reproduce. + * + * These assertions deliberately compare literal bytes rather than relying only + * on encode/decode round trips, which can hide matching bugs in both methods. + */ +class ClientRewriteWireContractTest { + + @Test + fun `v1 packet matches canonical unpadded bytes`() { + val packet = BitchatPacket( + version = 1u, + type = MessageType.MESSAGE.value, + senderID = hex("1011121314151617"), + recipientID = null, + timestamp = 0x0102030405060708uL, + payload = hex("aabbcc"), + signature = null, + ttl = 7u + ) + + val encoded = BinaryProtocol.encode(packet, padding = false) + + assertArrayEquals( + hex("01020701020304050607080000031011121314151617aabbcc"), + encoded + ) + assertEquals(packet, BinaryProtocol.decode(encoded!!)) + } + + @Test + fun `v2 routed signed packet matches canonical section order`() { + val signature = ByteArray(64) { 0x5a } + val packet = BitchatPacket( + version = 2u, + type = MessageType.NOISE_ENCRYPTED.value, + senderID = hex("0102030405060708"), + recipientID = hex("1112131415161718"), + timestamp = 42uL, + payload = hex("dead"), + signature = signature, + ttl = 5u, + route = listOf( + hex("2122232425262728"), + hex("3132333435363738") + ) + ) + + val encoded = BinaryProtocol.encode(packet, padding = false)!! + val expectedPrefix = hex( + "021105000000000000002a0b00000002" + + "0102030405060708" + + "1112131415161718" + + "02" + + "2122232425262728" + + "3132333435363738" + + "dead" + ) + + assertArrayEquals(expectedPrefix + signature, encoded) + assertEquals(packet, BinaryProtocol.decode(encoded)) + } + + @Test + fun `minimal chat message matches canonical binary payload`() { + val message = BitchatMessage( + id = "id", + sender = "bob", + content = "hi", + timestamp = Date(0x0102030405060708L) + ) + + val encoded = message.toBinaryPayload() + + assertArrayEquals( + hex("00010203040506070802696403626f6200026869"), + encoded + ) + assertEquals(message, BitchatMessage.fromBinaryPayload(encoded!!)) + } + + @Test + fun `chat message optional fields use flags and UTF-8 byte lengths`() { + val message = BitchatMessage( + id = "m", + sender = "é", + content = "hello", + timestamp = Date(42L), + isRelay = true, + originalSender = "o", + isPrivate = true, + recipientNickname = "r", + senderPeerID = "p", + mentions = listOf("a", "β"), + channel = "c" + ) + + val encoded = message.toBinaryPayload()!! + + assertArrayEquals( + hex( + "7f000000000000002a" + + "016d" + + "02c3a9" + + "000568656c6c6f" + + "016f" + + "0172" + + "0170" + + "02" + + "0161" + + "02ceb2" + + "0163" + ), + encoded + ) + assertEquals(message, BitchatMessage.fromBinaryPayload(encoded)) + } + + @Test + fun `encrypted chat payload carries ciphertext instead of placeholder content`() { + val message = BitchatMessage( + id = "e", + sender = "alice", + content = "must-not-be-on-wire", + timestamp = Date(1L), + encryptedContent = hex("000102ff"), + isEncrypted = true, + isPrivate = true + ) + + val decoded = BitchatMessage.fromBinaryPayload(message.toBinaryPayload()!!)!! + + assertEquals("", decoded.content) + assertArrayEquals(hex("000102ff"), decoded.encryptedContent) + assertTrue(decoded.isEncrypted) + assertTrue(decoded.isPrivate) + assertFalse(message.toBinaryPayload()!!.toString(Charsets.ISO_8859_1).contains("must-not-be-on-wire")) + } + + @Test + fun `private message and Noise envelopes match deployed type bytes`() { + val privateMessage = PrivateMessagePacket(messageID = "m1", content = "hi") + val privateMessageBytes = hex("00026d3101026869") + + assertArrayEquals(privateMessageBytes, privateMessage.encode()) + assertEquals(privateMessage, PrivateMessagePacket.decode(privateMessageBytes)) + assertArrayEquals( + hex("0100026d3101026869"), + NoisePayload(NoisePayloadType.PRIVATE_MESSAGE, privateMessageBytes).encode() + ) + assertEquals( + NoisePayloadType.FILE_TRANSFER, + NoisePayload.decode(hex("09cafe"))?.type + ) + assertArrayEquals( + hex("20cafe"), + NoisePayload.decode(hex("09cafe"))!!.encode() + ) + } + + @Test + fun `fragment payload matches the thirteen byte iOS header`() { + val fragment = FragmentPayload( + fragmentID = hex("0001020304050607"), + index = 1, + total = 3, + originalType = MessageType.MESSAGE.value, + data = hex("aabb") + ) + val wire = hex("00010203040506070001000302aabb") + + assertArrayEquals(wire, fragment.encode()) + assertEquals(fragment, FragmentPayload.decode(wire)) + assertTrue(fragment.isValid()) + } + + @Test + fun `sync request matches canonical TLV bytes and skips extensions`() { + val request = RequestSyncPacket( + p = 19, + m = 0x01020304L, + data = hex("aabb") + ) + val wire = hex("0100011302000401020304030002aabb") + + assertArrayEquals(wire, request.encode()) + assertSyncRequestEquals(request, RequestSyncPacket.decode(wire)) + + val withExtension = hex("7f0002cafe") + wire + assertSyncRequestEquals(request, RequestSyncPacket.decode(withExtension)) + } + + @Test + fun `identity announcement matches canonical TLV order and preserves extensions`() { + val announcement = IdentityAnnouncement( + nickname = "bob", + noisePublicKey = ByteArray(32) { 0x11 }, + signingPublicKey = ByteArray(32) { 0x22 }, + capabilities = PeerCapabilities.PRIVATE_MEDIA, + unknownTLVs = listOf(UnknownAnnouncementTLV(0x7f, hex("cafe"))) + ) + val expected = + hex("0103626f620220") + + ByteArray(32) { 0x11 } + + hex("0320") + + ByteArray(32) { 0x22 } + + hex("050200017f02cafe") + + val encoded = announcement.encode() + + assertArrayEquals(expected, encoded) + assertEquals(announcement, IdentityAnnouncement.decode(encoded!!)) + } + + @Test + fun `file transfer matches deployed mixed-width TLV vector`() { + val packet = BitchatFilePacket( + fileName = "a", + fileSize = 2, + mimeType = "m", + content = hex("dead") + ) + val wire = hex("01000161020004000000020300016d0400000002dead") + + assertArrayEquals(wire, packet.encode()) + + val decoded = BitchatFilePacket.decode(wire) + assertNotNull(decoded) + assertEquals(packet.fileName, decoded!!.fileName) + assertEquals(packet.fileSize, decoded.fileSize) + assertEquals(packet.mimeType, decoded.mimeType) + assertArrayEquals(packet.content, decoded.content) + } + + @Test + fun `required message prefixes reject every truncation`() { + val wire = BitchatMessage( + id = "id", + sender = "bob", + content = "hello", + timestamp = Date(1L) + ).toBinaryPayload()!! + + for (length in 0 until wire.size) { + assertNull( + "Accepted required message prefix of $length/${wire.size} bytes", + BitchatMessage.fromBinaryPayload(wire.copyOf(length)) + ) + } + assertNotNull(BitchatMessage.fromBinaryPayload(wire)) + } + + @Test + fun `TLV decoders reject missing required fields and truncated values`() { + assertNull(PrivateMessagePacket.decode(hex("00026d31"))) + assertNull(PrivateMessagePacket.decode(hex("00026d3101036869"))) + assertNull(RequestSyncPacket.decode(hex("0100011302000401020304"))) + assertNull(IdentityAnnouncement.decode(hex("0103626f62022011"))) + assertNull(BitchatFilePacket.decode(hex("010001610400000002de"))) + assertNull(FragmentPayload.decode(ByteArray(FragmentPayload.HEADER_SIZE - 1))) + } + + private fun hex(value: String): ByteArray { + require(value.length % 2 == 0) + return value.chunked(2).map { it.toInt(16).toByte() }.toByteArray() + } + + private fun assertSyncRequestEquals( + expected: RequestSyncPacket, + actual: RequestSyncPacket? + ) { + assertNotNull(actual) + assertEquals(expected.p, actual!!.p) + assertEquals(expected.m, actual.m) + assertArrayEquals(expected.data, actual.data) + } +} diff --git a/app/src/test/kotlin/com/bitchat/android/noise/NoiseExternalVectorTest.kt b/app/src/test/kotlin/com/bitchat/android/noise/NoiseExternalVectorTest.kt new file mode 100644 index 00000000..70badb96 --- /dev/null +++ b/app/src/test/kotlin/com/bitchat/android/noise/NoiseExternalVectorTest.kt @@ -0,0 +1,261 @@ +package com.bitchat.android.noise + +import com.bitchat.android.noise.southernstorm.protocol.CipherState +import com.bitchat.android.noise.southernstorm.protocol.HandshakeState +import com.bitchat.android.noise.southernstorm.protocol.Noise +import org.junit.Assert.assertArrayEquals +import org.junit.Assert.assertEquals +import org.junit.Assert.assertThrows +import org.junit.Test + +/** + * Cacophony/Noise-C vector for Noise_XX_25519_ChaChaPoly_SHA256. + * + * This exercises the vendored Noise state machine directly, independent of managers, Android + * storage, and generated keys. + */ +class NoiseExternalVectorTest { + private val messages = listOf( + VectorMessage( + "4c756477696720766f6e204d69736573", + "ca35def5ae56cec33dc2036731ab14896bc4c75dbb07a61f879f8e3afa4c7944" + + "4c756477696720766f6e204d69736573" + ), + VectorMessage( + "4d757272617920526f746862617264", + "95ebc60d2b1fa672c1f46a8aa265ef51bfe38e7ccb39ec5be34069f144808843" + + "81cbad1f276e038c48378ffce2b65285e08d6b68aaa3629a5a8639392490e5b9" + + "bd5269c2f1e4f488ed8831161f19b7815528f8982ffe09be9b5c412f8a0db50f" + + "8814c7194e83f23dbd8d162c9326ad" + ), + VectorMessage( + "462e20412e20486179656b", + "c7195ffacac1307ff99046f219750fc47693e23c3cb08b89c2af808b444850a8" + + "0ae475b9df0f169ae80a89be0865b57f58c9fea0d4ec82a286427402f113e4b6" + + "ae769a1d95941d49b25030" + ), + VectorMessage( + "4361726c204d656e676572", + "96763ed773f8e47bb3712f0e29b3060ffc956ffc146cee53d5e1df" + ), + VectorMessage( + "4a65616e2d426170746973746520536179", + "3e40f15f6f3a46ae446b253bf8b1d9ffb6ed9b174d272328ff91a7e2e5c79c07f5" + ), + VectorMessage( + "457567656e2042f6686d20766f6e2042617765726b", + "eb3f3515110702e047a6c9da4478b6ead94873c11c0f2d710ddb3f09fce024b3" + + "a58502ae3f" + ) + ) + + @Test + fun `Noise-C XX transcript matches every handshake and transport byte`() { + val initiator = vectorState(HandshakeState.INITIATOR) + val responder = vectorState(HandshakeState.RESPONDER) + try { + val states = listOf( + initiator to responder, + responder to initiator, + initiator to responder + ) + messages.take(3).zip(states).forEach { (message, peers) -> + assertHandshakeMessage(peers.first, peers.second, message) + } + + assertEquals(HandshakeState.SPLIT, initiator.action) + assertEquals(HandshakeState.SPLIT, responder.action) + assertArrayEquals(initiator.handshakeHash, responder.handshakeHash) + + val initiatorCiphers = initiator.split() + val responderCiphers = responder.split() + assertTransportMessage( + responderCiphers.sender, + initiatorCiphers.receiver, + messages[3] + ) + assertTransportMessage( + initiatorCiphers.sender, + responderCiphers.receiver, + messages[4] + ) + assertTransportMessage( + responderCiphers.sender, + initiatorCiphers.receiver, + messages[5] + ) + initiatorCiphers.sender.destroy() + initiatorCiphers.receiver.destroy() + responderCiphers.sender.destroy() + responderCiphers.receiver.destroy() + } finally { + initiator.destroy() + responder.destroy() + } + } + + @Test + fun `Noise state machine rejects invalid actions and a tampered handshake tag`() { + val initiator = vectorState(HandshakeState.INITIATOR) + val responder = vectorState(HandshakeState.RESPONDER) + try { + assertThrows(IllegalStateException::class.java) { initiator.start() } + assertThrows(IllegalStateException::class.java) { + responder.writeMessage(ByteArray(256), 0, null, 0, 0) + } + + assertHandshakeMessage(initiator, responder, messages[0]) + val message2 = write(responder, messages[1].payload) + val tampered = message2.copyOf() + tampered[tampered.lastIndex] = (tampered.last().toInt() xor 1).toByte() + + assertThrows(Exception::class.java) { + initiator.readMessage(tampered, 0, tampered.size, ByteArray(256), 0) + } + assertEquals(HandshakeState.FAILED, initiator.action) + } finally { + initiator.destroy() + responder.destroy() + } + } + + @Test + fun `ChaChaPoly authentication binds nonce ciphertext tag and associated data`() { + val key = ByteArray(32) { it.toByte() } + val plaintext = "associated".toByteArray() + val associatedData = "header".toByteArray() + val sender = Noise.createCipher("ChaChaPoly") + val receiver = Noise.createCipher("ChaChaPoly") + val wrongAdReceiver = Noise.createCipher("ChaChaPoly") + try { + sender.initializeKey(key, 0) + receiver.initializeKey(key, 0) + wrongAdReceiver.initializeKey(key, 0) + sender.setNonce(7) + receiver.setNonce(7) + wrongAdReceiver.setNonce(7) + val ciphertext = ByteArray(plaintext.size + sender.macLength) + val length = sender.encryptWithAd( + associatedData, + plaintext, + 0, + ciphertext, + 0, + plaintext.size + ) + + assertThrows(Exception::class.java) { + wrongAdReceiver.decryptWithAd( + "wrong".toByteArray(), + ciphertext, + 0, + ByteArray(length), + 0, + length + ) + } + val output = ByteArray(length) + val outputLength = receiver.decryptWithAd( + associatedData, + ciphertext, + 0, + output, + 0, + length + ) + assertArrayEquals(plaintext, output.copyOf(outputLength)) + } finally { + sender.destroy() + receiver.destroy() + wrongAdReceiver.destroy() + } + } + + private fun vectorState(role: Int): HandshakeState { + val state = HandshakeState(PROTOCOL, role) + val prologue = hex("4a6f686e2047616c74") + state.setPrologue(prologue, 0, prologue.size) + val staticPrivate = if (role == HandshakeState.INITIATOR) { + hex("e61ef9919cde45dd5f82166404bd08e38bceb5dfdfded0a34c8df7ed542214d1") + } else { + hex("4a3acbfdb163dec651dfa3194dece676d437029c62a408b4c5ea9114246e4893") + } + val ephemeralPrivate = if (role == HandshakeState.INITIATOR) { + hex("893e28b9dc6ca8d611ab664754b8ceb7bac5117349a4439a6b0569da977c464a") + } else { + hex("bbdb4cdbd309f1a1f2e1456967fe288cadd6f712d65dc7b7793d5e63da6b375b") + } + state.localKeyPair.setPrivateKey(staticPrivate, 0) + state.fixedEphemeralKey.setPrivateKey(ephemeralPrivate, 0) + state.start() + return state + } + + private fun assertHandshakeMessage( + writer: HandshakeState, + reader: HandshakeState, + message: VectorMessage + ) { + val actualCiphertext = write(writer, message.payload) + assertArrayEquals(message.ciphertext, actualCiphertext) + + val plaintext = ByteArray(256) + val length = reader.readMessage( + actualCiphertext, + 0, + actualCiphertext.size, + plaintext, + 0 + ) + assertArrayEquals(message.payload, plaintext.copyOf(length)) + } + + private fun write(state: HandshakeState, payload: ByteArray): ByteArray { + val output = ByteArray(512) + val length = state.writeMessage(output, 0, payload, 0, payload.size) + return output.copyOf(length) + } + + private fun assertTransportMessage( + sender: CipherState, + receiver: CipherState, + message: VectorMessage + ) { + val encrypted = ByteArray(message.payload.size + sender.macLength) + val encryptedLength = sender.encryptWithAd( + null, + message.payload, + 0, + encrypted, + 0, + message.payload.size + ) + assertArrayEquals(message.ciphertext, encrypted.copyOf(encryptedLength)) + + val decrypted = ByteArray(encryptedLength) + val decryptedLength = receiver.decryptWithAd( + null, + encrypted, + 0, + decrypted, + 0, + encryptedLength + ) + assertArrayEquals(message.payload, decrypted.copyOf(decryptedLength)) + } + + private data class VectorMessage( + private val payloadHex: String, + private val ciphertextHex: String + ) { + val payload: ByteArray get() = hex(payloadHex) + val ciphertext: ByteArray get() = hex(ciphertextHex) + } + + companion object { + private const val PROTOCOL = "Noise_XX_25519_ChaChaPoly_SHA256" + + private fun hex(value: String): ByteArray = + value.chunked(2).map { it.toInt(16).toByte() }.toByteArray() + } +} diff --git a/app/src/test/kotlin/com/bitchat/android/noise/NoiseSessionManagerIdentityBindingTest.kt b/app/src/test/kotlin/com/bitchat/android/noise/NoiseSessionManagerIdentityBindingTest.kt index 63f5e3c1..1e18fd6a 100644 --- a/app/src/test/kotlin/com/bitchat/android/noise/NoiseSessionManagerIdentityBindingTest.kt +++ b/app/src/test/kotlin/com/bitchat/android/noise/NoiseSessionManagerIdentityBindingTest.kt @@ -330,6 +330,51 @@ class NoiseSessionManagerIdentityBindingTest { assertArrayEquals(plaintext, bobManager.decrypt(ciphertext, alice.peerID)) } + @Test + fun `simultaneous handshake collision matrix has one deterministic winner`() { + val identities = listOf( + identity("e61ef9919cde45dd5f82166404bd08e38bceb5dfdfded0a34c8df7ed542214d1"), + identity("4a3acbfdb163dec651dfa3194dece676d437029c62a408b4c5ea9114246e4893"), + identity("77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a"), + identity("5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb") + ) + + identities.indices.forEach { leftIndex -> + ((leftIndex + 1) until identities.size).forEach { rightIndex -> + val left = identities[leftIndex] + val right = identities[rightIndex] + val leftManager = manager(left) + val rightManager = manager(right) + val leftMessage1 = leftManager.initiateHandshake(right.peerID)!! + val rightMessage1 = rightManager.initiateHandshake(left.peerID)!! + + val leftResponse = leftManager.processHandshakeMessage(right.peerID, rightMessage1) + val rightResponse = rightManager.processHandshakeMessage(left.peerID, leftMessage1) + + if (left.peerID < right.peerID) { + assertNull(leftResponse) + val message3 = leftManager.processHandshakeMessage(right.peerID, rightResponse!!)!! + assertNull(rightManager.processHandshakeMessage(left.peerID, message3)) + } else { + assertNull(rightResponse) + val message3 = rightManager.processHandshakeMessage(left.peerID, leftResponse!!)!! + assertNull(leftManager.processHandshakeMessage(right.peerID, message3)) + } + + assertTrue(leftManager.hasEstablishedSession(right.peerID)) + assertTrue(rightManager.hasEstablishedSession(left.peerID)) + val payload = "matrix-$leftIndex-$rightIndex".toByteArray() + assertArrayEquals( + payload, + rightManager.decrypt( + leftManager.encrypt(payload, right.peerID), + left.peerID + ) + ) + } + } + } + @Test fun `peer ID derivation rejects malformed keys and non-wire claims`() { val peer = identity() @@ -381,4 +426,19 @@ class NoiseSessionManagerIdentityBindingTest { dh.destroy() } } + + private fun identity(privateKeyHex: String): TestIdentity { + val privateKey = privateKeyHex.chunked(2) + .map { it.toInt(16).toByte() } + .toByteArray() + val dh = Noise.createDH("25519") + return try { + dh.setPrivateKey(privateKey, 0) + val publicKey = ByteArray(32) + dh.getPublicKey(publicKey, 0) + TestIdentity(privateKey, publicKey, NoisePeerIdentity.derivePeerID(publicKey)!!) + } finally { + dh.destroy() + } + } } diff --git a/app/src/test/kotlin/com/bitchat/android/nostr/NostrRelayManagerLifecycleSmokeTest.kt b/app/src/test/kotlin/com/bitchat/android/nostr/NostrRelayManagerLifecycleSmokeTest.kt new file mode 100644 index 00000000..7bb4aa30 --- /dev/null +++ b/app/src/test/kotlin/com/bitchat/android/nostr/NostrRelayManagerLifecycleSmokeTest.kt @@ -0,0 +1,51 @@ +package com.bitchat.android.nostr + +import org.junit.Assert.assertEquals +import org.junit.Assert.assertFalse +import org.junit.Assert.assertTrue +import org.junit.Test +import org.junit.runner.RunWith +import org.robolectric.RobolectricTestRunner + +@RunWith(RobolectricTestRunner::class) +class NostrRelayManagerLifecycleSmokeTest { + @Test + fun `disconnected manager maintains subscription and empty publish invariants locally`() { + val manager = NostrRelayManager.shared + manager.disconnect() + manager.clearAllSubscriptions() + + val id = manager.subscribe( + filter = NostrFilter(kinds = listOf(NostrKind.TEXT_NOTE)), + id = "local-contract", + handler = {}, + targetRelayUrls = emptyList() + ) + + assertEquals("local-contract", id) + assertEquals(1, manager.getActiveSubscriptionCount()) + assertTrue(manager.getActiveSubscriptions().containsKey(id)) + assertTrue(manager.validateSubscriptionConsistency().isConsistent) + manager.sendEvent(signedEvent(), relayUrls = emptyList()) + manager.retryConnection("wss://not-configured.example") + + manager.unsubscribe(id) + assertEquals(0, manager.getActiveSubscriptionCount()) + assertFalse(manager.isConnected.value) + assertTrue(manager.getRelayStatuses().none { it.isConnected }) + + manager.disconnect() + assertFalse(manager.isConnected.value) + } + + private fun signedEvent(): NostrEvent { + val privateKey = "0".repeat(63) + "1" + return NostrEvent( + pubkey = NostrCrypto.derivePublicKey(privateKey), + createdAt = 1, + kind = NostrKind.TEXT_NOTE, + tags = emptyList(), + content = "local" + ).sign(privateKey) + } +} diff --git a/app/src/test/kotlin/com/bitchat/android/onboarding/SystemStateManagerContractTest.kt b/app/src/test/kotlin/com/bitchat/android/onboarding/SystemStateManagerContractTest.kt new file mode 100644 index 00000000..a3f0341f --- /dev/null +++ b/app/src/test/kotlin/com/bitchat/android/onboarding/SystemStateManagerContractTest.kt @@ -0,0 +1,87 @@ +package com.bitchat.android.onboarding + +import android.app.Application +import android.bluetooth.BluetoothManager +import android.content.Context +import android.location.LocationManager +import androidx.activity.ComponentActivity +import androidx.test.core.app.ApplicationProvider +import org.junit.Assert.assertEquals +import org.junit.Assert.assertTrue +import org.junit.Test +import org.junit.runner.RunWith +import org.robolectric.Robolectric +import org.robolectric.RobolectricTestRunner +import org.robolectric.Shadows.shadowOf +import org.robolectric.annotation.Config + +@RunWith(RobolectricTestRunner::class) +@Config(sdk = [35], application = Application::class) +class SystemStateManagerContractTest { + @Test + fun `Bluetooth disabled and enabled states are observable without throwing`() { + val app = ApplicationProvider.getApplicationContext() + val controller = Robolectric.buildActivity(ComponentActivity::class.java).create() + val adapter = app.getSystemService(BluetoothManager::class.java).adapter + val manager = BluetoothStatusManager( + activity = controller.get(), + context = app, + onBluetoothEnabled = {}, + onBluetoothDisabled = {} + ) + + shadowOf(adapter).setEnabled(false) + assertEquals(BluetoothStatus.DISABLED, manager.checkBluetoothStatus()) + shadowOf(adapter).setEnabled(true) + assertEquals(BluetoothStatus.ENABLED, manager.checkBluetoothStatus()) + controller.destroy() + } + + @Test + fun `location disabled and enabled states are observable and receiver is cleaned up`() { + val app = ApplicationProvider.getApplicationContext() + val controller = Robolectric.buildActivity(ComponentActivity::class.java).create() + val locationManager = app.getSystemService(Context.LOCATION_SERVICE) as LocationManager + val manager = LocationStatusManager( + activity = controller.get(), + context = app, + onLocationEnabled = {}, + onLocationDisabled = {} + ) + + shadowOf(locationManager).setLocationEnabled(false) + assertEquals(LocationStatus.DISABLED, manager.checkLocationStatus()) + shadowOf(locationManager).setLocationEnabled(true) + assertEquals(LocationStatus.ENABLED, manager.checkLocationStatus()) + + manager.cleanup() + manager.cleanup() + controller.destroy() + } + + @Test + fun `location status routing and recovery messages remain exact`() { + val app = ApplicationProvider.getApplicationContext() + val controller = Robolectric.buildActivity(ComponentActivity::class.java).create() + var enabled = 0 + val disabled = mutableListOf() + val manager = LocationStatusManager( + activity = controller.get(), + context = app, + onLocationEnabled = { enabled++ }, + onLocationDisabled = disabled::add + ) + + manager.handleLocationStatus(LocationStatus.ENABLED) + manager.handleLocationStatus(LocationStatus.NOT_AVAILABLE) + + assertEquals(1, enabled) + assertEquals( + listOf("Location services are not available on this device."), + disabled + ) + assertTrue(manager.getStatusMessage(LocationStatus.DISABLED).contains("Bluetooth scanning")) + manager.cleanup() + controller.destroy() + } +} diff --git a/app/src/test/kotlin/com/bitchat/android/ui/MeshDelegateHandlerStateContractTest.kt b/app/src/test/kotlin/com/bitchat/android/ui/MeshDelegateHandlerStateContractTest.kt new file mode 100644 index 00000000..63ba28ef --- /dev/null +++ b/app/src/test/kotlin/com/bitchat/android/ui/MeshDelegateHandlerStateContractTest.kt @@ -0,0 +1,141 @@ +package com.bitchat.android.ui + +import com.bitchat.android.mesh.MeshService +import com.bitchat.android.model.BitchatMessage +import com.bitchat.android.model.DeliveryStatus +import kotlinx.coroutines.ExperimentalCoroutinesApi +import kotlinx.coroutines.test.TestScope +import kotlinx.coroutines.test.UnconfinedTestDispatcher +import org.junit.Assert.assertEquals +import org.junit.Assert.assertFalse +import org.junit.Assert.assertTrue +import org.junit.Before +import org.junit.Test +import org.mockito.kotlin.any +import org.mockito.kotlin.eq +import org.mockito.kotlin.mock +import org.mockito.kotlin.times +import org.mockito.kotlin.verify +import java.util.Date +import java.util.concurrent.atomic.AtomicInteger + +@OptIn(ExperimentalCoroutinesApi::class) +class MeshDelegateHandlerStateContractTest { + private lateinit var state: ChatState + private lateinit var messages: MessageManager + private lateinit var channels: ChannelManager + private lateinit var privateChats: PrivateChatManager + private lateinit var notifications: NotificationManager + private lateinit var mesh: MeshService + private lateinit var handler: MeshDelegateHandler + private lateinit var haptics: AtomicInteger + + @Before + fun setUp() { + val scope = TestScope(UnconfinedTestDispatcher()) + state = ChatState(scope) + state.setNickname("Résumé") + messages = MessageManager(state) + channels = mock() + privateChats = mock() + notifications = mock() + mesh = mock() + haptics = AtomicInteger() + handler = MeshDelegateHandler( + state = state, + messageManager = messages, + channelManager = channels, + privateChatManager = privateChats, + notificationManager = notifications, + coroutineScope = scope, + onHapticFeedback = { haptics.incrementAndGet() }, + getMyPeerID = { "self" }, + getMeshService = { mesh } + ) + } + + @Test + fun `peer arrival deduplicates list and final departure restores disconnected state`() { + handler.didUpdatePeerList(listOf("peer-a", "peer-a", "peer-b")) + + assertEquals(listOf("peer-a", "peer-b"), state.connectedPeers.value) + assertTrue(state.isConnected.value) + verify(notifications).showActiveUserNotification(listOf("peer-a", "peer-b")) + verify(channels).cleanupDisconnectedMembers(listOf("peer-a", "peer-b"), "self") + + handler.didUpdatePeerList(emptyList()) + + assertTrue(state.connectedPeers.value.isEmpty()) + assertFalse(state.isConnected.value) + verify(notifications).showActiveUserNotification(emptyList()) + } + + @Test + fun `delivery and read callbacks advance visible status monotonically`() { + val outgoing = message( + id = "outgoing", + sender = "me", + deliveryStatus = DeliveryStatus.Sending + ) + state.setMessages(listOf(outgoing)) + + handler.didReceiveDeliveryAck("outgoing", "peer-a") + assertTrue(state.messages.value.single().deliveryStatus is DeliveryStatus.Delivered) + + handler.didReceiveReadReceipt("outgoing", "peer-a") + assertTrue(state.messages.value.single().deliveryStatus is DeliveryStatus.Read) + + handler.didReceiveDeliveryAck("outgoing", "peer-a") + assertTrue(state.messages.value.single().deliveryStatus is DeliveryStatus.Read) + } + + @Test + fun `unicode mention notifies once and duplicate transport delivery is suppressed`() { + val incoming = message( + id = "incoming", + sender = "alice", + content = "hello @résumé", + senderPeerID = "peer-a" + ) + + handler.didReceiveMessage(incoming) + handler.didReceiveMessage(incoming) + + assertEquals(1, haptics.get()) + verify(notifications, times(1)).showMeshMentionNotification( + senderNickname = eq("alice"), + messageContent = eq("hello @résumé"), + senderPeerID = eq("peer-a") + ) + } + + @Test + fun `channel inbound increments unread only when conversation is not focused`() { + state.setJoinedChannels(setOf("#room")) + val incoming = message(id = "channel-1", channel = "#room") + + handler.didReceiveMessage(incoming) + assertEquals(1, state.unreadChannelMessages.value["#room"]) + + state.setCurrentChannel("#room") + handler.didReceiveMessage(incoming.copy(id = "channel-2")) + assertEquals(1, state.unreadChannelMessages.value["#room"]) + } + + private fun message( + id: String, + sender: String = "alice", + content: String = id, + senderPeerID: String? = null, + channel: String? = null, + deliveryStatus: DeliveryStatus? = null + ) = BitchatMessage( + id = id, + sender = sender, + content = content, + timestamp = Date(1), + senderPeerID = senderPeerID, + channel = channel, + deliveryStatus = deliveryStatus + ) +} diff --git a/app/src/test/kotlin/com/bitchat/android/wifi-aware/SyncedSocketContractTest.kt b/app/src/test/kotlin/com/bitchat/android/wifi-aware/SyncedSocketContractTest.kt new file mode 100644 index 00000000..ed5cec9f --- /dev/null +++ b/app/src/test/kotlin/com/bitchat/android/wifi-aware/SyncedSocketContractTest.kt @@ -0,0 +1,151 @@ +package com.bitchat.android.wifiaware + +import org.junit.Assert.assertArrayEquals +import org.junit.Assert.assertEquals +import org.junit.Assert.assertFalse +import org.junit.Assert.assertNull +import org.junit.Assert.assertThrows +import org.junit.Assert.assertTrue +import org.junit.Test +import org.mockito.kotlin.doReturn +import org.mockito.kotlin.mock +import org.mockito.kotlin.verify +import java.io.ByteArrayInputStream +import java.io.ByteArrayOutputStream +import java.io.DataInputStream +import java.io.DataOutputStream +import java.io.FilterInputStream +import java.io.IOException +import java.io.InputStream +import java.io.OutputStream +import java.net.Socket +import java.util.Collections + +class SyncedSocketContractTest { + @Test + fun `write emits big-endian length payload and empty keepalive frames`() { + val output = ByteArrayOutputStream() + val raw = socket(input = ByteArrayInputStream(byteArrayOf()), output = output) + val synced = SyncedSocket(raw, readTimeoutMs = 1_234) + + synced.write(byteArrayOf(1, 2, 3)) + synced.write(ByteArray(0)) + + assertArrayEquals( + byteArrayOf(0, 0, 0, 3, 1, 2, 3, 0, 0, 0, 0), + output.toByteArray() + ) + verify(raw).soTimeout = 1_234 + } + + @Test + fun `readFully reconstructs one-byte partial reads and keepalives`() { + val wire = framed(byteArrayOf(1, 2, 3, 4)) + framed(ByteArray(0)) + val partial = object : FilterInputStream(ByteArrayInputStream(wire)) { + override fun read(buffer: ByteArray, offset: Int, length: Int): Int = + super.read(buffer, offset, minOf(1, length)) + } + val synced = SyncedSocket(socket(partial, ByteArrayOutputStream())) + + assertArrayEquals(byteArrayOf(1, 2, 3, 4), synced.read()) + assertArrayEquals(ByteArray(0), synced.read()) + assertNull(synced.read()) + } + + @Test + fun `EOF truncated invalid and oversized frames fail closed`() { + val cases = listOf( + ByteArray(0), + byteArrayOf(0, 0), + byteArrayOf(0, 0, 0, 4, 1, 2), + intPrefix(-1), + intPrefix(65_537) + ) + + cases.forEach { wire -> + val synced = SyncedSocket( + socket(ByteArrayInputStream(wire), ByteArrayOutputStream()) + ) + assertNull(synced.read()) + } + } + + @Test + fun `write exceptions propagate and do not create a partial success`() { + val failingOutput = object : OutputStream() { + override fun write(value: Int) { + throw IOException("scripted write failure") + } + } + val synced = SyncedSocket(socket(ByteArrayInputStream(byteArrayOf()), failingOutput)) + + assertThrows(IOException::class.java) { + synced.write(byteArrayOf(1)) + } + } + + @Test + fun `concurrent writers produce complete non-interleaved frames`() { + val output = ByteArrayOutputStream() + val synced = SyncedSocket(socket(ByteArrayInputStream(byteArrayOf()), output)) + val payloads = (0 until 16).map { index -> + ByteArray(index + 1) { index.toByte() } + } + val failures = Collections.synchronizedList(mutableListOf()) + val threads = payloads.map { payload -> + Thread { + runCatching { synced.write(payload) } + .exceptionOrNull() + ?.let(failures::add) + }.also(Thread::start) + } + threads.forEach { thread -> + thread.join(2_000) + assertFalse("Writer thread did not complete", thread.isAlive) + } + assertTrue(failures.isEmpty()) + + val input = DataInputStream(ByteArrayInputStream(output.toByteArray())) + val decoded = mutableListOf() + while (input.available() > 0) { + val length = input.readInt() + decoded += ByteArray(length).also(input::readFully) + } + assertEquals( + payloads.map(ByteArray::toList).toSet(), + decoded.map(ByteArray::toList).toSet() + ) + } + + @Test + fun `close and raw socket status are exposed`() { + val raw = socket(ByteArrayInputStream(byteArrayOf()), ByteArrayOutputStream()) + org.mockito.kotlin.whenever(raw.isClosed).thenReturn(false, true) + org.mockito.kotlin.whenever(raw.isConnected).thenReturn(true) + val synced = SyncedSocket(raw) + + assertFalse(synced.isClosed()) + assertTrue(synced.isConnected()) + synced.close() + verify(raw).close() + assertTrue(synced.isClosed()) + } + + private fun socket(input: InputStream, output: OutputStream): Socket = mock { + on { getInputStream() } doReturn input + on { getOutputStream() } doReturn output + } + + private fun framed(payload: ByteArray): ByteArray = + ByteArrayOutputStream().also { output -> + DataOutputStream(output).use { data -> + data.writeInt(payload.size) + data.write(payload) + } + }.toByteArray() + + private fun intPrefix(value: Int): ByteArray = + ByteArrayOutputStream().also { output -> + DataOutputStream(output).use { it.writeInt(value) } + }.toByteArray() +} diff --git a/build.gradle.kts b/build.gradle.kts index 44c5199e..5aac5518 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -10,3 +10,9 @@ tasks.whenTaskAdded { enabled = false } } + +tasks.register("clientRewriteContractTest") { + group = "verification" + description = "Runs the complete compatibility gate for a from-scratch client rewrite." + dependsOn(":app:testDebugUnitTest") +} diff --git a/docs/client-rewrite-contracts.md b/docs/client-rewrite-contracts.md new file mode 100644 index 00000000..0337ccf9 --- /dev/null +++ b/docs/client-rewrite-contracts.md @@ -0,0 +1,63 @@ +# Client rewrite compatibility contracts + +This document defines the behavior a from-scratch BitChat client must preserve. +The executable source of truth is the JVM test suite under +`app/src/test/**/contracts`, together with the pre-existing protocol, security, +mesh, and state tests. + +The remaining implementation work and milestone progress are tracked in +[test-implementation-plan.md](test-implementation-plan.md). + +## Required contract layers + +| Layer | Compatibility promise | Primary tests | +|---|---|---| +| Outer mesh packet | v1/v2 header widths, big-endian fields, flags, section order, route placement, signature placement, padding, compression, signing bytes | `BinaryProtocolTest`, `ClientRewriteWireContractTest` | +| Chat payload | Flag bits, millisecond timestamp, UTF-8 byte lengths, encrypted-content substitution, optional-field order | `ClientRewriteWireContractTest` | +| Inner payloads | Noise type bytes, private-message TLVs, peer-state TLVs, file-transfer TLVs, fragment header, sync request TLVs | `ClientRewriteWireContractTest`, `AuthenticatedPeerStateTest`, `PrivateMediaTransferPreparerTest`, `FragmentManagerTest` | +| Identity/security | Announcement extensions, capability bitfield endianness, Noise static-key binding, handshake identity binding, signatures | `IdentityAnnouncementTest`, `NoiseSessionManagerIdentityBindingTest`, `ClientRewritePrimitiveContractTest` | +| Sync/routing | Stable packet IDs, GCS bitstream, replay collapse, TTL handling, relay choice, confirmed graph edges | `ClientRewritePrimitiveContractTest`, `GCSFilterTest`, `PacketRelayManagerTest`, `MeshGraphServiceTest`, `TransportBridgeServiceTest` | +| Nostr | Bech32, secp256k1 key derivation, NIP-01 event IDs/signatures, NIP-44 authenticated encryption, NIP-13 PoW, authenticated NIP-17 seals | `ClientRewriteNostrContractTest`, `NostrProtocolTest` | +| Application state | Peer unions, canonical private conversations, chronological history, delivery/read behavior, media migration policy | `AppStateStoreTest`, `PrivateChatManagerTest`, `MediaSendingManagerMigrationTest` | + +## Golden-vector policy + +Golden vectors compare literal externally visible bytes or hashes. Do not update +them merely because an implementation changed. Update a vector only when the +wire protocol is intentionally versioned and interoperating clients are updated +together. + +Round-trip tests remain useful but are not sufficient on their own: an encoder +and decoder can share the same defect. Each critical wire format therefore has +at least one literal vector. + +## Rewrite acceptance gate + +From a configured Android development environment, run: + +```sh +./gradlew clientRewriteContractTest +``` + +The task runs the new golden vectors and the complete existing unit suite. A +rewrite is compatible only when this gate passes. Tests should be ported +unchanged when package boundaries change; adapter façades are preferable to +weakening assertions. + +## Device-only acceptance + +Local JVM tests cannot prove Android radio and lifecycle behavior. Before +shipping a rewrite, run the following on at least two physical devices: + +1. BLE discovery, connection, disconnect, reconnect, and multi-hop relay. +2. Runtime permission denial/retry for Bluetooth, location, notifications, and + microphone. +3. Foreground-service survival with the screen off and after process recreation. +4. Cross-client Android/iOS exchange for announce, public/private text, delivery + and read receipts, image/audio/file transfer, sync replay, and Nostr fallback. +5. Corrupt, duplicated, reordered, delayed, and partially delivered fragments. +6. Identity rotation, verification continuity, downgrade rejection, and recovery + after stale Noise sessions. + +Those scenarios belong in instrumented tests or a two-device interoperability +harness; they must not be represented as passing JVM mocks. diff --git a/docs/device-transport-test-matrix.md b/docs/device-transport-test-matrix.md new file mode 100644 index 00000000..8ada4018 --- /dev/null +++ b/docs/device-transport-test-matrix.md @@ -0,0 +1,113 @@ +# Physical transport validation matrix + +This is the device-only companion to the deterministic Milestone 4 transport +suite. It validates that the fake adapters, Robolectric behavior, and pure +state machines match Android framework behavior. It is also consumed by the +Milestone 10 release gate. + +## Required device set + +- Two physical Android devices from different manufacturers. +- At least one Android 13+ device for `NEARBY_WIFI_DEVICES`. +- At least one device that supports Wi-Fi Aware. +- Bluetooth LE central and peripheral support on both devices. +- A build from the exact commit under test installed on both devices. +- Clean app data before the first run; retain a second run for restart tests. + +Record device models, API levels, build commit, negotiated MTUs, and timestamps +in the release artifact. Do not record user names, device serials, Bluetooth +addresses, IP addresses, peer IDs, message contents, or other identifying +values. + +## BLE discovery and recovery + +- [ ] Start both clients and confirm each begins scanning and advertising. +- [ ] Stop and restart the foreground service; confirm exactly one scanner and + advertiser generation remains active. +- [ ] Toggle Bluetooth off during scanning, then on; confirm scanning, + advertising, announcements, and peer discovery recover without process + restart. +- [ ] Disable and re-enable the BLE debug transport; confirm the same service + instance can recover without duplicate callbacks. +- [ ] Rotate the observed BLE address by restarting advertising; confirm the + canonical peer remains singular. +- [ ] Trigger a transient scan failure or Android Bluetooth process restart; + confirm bounded retry and watchdog recovery. +- [ ] Confirm permission denial reports unavailable state without a crash, + prompt loop, or active radio work. + +## GATT setup and teardown + +- [ ] Connect in both directions simultaneously and confirm one canonical link + survives. +- [ ] Record the negotiated MTU and repeat at 23, 247, and 517 where the device + or test peripheral allows it. +- [ ] Remove the service, characteristic, or CCCD in a test peripheral and + confirm setup fails closed. +- [ ] Reject notification registration and descriptor writes; confirm the peer + is never published ready. +- [ ] Disconnect during MTU negotiation, service discovery, subscription, + client write, and server notification; confirm no stale ready callback. +- [ ] Leave setup incomplete for more than 30 seconds; confirm timeout and + resource closure. +- [ ] Connect beyond configured client, server, and total limits; confirm + deterministic oldest-link eviction. + +## Packet delivery and fragmentation + +- [ ] Send directed and broadcast packets over client and server roles. +- [ ] Saturate each link faster than radio completion callbacks; confirm one + outstanding operation, bounded backpressure, and no reordered frames. +- [ ] Inject a failed `onCharacteristicWrite` and `onNotificationSent`; confirm + queued work is discarded and the failed generation is cleaned up. +- [ ] Transfer payloads immediately below and above the fragmentation boundary. +- [ ] Transfer a maximum admitted private-media payload at negotiated MTU 517. +- [ ] At MTU 247 and 23, confirm oversized frames are rejected rather than + partially sent. Adaptive per-link fragmentation remains tracked as + `TDB-023`. +- [ ] Disconnect and reconnect halfway through a fragmented transfer; confirm + incomplete state expires and a fresh transfer can finish. +- [ ] Cancel a queued transfer and stop the service during another; confirm no + later fragments or progress callbacks. + +## Wi-Fi Aware + +- [ ] Confirm unsupported hardware and temporarily unavailable radio states are + distinct. +- [ ] Deny and grant `NEARBY_WIFI_DEVICES`; confirm publish/subscribe work only + after grant. +- [ ] Start and stop publish and subscribe sessions repeatedly; confirm no + duplicate discovery callbacks. +- [ ] Authenticate a provisional socket and promote it to the canonical peer. +- [ ] Replace a socket while authentication is in flight; confirm the stale + socket cannot promote or deliver. +- [ ] Toggle Wi-Fi, location, and airplane mode; confirm rediscovery and bounded + reconnect after availability returns. +- [ ] Stop the service with active sockets, server sockets, and network + callbacks; confirm all are closed or unregistered. + +## Unified transport and failover + +- [ ] Connect the same peer over BLE and Wi-Fi Aware; confirm one peer-list row. +- [ ] Send with both transports active; confirm the preferred transport is used. +- [ ] Drop the preferred transport during a transfer and confirm defined + failover behavior without duplicate application delivery. +- [ ] Relay between transports and confirm TTL decreases once per hop. +- [ ] Reflect a bridged packet back over the other transport; confirm loop and + duplicate suppression. +- [ ] Stop the foreground service; confirm scans, advertisements, sessions, + sockets, operation queues, transfer jobs, and callbacks all terminate. + +## Evidence template + +| Field | Value | +|---|---| +| Commit | | +| Device/API classes | | +| BLE central/peripheral | Pass / Fail | +| MTU cases | Pass / Fail / Unsupported | +| BLE recovery | Pass / Fail | +| Wi-Fi Aware lifecycle | Pass / Fail / Unsupported | +| Cross-transport failover | Pass / Fail | +| Shutdown leak check | Pass / Fail | +| Bugs filed | | diff --git a/docs/release-gate-runbook.md b/docs/release-gate-runbook.md new file mode 100644 index 00000000..414bfbae --- /dev/null +++ b/docs/release-gate-runbook.md @@ -0,0 +1,244 @@ +# Physical-device and cross-client release gate + +This runbook turns Milestone 10 into a repeatable release procedure. The gate +uses a host-side CLI and USB/ADB as its control channel, so control traffic +never shares BLE, Wi-Fi Aware, Nostr, or Tor with the system under test. + +The gate cannot pass without the required physical devices and counterpart +clients. A pending or blocked result is useful diagnostic evidence, but it is +not release approval. + +## Safety and privacy rules + +- Use only disposable lab app data, identities, nicknames, messages, and files. +- Never use a personal Nostr account or a production relay. +- Do not put device serials, UDIDs, Bluetooth/MAC/IP addresses, peer IDs, + usernames, email addresses, local home paths, or message contents in a + result, trace, filename, issue, commit, or release artifact. +- Device selectors may be supplied to ADB commands as ephemeral inputs. The + tooling emits only logical aliases such as `android-current`. +- Models, manufacturer classes, Android API levels, negotiated MTU classes, + client versions, commit hashes, aggregate counts, durations, and stable + failure reason codes are allowed. +- Do not archive raw logcat. Convert observations to the structured, + privacy-checked trace format, and keep any raw diagnostic capture local until + it has been reviewed and sanitized. + +The validator rejects known identifying fields and values before a passing +bundle can be created. + +## Required lab + +Prepare: + +- At least three physical Android devices for three-hop relay testing. +- At least two Android API levels and two manufacturer classes. +- BLE central and peripheral support on every Android device. +- At least one Android 13+ device with Wi-Fi Aware. +- One physical device running the current iOS client. +- The last supported Android client. +- The release-candidate APK built from one exact full Git commit. +- A local, disposable Nostr relay/Tor fixture with production network access + blocked. + +One physical handset may be reused for the legacy-client phase after the +current-client evidence for that slot is complete, but the matrix must keep the +logical aliases and installed client versions unambiguous. + +## 1. Verify the deterministic gate + +From the repository root: + +```sh +./gradlew clientRewriteContractTest checkChangedLineCoverage lintDebug +python3 tools/release_gate/release_gate.py validate-manifest +``` + +Do not begin device work from a dirty tree or a build whose deterministic gate +does not pass. + +## 2. Create the device matrix + +Copy `tools/release_gate/device-matrix.example.json` to an ignored working +directory under `release-gate-results/`. Replace every template value and set +both current-Android commit fields to the exact full commit under test. + +Probe Android capabilities without storing the ADB selector: + +```sh +python3 tools/release_gate/android_lab.py probe \ + --serial "$BITCHAT_ADB_SELECTOR" \ + --alias android-current +``` + +Copy only the returned logical metadata into the matrix. Validate it: + +```sh +python3 tools/release_gate/release_gate.py validate-matrix \ + --matrix release-gate-results/device-matrix.json \ + --commit "$BITCHAT_RELEASE_COMMIT" +``` + +The matrix validator enforces physical devices, three Android participants, two +API levels, two manufacturer classes, Wi-Fi Aware, BLE roles, iOS, and explicit +current/legacy client versions. + +## 3. Initialize disposable fixtures + +```sh +python3 tools/release_gate/release_gate.py init \ + --matrix release-gate-results/device-matrix.json \ + --commit "$BITCHAT_RELEASE_COMMIT" \ + --run-id rc-lab-01 \ + --output release-gate-results/rc-lab-01 +``` + +Initialization pins the scenario and fixture manifests, creates every scenario +as `pending`, and generates deterministic: + +- zero-byte and small files; +- a Unicode-named medium file; +- sparse exact-maximum and oversized boundary files. + +The fixture manifest records size and SHA-256. The final archive contains the +manifest, not the large fixture bodies. + +Clear only the disposable app data on each selected lab device: + +```sh +python3 tools/release_gate/android_lab.py prepare \ + --serial "$BITCHAT_ADB_SELECTOR" \ + --confirm-disposable-app-data +``` + +This stops the app and runs package-data cleanup. The explicit confirmation is +required because the operation is destructive to that app's local data. + +## 4. Execute scenarios + +The canonical scenario list is +`tools/release_gate/scenarios.json`. It contains 27 mandatory scenarios: + +- the complete physical transport matrix; +- Android API/manufacturer/permission/background coverage; +- 11 Android-to-Android workflows; +- 8 cross-client/backward-compatibility workflows; +- 6 background and endurance workflows. + +For each scenario: + +1. Confirm the listed participants and capabilities. +2. Perform the corresponding steps in + [device-transport-test-matrix.md](device-transport-test-matrix.md) and the + Milestone 10 checklist. +3. Record connection, lifecycle, transport, receipt, resource, and terminal + state as aggregate evidence. +4. Append at least one structured trace event. +5. Mark the scenario `pass`, `fail`, `blocked`, or `unsupported`. + +Record evidence with the exact keys declared by the scenario: + +```sh +python3 tools/release_gate/release_gate.py record \ + --run release-gate-results/rc-lab-01 \ + --scenario A2A-001 \ + --status pass \ + --evidence connection-transitions=4 \ + --evidence packet-correlation-count=6 \ + --evidence failure-reasons=none +``` + +Append a privacy-safe trace event: + +```sh +python3 tools/release_gate/release_gate.py trace \ + --run release-gate-results/rc-lab-01 \ + --scenario A2A-001 \ + --source android-current \ + --event reconnect-terminal \ + --outcome pass \ + --metric reconnect-count=1 \ + --metric duplicate-delivery-count=0 +``` + +Capture resource snapshots during endurance work: + +```sh +python3 tools/release_gate/android_lab.py snapshot \ + --serial "$BITCHAT_ADB_SELECTOR" \ + --alias android-current \ + --run release-gate-results/rc-lab-01 \ + --scenario END-003 +``` + +Use run-local sequential correlation labels while observing packets; archive +only aggregate correlation counts. Record failures with a stable reason code, +file a regression issue, and preserve the incomplete artifact. + +## 5. Endurance requirements + +- `END-001` requires at least 240 minutes. +- `END-002` requires at least 50 large-transfer/cancellation cycles. +- Sample memory, threads, file descriptors, wake locks, connection counts, and + late callbacks at consistent intervals. +- A passing result requires bounded resource behavior and a clean terminal + state; merely completing the time window is insufficient. + +The validator rejects shorter durations and cycle counts. + +## 6. Inspect progress and validate + +During a run: + +```sh +python3 tools/release_gate/release_gate.py validate \ + --run release-gate-results/rc-lab-01 \ + --allow-incomplete + +python3 tools/release_gate/release_gate.py summary \ + --run release-gate-results/rc-lab-01 +``` + +The release validator, without `--allow-incomplete`, requires: + +- every scenario to be `pass`; +- every declared evidence field; +- at least one structured trace per scenario; +- the pinned scenario and fixture manifests; +- the exact client commit and complete device matrix; +- endurance minimums; +- a completion timestamp; +- no detected identifying fields or values. + +`unsupported`, `blocked`, and `pending` never satisfy release approval. + +## 7. Archive release approval + +After the complete validator passes: + +```sh +python3 tools/release_gate/release_gate.py bundle \ + --run release-gate-results/rc-lab-01 \ + --output release-gate-results/rc-lab-01.zip +``` + +The deterministic archive contains the scenario manifest, device/client matrix, +results, structured trace, fixture manifest, Markdown summary, and +`SHA256SUMS`. Attach it to the release approval record without renaming fields +or adding raw diagnostics. + +Finally, clean the disposable app data with the same confirmed `cleanup` +command and stop the local relay/Tor fixture. + +## Failure handling + +- `fail`: behavior violated a contract. Record a stable reason code, file a bug, + add a deterministic regression where possible, fix it, and rerun the affected + scenario plus dependent scenarios. +- `blocked`: required lab infrastructure or counterpart client was unavailable. + Preserve the artifact and do not approve release. +- `unsupported`: the selected device lacks a capability. Because the defined + matrix requires Wi-Fi Aware, replace the device or matrix; unsupported does + not waive a mandatory scenario. +- A flaky result is a failure until its cause is understood. Never average + retries into a pass. diff --git a/docs/test-implementation-plan.md b/docs/test-implementation-plan.md new file mode 100644 index 00000000..e64b633b --- /dev/null +++ b/docs/test-implementation-plan.md @@ -0,0 +1,779 @@ +# Test implementation plan + +## Objective + +Build enough deterministic, adversarial, integration, and device-level coverage +that the Android client can be rewritten from scratch without silently changing +its wire behavior, security properties, delivery semantics, lifecycle behavior, +or user-visible workflows. + +The canonical compatibility requirements are documented in +[client-rewrite-contracts.md](client-rewrite-contracts.md). This plan describes +how to turn those requirements into a complete, continuously enforced test +program. + +## Status legend + +- **Complete**: acceptance criteria are met and the tests run in the rewrite gate. +- **In progress**: implementation has started but acceptance criteria are not met. +- **Not started**: no implementation work has been completed. +- **Blocked**: progress requires an external dependency, device, or decision. + +## Current progress + +| Milestone | Status | Progress | Depends on | +|---|---|---:|---| +| 0. Compatibility baseline | Complete | 100% | — | +| 1. Coverage and deterministic test infrastructure | Not started | 0% | 0 | +| 2. Adversarial protocol and parser testing | Not started | 0% | 1 | +| 3. Noise, cryptography, and identity testing | Not started | 0% | 1 | +| 4. BLE, Wi-Fi Aware, and transport lifecycle testing | Not started | 0% | 1, 3 | +| 5. Sync, routing, and store-and-forward testing | Not started | 0% | 1, 4 | +| 6. Nostr and Tor integration testing | Not started | 0% | 1, 3 | +| 7. Android lifecycle and permission testing | Not started | 0% | 1, 4 | +| 8. Persistence, migration, and recovery testing | Not started | 0% | 1, 3 | +| 9. UI, media, and accessibility testing | Not started | 0% | 1, 7, 8 | +| 10. Physical-device and cross-client release gate | Not started | 0% | 2–9 | + +Milestone completion is currently **1 of 11 milestones (9%)**. This is +milestone-based progress, not line or branch coverage. Milestone 1 will establish +measured coverage baselines and trends. + +## Test levels and execution policy + +| Level | Purpose | Expected execution | +|---|---|---| +| Pure JVM unit tests | Protocols, state machines, crypto vectors, parsing, routing, and deterministic utilities | Every pull request | +| Property and fuzz tests | Malformed inputs, boundary exploration, invariants, and crash resistance | Bounded set on every pull request; extended corpus nightly | +| Robolectric tests | Android services, lifecycle, broadcasts, permissions, persistence, and process recreation | Every pull request where stable | +| Instrumented emulator tests | Compose semantics, navigation, database/filesystem integration, and permission flows | Main branch and release candidates | +| Physical-device tests | BLE, Wi-Fi Aware, radios, background execution, and manufacturer-specific behavior | Nightly where devices are available; mandatory release gate | +| Cross-client interoperability | Android/iOS and old/new client wire compatibility | Mandatory release gate | + +## Global rules + +- [x] Keep literal golden vectors for externally visible bytes and hashes. +- [x] Run all compatibility and regression tests through + `./gradlew clientRewriteContractTest`. +- [ ] Prefer public behavior and stable adapter interfaces over implementation + details. +- [ ] Require deterministic clocks, randomness, dispatchers, storage, and + transports in tests. +- [ ] Never use production relay or internet availability as a test dependency. +- [ ] Every fixed protocol or security defect must receive a regression test. +- [ ] Every decoder must have positive, boundary, malformed, and fuzz coverage. +- [ ] Every asynchronous test must have bounded completion and must not use + arbitrary sleeps. +- [ ] Test failures must preserve seeds, inputs, and traces needed to reproduce + the failure. +- [ ] Golden vectors may change only with an intentional protocol version change + and coordinated interoperability review. + +--- + +## Milestone 0: Compatibility baseline + +**Status:** Complete +**Progress:** 100% + +### Scope + +Establish executable rewrite contracts for the most important deterministic +wire formats and reuse the existing regression suite as a single acceptance +gate. + +### Completed checklist + +- [x] Create an isolated workspace and + `codex/client-rewrite-contract-tests` branch. +- [x] Add literal v1 and v2 outer packet vectors. +- [x] Add public, private, optional-field, and encrypted message vectors. +- [x] Add private-message, Noise envelope, fragment, sync, identity, and file + transfer vectors. +- [x] Add padding, binary encoding, geohash, gossip, packet ID, GCS, and Noise + peer-ID contracts. +- [x] Add Bech32, secp256k1, NIP-01, NIP-44, and NIP-13 contracts. +- [x] Add required-prefix and representative truncated-input rejection tests. +- [x] Add explicit validation for malformed fragment IDs. +- [x] Add `clientRewriteContractTest` as the complete rewrite acceptance task. +- [x] Verify 32 new tests pass without skips. +- [x] Verify the full gate discovers 254 tests with zero failures or errors. +- [x] Document the remaining device-only acceptance requirements. + +### Acceptance criteria + +- [x] The original `main` workspace remains unchanged. +- [x] All new golden-vector tests pass. +- [x] The complete unit suite passes through one documented command. + +--- + +## Milestone 1: Coverage and deterministic test infrastructure + +**Status:** Not started +**Progress:** 0% + +### Goal + +Make coverage measurable and provide reusable deterministic seams so later +milestones test behavior without real time, radios, network access, or flaky +scheduling. + +### TODO checklist + +#### Coverage reporting + +- [ ] Add JaCoCo or Kover for JVM unit-test line and branch coverage. +- [ ] Generate XML and HTML reports from the rewrite acceptance task. +- [ ] Record the initial project-wide line and branch coverage baseline. +- [ ] Record package-level baselines for `mesh`, `noise`, `nostr`, `service`, + `services`, `sync`, `model`, `protocol`, `identity`, and `ui`. +- [ ] Publish coverage artifacts in CI. +- [ ] Add a changed-lines coverage check for new production code. +- [ ] Add non-regression thresholds without forcing low-value tests for trivial + generated or platform glue. +- [ ] Exclude generated code, Compose compiler output, Android resource classes, + and vendored cryptographic code from first-party coverage metrics. + +#### Deterministic seams + +- [ ] Introduce an injectable monotonic clock and wall clock. +- [ ] Introduce injectable secure and non-secure random-byte sources where + deterministic vectors are required. +- [ ] Introduce injectable coroutine dispatchers and test scopes. +- [ ] Introduce an in-memory key/value storage adapter for preferences. +- [ ] Introduce an in-memory file store with controllable I/O failures. +- [ ] Define a fake mesh transport that can connect, disconnect, delay, drop, + duplicate, corrupt, reorder, and fragment packets. +- [ ] Define fake BLE scanner, advertiser, GATT client, and GATT server adapters. +- [ ] Define a fake Wi-Fi Aware session/socket adapter. +- [ ] Define a fake Nostr relay transport or MockWebServer fixture. +- [ ] Provide reusable packet, identity, peer, graph, and message fixture + builders. +- [ ] Provide seed capture and reproduction helpers for randomized tests. +- [ ] Add test naming and directory conventions for unit, property, Robolectric, + instrumented, and interoperability suites. + +### Acceptance criteria + +- [ ] One command generates a repeatable coverage report. +- [ ] Two consecutive clean runs produce identical deterministic test results. +- [ ] Fake time and transport behavior require no wall-clock sleeps. +- [ ] CI publishes coverage and test-result artifacts. +- [ ] The plan's progress table is updated with measured baseline numbers. + +--- + +## Milestone 2: Adversarial protocol and parser testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Prove that all wire decoders preserve canonical behavior, reject unsafe input, +and never crash or allocate unreasonable memory for attacker-controlled data. + +### TODO checklist + +#### Outer packet protocol + +- [ ] Test every valid flag combination for v1 and v2. +- [ ] Test exact minimum and maximum payload sizes. +- [ ] Test sender and recipient IDs at 0, 1, 7, 8, 9, and oversized lengths. +- [ ] Test signatures at 0, 1, 63, 64, 65, and oversized lengths. +- [ ] Test route counts at 0, 1, 254, 255, and truncated route entries. +- [ ] Test unknown message type values remain safely representable or are + rejected according to the protocol contract. +- [ ] Test invalid versions, reserved flags, integer overflow, and unsigned + length conversion. +- [ ] Test trailing bytes and concatenated frames explicitly. +- [ ] Test padding boundaries around 256, 512, 1024, and 2048 bytes. +- [ ] Test malformed PKCS#7 tails and ambiguous unpadded frames. +- [ ] Test raw DEFLATE and zlib-header compatibility vectors. +- [ ] Test forged original-size fields, compression bombs, and truncated + compressed streams. +- [ ] Add encode/decode property tests for all valid packet shapes. +- [ ] Add a mutation corpus derived from every golden packet. + +#### Inner payloads and TLVs + +- [ ] Fuzz `BitchatMessage.fromBinaryPayload`. +- [ ] Fuzz `IdentityAnnouncement.decode`. +- [ ] Fuzz `AuthenticatedPeerState.decode`. +- [ ] Fuzz `PrivateMessagePacket.decode`. +- [ ] Fuzz `NoisePayload.decode`. +- [ ] Fuzz `BitchatFilePacket.decode`. +- [ ] Fuzz `FragmentPayload.decode`. +- [ ] Fuzz `RequestSyncPacket.decode`. +- [ ] Test missing, duplicated, reordered, unknown, and zero-length TLVs. +- [ ] Test truncated headers and values at every byte offset. +- [ ] Test UTF-8 ASCII, multi-byte, combining-mark, emoji, invalid-byte, and + maximum-byte-length cases. +- [ ] Test 255-byte one-byte-length boundaries. +- [ ] Test 65,535-byte two-byte-length boundaries. +- [ ] Test four-byte file content lengths and impossible content declarations. +- [ ] Test fragmented file content using one and multiple content TLVs. +- [ ] Define and test whether non-canonical but tolerated inputs re-encode + canonically. + +#### Fuzzing operations + +- [ ] Select a JVM-compatible property/fuzz framework. +- [ ] Add bounded pull-request fuzz runs with fixed seeds. +- [ ] Add extended randomized nightly runs. +- [ ] Store minimized failing inputs as regression fixtures. +- [ ] Assert no decoder throws for arbitrary byte arrays. +- [ ] Assert decoder runtime and allocations stay within configured bounds. + +### Acceptance criteria + +- [ ] Every externally reachable decoder has boundary and malformed-input tests. +- [ ] Every decoder has a bounded arbitrary-byte no-crash property. +- [ ] All discovered crashes or ambiguous contracts have regression fixtures. +- [ ] Extended fuzzing completes nightly and preserves reproduction seeds. + +--- + +## Milestone 3: Noise, cryptography, and identity testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Prove confidentiality, authenticity, identity binding, replay behavior, session +replacement, rekeying, and recovery across the complete secure-channel +lifecycle. + +### TODO checklist + +#### Known vectors and primitives + +- [ ] Add known Curve25519 key agreement vectors. +- [ ] Add known Ed25519 signing and verification vectors. +- [ ] Add known BIP-340 verification vectors. +- [ ] Add known HKDF and channel-key derivation vectors. +- [ ] Add external Noise XX handshake transcript vectors where compatible. +- [ ] Add deterministic channel encryption vectors with injected nonces. +- [ ] Test constant-time verification APIs where the underlying library exposes + an appropriate contract. + +#### Noise session lifecycle + +- [ ] Test initiator and responder handshakes without manager wrappers. +- [ ] Test all valid handshake state transitions. +- [ ] Test every invalid message for every handshake state. +- [ ] Test tampered handshake messages and remote static-key substitution. +- [ ] Test post-handshake encryption in both directions. +- [ ] Test empty, small, maximum, and fragmented plaintext. +- [ ] Test tampered ciphertext, nonce, tag, and associated data. +- [ ] Test replayed ciphertext. +- [ ] Test skipped, duplicated, and out-of-order transport messages. +- [ ] Test send and receive nonce progression. +- [ ] Test nonce exhaustion and counter-overflow behavior. +- [ ] Test rekey thresholds, successful rekey, failed rekey, and simultaneous + rekey. +- [ ] Test session reset and destruction zeroize or discard sensitive state as + designed. +- [ ] Test handshake timeouts and stale generation leases with fake time. +- [ ] Test simultaneous initiator tie-breaking across a larger peer matrix. +- [ ] Test process restart with and without persisted identity. + +#### Identity and downgrade protection + +- [ ] Test peer-ID derivation for valid and malformed static keys. +- [ ] Test signing-key rotation with authorized and unauthorized announcements. +- [ ] Test private-media capability pinning across restart. +- [ ] Test downgrade attempts after a capability has been pinned. +- [ ] Test corrupted, missing, partially written, and legacy identity storage. +- [ ] Test atomic clearing of identity, capability, and peer mappings. +- [ ] Test verification fingerprints remain stable for unchanged identities. +- [ ] Test identity replacement does not expose an established session before + authentication completes. + +### Acceptance criteria + +- [ ] Known vectors pass independently of Android storage and services. +- [ ] Replay, tampering, downgrade, and identity-substitution tests all fail + closed. +- [ ] All timeouts and rekey tests use fake time. +- [ ] No sensitive test fixtures contain production keys or user data. + +--- + +## Milestone 4: BLE, Wi-Fi Aware, and transport lifecycle testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Verify connection state machines and packet delivery across unreliable Android +transports without requiring real radios for the majority of cases. + +### TODO checklist + +#### BLE discovery and connection + +- [ ] Test scan start, stop, restart, and failure callbacks. +- [ ] Test advertising start, stop, restart, and failure callbacks. +- [ ] Test Bluetooth-off and Bluetooth-on recovery. +- [ ] Test duplicate scan results and rapidly changing peer addresses. +- [ ] Test connection success, rejection, timeout, and cancellation. +- [ ] Test simultaneous inbound and outbound connection races. +- [ ] Test canonical connection selection and duplicate-link teardown. +- [ ] Test service discovery failure and missing characteristics. +- [ ] Test GATT disconnect during discovery, negotiation, read, and write. +- [ ] Test reconnect backoff with fake time. +- [ ] Test maximum-connection enforcement and eviction policy. +- [ ] Test RSSI thresholds and power-mode transitions. + +#### Packet transfer + +- [ ] Test MTU negotiation at minimum, normal, and maximum values. +- [ ] Test partial writes and write callbacks delivered out of order. +- [ ] Test notification subscription and notification failure. +- [ ] Test queue backpressure and bounded memory use. +- [ ] Test fragmentation and reassembly across disconnect/reconnect. +- [ ] Test duplicate, missing, reordered, and corrupted fragments. +- [ ] Test cancellation cleans pending queues and transfer state. +- [ ] Test large file/media transfers under constrained MTU. +- [ ] Test broadcast and directed packet delivery. +- [ ] Test packet relay while one link disconnects. + +#### Wi-Fi Aware + +- [ ] Test feature unavailable and permission-denied behavior. +- [ ] Test publish/subscribe session creation and teardown. +- [ ] Test provisional link authentication and canonical promotion. +- [ ] Test socket replacement and stale-socket rejection. +- [ ] Test partial reads, writes, EOF, exceptions, and cancellation. +- [ ] Test reconnect and rediscovery. +- [ ] Test coexistence with BLE for the same peer. + +#### Unified transport behavior + +- [ ] Test peer-list union and removal across transports. +- [ ] Test preferred-transport selection. +- [ ] Test transparent failover between BLE and Wi-Fi Aware. +- [ ] Test duplicate packet suppression across transports. +- [ ] Test transport bridge TTL decrement and loop prevention. +- [ ] Test shutdown cancels all jobs, scans, advertisements, sockets, and queues. + +### Acceptance criteria + +- [ ] Transport state-machine tests run deterministically on the JVM or + Robolectric. +- [ ] Disconnect and cancellation tests leave no queued work or active jobs. +- [ ] Cross-transport duplicate delivery and loops are prevented. +- [ ] A smaller physical-device suite confirms the fake adapters match Android + behavior. + +--- + +## Milestone 5: Sync, routing, and store-and-forward testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Verify eventual delivery, bounded resource usage, correct routing, and duplicate +suppression during partitions, topology changes, and reconnects. + +### TODO checklist + +#### Packet identity and sync filters + +- [ ] Add more packet-ID vectors for every message type. +- [ ] Prove TTL, route, recipient, and signature mutations do not change sync + identity. +- [ ] Prove payload, sender, timestamp, and type mutations do change identity. +- [ ] Property-test GCS encode/decode membership. +- [ ] Test empty, singleton, maximum-capacity, duplicate, and collision-heavy + filters. +- [ ] Test false-positive behavior statistically against configured tolerances. +- [ ] Test maximum accepted filter bytes and malicious bitstreams. +- [ ] Test sync requests with unknown TLVs and future capability extensions. + +#### Store and forward + +- [ ] Test caching decisions for public, private, favorite, and offline peers. +- [ ] Test cache capacity and deterministic eviction. +- [ ] Test cache expiry with fake time. +- [ ] Test delivery acknowledgement removal. +- [ ] Test retransmission after reconnect. +- [ ] Test duplicate acknowledgements and late acknowledgements. +- [ ] Test process restart persistence policy. +- [ ] Test shutdown and cleanup under active delivery. +- [ ] Test memory bounds under repeated undeliverable messages. + +#### Routing and topology + +- [ ] Test shortest paths for disconnected, cyclic, diamond, and changing graphs. +- [ ] Test deterministic tie-breaking for equal-length routes. +- [ ] Test only confirmed edges are used. +- [ ] Test edge expiry and peer disappearance with fake time. +- [ ] Test a route invalidated between planning and send. +- [ ] Test relay TTL exhaustion at every hop. +- [ ] Test source-route loop rejection. +- [ ] Test broadcast storm suppression. +- [ ] Test delivery across mixed BLE and Wi-Fi Aware paths. +- [ ] Test graph updates while sync and relay operations run concurrently. + +### Acceptance criteria + +- [ ] Partition/reconnect scenarios eventually deliver exactly once at the + application layer. +- [ ] Cache, graph, and filter resource bounds are enforced. +- [ ] No topology or bridge scenario produces an infinite relay loop. +- [ ] All expiry behavior uses fake time. + +--- + +## Milestone 6: Nostr and Tor integration testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Verify relay communication, subscriptions, event validation, NIP-17 delivery, +and Tor-mode behavior under realistic network failures. + +### TODO checklist + +#### Relay protocol + +- [ ] Add a scripted local WebSocket relay fixture. +- [ ] Test initial connection and clean disconnect. +- [ ] Test DNS, TCP, TLS, WebSocket, and protocol failures. +- [ ] Test reconnect backoff and cancellation with fake time. +- [ ] Test relay notices, acknowledgements, end-of-stored-events, and malformed + messages. +- [ ] Test subscription creation, replacement, unsubscribe, and reconnect + restoration. +- [ ] Test duplicate, delayed, reordered, and conflicting events. +- [ ] Test multi-relay publish success, partial success, and total failure. +- [ ] Test event deduplication across relays. +- [ ] Test relay-list selection and invalid relay URLs. + +#### Event security and messaging + +- [ ] Add external NIP-01, NIP-13, NIP-17, and NIP-44 vectors. +- [ ] Test invalid event IDs and signatures are rejected before dispatch. +- [ ] Test future timestamps, stale timestamps, and integer boundaries. +- [ ] Test NIP-17 gift-wrap signer/rumor identity mismatches. +- [ ] Test malformed seals, wrong recipients, and tampered ciphertext. +- [ ] Test private-message and acknowledgement embedding/extraction. +- [ ] Test geohash note, presence, and ephemeral-event filters. +- [ ] Test nickname and teleport tags. +- [ ] Test proof-of-work policy at exact difficulty boundaries. +- [ ] Test cancellation and bounded mining iterations. + +#### Tor behavior + +- [ ] Add a fake Tor-state provider and proxy-selection tests. +- [ ] Test direct, Tor-only, and fallback modes. +- [ ] Test bootstrap delay, bootstrap failure, proxy failure, and shutdown. +- [ ] Verify Tor-only mode never silently uses a direct connection. +- [ ] Verify mode changes rebuild clients and close old connections. + +### Acceptance criteria + +- [ ] Nostr integration tests require no public relay or internet connection. +- [ ] Invalid or unauthenticated events never reach application state. +- [ ] Reconnect restores intended subscriptions without duplicate delivery. +- [ ] Tor-only policy fails closed. + +--- + +## Milestone 7: Android lifecycle and permission testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Verify the app behaves correctly under Android process, service, permission, +Bluetooth, battery, and background-execution rules. + +### TODO checklist + +#### Foreground service + +- [ ] Add Robolectric tests for service create, start, bind, unbind, and destroy. +- [ ] Test repeated start commands are idempotent. +- [ ] Test foreground notification creation and channel configuration. +- [ ] Test explicit shutdown clears transport and application state correctly. +- [ ] Test unexpected process/service recreation restores required state. +- [ ] Test task removal behavior. +- [ ] Test boot-completed handling. +- [ ] Test service start restrictions and failure reporting. +- [ ] Test all coroutines and resources are cancelled on destroy. + +#### Permissions and system state + +- [ ] Test first-run permission explanations. +- [ ] Test denial, permanent denial, and later grant. +- [ ] Test partial Bluetooth permission grants by Android version. +- [ ] Test location-disabled and Bluetooth-disabled states. +- [ ] Test notification permission denial. +- [ ] Test microphone permission denial during voice recording. +- [ ] Test background-location preferences where applicable. +- [ ] Test battery-optimization accepted, declined, and unavailable paths. +- [ ] Test configuration changes during onboarding. +- [ ] Test onboarding restoration after process recreation. + +#### Android-version matrix + +- [ ] Define minimum, target, and newest-supported API test matrix. +- [ ] Add emulator coverage for behavior changes in permissions and foreground + services. +- [ ] Add at least one low-memory/process-death scenario. +- [ ] Add manufacturer-device coverage for known BLE/background differences. + +### Acceptance criteria + +- [ ] Critical service and permission flows have Robolectric or instrumented + coverage. +- [ ] No permission denial crashes or leaves onboarding irrecoverable. +- [ ] Service recreation does not duplicate transports or lose required state. +- [ ] Required API-level matrix passes before release. + +--- + +## Milestone 8: Persistence, migration, and recovery testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Ensure identities, settings, aliases, favorites, bookmarks, messages, and +capability pins survive upgrades and fail safely when storage is incomplete or +corrupt. + +### TODO checklist + +- [ ] Inventory every persisted key, file, schema, and version marker. +- [ ] Create legacy fixtures for every supported application version. +- [ ] Test clean first launch with no persisted state. +- [ ] Test upgrade from each retained legacy fixture. +- [ ] Test unknown future fields are preserved or ignored safely. +- [ ] Test truncated, malformed, empty, and type-mismatched preference values. +- [ ] Test partial multi-key identity writes. +- [ ] Test storage write failure and rollback. +- [ ] Test concurrent readers and writers. +- [ ] Test alias merging and canonical conversation migration. +- [ ] Test chronological ordering after migration. +- [ ] Test favorite and bookmark preservation. +- [ ] Test message-retention expiry with fake time. +- [ ] Test secure identity clearing removes all linked mappings and pins. +- [ ] Test signing-key and capability rotation is atomic. +- [ ] Test backup/restore policy does not duplicate or expose sensitive identity + material. +- [ ] Test migration idempotence by running each migration twice. +- [ ] Test downgrade behavior when a newer schema has already been written. + +### Acceptance criteria + +- [ ] Every supported legacy fixture migrates deterministically. +- [ ] Failed migrations leave either the old valid state or the new valid state, + never a partial mixture. +- [ ] Security-sensitive corruption fails closed with a recoverable user path. +- [ ] Migration and retention behavior uses deterministic storage and time. + +--- + +## Milestone 9: UI, media, and accessibility testing + +**Status:** Not started +**Progress:** 0% + +### Goal + +Protect user-visible behavior and media workflows while keeping most assertions +at ViewModel/state boundaries and reserving Compose instrumentation for genuine +interaction and rendering contracts. + +### TODO checklist + +#### ViewModels and application state + +- [ ] Restore or replace the currently skipped command-processor tests. +- [ ] Restore or replace the currently skipped notification tests. +- [ ] Test public/private/channel conversation switching. +- [ ] Test optimistic send, success, failure, retry, and cancellation. +- [ ] Test delivery and read-receipt transitions. +- [ ] Test peer arrival, departure, alias change, and identity rotation. +- [ ] Test state restoration after configuration change and process recreation. +- [ ] Test concurrent inbound messages while changing conversations. +- [ ] Test error messages for permission, transport, storage, and crypto failures. + +#### Compose UI + +- [ ] Add semantics tests for critical chat actions. +- [ ] Test onboarding navigation and recoverability. +- [ ] Test empty, loading, connected, disconnected, and error states. +- [ ] Test long nicknames, messages, channels, and localized text. +- [ ] Test dynamic font sizes and display scaling. +- [ ] Test light, dark, and supported theme variants. +- [ ] Add screenshot tests only for stable high-value layouts. +- [ ] Test keyboard, focus, back navigation, and bottom-sheet behavior. +- [ ] Test screen-reader labels, traversal order, and minimum touch targets. +- [ ] Test reduced-motion behavior where animations are nonessential. + +#### Files, images, and voice + +- [ ] Test zero-byte, small, maximum-size, and oversized files. +- [ ] Test unsupported and misleading MIME types. +- [ ] Test missing filenames and Unicode filenames. +- [ ] Test file read/write failures and insufficient storage. +- [ ] Test image decode failures, orientation metadata, and large-image memory + limits. +- [ ] Test voice-recording start, pause/stop, cancellation, and microphone loss. +- [ ] Test corrupt and unsupported audio playback. +- [ ] Test waveform generation boundaries. +- [ ] Test interrupted private-media preparation and commit rollback. +- [ ] Test cleanup of temporary files after success, failure, and cancellation. + +### Acceptance criteria + +- [ ] Critical user journeys pass through state-level tests. +- [ ] A focused Compose suite protects navigation, semantics, and accessibility. +- [ ] Media failures are visible, recoverable, and leak no temporary resources. +- [ ] Previously skipped UI-related tests are either active or replaced with + equivalent coverage. + +--- + +## Milestone 10: Physical-device and cross-client release gate + +**Status:** Not started +**Progress:** 0% + +### Goal + +Validate the behavior that JVM, Robolectric, and emulator tests cannot prove: +real radios, background limits, device interoperability, and compatibility with +released clients. + +### TODO checklist + +#### Device matrix and harness + +- [ ] Define a minimum physical-device matrix covering at least two Android API + levels and two manufacturers. +- [ ] Include devices supporting BLE only and BLE plus Wi-Fi Aware where + available. +- [ ] Build a test control channel that does not interfere with mesh transport. +- [ ] Capture structured traces, packet IDs, connection transitions, and failure + reasons. +- [ ] Make test accounts, identities, and files disposable and non-personal. +- [ ] Provide deterministic scenario setup and cleanup. + +#### Android-to-Android scenarios + +- [ ] Discover, connect, exchange announcements, disconnect, and reconnect. +- [ ] Send public and private messages in both directions. +- [ ] Verify delivery and read receipts. +- [ ] Transfer image, audio, and generic files at multiple sizes. +- [ ] Relay across at least three devices. +- [ ] Partition the mesh and verify store-and-forward delivery after reconnect. +- [ ] Disable and re-enable Bluetooth during active transfers. +- [ ] Lock screens and background both apps during active mesh operation. +- [ ] Kill and recreate one process. +- [ ] Exercise simultaneous connections and duplicate-link resolution. +- [ ] Exercise Wi-Fi Aware failover where supported. + +#### Cross-client and backward compatibility + +- [ ] Test current Android against the current iOS client. +- [ ] Test the rewrite against the last supported Android release. +- [ ] Test legacy announcements without capabilities. +- [ ] Test current capability announcements with an older client. +- [ ] Test canonical private-media type and decode-only prerelease alias. +- [ ] Compare packet, message, identity, fragment, sync, and file golden vectors + across implementations. +- [ ] Verify malformed and unauthenticated inputs are rejected consistently. +- [ ] Verify Nostr fallback messages and receipts across clients. + +#### Background and endurance + +- [ ] Run a multi-hour discovery/connect/disconnect soak test. +- [ ] Run repeated large-transfer and cancellation cycles. +- [ ] Monitor memory, threads, file descriptors, wake locks, and battery impact. +- [ ] Test foreground-service survival with screens off. +- [ ] Test network and Tor availability changes during Nostr operation. +- [ ] Confirm shutdown releases radios, sockets, jobs, and wake locks. + +### Acceptance criteria + +- [ ] All mandatory scenarios pass on the defined device matrix. +- [ ] Android/iOS and old/new clients exchange every supported critical payload. +- [ ] No endurance run shows unbounded growth or leaked resources. +- [ ] Failures produce sufficient traces for deterministic reproduction where + possible. +- [ ] Release approval records the client versions, device matrix, and results. + +--- + +## CI rollout + +### Pull-request gate + +- [ ] Run formatting and static analysis. +- [ ] Run deterministic JVM unit tests. +- [ ] Run bounded property/fuzz tests. +- [ ] Run stable Robolectric tests. +- [ ] Run `clientRewriteContractTest`. +- [ ] Upload JUnit and coverage reports. +- [ ] Reject new failures, errors, or unexpected skips. +- [ ] Reject golden-vector changes without the protocol-change review label. + +### Main and nightly gate + +- [ ] Run the extended fuzz corpus. +- [ ] Run emulator instrumented tests. +- [ ] Run local relay/Tor integration tests. +- [ ] Run physical-device smoke tests when the lab is available. +- [ ] Track runtime, flakes, coverage, and quarantined tests. + +### Release-candidate gate + +- [ ] Run the complete device matrix. +- [ ] Run Android/iOS and old/new interoperability. +- [ ] Run endurance and background scenarios. +- [ ] Review all skipped or quarantined tests. +- [ ] Archive coverage, test, trace, and version metadata with the release. + +## Progress update procedure + +When work lands: + +1. Check completed TODOs in the relevant milestone. +2. Update the milestone percentage based on completed checklist items. +3. Change status to **In progress** when its first TODO is complete. +4. Change status to **Complete** only when all acceptance criteria are met. +5. Update the top-level progress table and milestone completion count. +6. Link the implementing pull request or commit next to material completed work + without including personal information. +7. Record intentionally deferred items and their justification; do not mark them + complete. + +## Final definition of done + +The test program is complete when: + +- [ ] Milestones 0–10 meet every acceptance criterion. +- [ ] Project and package-level line/branch coverage no longer regress. +- [ ] All critical parsers have adversarial and fuzz coverage. +- [ ] All security-sensitive state transitions fail closed under tampering, + replay, downgrade, and corruption. +- [ ] Transport, sync, and lifecycle tests cover disconnection, cancellation, + timeout, and restart. +- [ ] Physical-device and cross-client scenarios pass for every release. +- [ ] The full rewrite can replace the existing implementation while preserving + the unchanged compatibility and acceptance tests. diff --git a/docs/testing-conventions.md b/docs/testing-conventions.md new file mode 100644 index 00000000..b2da4e7b --- /dev/null +++ b/docs/testing-conventions.md @@ -0,0 +1,90 @@ +# Testing conventions + +## Purpose + +These conventions keep the client-rewrite suite deterministic, reproducible, +and portable across implementations. + +## Test locations + +| Test type | Location | Naming | +|---|---|---| +| JVM unit and contract tests | `app/src/test/` | `*Test.kt` | +| Shared deterministic fakes and fixtures | `app/src/test/**/testsupport/` | Descriptive fixture name | +| Robolectric tests | `app/src/test/` | `*RobolectricTest.kt` | +| Android instrumented tests | `app/src/androidTest/` | `*InstrumentedTest.kt` | +| Coverage-tool tests | `tools/coverage/` | `test_*.py` | +| Interoperability fixtures | `app/src/test/resources/contracts/` | Protocol and version in filename | + +## Required behavior + +- Tests must not use arbitrary sleeps. Advance a fake clock or coroutine test + scheduler instead. +- Tests must not require public relays, internet access, Bluetooth hardware, or a + user's persisted data. +- Time, randomness, dispatchers, storage, and transports must be injectable in + code exercised by state-machine tests. +- Randomized failures must print a reproduction seed. Use `TEST_SEED` for a + specific replay. +- Mutable byte arrays returned by fixtures and fakes must be defensively copied. +- Negative security tests must assert fail-closed behavior. +- Protocol round trips must be paired with literal golden vectors for critical + externally visible formats. +- Asynchronous tests must have a deterministic completion condition and a + bounded timeout. +- A fixed bug must retain its smallest reproducing input as a regression test. + +## Naming + +Test names should describe observable behavior: + +```kotlin +@Test +fun `replayed ciphertext is rejected without advancing receive state`() { + // ... +} +``` + +Avoid names tied to private methods or temporary implementation structure. + +## Fixtures and seeds + +Reusable Kotlin fixtures live under +`com.bitchat.android.testsupport`. `ReproducibleTestSeed` resolves +`TEST_SEED` and provides a reproduction hint: + +```sh +TEST_SEED=12345 ./gradlew clientRewriteContractTest +``` + +Never use production keys, contact information, messages, or other user data in +fixtures. + +## Coverage + +Run the full report and non-regression floor: + +```sh +./gradlew clientRewriteContractTest +``` + +Reports are written to: + +- `app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml` +- `app/build/reports/jacoco/jacocoTestReport/html/` + +Check executable production lines changed from the base branch: + +```sh +COVERAGE_BASE_REF=origin/main ./gradlew checkChangedLineCoverage +``` + +Generated resource classes, Compose-generated singleton classes, platform +bridges, and vendored Noise code are excluded from first-party coverage metrics. + +## Quarantine and skips + +- A flaky test must be fixed, not silently retried. +- A temporary quarantine must include an issue and removal condition. +- Unexpected skips fail review. Existing skips must be restored or replaced by + equivalent coverage. diff --git a/tools/__init__.py b/tools/__init__.py new file mode 100644 index 00000000..b48e1209 --- /dev/null +++ b/tools/__init__.py @@ -0,0 +1 @@ +"""Repository-local verification tooling.""" diff --git a/tools/coverage/__init__.py b/tools/coverage/__init__.py new file mode 100644 index 00000000..8aec01cc --- /dev/null +++ b/tools/coverage/__init__.py @@ -0,0 +1 @@ +"""Coverage verification helpers.""" diff --git a/tools/coverage/check_changed_coverage.py b/tools/coverage/check_changed_coverage.py new file mode 100644 index 00000000..fde7b1bc --- /dev/null +++ b/tools/coverage/check_changed_coverage.py @@ -0,0 +1,154 @@ +#!/usr/bin/env python3 +"""Enforce JaCoCo coverage for executable Kotlin/Java lines changed from a Git base.""" + +from __future__ import annotations + +import argparse +import pathlib +import re +import subprocess +import sys +import xml.etree.ElementTree as ET +from dataclasses import dataclass + + +SOURCE_ROOTS = ( + "app/src/main/java/", + "app/src/main/kotlin/", +) + + +@dataclass(frozen=True) +class CoverageLine: + missed_instructions: int + covered_instructions: int + + @property + def covered(self) -> bool: + return self.covered_instructions > 0 + + +def parse_jacoco(xml_path: pathlib.Path) -> dict[tuple[str, int], CoverageLine]: + root = ET.parse(xml_path).getroot() + result: dict[tuple[str, int], CoverageLine] = {} + for package in root.findall("package"): + package_name = package.attrib["name"] + for source_file in package.findall("sourcefile"): + relative_path = f"{package_name}/{source_file.attrib['name']}" + for line in source_file.findall("line"): + result[(relative_path, int(line.attrib["nr"]))] = CoverageLine( + missed_instructions=int(line.attrib.get("mi", "0")), + covered_instructions=int(line.attrib.get("ci", "0")), + ) + return result + + +def parse_changed_lines(diff_text: str) -> dict[str, set[int]]: + changed: dict[str, set[int]] = {} + current_path: str | None = None + for raw_line in diff_text.splitlines(): + if raw_line.startswith("+++ b/"): + current_path = raw_line[6:] + continue + if raw_line.startswith("+++ /dev/null"): + current_path = None + continue + if not raw_line.startswith("@@") or current_path is None: + continue + match = re.search(r"\+(\d+)(?:,(\d+))?", raw_line) + if match is None: + continue + start = int(match.group(1)) + count = int(match.group(2) or "1") + if count > 0: + changed.setdefault(current_path, set()).update(range(start, start + count)) + return changed + + +def jacoco_relative_path(repository_path: str) -> str | None: + for root in SOURCE_ROOTS: + if repository_path.startswith(root): + return repository_path[len(root) :] + return None + + +def git_diff_command(base: str) -> list[str]: + return [ + "git", + "diff", + # Reformatting an executable line without changing its tokens must not turn an otherwise + # covered change set into a coverage failure. + "--ignore-all-space", + "--unified=0", + "--diff-filter=AM", + base, + "--", + *SOURCE_ROOTS, + ] + + +def git_diff(base: str) -> str: + command = git_diff_command(base) + result = subprocess.run(command, check=True, capture_output=True, text=True) + return result.stdout + + +def evaluate( + changed: dict[str, set[int]], + coverage: dict[tuple[str, int], CoverageLine], +) -> tuple[int, int, list[str]]: + executable = 0 + covered = 0 + missed: list[str] = [] + for repository_path, line_numbers in sorted(changed.items()): + source_path = jacoco_relative_path(repository_path) + if source_path is None: + continue + for line_number in sorted(line_numbers): + line = coverage.get((source_path, line_number)) + if line is None: + continue + executable += 1 + if line.covered: + covered += 1 + else: + missed.append(f"{repository_path}:{line_number}") + return covered, executable, missed + + +def parse_args() -> argparse.Namespace: + parser = argparse.ArgumentParser() + parser.add_argument("--xml", type=pathlib.Path, required=True) + parser.add_argument("--base", required=True) + parser.add_argument("--threshold", type=float, default=0.80) + return parser.parse_args() + + +def main() -> int: + args = parse_args() + if not 0.0 <= args.threshold <= 1.0: + raise SystemExit("--threshold must be between 0 and 1") + if not args.xml.is_file(): + raise SystemExit(f"JaCoCo XML report not found: {args.xml}") + + coverage = parse_jacoco(args.xml) + changed = parse_changed_lines(git_diff(args.base)) + covered, executable, missed = evaluate(changed, coverage) + ratio = 1.0 if executable == 0 else covered / executable + + print( + f"Changed executable line coverage: {covered}/{executable} " + f"({ratio:.1%}), required {args.threshold:.1%}" + ) + if ratio >= args.threshold: + return 0 + + for location in missed[:50]: + print(f"UNCOVERED {location}") + if len(missed) > 50: + print(f"... and {len(missed) - 50} more uncovered executable lines") + return 1 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/tools/coverage/test_check_changed_coverage.py b/tools/coverage/test_check_changed_coverage.py new file mode 100644 index 00000000..7c452449 --- /dev/null +++ b/tools/coverage/test_check_changed_coverage.py @@ -0,0 +1,85 @@ +import pathlib +import tempfile +import unittest + +from tools.coverage.check_changed_coverage import ( + CoverageLine, + evaluate, + git_diff_command, + jacoco_relative_path, + parse_changed_lines, + parse_jacoco, +) + + +class ChangedCoverageToolTest(unittest.TestCase): + def test_parses_added_and_modified_hunks(self) -> None: + diff = """\ +diff --git a/app/src/main/java/example/Thing.kt b/app/src/main/java/example/Thing.kt +--- a/app/src/main/java/example/Thing.kt ++++ b/app/src/main/java/example/Thing.kt +@@ -1,0 +2,3 @@ ++a ++b ++c +@@ -9 +12 @@ +-old ++new +""" + self.assertEqual( + {"app/src/main/java/example/Thing.kt": {2, 3, 4, 12}}, + parse_changed_lines(diff), + ) + + def test_parses_jacoco_source_lines(self) -> None: + xml = """\ + + + + + + + + +""" + with tempfile.TemporaryDirectory() as directory: + path = pathlib.Path(directory) / "report.xml" + path.write_text(xml, encoding="utf-8") + parsed = parse_jacoco(path) + + self.assertTrue(parsed[("example/Thing.kt", 2)].covered) + self.assertFalse(parsed[("example/Thing.kt", 3)].covered) + + def test_evaluates_only_executable_changed_lines(self) -> None: + changed = {"app/src/main/java/example/Thing.kt": {1, 2, 3}} + coverage = { + ("example/Thing.kt", 2): CoverageLine(0, 1), + ("example/Thing.kt", 3): CoverageLine(1, 0), + } + + self.assertEqual( + (1, 2, ["app/src/main/java/example/Thing.kt:3"]), + evaluate(changed, coverage), + ) + + def test_maps_both_supported_source_roots(self) -> None: + self.assertEqual( + "example/Thing.kt", + jacoco_relative_path("app/src/main/java/example/Thing.kt"), + ) + self.assertEqual( + "example/Thing.kt", + jacoco_relative_path("app/src/main/kotlin/example/Thing.kt"), + ) + self.assertIsNone(jacoco_relative_path("app/src/test/example/Thing.kt")) + + def test_changed_line_diff_ignores_formatting_only_edits(self) -> None: + command = git_diff_command("origin/main") + + self.assertIn("--ignore-all-space", command) + self.assertIn("--unified=0", command) + self.assertEqual("origin/main", command[command.index("--diff-filter=AM") + 1]) + + +if __name__ == "__main__": + unittest.main() diff --git a/tools/release_gate/__init__.py b/tools/release_gate/__init__.py new file mode 100644 index 00000000..e9ab0855 --- /dev/null +++ b/tools/release_gate/__init__.py @@ -0,0 +1 @@ +"""Physical-device and cross-client release-gate tooling.""" diff --git a/tools/release_gate/android_lab.py b/tools/release_gate/android_lab.py new file mode 100644 index 00000000..165bb469 --- /dev/null +++ b/tools/release_gate/android_lab.py @@ -0,0 +1,209 @@ +#!/usr/bin/env python3 +"""USB/ADB control helpers for the physical release gate. + +Device selectors are accepted only as ephemeral command inputs. They are never +printed or written to artifacts; all output uses the operator-assigned alias. +""" + +from __future__ import annotations + +import argparse +import json +import os +import re +import shutil +import subprocess +import sys +from pathlib import Path +from typing import Callable + +REPOSITORY_ROOT = Path(__file__).resolve().parents[2] +if str(REPOSITORY_ROOT) not in sys.path: + sys.path.insert(0, str(REPOSITORY_ROOT)) + +from tools.release_gate.release_gate import ( + GateError, + SAFE_ID_RE, + append_trace_event, +) + + +APPLICATION_ID = "com.bitchat.droid" + + +def find_adb() -> str: + direct = shutil.which("adb") + if direct: + return direct + android_home = os.environ.get("ANDROID_HOME") + if android_home: + candidate = Path(android_home) / "platform-tools" / "adb" + if candidate.is_file(): + return str(candidate) + raise GateError("adb was not found; set ANDROID_HOME or add adb to PATH") + + +def run_adb( + serial: str, + arguments: list[str], + *, + runner: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run, +) -> str: + result = runner( + [find_adb(), "-s", serial, *arguments], + check=False, + capture_output=True, + text=True, + timeout=30, + ) + if result.returncode != 0: + raise GateError("ADB command failed for the selected logical device") + return result.stdout.strip() + + +def count_connected_devices( + *, + runner: Callable[..., subprocess.CompletedProcess[str]] = subprocess.run, +) -> int: + result = runner( + [find_adb(), "devices"], + check=False, + capture_output=True, + text=True, + timeout=30, + ) + if result.returncode != 0: + raise GateError("could not enumerate ADB devices") + return sum( + 1 + for line in result.stdout.splitlines()[1:] + if line.strip().endswith("\tdevice") + ) + + +def probe_device(serial: str, alias: str) -> dict[str, object]: + if not SAFE_ID_RE.fullmatch(alias): + raise GateError("device alias must be a lowercase logical identifier") + api_text = run_adb(serial, ["shell", "getprop", "ro.build.version.sdk"]) + if not api_text.isdigit(): + raise GateError("selected device returned an invalid API level") + features = run_adb(serial, ["shell", "pm", "list", "features"]) + manufacturer = run_adb( + serial, ["shell", "getprop", "ro.product.manufacturer"] + ).strip().lower() + model = run_adb(serial, ["shell", "getprop", "ro.product.model"]).strip() + capabilities = ["ble-central", "ble-peripheral"] + if "android.hardware.wifi.aware" in features: + capabilities.append("wifi-aware") + return { + "alias": alias, + "platform": "android", + "model": model, + "manufacturer_class": re.sub(r"[^a-z0-9._-]", "-", manufacturer)[:64], + "api_level": int(api_text), + "physical": True, + "capabilities": capabilities, + } + + +def prepare_disposable_device(serial: str, confirmed: bool) -> None: + if not confirmed: + raise GateError("prepare requires --confirm-disposable-app-data") + run_adb(serial, ["shell", "am", "force-stop", APPLICATION_ID]) + output = run_adb(serial, ["shell", "pm", "clear", APPLICATION_ID]) + if "Success" not in output: + raise GateError("could not clear disposable app data") + + +def collect_resource_snapshot(serial: str) -> dict[str, int | bool]: + pid_text = run_adb(serial, ["shell", "pidof", APPLICATION_ID]) + pid = pid_text.split()[0] if pid_text else "" + metrics: dict[str, int | bool] = {"process-running": bool(pid)} + if not pid.isdigit(): + return metrics + meminfo = run_adb(serial, ["shell", "dumpsys", "meminfo", APPLICATION_ID]) + total_match = re.search(r"TOTAL\s+(\d+)", meminfo) + metrics["total-pss-kb"] = int(total_match.group(1)) if total_match else -1 + thread_text = run_adb( + serial, + ["shell", "sh", "-c", f"find /proc/{pid}/task -mindepth 1 -maxdepth 1 | wc -l"], + ) + fd_text = run_adb( + serial, + ["shell", "sh", "-c", f"find /proc/{pid}/fd -mindepth 1 -maxdepth 1 | wc -l"], + ) + metrics["thread-count"] = int(thread_text) if thread_text.isdigit() else -1 + metrics["fd-count"] = int(fd_text) if fd_text.isdigit() else -1 + power = run_adb(serial, ["shell", "dumpsys", "power"]) + metrics["app-wakelock-count"] = sum( + 1 + for line in power.splitlines() + if APPLICATION_ID in line and "WakeLock" in line + ) + battery = run_adb(serial, ["shell", "dumpsys", "battery"]) + battery_level = re.search(r"^\s*level:\s*(\d+)", battery, re.MULTILINE) + metrics["battery-level-percent"] = ( + int(battery_level.group(1)) if battery_level else -1 + ) + return metrics + + +def build_parser() -> argparse.ArgumentParser: + parser = argparse.ArgumentParser(description=__doc__) + commands = parser.add_subparsers(dest="command", required=True) + + commands.add_parser("count") + + probe = commands.add_parser("probe") + probe.add_argument("--serial", required=True, help=argparse.SUPPRESS) + probe.add_argument("--alias", required=True) + + prepare = commands.add_parser("prepare") + prepare.add_argument("--serial", required=True, help=argparse.SUPPRESS) + prepare.add_argument("--confirm-disposable-app-data", action="store_true") + + cleanup = commands.add_parser("cleanup") + cleanup.add_argument("--serial", required=True, help=argparse.SUPPRESS) + cleanup.add_argument("--confirm-disposable-app-data", action="store_true") + + snapshot = commands.add_parser("snapshot") + snapshot.add_argument("--serial", required=True, help=argparse.SUPPRESS) + snapshot.add_argument("--alias", required=True) + snapshot.add_argument("--run", type=Path, required=True) + snapshot.add_argument("--scenario", required=True) + snapshot.add_argument("--event", default="resource-snapshot") + return parser + + +def main(argv: list[str] | None = None) -> int: + args = build_parser().parse_args(argv) + try: + if args.command == "count": + print(json.dumps({"authorized-device-count": count_connected_devices()})) + elif args.command == "probe": + print(json.dumps(probe_device(args.serial, args.alias), sort_keys=True)) + elif args.command in {"prepare", "cleanup"}: + prepare_disposable_device( + args.serial, args.confirm_disposable_app_data + ) + print(json.dumps({"status": "clean", "application": APPLICATION_ID})) + elif args.command == "snapshot": + metrics = collect_resource_snapshot(args.serial) + append_trace_event( + args.run, + args.scenario, + args.alias, + args.event, + "observed", + None, + metrics, + ) + print(json.dumps({"source_alias": args.alias, "metrics": metrics}, sort_keys=True)) + return 0 + except (GateError, OSError, subprocess.SubprocessError) as error: + print(f"android lab error: {error}", file=sys.stderr) + return 2 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/tools/release_gate/device-matrix.example.json b/tools/release_gate/device-matrix.example.json new file mode 100644 index 00000000..01b8f629 --- /dev/null +++ b/tools/release_gate/device-matrix.example.json @@ -0,0 +1,72 @@ +{ + "schema_version": 1, + "commit": "0000000000000000000000000000000000000000", + "clients": { + "android-current": { + "version": "replace-with-release-candidate", + "commit": "0000000000000000000000000000000000000000" + }, + "android-legacy": { + "version": "replace-with-last-supported-release" + }, + "ios-current": { + "version": "replace-with-current-ios-release" + } + }, + "lab_capabilities": ["local-relay", "tor"], + "devices": [ + { + "alias": "android-low", + "platform": "android", + "model": "replace-with-model", + "manufacturer_class": "manufacturer-a", + "api_level": 28, + "physical": true, + "capabilities": ["ble-central", "ble-peripheral"] + }, + { + "alias": "android-current", + "platform": "android", + "model": "replace-with-model", + "manufacturer_class": "manufacturer-b", + "api_level": 35, + "physical": true, + "capabilities": ["ble-central", "ble-peripheral", "wifi-aware"] + }, + { + "alias": "android-relay", + "platform": "android", + "model": "replace-with-model", + "manufacturer_class": "manufacturer-c", + "api_level": 33, + "physical": true, + "capabilities": ["ble-central", "ble-peripheral"] + }, + { + "alias": "android-aware", + "platform": "android", + "model": "replace-with-model", + "manufacturer_class": "manufacturer-b", + "api_level": 35, + "physical": true, + "capabilities": ["ble-central", "ble-peripheral", "wifi-aware"] + }, + { + "alias": "android-legacy", + "platform": "android", + "model": "replace-with-model", + "manufacturer_class": "manufacturer-a", + "api_level": 28, + "physical": true, + "capabilities": ["ble-central", "ble-peripheral"] + }, + { + "alias": "ios-current", + "platform": "ios", + "model": "replace-with-model", + "manufacturer_class": "apple", + "physical": true, + "capabilities": ["ble-central", "ble-peripheral"] + } + ] +} diff --git a/tools/release_gate/release_gate.py b/tools/release_gate/release_gate.py new file mode 100644 index 00000000..fbec7e32 --- /dev/null +++ b/tools/release_gate/release_gate.py @@ -0,0 +1,744 @@ +#!/usr/bin/env python3 +"""Create, record, validate, and archive the physical release gate. + +The host-side CLI is the control channel. It coordinates operators over USB or +local files and never sends control traffic through the mesh under test. +Artifacts intentionally contain logical device aliases and aggregate evidence, +not device identifiers, addresses, peer IDs, or message contents. +""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import math +import re +import sys +import zipfile +from datetime import datetime, timezone +from pathlib import Path +from typing import Any, Iterable + + +SCHEMA_VERSION = 1 +RESULT_STATUSES = {"pending", "pass", "fail", "blocked", "unsupported"} +COMMIT_RE = re.compile(r"^[0-9a-f]{40}$") +SAFE_ID_RE = re.compile(r"^[a-z0-9][a-z0-9._-]{0,63}$") +DISALLOWED_KEYS = { + "serial", + "serial_number", + "udid", + "imei", + "bluetooth_address", + "mac_address", + "ip_address", + "peer_id", + "username", + "user_name", + "email", + "account", + "device_name", +} +HASH_VALUE_KEYS = { + "commit", + "sha256", + "digest", + "scenario_manifest_sha256", + "fixture_sha256", + "vector_manifest_digest", + "corpus_digest", +} +SENSITIVE_PATTERNS = ( + re.compile(r"(?:^|[\s/])Users/[^/\s]+"), + re.compile(r"(?:^|[\s/])home/[^/\s]+"), + re.compile(r"\b[\w.+-]+@[\w.-]+\.[A-Za-z]{2,}\b"), + re.compile(r"\b(?:\d{1,3}\.){3}\d{1,3}\b"), + re.compile(r"\b(?:[0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}\b"), + re.compile(r"\b[0-9A-Fa-f]{16,}\b"), +) +MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024 + + +class GateError(ValueError): + """A release-gate artifact violated an executable contract.""" + + +def utc_now() -> str: + return datetime.now(timezone.utc).replace(microsecond=0).isoformat() + + +def load_json(path: Path) -> dict[str, Any]: + try: + value = json.loads(path.read_text(encoding="utf-8")) + except (OSError, json.JSONDecodeError) as error: + raise GateError(f"could not read JSON {path.name}: {error}") from error + if not isinstance(value, dict): + raise GateError(f"{path.name} must contain a JSON object") + return value + + +def write_json(path: Path, value: dict[str, Any]) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + temporary = path.with_suffix(path.suffix + ".tmp") + temporary.write_text( + json.dumps(value, indent=2, sort_keys=True, ensure_ascii=False) + "\n", + encoding="utf-8", + ) + temporary.replace(path) + + +def sha256_bytes(value: bytes) -> str: + return hashlib.sha256(value).hexdigest() + + +def sha256_file(path: Path) -> str: + digest = hashlib.sha256() + with path.open("rb") as stream: + for chunk in iter(lambda: stream.read(1024 * 1024), b""): + digest.update(chunk) + return digest.hexdigest() + + +def canonical_json_digest(value: dict[str, Any]) -> str: + encoded = json.dumps( + value, sort_keys=True, separators=(",", ":"), ensure_ascii=False + ).encode("utf-8") + return sha256_bytes(encoded) + + +def validate_privacy(value: Any, path: tuple[str, ...] = ()) -> None: + if isinstance(value, dict): + for key, child in value.items(): + normalized = str(key).lower() + if normalized in DISALLOWED_KEYS: + raise GateError(f"disallowed identifying field: {'.'.join(path + (str(key),))}") + validate_privacy(child, path + (str(key),)) + return + if isinstance(value, list): + for index, child in enumerate(value): + validate_privacy(child, path + (str(index),)) + return + if not isinstance(value, str): + return + final_key = path[-1].lower().replace("-", "_") if path else "" + for index, pattern in enumerate(SENSITIVE_PATTERNS): + if index == len(SENSITIVE_PATTERNS) - 1 and ( + final_key in HASH_VALUE_KEYS + or final_key.endswith("_digest") + or final_key.endswith("_sha256") + ): + continue + if pattern.search(value): + raise GateError(f"potential identifying value at {'.'.join(path)}") + + +def validate_manifest(manifest: dict[str, Any]) -> dict[str, dict[str, Any]]: + if manifest.get("schema_version") != SCHEMA_VERSION: + raise GateError("unsupported scenario schema_version") + scenarios = manifest.get("scenarios") + if not isinstance(scenarios, list) or not scenarios: + raise GateError("scenario manifest must contain scenarios") + by_id: dict[str, dict[str, Any]] = {} + for scenario in scenarios: + if not isinstance(scenario, dict): + raise GateError("each scenario must be an object") + scenario_id = scenario.get("id") + if not isinstance(scenario_id, str) or not re.fullmatch( + r"[A-Z0-9]{3}-\d{3}", scenario_id + ): + raise GateError(f"invalid scenario id: {scenario_id!r}") + if scenario_id in by_id: + raise GateError(f"duplicate scenario id: {scenario_id}") + if scenario.get("category") not in { + "transport", + "android-platform", + "android-to-android", + "cross-client", + "endurance", + }: + raise GateError(f"invalid category for {scenario_id}") + if scenario.get("required") is not True: + raise GateError(f"release scenario {scenario_id} must be required") + if not scenario.get("participants") or not scenario.get("evidence"): + raise GateError(f"scenario {scenario_id} lacks participants or evidence") + by_id[scenario_id] = scenario + validate_privacy(manifest) + return by_id + + +def validate_matrix( + matrix: dict[str, Any], + expected_commit: str | None = None, + *, + allow_placeholders: bool = False, +) -> dict[str, dict[str, Any]]: + if matrix.get("schema_version") != SCHEMA_VERSION: + raise GateError("unsupported matrix schema_version") + commit = matrix.get("commit") + if not isinstance(commit, str) or not COMMIT_RE.fullmatch(commit): + raise GateError("matrix commit must be a lowercase full Git commit") + if expected_commit is not None and commit != expected_commit: + raise GateError("matrix commit does not match the release candidate") + clients = matrix.get("clients") + required_clients = {"android-current", "android-legacy", "ios-current"} + if not isinstance(clients, dict) or not required_clients.issubset(clients): + raise GateError("matrix must version current Android, legacy Android, and current iOS") + for client_name in required_clients: + client = clients.get(client_name) + if not isinstance(client, dict) or not isinstance(client.get("version"), str): + raise GateError(f"{client_name} must declare a version") + if not allow_placeholders and client["version"].startswith("replace-with-"): + raise GateError(f"{client_name} still contains a template version") + current_commit = clients["android-current"].get("commit") + if current_commit != commit and not (allow_placeholders and commit == "0" * 40): + raise GateError("current Android client commit must match the matrix commit") + lab_capabilities = matrix.get("lab_capabilities") + if not isinstance(lab_capabilities, list) or any( + not isinstance(capability, str) or not SAFE_ID_RE.fullmatch(capability) + for capability in lab_capabilities + ): + raise GateError("matrix must declare logical lab_capabilities") + devices = matrix.get("devices") + if not isinstance(devices, list): + raise GateError("matrix devices must be a list") + by_alias: dict[str, dict[str, Any]] = {} + for device in devices: + if not isinstance(device, dict): + raise GateError("each device must be an object") + alias = device.get("alias") + if not isinstance(alias, str) or not SAFE_ID_RE.fullmatch(alias): + raise GateError(f"invalid logical device alias: {alias!r}") + if alias in by_alias: + raise GateError(f"duplicate device alias: {alias}") + if device.get("physical") is not True: + raise GateError(f"{alias} is not a physical device") + if device.get("platform") not in {"android", "ios"}: + raise GateError(f"{alias} has an unsupported platform") + if not isinstance(device.get("capabilities"), list): + raise GateError(f"{alias} must declare capabilities") + if not allow_placeholders and ( + not isinstance(device.get("model"), str) + or device["model"].startswith("replace-with-") + ): + raise GateError(f"{alias} still contains template values") + by_alias[alias] = device + android = [device for device in devices if device.get("platform") == "android"] + if len(android) < 3: + raise GateError("three physical Android devices are required for relay scenarios") + api_levels = {device.get("api_level") for device in android} + manufacturers = {device.get("manufacturer_class") for device in android} + if len(api_levels) < 2 or not all(isinstance(level, int) for level in api_levels): + raise GateError("Android matrix must cover at least two API levels") + if len(manufacturers) < 2 or None in manufacturers: + raise GateError("Android matrix must cover at least two manufacturer classes") + for device in android: + capabilities = set(device["capabilities"]) + if not {"ble-central", "ble-peripheral"}.issubset(capabilities): + raise GateError(f"{device['alias']} lacks required BLE roles") + if not any("wifi-aware" in device["capabilities"] for device in android): + raise GateError("at least one Android device must support Wi-Fi Aware") + if not any(device.get("platform") == "ios" for device in devices): + raise GateError("a physical iOS device is required") + validate_privacy(matrix) + return by_alias + + +def _fixture_bytes(seed: bytes, size: int) -> bytes: + output = bytearray() + counter = 0 + while len(output) < size: + output.extend(hashlib.sha256(seed + counter.to_bytes(4, "big")).digest()) + counter += 1 + return bytes(output[:size]) + + +def create_fixtures(directory: Path, run_id: str) -> dict[str, Any]: + fixture_directory = directory / "fixtures" + fixture_directory.mkdir() + definitions = ( + ("empty.bin", 0, False), + ("small.bin", 4 * 1024, False), + ("lab-résumé-秘密.bin", 256 * 1024, False), + ("maximum.bin", MAX_FILE_SIZE_BYTES, True), + ("oversized.bin", MAX_FILE_SIZE_BYTES + 1, True), + ) + fixtures: list[dict[str, Any]] = [] + for name, size, sparse in definitions: + path = fixture_directory / name + if sparse: + with path.open("wb") as stream: + stream.truncate(size) + else: + path.write_bytes(_fixture_bytes(run_id.encode("utf-8"), size)) + fixtures.append( + { + "name": name, + "size_bytes": size, + "sparse": sparse, + "fixture_sha256": sha256_file(path), + } + ) + manifest = {"schema_version": SCHEMA_VERSION, "fixtures": fixtures} + write_json(fixture_directory / "manifest.json", manifest) + return manifest + + +def initialize_run( + manifest: dict[str, Any], + matrix: dict[str, Any], + output: Path, + commit: str, + run_id: str, + *, + started_at: str | None = None, +) -> dict[str, Any]: + scenarios = validate_manifest(manifest) + devices = validate_matrix(matrix, commit) + if not SAFE_ID_RE.fullmatch(run_id): + raise GateError("run id must be a non-identifying lowercase logical id") + missing_aliases = { + participant + for scenario in scenarios.values() + for participant in scenario["participants"] + if participant not in devices + } + if missing_aliases: + raise GateError(f"matrix lacks scenario aliases: {sorted(missing_aliases)}") + for scenario_id, scenario in scenarios.items(): + available = set(matrix["lab_capabilities"]) + for participant in scenario["participants"]: + available.update(devices[participant]["capabilities"]) + missing_capabilities = set(scenario["capabilities"]) - available + if missing_capabilities: + raise GateError( + f"{scenario_id} lacks capabilities: {sorted(missing_capabilities)}" + ) + output.mkdir(parents=True, exist_ok=False) + write_json(output / "manifest.json", manifest) + write_json(output / "matrix.json", matrix) + fixtures = create_fixtures(output, run_id) + results = { + "schema_version": SCHEMA_VERSION, + "run_id": run_id, + "commit": commit, + "started_at": started_at or utc_now(), + "completed_at": None, + "scenario_manifest_sha256": canonical_json_digest(manifest), + "fixture_manifest_sha256": canonical_json_digest(fixtures), + "scenario_results": { + scenario_id: { + "status": "pending", + "participants": scenario["participants"], + "evidence": {}, + "reason_code": None, + "updated_at": None, + "history": [], + } + for scenario_id, scenario in scenarios.items() + }, + } + write_json(output / "results.json", results) + (output / "trace.jsonl").write_text("", encoding="utf-8") + return results + + +def _parse_scalar(value: str) -> Any: + lowered = value.lower() + if lowered in {"true", "false"}: + return lowered == "true" + try: + return int(value) + except ValueError: + try: + return float(value) + except ValueError: + return value + + +def parse_evidence(values: Iterable[str]) -> dict[str, Any]: + evidence: dict[str, Any] = {} + for value in values: + if "=" not in value: + raise GateError("evidence must use key=value") + key, raw = value.split("=", 1) + if not SAFE_ID_RE.fullmatch(key): + raise GateError(f"invalid evidence key: {key!r}") + evidence[key] = _parse_scalar(raw) + validate_privacy(evidence) + return evidence + + +def record_result( + run_directory: Path, + scenario_id: str, + status: str, + evidence: dict[str, Any], + reason_code: str | None, + *, + updated_at: str | None = None, +) -> dict[str, Any]: + manifest = load_json(run_directory / "manifest.json") + scenarios = validate_manifest(manifest) + if scenario_id not in scenarios: + raise GateError(f"unknown scenario: {scenario_id}") + if status not in RESULT_STATUSES - {"pending"}: + raise GateError(f"invalid terminal status: {status}") + if reason_code is not None and not SAFE_ID_RE.fullmatch(reason_code): + raise GateError("reason code must be a non-identifying stable code") + if status == "pass" and not evidence: + raise GateError("passing a scenario requires structured evidence") + if status == "pass" and reason_code is not None: + raise GateError("passing a scenario cannot have a failure reason code") + if status in {"fail", "blocked", "unsupported"} and reason_code is None: + raise GateError(f"{status} requires a stable reason code") + if any(not SAFE_ID_RE.fullmatch(str(key)) for key in evidence): + raise GateError("evidence keys must be stable logical identifiers") + validate_privacy(evidence) + results = load_json(run_directory / "results.json") + result = results["scenario_results"][scenario_id] + terminal_update = { + "status": status, + "evidence": evidence, + "reason_code": reason_code, + "updated_at": updated_at or utc_now(), + } + result.setdefault("history", []).append(terminal_update.copy()) + result.update( + terminal_update + ) + results["completed_at"] = ( + result["updated_at"] + if all( + item.get("status") == "pass" + for item in results["scenario_results"].values() + ) + else None + ) + write_json(run_directory / "results.json", results) + return results + + +def append_trace_event( + run_directory: Path, + scenario_id: str, + source_alias: str, + event: str, + outcome: str, + reason_code: str | None, + metrics: dict[str, Any], + *, + timestamp: str | None = None, +) -> dict[str, Any]: + manifest = load_json(run_directory / "manifest.json") + matrix = load_json(run_directory / "matrix.json") + scenarios = validate_manifest(manifest) + devices = validate_matrix(matrix, allow_placeholders=False) + if scenario_id not in scenarios: + raise GateError(f"unknown scenario: {scenario_id}") + if source_alias not in devices: + raise GateError(f"unknown source alias: {source_alias}") + for label, value in (("event", event), ("outcome", outcome)): + if not SAFE_ID_RE.fullmatch(value): + raise GateError(f"invalid {label}") + if reason_code is not None and not SAFE_ID_RE.fullmatch(reason_code): + raise GateError("invalid reason code") + if any(not SAFE_ID_RE.fullmatch(str(key)) for key in metrics): + raise GateError("trace metric keys must be stable logical identifiers") + if any( + not isinstance(value, (int, float, bool)) + or isinstance(value, float) and not math.isfinite(value) + for value in metrics.values() + ): + raise GateError("trace metrics must be numeric or boolean aggregates") + trace = { + "timestamp": timestamp or utc_now(), + "scenario_id": scenario_id, + "source_alias": source_alias, + "event": event, + "outcome": outcome, + "reason_code": reason_code, + "metrics": metrics, + } + validate_privacy(trace) + with (run_directory / "trace.jsonl").open("a", encoding="utf-8") as stream: + stream.write(json.dumps(trace, sort_keys=True, ensure_ascii=False) + "\n") + return trace + + +def _validate_trace( + run_directory: Path, + scenarios: dict[str, dict[str, Any]], + devices: dict[str, dict[str, Any]], +) -> tuple[int, set[str]]: + path = run_directory / "trace.jsonl" + if not path.exists(): + raise GateError("trace.jsonl is missing") + count = 0 + traced_scenarios: set[str] = set() + for line_number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1): + try: + event = json.loads(line) + except json.JSONDecodeError as error: + raise GateError(f"invalid trace line {line_number}") from error + if not isinstance(event, dict): + raise GateError(f"trace line {line_number} must be an object") + if event.get("scenario_id") not in scenarios: + raise GateError(f"trace line {line_number} has an unknown scenario") + if event.get("source_alias") not in devices: + raise GateError(f"trace line {line_number} has an unknown source") + if set(event) != { + "timestamp", + "scenario_id", + "source_alias", + "event", + "outcome", + "reason_code", + "metrics", + }: + raise GateError(f"trace line {line_number} has unexpected fields") + if not isinstance(event.get("metrics"), dict) or any( + not isinstance(value, (int, float, bool)) + for value in event["metrics"].values() + ): + raise GateError(f"trace line {line_number} has invalid metrics") + validate_privacy(event) + count += 1 + traced_scenarios.add(event["scenario_id"]) + return count, traced_scenarios + + +def validate_run(run_directory: Path, *, allow_incomplete: bool = False) -> dict[str, Any]: + manifest = load_json(run_directory / "manifest.json") + matrix = load_json(run_directory / "matrix.json") + results = load_json(run_directory / "results.json") + scenarios = validate_manifest(manifest) + devices = validate_matrix(matrix, results.get("commit")) + if results.get("schema_version") != SCHEMA_VERSION: + raise GateError("unsupported results schema_version") + if results.get("scenario_manifest_sha256") != canonical_json_digest(manifest): + raise GateError("scenario manifest changed after run initialization") + fixture_manifest = load_json(run_directory / "fixtures" / "manifest.json") + if results.get("fixture_manifest_sha256") != canonical_json_digest(fixture_manifest): + raise GateError("fixture manifest changed after run initialization") + actual = results.get("scenario_results") + if not isinstance(actual, dict) or set(actual) != set(scenarios): + raise GateError("results must contain exactly every declared scenario") + validate_privacy(results) + for scenario_id, scenario in scenarios.items(): + result = actual[scenario_id] + if result.get("participants") != scenario["participants"]: + raise GateError(f"{scenario_id} participants changed") + if any(alias not in devices for alias in result["participants"]): + raise GateError(f"{scenario_id} references an unknown device") + available = set(matrix["lab_capabilities"]) + for participant in result["participants"]: + available.update(devices[participant]["capabilities"]) + missing_capabilities = set(scenario["capabilities"]) - available + if missing_capabilities: + raise GateError( + f"{scenario_id} lacks capabilities: {sorted(missing_capabilities)}" + ) + status = result.get("status") + if status not in RESULT_STATUSES: + raise GateError(f"{scenario_id} has invalid status") + if not allow_incomplete and status != "pass": + raise GateError(f"{scenario_id} is not passing: {status}") + if status == "pass": + evidence = result.get("evidence") + missing = set(scenario["evidence"]) - set(evidence or {}) + if missing: + raise GateError(f"{scenario_id} lacks evidence: {sorted(missing)}") + if scenario.get("minimum_duration_minutes") is not None and ( + evidence.get("duration-minutes", 0) + < scenario["minimum_duration_minutes"] + ): + raise GateError(f"{scenario_id} did not meet minimum duration") + if scenario.get("minimum_cycles") is not None and ( + evidence.get("cycle-count", 0) < scenario["minimum_cycles"] + ): + raise GateError(f"{scenario_id} did not meet minimum cycles") + trace_events, traced_scenarios = _validate_trace(run_directory, scenarios, devices) + if not allow_incomplete: + missing_traces = set(scenarios) - traced_scenarios + if missing_traces: + raise GateError( + f"passing scenarios lack structured traces: {sorted(missing_traces)}" + ) + if not results.get("completed_at"): + raise GateError("complete results must record completed_at") + summary = { + status: sum( + 1 for result in actual.values() if result.get("status") == status + ) + for status in sorted(RESULT_STATUSES) + } + summary["trace_events"] = trace_events + summary["complete"] = all( + result.get("status") == "pass" for result in actual.values() + ) + return summary + + +def render_summary(run_directory: Path) -> str: + results = load_json(run_directory / "results.json") + summary = validate_run(run_directory, allow_incomplete=True) + rows = [ + "# Physical release-gate result", + "", + f"- Run: `{results['run_id']}`", + f"- Commit: `{results['commit']}`", + f"- Complete: `{str(summary['complete']).lower()}`", + f"- Trace events: {summary['trace_events']}", + "", + "| Status | Count |", + "|---|---:|", + ] + rows.extend( + f"| {status} | {summary[status]} |" for status in sorted(RESULT_STATUSES) + ) + return "\n".join(rows) + "\n" + + +def create_bundle(run_directory: Path, output: Path) -> None: + validate_run(run_directory) + if output.exists(): + raise GateError("refusing to overwrite an existing release-gate bundle") + members = [ + Path("manifest.json"), + Path("matrix.json"), + Path("results.json"), + Path("trace.jsonl"), + Path("fixtures/manifest.json"), + ] + generated = {"summary.md": render_summary(run_directory).encode("utf-8")} + checksums: list[str] = [] + payloads: dict[str, bytes] = {} + for member in members: + payload = (run_directory / member).read_bytes() + payloads[member.as_posix()] = payload + payloads.update(generated) + for name in sorted(payloads): + checksums.append(f"{sha256_bytes(payloads[name])} {name}") + payloads["SHA256SUMS"] = ("\n".join(checksums) + "\n").encode("utf-8") + output.parent.mkdir(parents=True, exist_ok=True) + with zipfile.ZipFile(output, "w", compression=zipfile.ZIP_DEFLATED) as archive: + for name in sorted(payloads): + info = zipfile.ZipInfo(name, date_time=(1980, 1, 1, 0, 0, 0)) + info.compress_type = zipfile.ZIP_DEFLATED + info.external_attr = 0o100644 << 16 + archive.writestr(info, payloads[name]) + + +def _default_manifest() -> Path: + return Path(__file__).with_name("scenarios.json") + + +def build_parser() -> argparse.ArgumentParser: + parser = argparse.ArgumentParser(description=__doc__) + subparsers = parser.add_subparsers(dest="command", required=True) + + manifest = subparsers.add_parser("validate-manifest") + manifest.add_argument("--manifest", type=Path, default=_default_manifest()) + + matrix = subparsers.add_parser("validate-matrix") + matrix.add_argument("--matrix", type=Path, required=True) + matrix.add_argument("--commit") + matrix.add_argument("--allow-template", action="store_true") + + initialize = subparsers.add_parser("init") + initialize.add_argument("--manifest", type=Path, default=_default_manifest()) + initialize.add_argument("--matrix", type=Path, required=True) + initialize.add_argument("--output", type=Path, required=True) + initialize.add_argument("--commit", required=True) + initialize.add_argument("--run-id", required=True) + + record = subparsers.add_parser("record") + record.add_argument("--run", type=Path, required=True) + record.add_argument("--scenario", required=True) + record.add_argument("--status", choices=sorted(RESULT_STATUSES - {"pending"}), required=True) + record.add_argument("--evidence", action="append", default=[]) + record.add_argument("--reason-code") + + trace = subparsers.add_parser("trace") + trace.add_argument("--run", type=Path, required=True) + trace.add_argument("--scenario", required=True) + trace.add_argument("--source", required=True) + trace.add_argument("--event", required=True) + trace.add_argument("--outcome", required=True) + trace.add_argument("--reason-code") + trace.add_argument("--metric", action="append", default=[]) + + validate = subparsers.add_parser("validate") + validate.add_argument("--run", type=Path, required=True) + validate.add_argument("--allow-incomplete", action="store_true") + + summary = subparsers.add_parser("summary") + summary.add_argument("--run", type=Path, required=True) + + bundle = subparsers.add_parser("bundle") + bundle.add_argument("--run", type=Path, required=True) + bundle.add_argument("--output", type=Path, required=True) + return parser + + +def main(argv: list[str] | None = None) -> int: + args = build_parser().parse_args(argv) + try: + if args.command == "validate-manifest": + scenarios = validate_manifest(load_json(args.manifest)) + print(f"valid scenarios: {len(scenarios)}") + elif args.command == "validate-matrix": + devices = validate_matrix( + load_json(args.matrix), + args.commit, + allow_placeholders=args.allow_template, + ) + print(f"valid devices: {len(devices)}") + elif args.command == "init": + initialize_run( + load_json(args.manifest), + load_json(args.matrix), + args.output, + args.commit, + args.run_id, + ) + print(args.output) + elif args.command == "record": + record_result( + args.run, + args.scenario, + args.status, + parse_evidence(args.evidence), + args.reason_code, + ) + elif args.command == "trace": + append_trace_event( + args.run, + args.scenario, + args.source, + args.event, + args.outcome, + args.reason_code, + parse_evidence(args.metric), + ) + elif args.command == "validate": + print( + json.dumps( + validate_run(args.run, allow_incomplete=args.allow_incomplete), + sort_keys=True, + ) + ) + elif args.command == "summary": + print(render_summary(args.run), end="") + elif args.command == "bundle": + create_bundle(args.run, args.output) + print(args.output) + return 0 + except GateError as error: + print(f"release gate error: {error}", file=sys.stderr) + return 2 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/tools/release_gate/scenarios.json b/tools/release_gate/scenarios.json new file mode 100644 index 00000000..d9b50907 --- /dev/null +++ b/tools/release_gate/scenarios.json @@ -0,0 +1,251 @@ +{ + "schema_version": 1, + "scenario_version": "1.0", + "scenarios": [ + { + "id": "TRN-001", + "category": "transport", + "title": "Complete the physical BLE, GATT, MTU, Wi-Fi Aware, and failover matrix", + "participants": ["android-low", "android-current", "android-aware"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral", "wifi-aware"], + "evidence": ["matrix-check-count", "mtu-case-count", "failure-injection-count", "shutdown-check-count"] + }, + { + "id": "AND-001", + "category": "android-platform", + "title": "Complete API-level, manufacturer, permission-revocation, and background gates", + "participants": ["android-low", "android-current", "android-aware"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral", "wifi-aware"], + "evidence": ["api-level-count", "manufacturer-count", "permission-revocation-count", "background-case-count"] + }, + { + "id": "A2A-001", + "category": "android-to-android", + "title": "Discover, connect, announce, disconnect, and reconnect", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["connection-transitions", "packet-correlation-count", "failure-reasons"] + }, + { + "id": "A2A-002", + "category": "android-to-android", + "title": "Exchange public and private messages in both directions", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["message-counts", "packet-correlation-count"] + }, + { + "id": "A2A-003", + "category": "android-to-android", + "title": "Advance delivery and read receipts", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["receipt-transitions"] + }, + { + "id": "A2A-004", + "category": "android-to-android", + "title": "Transfer image, audio, and generic files at multiple sizes", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["fixture-digests", "transfer-progress", "delivery-digests"] + }, + { + "id": "A2A-005", + "category": "android-to-android", + "title": "Relay across three Android devices", + "participants": ["android-low", "android-current", "android-relay"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["route-transitions", "ttl-values", "packet-correlation-count"] + }, + { + "id": "A2A-006", + "category": "android-to-android", + "title": "Partition and recover store-and-forward delivery", + "participants": ["android-low", "android-current", "android-relay"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["partition-window", "queue-counts", "delivery-counts"] + }, + { + "id": "A2A-007", + "category": "android-to-android", + "title": "Toggle Bluetooth during active transfers", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["radio-transitions", "transfer-terminal-state"] + }, + { + "id": "A2A-008", + "category": "android-to-android", + "title": "Lock screens and background both apps during mesh operation", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["lifecycle-transitions", "service-state", "delivery-counts"] + }, + { + "id": "A2A-009", + "category": "android-to-android", + "title": "Kill and recreate one process", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["process-generation", "restored-state", "reconnect-count"] + }, + { + "id": "A2A-010", + "category": "android-to-android", + "title": "Resolve simultaneous and duplicate links", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["candidate-links", "canonical-link-count"] + }, + { + "id": "A2A-011", + "category": "android-to-android", + "title": "Fail over through Wi-Fi Aware", + "participants": ["android-current", "android-aware"], + "required": true, + "capabilities": ["wifi-aware"], + "evidence": ["transport-selection", "failover-window", "delivery-counts"] + }, + { + "id": "XCL-001", + "category": "cross-client", + "title": "Current Android interoperates with current iOS", + "participants": ["android-current", "ios-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["client-versions", "payload-counts"] + }, + { + "id": "XCL-002", + "category": "cross-client", + "title": "Current rewrite contracts interoperate with the last supported Android", + "participants": ["android-current", "android-legacy"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["client-versions", "payload-counts"] + }, + { + "id": "XCL-003", + "category": "cross-client", + "title": "Legacy announcements without capabilities remain compatible", + "participants": ["android-current", "android-legacy"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["announcement-version", "peer-state"] + }, + { + "id": "XCL-004", + "category": "cross-client", + "title": "Older clients safely ignore current capability announcements", + "participants": ["android-current", "android-legacy"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["announcement-version", "peer-state"] + }, + { + "id": "XCL-005", + "category": "cross-client", + "title": "Canonical private media and prerelease decode-only alias interoperate", + "participants": ["android-current", "ios-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["wire-type", "delivery-digests", "downgrade-decision"] + }, + { + "id": "XCL-006", + "category": "cross-client", + "title": "Golden vectors match across implementations", + "participants": ["android-current", "ios-current", "android-legacy"], + "required": true, + "capabilities": [], + "evidence": ["vector-manifest-digest", "comparison-counts"] + }, + { + "id": "XCL-007", + "category": "cross-client", + "title": "Malformed and unauthenticated inputs are rejected consistently", + "participants": ["android-current", "ios-current", "android-legacy"], + "required": true, + "capabilities": [], + "evidence": ["corpus-digest", "rejection-counts", "crash-count"] + }, + { + "id": "XCL-008", + "category": "cross-client", + "title": "Nostr fallback messages and receipts interoperate", + "participants": ["android-current", "ios-current"], + "required": true, + "capabilities": ["local-relay", "tor"], + "evidence": ["relay-fixture", "event-id-count", "receipt-counts"] + }, + { + "id": "END-001", + "category": "endurance", + "title": "Multi-hour discovery, connect, and disconnect soak", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "minimum_duration_minutes": 240, + "evidence": ["duration-minutes", "connection-counts", "failure-counts"] + }, + { + "id": "END-002", + "category": "endurance", + "title": "Repeated large-transfer and cancellation cycles", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "minimum_cycles": 50, + "evidence": ["cycle-count", "delivery-counts", "cancellation-counts"] + }, + { + "id": "END-003", + "category": "endurance", + "title": "Resource growth remains bounded", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["memory-samples", "thread-samples", "fd-samples", "wakelock-samples", "battery-samples"] + }, + { + "id": "END-004", + "category": "endurance", + "title": "Foreground service survives with screens off", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["service-state", "screen-state", "delivery-counts"] + }, + { + "id": "END-005", + "category": "endurance", + "title": "Nostr survives network and Tor availability changes", + "participants": ["android-current"], + "required": true, + "capabilities": ["local-relay", "tor"], + "evidence": ["network-transitions", "tor-transitions", "receipt-counts"] + }, + { + "id": "END-006", + "category": "endurance", + "title": "Shutdown releases radios, sockets, jobs, and wake locks", + "participants": ["android-low", "android-current"], + "required": true, + "capabilities": ["ble-central", "ble-peripheral"], + "evidence": ["resource-terminal-state", "late-callback-count"] + } + ] +} diff --git a/tools/release_gate/test_release_gate.py b/tools/release_gate/test_release_gate.py new file mode 100644 index 00000000..3ca39ac8 --- /dev/null +++ b/tools/release_gate/test_release_gate.py @@ -0,0 +1,367 @@ +import json +import subprocess +import tempfile +import unittest +import zipfile +from pathlib import Path +from unittest import mock + +from tools.release_gate import android_lab +from tools.release_gate.release_gate import ( + GateError, + append_trace_event, + canonical_json_digest, + create_bundle, + initialize_run, + load_json, + parse_evidence, + record_result, + validate_manifest, + validate_matrix, + validate_privacy, + validate_run, +) + + +COMMIT = "1" * 40 +TOOL_DIRECTORY = Path(__file__).parent + + +def valid_matrix(): + return { + "schema_version": 1, + "commit": COMMIT, + "clients": { + "android-current": {"version": "2.0.0-rc1", "commit": COMMIT}, + "android-legacy": {"version": "1.9.0"}, + "ios-current": {"version": "2.0.0"}, + }, + "lab_capabilities": ["local-relay", "tor"], + "devices": [ + { + "alias": "android-low", + "platform": "android", + "model": "model-low", + "manufacturer_class": "vendor-a", + "api_level": 28, + "physical": True, + "capabilities": ["ble-central", "ble-peripheral"], + }, + { + "alias": "android-current", + "platform": "android", + "model": "model-current", + "manufacturer_class": "vendor-b", + "api_level": 35, + "physical": True, + "capabilities": ["ble-central", "ble-peripheral", "wifi-aware"], + }, + { + "alias": "android-relay", + "platform": "android", + "model": "model-relay", + "manufacturer_class": "vendor-c", + "api_level": 33, + "physical": True, + "capabilities": ["ble-central", "ble-peripheral"], + }, + { + "alias": "android-aware", + "platform": "android", + "model": "model-aware", + "manufacturer_class": "vendor-b", + "api_level": 35, + "physical": True, + "capabilities": ["ble-central", "ble-peripheral", "wifi-aware"], + }, + { + "alias": "android-legacy", + "platform": "android", + "model": "model-legacy", + "manufacturer_class": "vendor-a", + "api_level": 28, + "physical": True, + "capabilities": ["ble-central", "ble-peripheral"], + }, + { + "alias": "ios-current", + "platform": "ios", + "model": "ios-model", + "manufacturer_class": "apple", + "physical": True, + "capabilities": ["ble-central", "ble-peripheral"], + }, + ], + } + + +class ReleaseGateTest(unittest.TestCase): + def setUp(self): + self.manifest = load_json(TOOL_DIRECTORY / "scenarios.json") + + def test_manifest_covers_every_release_category(self): + scenarios = validate_manifest(self.manifest) + self.assertEqual(27, len(scenarios)) + self.assertEqual( + { + "transport", + "android-platform", + "android-to-android", + "cross-client", + "endurance", + }, + {scenario["category"] for scenario in scenarios.values()}, + ) + + def test_documented_matrix_template_is_schema_valid_but_not_runnable(self): + template = load_json(TOOL_DIRECTORY / "device-matrix.example.json") + self.assertEqual(6, len(validate_matrix(template, allow_placeholders=True))) + with self.assertRaises(GateError): + validate_matrix(template) + + def test_matrix_enforces_distinct_api_manufacturer_and_counterpart_clients(self): + matrix = valid_matrix() + self.assertEqual(6, len(validate_matrix(matrix, COMMIT))) + + for device in matrix["devices"]: + if device["platform"] == "android": + device["manufacturer_class"] = "one-vendor" + with self.assertRaisesRegex(GateError, "manufacturer"): + validate_matrix(matrix, COMMIT) + + def test_privacy_policy_rejects_identifiers_paths_addresses_and_long_ids(self): + rejected = ( + {"serial": "device-selector"}, + {"note": "/" + "home/operator/result"}, + {"note": "operator@example.test"}, + {"note": "192.0.2.1"}, + {"note": "aa:bb:cc:dd:ee:ff"}, + {"note": "0123456789abcdef"}, + ) + for value in rejected: + with self.subTest(value=value), self.assertRaises(GateError): + validate_privacy(value) + validate_privacy({"commit": COMMIT, "packet-correlation-count": 3}) + + def test_initialize_creates_disposable_fixtures_and_pending_results(self): + with tempfile.TemporaryDirectory() as temporary: + run = Path(temporary) / "rc-run" + results = initialize_run( + self.manifest, + valid_matrix(), + run, + COMMIT, + "rc-run", + started_at="2026-01-01T00:00:00+00:00", + ) + self.assertTrue(all( + result["status"] == "pending" + for result in results["scenario_results"].values() + )) + fixtures = load_json(run / "fixtures" / "manifest.json")["fixtures"] + sizes = {fixture["name"]: fixture["size_bytes"] for fixture in fixtures} + self.assertEqual(0, sizes["empty.bin"]) + self.assertEqual(50 * 1024 * 1024, sizes["maximum.bin"]) + self.assertEqual(50 * 1024 * 1024 + 1, sizes["oversized.bin"]) + self.assertEqual( + results["scenario_manifest_sha256"], + canonical_json_digest(self.manifest), + ) + summary = validate_run(run, allow_incomplete=True) + self.assertEqual(27, summary["pending"]) + self.assertFalse(summary["complete"]) + + def test_record_requires_structured_evidence_and_rejects_pii(self): + with tempfile.TemporaryDirectory() as temporary: + run = Path(temporary) / "rc-run" + initialize_run(self.manifest, valid_matrix(), run, COMMIT, "rc-run") + with self.assertRaises(GateError): + record_result(run, "A2A-001", "pass", {}, None) + with self.assertRaises(GateError): + record_result( + run, + "A2A-001", + "pass", + {"connection-transitions": "operator@example.test"}, + None, + ) + with self.assertRaisesRegex(GateError, "reason code"): + record_result(run, "A2A-001", "fail", {}, None) + recorded = record_result( + run, + "A2A-001", + "blocked", + {}, + "counterpart-unavailable", + updated_at="2026-01-01T00:00:00+00:00", + ) + self.assertEqual( + ["blocked"], + [ + item["status"] + for item in recorded["scenario_results"]["A2A-001"]["history"] + ], + ) + + def test_complete_run_requires_all_evidence_traces_and_endurance_bounds(self): + with tempfile.TemporaryDirectory() as temporary: + run = Path(temporary) / "rc-run" + initialize_run(self.manifest, valid_matrix(), run, COMMIT, "rc-run") + scenarios = validate_manifest(self.manifest) + for scenario_id, scenario in scenarios.items(): + evidence = {key: 1 for key in scenario["evidence"]} + if "duration-minutes" in evidence: + evidence["duration-minutes"] = 240 + if "cycle-count" in evidence: + evidence["cycle-count"] = 50 + record_result( + run, + scenario_id, + "pass", + evidence, + None, + updated_at="2026-01-01T04:00:00+00:00", + ) + append_trace_event( + run, + scenario_id, + scenario["participants"][0], + "scenario-terminal", + "pass", + None, + {"assertion-count": len(evidence)}, + timestamp="2026-01-01T04:00:00+00:00", + ) + summary = validate_run(run) + self.assertTrue(summary["complete"]) + self.assertEqual(27, summary["pass"]) + self.assertEqual(27, summary["trace_events"]) + + bundle = Path(temporary) / "release-gate.zip" + create_bundle(run, bundle) + with zipfile.ZipFile(bundle) as archive: + self.assertEqual( + { + "SHA256SUMS", + "fixtures/manifest.json", + "manifest.json", + "matrix.json", + "results.json", + "summary.md", + "trace.jsonl", + }, + set(archive.namelist()), + ) + with self.assertRaisesRegex(GateError, "overwrite"): + create_bundle(run, bundle) + + def test_manifest_tampering_after_initialization_is_detected(self): + with tempfile.TemporaryDirectory() as temporary: + run = Path(temporary) / "rc-run" + initialize_run(self.manifest, valid_matrix(), run, COMMIT, "rc-run") + manifest = load_json(run / "manifest.json") + manifest["scenario_version"] = "tampered" + (run / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8") + with self.assertRaisesRegex(GateError, "changed"): + validate_run(run, allow_incomplete=True) + + def test_trace_accepts_only_aggregate_metrics(self): + with tempfile.TemporaryDirectory() as temporary: + run = Path(temporary) / "rc-run" + initialize_run(self.manifest, valid_matrix(), run, COMMIT, "rc-run") + with self.assertRaisesRegex(GateError, "numeric"): + append_trace_event( + run, + "A2A-001", + "android-current", + "packet", + "observed", + None, + {"raw-packet": "payload"}, + ) + + def test_evidence_parser_is_typed_and_privacy_checked(self): + self.assertEqual( + {"count": 3, "ratio": 0.5, "clean": True}, + parse_evidence(["count=3", "ratio=0.5", "clean=true"]), + ) + with self.assertRaises(GateError): + parse_evidence(["note=10.0.0.1"]) + + @mock.patch("tools.release_gate.android_lab.find_adb", return_value="adb") + def test_adb_device_count_never_returns_selectors(self, _find_adb): + completed = subprocess.CompletedProcess( + ["adb", "devices"], + 0, + "List of devices attached\nselector-one\tdevice\nselector-two\toffline\n", + "", + ) + count = android_lab.count_connected_devices(runner=lambda *args, **kwargs: completed) + self.assertEqual(1, count) + + @mock.patch("tools.release_gate.android_lab.run_adb") + def test_adb_probe_emits_only_logical_device_metadata(self, run_adb): + run_adb.side_effect = [ + "35", + "feature:android.hardware.wifi.aware", + "Vendor", + "Model", + ] + probe = android_lab.probe_device("ephemeral-selector", "android-current") + self.assertEqual("android-current", probe["alias"]) + self.assertNotIn("serial", probe) + self.assertIn("wifi-aware", probe["capabilities"]) + + @mock.patch("tools.release_gate.android_lab.run_adb") + def test_disposable_cleanup_targets_the_real_application_id(self, run_adb): + run_adb.side_effect = ["", "Success"] + + android_lab.prepare_disposable_device("ephemeral-selector", confirmed=True) + + self.assertEqual( + [ + mock.call( + "ephemeral-selector", + ["shell", "am", "force-stop", "com.bitchat.droid"], + ), + mock.call( + "ephemeral-selector", + ["shell", "pm", "clear", "com.bitchat.droid"], + ), + ], + run_adb.call_args_list, + ) + + @mock.patch("tools.release_gate.android_lab.run_adb") + def test_resource_snapshot_returns_only_aggregate_metrics(self, run_adb): + run_adb.side_effect = [ + "123", + "TOTAL 2048", + "7", + "11", + "WakeLock com.bitchat.droid\nWakeLock another.package", + "level: 73", + ] + metrics = android_lab.collect_resource_snapshot("ephemeral-selector") + self.assertEqual( + { + "process-running": True, + "total-pss-kb": 2048, + "thread-count": 7, + "fd-count": 11, + "app-wakelock-count": 1, + "battery-level-percent": 73, + }, + metrics, + ) + self.assertEqual( + mock.call( + "ephemeral-selector", + ["shell", "pidof", "com.bitchat.droid"], + ), + run_adb.call_args_list[0], + ) + + +if __name__ == "__main__": + unittest.main()