From a0b7985cbee6a8d0797f3a018a280dd14839cf95 Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Wed, 29 Jul 2026 19:19:13 +0100 Subject: [PATCH 01/23] Link layer slice 2: cohere link-auth state and split bindings from the physical store (#1540) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Cohere per-link Noise auth and rebind containment into BLELinkAuthState The authenticated-link owners, the reconnect revalidation policy, and the two rebind-containment cooldowns were four loose bleQueue-owned maps whose invariants lived in call-site discipline: every teardown path had to remember to retire the proof AND close the revalidation epoch (the pair appeared seven times), and both cooldowns hand-rolled the same prune-check-record dance. BLELinkAuthState owns them as whole transitions — retireLink, retireLinks(ownedBy:), permitRebind, permitRedundantRetirement — with the ownership question (bleQueue today, engine after the option-B flip) answered in one place. No behavior change; the one call-site reordering (redundant retirement computes the survivor before the cooldown check instead of after) is outcome-equivalent since the cooldown only ever recorded when a survivor existed. Co-Authored-By: Claude Fable 5 * Split identity-link bindings out of the physical link store BLELinkStateStore owned two different kinds of truth: what physical links exist (CB handles, connect lifecycles, characteristics, stream assemblers) and who each link belongs to (peer bindings in both roles plus the preferred-peripheral reverse map for directed sends and fanout collapse). The bindings now live on BLELinkBindings — same bleQueue ownership, whole-transition methods, direct tests for the rotation reverse-map cleanup and the preferred-link survivor repair that were previously only exercised end to end. Composed operations that need both truths (remove-with-repair, direct link state, the subscribed- central snapshot, bind-only-live-links) live on the transport as explicitly bleQueue-confined helpers. This is the structural half of the option-B boundary flip (docs/BLE-ARCHITECTURE-V3.md): ownership of the bindings can now move to the engine without touching what-links-exist. An audit of every physical clear/remove found three sites (emergency clear, both unauthorized branches) that needed explicit binding-clear pairing under the split — each now clears both. Co-Authored-By: Claude Fable 5 * Fix iOS-gated constructors and preserve containment cooldowns on reset CI caught what the macOS SwiftPM build cannot see: two #if os(iOS) sites still passed the peerID field that slice B1 removed from BLEPeripheralLinkState (willRestoreState in BLEService and armPendingBackgroundConnects in BLERadioController). Both fixed and verified with a local iOS simulator xcodebuild. Codex also caught a real regression: BLELinkAuthState.removeAll() cleared the rebind/retirement cooldown maps, which the original panic and emergency reset paths deliberately left alive. A stable CoreBluetooth UUID must not earn a fresh rebind allowance just because the session state around it was wiped. removeAll() now clears only the proofs and revalidation epochs, and BLELinkAuthStateTests pins the survival invariant along with the other auth-state transitions. Co-Authored-By: Claude Fable 5 --------- Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchat/Services/BLE/BLELinkAuthState.swift | 115 ++++++++ bitchat/Services/BLE/BLELinkBindings.swift | 149 ++++++++++ bitchat/Services/BLE/BLELinkStateStore.swift | 135 ++------- bitchat/Services/BLE/BLERadioController.swift | 1 - bitchat/Services/BLE/BLEService.swift | 265 ++++++++++-------- .../Services/BLELinkAuthStateTests.swift | 75 +++++ .../Services/BLELinkBindingsTests.swift | 111 ++++++++ .../Services/BLELinkStateStoreTests.swift | 46 --- 8 files changed, 607 insertions(+), 290 deletions(-) create mode 100644 bitchat/Services/BLE/BLELinkAuthState.swift create mode 100644 bitchat/Services/BLE/BLELinkBindings.swift create mode 100644 bitchatTests/Services/BLELinkAuthStateTests.swift create mode 100644 bitchatTests/Services/BLELinkBindingsTests.swift delete mode 100644 bitchatTests/Services/BLELinkStateStoreTests.swift diff --git a/bitchat/Services/BLE/BLELinkAuthState.swift b/bitchat/Services/BLE/BLELinkAuthState.swift new file mode 100644 index 00000000..ce31e350 --- /dev/null +++ b/bitchat/Services/BLE/BLELinkAuthState.swift @@ -0,0 +1,115 @@ +import BitFoundation +import Foundation + +/// Per-link Noise authentication and rebind-containment state. +/// +/// A peer ID can retain an established Noise session after its physical +/// link disappears, and link bindings heal on announces whose directness +/// is forgeable (TTL is unsigned). This state pins the stronger facts the +/// containment rules need: which exact ingress link a Noise handshake +/// completed on, each link's revalidation epoch, and the cooldowns that +/// stop a replayed announce from flip-flopping bindings or survivor +/// selection. +/// +/// bleQueue-confined today, alongside the link bindings it qualifies; +/// both move to the engine together in the option-B boundary flip +/// (docs/BLE-ARCHITECTURE-V3.md). +struct BLELinkAuthState { + private var authenticatedOwners: [BLEIngressLinkID: PeerID] = [:] + private var reconnectPolicy = BLENoiseReconnectPolicy() + // Entries older than the cooldown are pruned on each check. + private var lastRebindAt: [String: Date] = [:] + private var lastRedundantRetirementAt: [PeerID: Date] = [:] + + // MARK: - Authentication ownership + + /// Whether `peerID`'s Noise session was established on this exact link. + func isAuthenticated(_ link: BLEIngressLinkID, for peerID: PeerID) -> Bool { + authenticatedOwners[link] == peerID + } + + func links(ownedBy peerID: PeerID) -> [BLEIngressLinkID] { + authenticatedOwners.compactMap { link, owner in + owner == peerID ? link : nil + } + } + + mutating func markAuthenticated(_ link: BLEIngressLinkID, owner peerID: PeerID) { + authenticatedOwners[link] = peerID + } + + /// Retires a link's proof and closes its revalidation epoch — the pair + /// every teardown path (disconnect, unsubscribe, timeout, rebind, + /// redundant retirement) must apply together. + mutating func retireLink(_ link: BLEIngressLinkID) { + authenticatedOwners.removeValue(forKey: link) + reconnectPolicy.endLinkEpoch(link) + } + + /// Retires every link the departing peer's proofs still own; returns + /// the retired links. + mutating func retireLinks(ownedBy peerID: PeerID) -> [BLEIngressLinkID] { + let departed = links(ownedBy: peerID) + for link in departed { + retireLink(link) + } + return departed + } + + /// Drops every link proof and revalidation epoch. The containment + /// cooldowns deliberately SURVIVE this: panic and emergency resets can + /// restart services well inside `bleLinkRebindCooldownSeconds`, and a + /// stable CoreBluetooth UUID must not get a fresh rebind/retirement + /// allowance just because the session state around it was wiped. The + /// maps stay time-pruned on each permit check. + mutating func removeAll() { + authenticatedOwners.removeAll() + reconnectPolicy.removeAll() + } + + // MARK: - Session revalidation + + /// Whether a fresh direct link warrants revalidating a cached + /// peer-level session with a new XX exchange. + mutating func shouldRevalidate( + on link: BLEIngressLinkID, + for peerID: PeerID, + hasEstablishedSession: Bool, + hasAuthenticatedPeerLink: Bool, + now: Date + ) -> Bool { + reconnectPolicy.shouldRevalidate( + on: link, + hasEstablishedSession: hasEstablishedSession, + isNoiseAuthenticatedLink: isAuthenticated(link, for: peerID), + hasAuthenticatedPeerLink: hasAuthenticatedPeerLink, + now: now + ) + } + + // MARK: - Rebind containment cooldowns + + /// At most one rotation rebind per link per cooldown window, so two + /// identities can't fight over a link in a replay flip-flop. Prunes, + /// checks, and records in one transition; true = permitted (recorded). + mutating func permitRebind(linkUUID: String, now: Date, cooldown: TimeInterval) -> Bool { + lastRebindAt = lastRebindAt.filter { + now.timeIntervalSince($0.value) < cooldown + } + guard lastRebindAt[linkUUID] == nil else { return false } + lastRebindAt[linkUUID] = now + return true + } + + /// At most one redundant-link retirement per peer per cooldown window, + /// bounding how often a replayed announce could flip which duplicate + /// link survives. True = permitted (recorded). + mutating func permitRedundantRetirement(peerID: PeerID, now: Date, cooldown: TimeInterval) -> Bool { + lastRedundantRetirementAt = lastRedundantRetirementAt.filter { + now.timeIntervalSince($0.value) < cooldown + } + guard lastRedundantRetirementAt[peerID] == nil else { return false } + lastRedundantRetirementAt[peerID] = now + return true + } +} diff --git a/bitchat/Services/BLE/BLELinkBindings.swift b/bitchat/Services/BLE/BLELinkBindings.swift new file mode 100644 index 00000000..d4c5342c --- /dev/null +++ b/bitchat/Services/BLE/BLELinkBindings.swift @@ -0,0 +1,149 @@ +import BitFoundation +import Foundation + +/// Identity↔link bindings: which peer each physical link currently +/// belongs to, in both roles, plus each peer's preferred peripheral link +/// for directed sends and fanout collapse. +/// +/// Split from the physical link-state store so the option-B boundary flip +/// (docs/BLE-ARCHITECTURE-V3.md) can move ownership of *who owns a link* +/// to the engine without touching *what links exist*. bleQueue-confined +/// today, alongside the physical store and `BLELinkAuthState`. +/// +/// Lifecycle contract: bindings are only created for live physical links +/// (callers guard existence) and are retired through +/// `peripheralRemoved`/`centralRemoved`/`clear*` when the physical link +/// goes, so binding queries never see departed links. +struct BLELinkBindings { + private var peripheralPeers: [String: PeerID] = [:] + private var centralPeers: [String: PeerID] = [:] + /// The peer's most recently bound peripheral link, kept so duplicate- + /// link fanout collapse stays deterministic (see BLEFanoutSelector). + private var preferredPeripheral: [PeerID: String] = [:] + + // MARK: - Queries + + func peer(forPeripheralID peripheralID: String) -> PeerID? { + peripheralPeers[peripheralID] + } + + func peer(forCentralUUID centralUUID: String) -> PeerID? { + centralPeers[centralUUID] + } + + func boundPeer(for link: BLEIngressLinkID) -> PeerID? { + switch link { + case .peripheral(let peripheralUUID): + return peripheralPeers[peripheralUUID] + case .central(let centralUUID): + return centralPeers[centralUUID] + } + } + + /// Every link bound to the peer, both roles. After a state restoration + /// the same device can hold several live peripheral links bound to one + /// peer (it reappears under a fresh UUID while the restored connection + /// lives on), so this scans all bindings rather than the 1:1 preferred + /// map. + func links(to peerID: PeerID?) -> Set { + guard let peerID else { return [] } + var links: Set = [] + for (peripheralUUID, boundPeer) in peripheralPeers where boundPeer == peerID { + links.insert(.peripheral(peripheralUUID)) + } + for (centralUUID, boundPeer) in centralPeers where boundPeer == peerID { + links.insert(.central(centralUUID)) + } + return links + } + + func hasCentral(boundTo peerID: PeerID) -> Bool { + centralPeers.values.contains(peerID) + } + + func preferredPeripheralUUID(for peerID: PeerID) -> String? { + preferredPeripheral[peerID] + } + + /// The full preferred-peripheral map, for fanout collapse. + var preferredPeripheralBindings: [PeerID: String] { + preferredPeripheral + } + + /// The full central binding map, for the subscribed-central snapshot. + var centralPeersByUUID: [String: PeerID] { + centralPeers + } + + // MARK: - Binding transitions + + mutating func bindCentral(_ centralUUID: String, to peerID: PeerID) { + centralPeers[centralUUID] = peerID + } + + mutating func bindPeripheral(_ peripheralUUID: String, to peerID: PeerID) { + let previousPeerID = peripheralPeers[peripheralUUID] + peripheralPeers[peripheralUUID] = peerID + // Rebinding (peer-ID rotation): drop the retired ID's reverse + // mapping so the old peer no longer claims this link. + if let previousPeerID, previousPeerID != peerID, + preferredPeripheral[previousPeerID] == peripheralUUID { + preferredPeripheral.removeValue(forKey: previousPeerID) + } + preferredPeripheral[peerID] = peripheralUUID + } + + /// Retires a peripheral link's binding. When the removed link was the + /// peer's preferred one, the reverse map is repaired onto a surviving + /// duplicate chosen by the caller from the peer's remaining bound links + /// (the caller knows physical liveness; prefer a writable survivor — + /// repairing onto a link mid-service-rediscovery would strand directed + /// sends until its characteristic comes back). + mutating func peripheralRemoved( + _ peripheralUUID: String, + chooseSurvivor: (_ remainingBoundUUIDs: [String]) -> String? + ) -> PeerID? { + guard let peerID = peripheralPeers.removeValue(forKey: peripheralUUID) else { + return nil + } + // Only clear (or repair) the reverse map when it points at the + // removed link: with duplicate links to one peer, removing a stale + // duplicate must not strand the peer's surviving bound link. + if preferredPeripheral[peerID] == peripheralUUID { + let remaining = peripheralPeers.compactMap { uuid, boundPeer in + boundPeer == peerID ? uuid : nil + } + if let survivorUUID = chooseSurvivor(remaining) { + preferredPeripheral[peerID] = survivorUUID + } else { + preferredPeripheral.removeValue(forKey: peerID) + } + } + return peerID + } + + mutating func centralRemoved(_ centralUUID: String) -> PeerID? { + centralPeers.removeValue(forKey: centralUUID) + } + + /// Drops every peripheral binding; returns the peers that held one. + mutating func clearPeripherals() -> [PeerID] { + let peerIDs = Array(peripheralPeers.values) + peripheralPeers.removeAll() + preferredPeripheral.removeAll() + return peerIDs + } + + /// Drops every central binding; returns the peers that held one. + mutating func clearCentrals() -> [PeerID] { + let peerIDs = Array(centralPeers.values) + centralPeers.removeAll() + return peerIDs + } + + mutating func removeAll() { + peripheralPeers.removeAll() + centralPeers.removeAll() + preferredPeripheral.removeAll() + } +} diff --git a/bitchat/Services/BLE/BLELinkStateStore.swift b/bitchat/Services/BLE/BLELinkStateStore.swift index 31914092..ebf39114 100644 --- a/bitchat/Services/BLE/BLELinkStateStore.swift +++ b/bitchat/Services/BLE/BLELinkStateStore.swift @@ -5,7 +5,6 @@ import Foundation struct BLEPeripheralLinkState { let peripheral: CBPeripheral var characteristic: CBCharacteristic? - var peerID: PeerID? var isConnecting: Bool var isConnected: Bool var lastConnectionAttempt: Date? @@ -26,17 +25,20 @@ struct BLESubscribedCentralSnapshot { } } -/// Owns all BLE link state (peripheral connections we hold as central, and -/// central subscriptions we serve as peripheral). The store has no internal -/// locking: every access must happen on the single owning queue (the BLE -/// queue). Other queues must go through BLEService's `readLinkState`, which -/// hops to that queue. Call `assumeOwnership(of:)` to have debug builds trap -/// any access from the wrong queue. +// BLEDirectLinkState and the identity↔link binding queries live on +// BLELinkBindings; this store owns only physical link state. + +/// Owns the PHYSICAL BLE link state (peripheral connections we hold as +/// central, and central subscriptions we serve as peripheral) — CB object +/// handles, connect lifecycles, characteristics, and stream assemblers. +/// Identity↔link bindings live on `BLELinkBindings`. The store has no +/// internal locking: every access must happen on the single owning queue +/// (the BLE queue). Other queues must go through BLEService's +/// `readLinkState`, which hops to that queue. Call `assumeOwnership(of:)` +/// to have debug builds trap any access from the wrong queue. final class BLELinkStateStore { private(set) var peripherals: [String: BLEPeripheralLinkState] = [:] - private(set) var peerToPeripheralUUID: [PeerID: String] = [:] private(set) var subscribedCentrals: [CBCentral] = [] - private(set) var centralToPeerID: [String: PeerID] = [:] #if DEBUG private var ownerQueue: DispatchQueue? @@ -64,14 +66,6 @@ final class BLELinkStateStore { return Array(peripherals.values) } - var subscribedCentralSnapshot: BLESubscribedCentralSnapshot { - assertOwned() - return BLESubscribedCentralSnapshot( - centrals: subscribedCentrals, - peerIDsByCentralUUID: centralToPeerID - ) - } - var subscribedCentralCount: Int { assertOwned() return subscribedCentrals.count @@ -109,7 +103,6 @@ final class BLELinkStateStore { BLEPeripheralLinkState( peripheral: peripheral, characteristic: nil, - peerID: nil, isConnecting: true, isConnected: false, lastConnectionAttempt: date, @@ -129,7 +122,6 @@ final class BLELinkStateStore { BLEPeripheralLinkState( peripheral: peripheral, characteristic: nil, - peerID: nil, isConnecting: false, isConnected: true, lastConnectionAttempt: nil, @@ -146,130 +138,35 @@ final class BLELinkStateStore { } } - func directPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? { - assertOwned() - return peerToPeripheralUUID[peerID].flatMap { peripherals[$0] } - } - - func directLinkState(for peerID: PeerID) -> BLEDirectLinkState { - assertOwned() - let peripheralUUID = peerToPeripheralUUID[peerID] - let hasPeripheral = peripheralUUID.flatMap { peripherals[$0]?.isConnected } ?? false - let hasCentral = centralToPeerID.values.contains(peerID) - return BLEDirectLinkState(hasPeripheral: hasPeripheral, hasCentral: hasCentral) - } - - func links(to peerID: PeerID?) -> Set { - assertOwned() - guard let peerID else { return [] } - - var links: Set = [] - // Scan all states rather than the 1:1 reverse map: after a state - // restoration the same device can hold several live peripheral links - // bound to one peer (it reappears under a fresh UUID while the - // restored connection lives on). - for (peripheralUUID, state) in peripherals where state.peerID == peerID { - links.insert(.peripheral(peripheralUUID)) - } - for (centralUUID, mappedPeerID) in centralToPeerID where mappedPeerID == peerID { - links.insert(.central(centralUUID)) - } - return links - } - - /// The peer's most recently bound peripheral link, per peer. Used to keep - /// duplicate-link fanout collapse deterministic (see BLEFanoutSelector). - var preferredPeripheralBindings: [PeerID: String] { - assertOwned() - return peerToPeripheralUUID - } - - func peerID(forPeripheralID peripheralID: String) -> PeerID? { - assertOwned() - return peripherals[peripheralID]?.peerID - } - - func peerID(forCentralUUID centralUUID: String) -> PeerID? { - assertOwned() - return centralToPeerID[centralUUID] - } - func addSubscribedCentral(_ central: CBCentral) { assertOwned() guard !subscribedCentrals.contains(central) else { return } subscribedCentrals.append(central) } - func removeSubscribedCentral(_ central: CBCentral) -> PeerID? { + func removeSubscribedCentral(_ central: CBCentral) { assertOwned() - let centralUUID = central.identifier.uuidString subscribedCentrals.removeAll { $0.identifier == central.identifier } - return centralToPeerID.removeValue(forKey: centralUUID) } - func bindCentral(_ centralUUID: String, to peerID: PeerID) { + func removePeripheral(_ peripheralID: String) { assertOwned() - centralToPeerID[centralUUID] = peerID + peripherals.removeValue(forKey: peripheralID) } - func bindPeripheral(_ peripheralUUID: String, to peerID: PeerID) { + func clearPeripherals() { assertOwned() - var previousPeerID: PeerID? - let updated = updatePeripheral(peripheralUUID) { - previousPeerID = $0.peerID - $0.peerID = peerID - } - guard updated != nil else { return } - // Rebinding (peer-ID rotation): drop the retired ID's reverse mapping - // so the old peer no longer claims this link. - if let previousPeerID, previousPeerID != peerID, - peerToPeripheralUUID[previousPeerID] == peripheralUUID { - peerToPeripheralUUID.removeValue(forKey: previousPeerID) - } - peerToPeripheralUUID[peerID] = peripheralUUID - } - - func removePeripheral(_ peripheralID: String) -> PeerID? { - assertOwned() - let peerID = peripherals.removeValue(forKey: peripheralID)?.peerID - // Only clear (or repair) the reverse map when it points at the removed - // link: with duplicate links to one peer, removing a stale duplicate - // must not strand the peer's surviving bound link. - if let peerID, peerToPeripheralUUID[peerID] == peripheralID { - // Prefer a writable survivor: repairing onto a link that is - // mid-service-rediscovery would strand directed sends until the - // characteristic comes back. - let survivors = peripherals.filter { $0.value.peerID == peerID && $0.value.isConnected } - if let survivorUUID = survivors.first(where: { $0.value.characteristic != nil })?.key ?? survivors.first?.key { - peerToPeripheralUUID[peerID] = survivorUUID - } else { - peerToPeripheralUUID.removeValue(forKey: peerID) - } - } - return peerID - } - - func clearPeripherals() -> [PeerID] { - assertOwned() - let peerIDs = peripherals.compactMap { $0.value.peerID } peripherals.removeAll() - peerToPeripheralUUID.removeAll() - return peerIDs } - func clearCentrals() -> [PeerID] { + func clearCentrals() { assertOwned() - let peerIDs = Array(centralToPeerID.values) subscribedCentrals.removeAll() - centralToPeerID.removeAll() - return peerIDs } func clearAll() { assertOwned() peripherals.removeAll() - peerToPeripheralUUID.removeAll() subscribedCentrals.removeAll() - centralToPeerID.removeAll() } } diff --git a/bitchat/Services/BLE/BLERadioController.swift b/bitchat/Services/BLE/BLERadioController.swift index 8c7813e1..cf9d6c2d 100644 --- a/bitchat/Services/BLE/BLERadioController.swift +++ b/bitchat/Services/BLE/BLERadioController.swift @@ -337,7 +337,6 @@ final class BLERadioController { BLEPeripheralLinkState( peripheral: target.peripheral, characteristic: nil, - peerID: nil, isConnecting: true, isConnected: false, lastConnectionAttempt: nil, diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index 6b0dc932..5ad02cf9 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -206,20 +206,14 @@ final class BLEService: NSObject { // 1. Consolidated BLE link tracking for both central and peripheral roles. private var linkStateStore = BLELinkStateStore() - // A peer ID can retain an established Noise session after its physical - // link disappears. Courier handover therefore needs the stronger fact - // that the session was established *on this current ingress link*, not - // merely that some session exists for the claimed ID. bleQueue-owned. - private var noiseAuthenticatedLinkOwners: [BLEIngressLinkID: PeerID] = [:] - private var noiseReconnectPolicy = BLENoiseReconnectPolicy() - - // Rotation-rebind cooldown per link UUID (bleQueue-owned, like the link - // store): entries older than the cooldown are pruned on insert. - private var lastLinkRebindAt: [String: Date] = [:] - - // Redundant-link retirement cooldown per peer (bleQueue-owned): bounds - // how often a replayed announce could flip which duplicate link survives. - private var lastRedundantLinkRetirementAt: [PeerID: Date] = [:] + // Per-link Noise authentication and rebind containment (bleQueue-owned, + // like the link store — courier handover needs the stronger fact that a + // session was established *on this current ingress link*, not merely + // that some session exists for the claimed ID). + private var linkAuth = BLELinkAuthState() + // Identity↔link bindings, split from the physical link store so the + // option-B flip can move ownership to the engine (bleQueue-owned). + private var linkBindings = BLELinkBindings() // BCH-01-004: Rate-limiting for subscription-triggered announces. private var subscriptionAnnounceLimiter = BLESubscriptionAnnounceLimiter() @@ -781,8 +775,7 @@ final class BLEService: NSObject { pendingPeripheralWrites.removeAll() pendingNotifications.removeAll() pendingWriteBuffers.removeAll() - noiseAuthenticatedLinkOwners.removeAll() - noiseReconnectPolicy.removeAll() + linkAuth.removeAll() radio.reset() } disconnectNotifyDebouncer.removeAll() @@ -1073,8 +1066,8 @@ final class BLEService: NSObject { // Clear peripheral references (synchronized access to avoid races with BLE callbacks) bleQueue.sync { linkStateStore.clearAll() - noiseAuthenticatedLinkOwners.removeAll() - noiseReconnectPolicy.removeAll() + linkBindings.removeAll() + linkAuth.removeAll() radio.reset() subscriptionAnnounceLimiter.removeAll() } @@ -2207,8 +2200,8 @@ final class BLEService: NSObject { if let peerID = requiredAuthenticatedPeer { eligible = centrals.filter { central in let link = BLEIngressLinkID.central(central.identifier.uuidString) - return noiseAuthenticatedLinkOwners[link] == peerID - && linkStateStore.peerID(forCentralUUID: central.identifier.uuidString) == peerID + return linkAuth.isAuthenticated(link, for: peerID) + && linkBindings.peer(forCentralUUID: central.identifier.uuidString) == peerID } } else { eligible = centrals @@ -2265,8 +2258,9 @@ final class BLEService: NSObject { let subscribedCentrals = characteristic == nil ? [] : centralSnapshot.centrals let connectedPeripheralIDs = connectedStates.map { $0.peripheral.identifier.uuidString } let centralIDs = subscribedCentrals.map { $0.identifier.uuidString } - let peripheralPeerBindings = Dictionary(uniqueKeysWithValues: connectedStates.compactMap { state in - state.peerID.map { (state.peripheral.identifier.uuidString, $0) } + let peripheralPeerBindings = Dictionary(uniqueKeysWithValues: connectedStates.compactMap { state -> (String, PeerID)? in + let uuid = state.peripheral.identifier.uuidString + return readLinkState { _ in linkBindings.peer(forPeripheralID: uuid) }.map { (uuid, $0) } }) let plan = BLEOutboundLinkPlanner.plan( packet: packet, @@ -2282,7 +2276,7 @@ final class BLEService: NSObject { // Perf note: this is a third bleQueue hop per send; if send-path // profiling ever flags it, fold it into snapshotPeripheralStates // as a combined snapshot. - preferredPeripheralPerPeer: readLinkState { $0.preferredPeripheralBindings }, + preferredPeripheralPerPeer: readLinkState { _ in linkBindings.preferredPeripheralBindings }, directAnnounceTTL: messageTTL, directedOnlyPeer: directedOnlyPeer, requireDirectPeerLink: requireDirectPeerLink || requireNoiseAuthenticatedPeerLink @@ -2703,13 +2697,7 @@ final class BLEService: NSObject { // canDeliverSecurely could remain true for a peer we just removed. clearNoiseSession(for: peerID) readLinkState { _ in - let departedLinks = noiseAuthenticatedLinkOwners.compactMap { link, owner in - owner == peerID ? link : nil - } - for link in departedLinks { - noiseAuthenticatedLinkOwners.removeValue(forKey: link) - noiseReconnectPolicy.endLinkEpoch(link) - } + _ = linkAuth.retireLinks(ownedBy: peerID) } // Remove the peer when they leave peerRegistry.mutate { _ = $0.remove(peerID) } @@ -2962,14 +2950,12 @@ extension BLEService: CBCentralManagerDelegate { let existing = linkStateStore.state(forPeripheralID: identifier) let assembler = existing?.assembler ?? NotificationStreamAssembler() let characteristic = existing?.characteristic - let peerID = existing?.peerID let wasConnecting = existing?.isConnecting ?? false let wasConnected = existing?.isConnected ?? false let restoredState = BLEPeripheralLinkState( peripheral: peripheral, characteristic: characteristic, - peerID: peerID, isConnecting: wasConnecting || peripheral.state == .connecting, isConnected: wasConnected || peripheral.state == .connected, lastConnectionAttempt: existing?.lastConnectionAttempt, @@ -3026,16 +3012,13 @@ extension BLEService: CBCentralManagerDelegate { // misuse. Retire our link state locally instead. SecureLogger.info("📴 Bluetooth powered off - cleaning up central state", category: .session) let peripheralStates = linkStateStore.peripheralStates - let peerIDs: [PeerID] = peripheralStates.compactMap(\.peerID) for state in peripheralStates { let peripheralID = state.peripheral.identifier.uuidString pendingPeripheralWrites.discardAll(for: peripheralID) - noiseAuthenticatedLinkOwners.removeValue( - forKey: .peripheral(peripheralID) - ) - noiseReconnectPolicy.endLinkEpoch(.peripheral(peripheralID)) + linkAuth.retireLink(.peripheral(peripheralID)) } - _ = linkStateStore.clearPeripherals() + linkStateStore.clearPeripherals() + let peerIDs = linkBindings.clearPeripherals() // Notify UI of disconnections for peerID in peerIDs { notifyUI { [weak self] in @@ -3046,7 +3029,8 @@ extension BLEService: CBCentralManagerDelegate { case .unauthorized: // User denied Bluetooth permission SecureLogger.warning("🚫 Bluetooth unauthorized - user denied permission", category: .session) - _ = linkStateStore.clearPeripherals() + linkStateStore.clearPeripherals() + _ = linkBindings.clearPeripherals() case .unsupported: // Device doesn't support BLE @@ -3101,7 +3085,7 @@ extension BLEService: CBCentralManagerDelegate { let peripheralID = peripheral.identifier.uuidString // Find the peer ID if we have it - let peerID = linkStateStore.peerID(forPeripheralID: peripheralID) + let peerID = linkBindings.peer(forPeripheralID: peripheralID) SecureLogger.debug("📱 Disconnect: \(peerID?.id ?? peripheralID)\(error != nil ? " (\(error!.localizedDescription))" : "")", category: .session) @@ -3139,7 +3123,7 @@ extension BLEService: CBCentralManagerDelegate { // here. The scan restart and connect-slot refill below stay // unguarded — they respond to the physical drop regardless of // remaining logical links. - let remainingLinks = peerID.map { linkStateStore.directLinkState(for: $0) } + let remainingLinks = peerID.map { directLinkState(for: $0) } let peerStillLinked = (remainingLinks?.hasPeripheral ?? false) || (remainingLinks?.hasCentral ?? false) if let peerID, !peerStillLinked { // Do not remove peer; mark as not connected but retain for reachability @@ -3211,13 +3195,62 @@ extension BLEService: BLERadioControllerDelegate { /// Retires one peripheral link's transport bookkeeping: its write /// backpressure, its Noise link proof and reconnect epoch, and the - /// link-state entry (which repairs the peer's reverse mapping onto a - /// surviving duplicate link). bleQueue-confined. + /// link-state entry plus binding (which repairs the peer's reverse + /// mapping onto a surviving duplicate link). bleQueue-confined. func tearDownPeripheralLink(_ peripheralID: String) { pendingPeripheralWrites.discardAll(for: peripheralID) - noiseAuthenticatedLinkOwners.removeValue(forKey: .peripheral(peripheralID)) - noiseReconnectPolicy.endLinkEpoch(.peripheral(peripheralID)) - _ = linkStateStore.removePeripheral(peripheralID) + linkAuth.retireLink(.peripheral(peripheralID)) + removePeripheralLink(peripheralID) + } + + /// Physical removal plus binding retirement, one unit: the preferred + /// link repairs onto a connected survivor, preferring a writable one + /// (a link mid-service-rediscovery would strand directed sends until + /// its characteristic comes back). bleQueue-confined. + @discardableResult + func removePeripheralLink(_ peripheralID: String) -> PeerID? { + linkStateStore.removePeripheral(peripheralID) + return linkBindings.peripheralRemoved(peripheralID) { remaining in + let alive = remaining.compactMap { uuid -> (uuid: String, writable: Bool)? in + guard let state = linkStateStore.state(forPeripheralID: uuid), + state.isConnected else { return nil } + return (uuid, state.characteristic != nil) + } + return (alive.first(where: \.writable) ?? alive.first)?.uuid + } + } + + /// Binds only live physical links, preserving the store-era guard that + /// a binding can never outlive (or precede) its link. bleQueue-confined. + func bindPeripheralLink(_ peripheralUUID: String, to peerID: PeerID) { + guard linkStateStore.state(forPeripheralID: peripheralUUID) != nil else { return } + linkBindings.bindPeripheral(peripheralUUID, to: peerID) + } + + /// Whether the peer holds a live direct link in either role. + /// bleQueue-confined (physical liveness + bindings in one view). + func directLinkState(for peerID: PeerID) -> BLEDirectLinkState { + let hasPeripheral = linkBindings.preferredPeripheralUUID(for: peerID) + .flatMap { linkStateStore.state(forPeripheralID: $0)?.isConnected } ?? false + return BLEDirectLinkState( + hasPeripheral: hasPeripheral, + hasCentral: linkBindings.hasCentral(boundTo: peerID) + ) + } + + /// The peer's preferred peripheral link state, when physically present. + /// bleQueue-confined. + func directPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? { + linkBindings.preferredPeripheralUUID(for: peerID) + .flatMap { linkStateStore.state(forPeripheralID: $0) } + } + + /// Subscribed centrals with their bindings, one view. bleQueue-confined. + func subscribedCentralSnapshot() -> BLESubscribedCentralSnapshot { + BLESubscribedCentralSnapshot( + centrals: linkStateStore.subscribedCentrals, + peerIDsByCentralUUID: linkBindings.centralPeersByUUID + ) } } @@ -3343,23 +3376,23 @@ extension BLEService { } func _test_bindCentral(_ centralUUID: String, to peerID: PeerID) { - bleQueue.sync { linkStateStore.bindCentral(centralUUID, to: peerID) } + bleQueue.sync { linkBindings.bindCentral(centralUUID, to: peerID) } } func _test_centralBinding(_ centralUUID: String) -> PeerID? { - bleQueue.sync { linkStateStore.peerID(forCentralUUID: centralUUID) } + bleQueue.sync { linkBindings.peer(forCentralUUID: centralUUID) } } func _test_markNoiseAuthenticatedCentral(_ centralUUID: String, to peerID: PeerID) { bleQueue.sync { - guard linkStateStore.peerID(forCentralUUID: centralUUID) == peerID else { return } - noiseAuthenticatedLinkOwners[.central(centralUUID)] = peerID + guard linkBindings.peer(forCentralUUID: centralUUID) == peerID else { return } + linkAuth.markAuthenticated(.central(centralUUID), owner: peerID) } } func _test_isNoiseAuthenticatedCentral(_ centralUUID: String, for peerID: PeerID) -> Bool { bleQueue.sync { - noiseAuthenticatedLinkOwners[.central(centralUUID)] == peerID + linkAuth.isAuthenticated(.central(centralUUID), for: peerID) } } @@ -3650,7 +3683,6 @@ extension BLEService: CBPeripheralDelegate { var state = linkStateStore.state(forPeripheralID: peripheralUUID) ?? BLEPeripheralLinkState( peripheral: peripheral, characteristic: nil, - peerID: nil, isConnecting: false, isConnected: peripheral.state == .connected, lastConnectionAttempt: nil, @@ -3675,7 +3707,7 @@ extension BLEService: CBPeripheralDelegate { // NOTE: `processNotificationPacket` may bind the stored peer ID when an announce // is processed, but `state` above is a snapshot. Track a local binding that we update as soon as // we see a binding-eligible announce so subsequent frames can't spoof a different sender. - var boundPeerID: PeerID? = state.peerID + var boundPeerID: PeerID? = linkBindings.peer(forPeripheralID: peripheralUUID) for frame in result.frames { guard let packet = BinaryProtocol.decode(frame) else { @@ -3699,8 +3731,7 @@ extension BLEService: CBPeripheralDelegate { packet.type == MessageType.announce.rawValue, packet.ttl == messageTTL { boundPeerID = claimedSenderID - state.peerID = claimedSenderID - linkStateStore.bindPeripheral(peripheralUUID, to: claimedSenderID) + bindPeripheralLink(peripheralUUID, to: claimedSenderID) } if !recordIngressIfNew(packet, link: .peripheral(peripheralUUID), peerID: context.receivedFromPeerID) { @@ -3728,9 +3759,9 @@ extension BLEService: CBPeripheralDelegate { // verification, so a bound link must not be re-bound by a raw // announce (spoofable). Rotation rebinds happen after the announce // verifies (rebindLinkAfterVerifiedDirectAnnounce). - let boundPeerID = linkStateStore.peerID(forPeripheralID: peripheralUUID) + let boundPeerID = linkBindings.peer(forPeripheralID: peripheralUUID) if boundPeerID == nil || boundPeerID == senderID { - linkStateStore.bindPeripheral(peripheralUUID, to: senderID) + bindPeripheralLink(peripheralUUID, to: senderID) refreshLocalTopology() } } @@ -3831,17 +3862,15 @@ extension BLEService: CBPeripheralManagerDelegate { // Bluetooth was turned off - clean up peripheral state SecureLogger.info("📴 Bluetooth powered off - cleaning up peripheral state", category: .session) // Clear subscribed centrals (they are now invalid) - let centralSnapshot = linkStateStore.subscribedCentralSnapshot + let centralSnapshot = subscribedCentralSnapshot() for central in centralSnapshot.centrals { let centralID = central.identifier.uuidString - noiseAuthenticatedLinkOwners.removeValue( - forKey: .central(centralID) - ) - noiseReconnectPolicy.endLinkEpoch(.central(centralID)) + linkAuth.retireLink(.central(centralID)) } pendingNotifications.removeAll() pendingWriteBuffers.removeAll() - let centralPeerIDs = linkStateStore.clearCentrals() + linkStateStore.clearCentrals() + let centralPeerIDs = linkBindings.clearCentrals() subscriptionAnnounceLimiter.removeAll() characteristic = nil // Notify UI of disconnections @@ -3854,7 +3883,8 @@ extension BLEService: CBPeripheralManagerDelegate { case .unauthorized: // User denied Bluetooth permission SecureLogger.warning("🚫 Bluetooth unauthorized for peripheral role", category: .session) - _ = linkStateStore.clearCentrals() + linkStateStore.clearCentrals() + _ = linkBindings.clearCentrals() subscriptionAnnounceLimiter.removeAll() characteristic = nil @@ -3963,9 +3993,9 @@ extension BLEService: CBPeripheralManagerDelegate { let centralID = central.identifier.uuidString SecureLogger.debug("📤 Central unsubscribed: \(centralID.prefix(8))…", category: .session) pendingNotifications.removeTarget { $0.identifier.uuidString == centralID } - noiseAuthenticatedLinkOwners.removeValue(forKey: .central(centralID)) - noiseReconnectPolicy.endLinkEpoch(.central(centralID)) - let removedPeerID = linkStateStore.removeSubscribedCentral(central) + linkAuth.retireLink(.central(centralID)) + linkStateStore.removeSubscribedCentral(central) + let removedPeerID = linkBindings.centralRemoved(centralID) // Ensure we're still advertising for other devices to find us if !isPanicSuspended, peripheral.isAdvertising == false { @@ -3981,7 +4011,7 @@ extension BLEService: CBPeripheralManagerDelegate { // counts. If every link truly dropped, the surviving-link // callbacks (didDisconnectPeripheral, or this one again) run // the bookkeeping. - guard linkStateStore.links(to: peerID).isEmpty else { return } + guard linkBindings.links(to: peerID).isEmpty else { return } // Mark peer as not connected; retain for reachability peerRegistry.mutate { $0.markDisconnected(peerID) } @@ -4124,7 +4154,7 @@ extension BLEService: CBPeripheralManagerDelegate { let context = acceptedIngressContext( for: packet, claimedSenderID: claimedSenderID, - boundPeerID: linkStateStore.peerID(forCentralUUID: centralUUID), + boundPeerID: linkBindings.peer(forCentralUUID: centralUUID), linkDescription: "Central \(centralUUID.prefix(8))…" ) guard let context else { return } @@ -4139,9 +4169,9 @@ extension BLEService: CBPeripheralManagerDelegate { packet.ttl == messageTTL { // Same rule as the peripheral path: raw announces only bind // unbound links; rotation rebinds require a verified announce. - let boundPeerID = linkStateStore.peerID(forCentralUUID: centralUUID) + let boundPeerID = linkBindings.peer(forCentralUUID: centralUUID) if boundPeerID == nil || boundPeerID == claimedSenderID { - linkStateStore.bindCentral(centralUUID, to: claimedSenderID) + linkBindings.bindCentral(centralUUID, to: claimedSenderID) refreshLocalTopology() } } @@ -4683,22 +4713,15 @@ extension BLEService { /// Safely fetch the current direct-link state for a peer using the BLE queue. private func linkState(for peerID: PeerID) -> (hasPeripheral: Bool, hasCentral: Bool) { - let state = readLinkState { $0.directLinkState(for: peerID) } + let state = readLinkState { _ in directLinkState(for: peerID) } return (state.hasPeripheral, state.hasCentral) } private func links(to peerID: PeerID?) -> Set { - readLinkState { $0.links(to: peerID) } + readLinkState { _ in linkBindings.links(to: peerID) } } - private func boundPeerID(for link: BLEIngressLinkID, in store: BLELinkStateStore) -> PeerID? { - switch link { - case .peripheral(let peripheralUUID): - store.peerID(forPeripheralID: peripheralUUID) - case .central(let centralUUID): - store.peerID(forCentralUUID: centralUUID) - } - } + /// Marks the exact physical ingress link that completed a fresh Noise /// handshake. An old session keyed only by peer ID is insufficient: a @@ -4706,15 +4729,15 @@ extension BLEService { private func markNoiseAuthenticatedIngressLink(for packet: BitchatPacket, peerID: PeerID) { guard let link = ingressLinks.link(for: packet) else { return } readLinkState { store in - guard boundPeerID(for: link, in: store) == peerID else { return } - noiseAuthenticatedLinkOwners[link] = peerID + guard linkBindings.boundPeer(for: link) == peerID else { return } + linkAuth.markAuthenticated(link, owner: peerID) } } private func isNoiseAuthenticatedIngressLink(for packet: BitchatPacket, peerID: PeerID) -> Bool { guard let link = ingressLinks.link(for: packet) else { return false } return readLinkState { store in - noiseAuthenticatedLinkOwners[link] == peerID && boundPeerID(for: link, in: store) == peerID + linkAuth.isAuthenticated(link, for: peerID) && linkBindings.boundPeer(for: link) == peerID } } @@ -4724,8 +4747,8 @@ extension BLEService { private func currentNoiseAuthenticatedLinks(to peerID: PeerID) -> Set { readLinkState { store in - Set(noiseAuthenticatedLinkOwners.compactMap { link, owner in - owner == peerID && boundPeerID(for: link, in: store) == peerID ? link : nil + Set(linkAuth.links(ownedBy: peerID).filter { link in + linkBindings.boundPeer(for: link) == peerID }) } } @@ -4744,13 +4767,13 @@ extension BLEService { let hasEstablishedSession = noiseService.hasEstablishedSession(with: peerID) let authenticatedPeerLinks = currentNoiseAuthenticatedLinks(to: peerID) let shouldRevalidate = readLinkState { store in - guard boundPeerID(for: link, in: store) == peerID else { + guard linkBindings.boundPeer(for: link) == peerID else { return false } - return noiseReconnectPolicy.shouldRevalidate( + return linkAuth.shouldRevalidate( on: link, + for: peerID, hasEstablishedSession: hasEstablishedSession, - isNoiseAuthenticatedLink: noiseAuthenticatedLinkOwners[link] == peerID, hasAuthenticatedPeerLink: !authenticatedPeerLinks.isEmpty, now: Date() ) @@ -5801,7 +5824,7 @@ extension BLEService { } private func snapshotDirectPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? { - readLinkState { $0.directPeripheralState(for: peerID) } + readLinkState { _ in directPeripheralState(for: peerID) } } private func snapshotPeripheralStates() -> [BLEPeripheralLinkState] { @@ -5809,7 +5832,7 @@ extension BLEService { } private func snapshotSubscribedCentrals() -> BLESubscribedCentralSnapshot { - readLinkState(\.subscribedCentralSnapshot) + readLinkState { _ in subscribedCentralSnapshot() } } // MARK: Helpers: IDs, selection, and write backpressure @@ -5861,8 +5884,8 @@ extension BLEService { } if let peerID = requiredAuthenticatedPeer { let link = BLEIngressLinkID.peripheral(uuid) - guard state.peerID == peerID, - noiseAuthenticatedLinkOwners[link] == peerID else { + guard linkBindings.peer(forPeripheralID: uuid) == peerID, + linkAuth.isAuthenticated(link, for: peerID) else { return false } } @@ -6747,10 +6770,10 @@ extension BLEService { switch link { case .peripheral(let peripheralUUID): linkUUID = peripheralUUID - previousPeerID = self.linkStateStore.peerID(forPeripheralID: peripheralUUID) + previousPeerID = self.linkBindings.peer(forPeripheralID: peripheralUUID) case .central(let centralUUID): linkUUID = centralUUID - previousPeerID = self.linkStateStore.peerID(forCentralUUID: centralUUID) + previousPeerID = self.linkBindings.peer(forCentralUUID: centralUUID) } guard let previousPeerID else { return } guard previousPeerID != peerID else { @@ -6768,30 +6791,29 @@ extension BLEService { // never steal an identity another live link already owns, and // allow at most one rebind per link per cooldown window so two // identities can't fight over a link in a replay flip-flop. - guard self.linkStateStore.links(to: peerID).isEmpty else { + guard self.linkBindings.links(to: peerID).isEmpty else { SecureLogger.warning("🚫 Refusing link rebind to \(peerID.id.prefix(8))…: identity already owns another live link", category: .security) return } let now = Date() - self.lastLinkRebindAt = self.lastLinkRebindAt.filter { - now.timeIntervalSince($0.value) < TransportConfig.bleLinkRebindCooldownSeconds - } - guard self.lastLinkRebindAt[linkUUID] == nil else { + guard self.linkAuth.permitRebind( + linkUUID: linkUUID, + now: now, + cooldown: TransportConfig.bleLinkRebindCooldownSeconds + ) else { SecureLogger.warning("🚫 Refusing link rebind to \(peerID.id.prefix(8))…: rebind cooldown active for this link", category: .security) return } - self.lastLinkRebindAt[linkUUID] = now // A Noise proof belongs to the old physical binding. Never carry // it across an announce-driven rebind, whose direct TTL is // replayable; the new owner must complete a fresh handshake. - self.noiseAuthenticatedLinkOwners.removeValue(forKey: link) - self.noiseReconnectPolicy.endLinkEpoch(link) + self.linkAuth.retireLink(link) switch link { case .peripheral(let peripheralUUID): - self.linkStateStore.bindPeripheral(peripheralUUID, to: peerID) + self.bindPeripheralLink(peripheralUUID, to: peerID) case .central(let centralUUID): - self.linkStateStore.bindCentral(centralUUID, to: peerID) + self.linkBindings.bindCentral(centralUUID, to: peerID) } // Keep the rebind and reconnect decision in one bleQueue critical // section. No observer may see the new binding while a cached @@ -6820,7 +6842,7 @@ extension BLEService { self.cancelBoundPeripheralLinks(to: previousPeerID, keeping: linkUUID) // Retire the rotated-away ID only once its last link is gone; a // remaining stale link heals the same way or ages out. - guard self.linkStateStore.links(to: previousPeerID).isEmpty else { return } + guard self.linkBindings.links(to: previousPeerID).isEmpty else { return } self.messageQueue.async { [weak self] in self?.retireRotatedPeer(previousPeerID) } @@ -6849,26 +6871,25 @@ extension BLEService { bleQueue.async { [weak self] in guard let self else { return } let now = Date() - self.lastRedundantLinkRetirementAt = self.lastRedundantLinkRetirementAt.filter { - now.timeIntervalSince($0.value) < TransportConfig.bleLinkRebindCooldownSeconds - } - guard self.lastRedundantLinkRetirementAt[peerID] == nil else { return } - var ingressPeripheralUUID: String? if case .peripheral(let uuid) = ingressLink { ingressPeripheralUUID = uuid } guard let keptUUID = BLERedundantLinkPolicy.keptPeripheralUUID( ingressPeripheralUUID: ingressPeripheralUUID, - mostRecentlyBoundUUID: self.linkStateStore.preferredPeripheralBindings[peerID], + mostRecentlyBoundUUID: self.linkBindings.preferredPeripheralUUID(for: peerID), links: self.peripheralLinkPolicySnapshot(), peerID: peerID ) else { return } - self.lastRedundantLinkRetirementAt[peerID] = now + guard self.linkAuth.permitRedundantRetirement( + peerID: peerID, + now: now, + cooldown: TransportConfig.bleLinkRebindCooldownSeconds + ) else { return } // The survivor becomes the peer's reverse-mapped link so directed // sends follow the consolidation. - self.linkStateStore.bindPeripheral(keptUUID, to: peerID) + self.bindPeripheralLink(keptUUID, to: peerID) self.cancelBoundPeripheralLinks(to: peerID, keeping: keptUUID) self.refreshLocalTopology() } @@ -6899,9 +6920,10 @@ extension BLEService { /// bleQueue only (reads the link store). private func peripheralLinkPolicySnapshot() -> [BLERedundantLinkPolicy.PeripheralLink] { linkStateStore.peripheralStates.map { - BLERedundantLinkPolicy.PeripheralLink( - uuid: $0.peripheral.identifier.uuidString, - peerID: $0.peerID, + let uuid = $0.peripheral.identifier.uuidString + return BLERedundantLinkPolicy.PeripheralLink( + uuid: uuid, + peerID: linkBindings.peer(forPeripheralID: uuid), isConnected: $0.isConnected, hasCharacteristic: $0.characteristic != nil ) @@ -6986,13 +7008,8 @@ extension BLEService { // residual forged-presence window this leaves is accepted. guard let self else { return false } guard let link = self.ingressLinks.link(for: packet) else { return false } - let boundPeerID: PeerID? = self.readLinkState { store in - switch link { - case .peripheral(let peripheralUUID): - return store.peerID(forPeripheralID: peripheralUUID) - case .central(let centralUUID): - return store.peerID(forCentralUUID: centralUUID) - } + let boundPeerID: PeerID? = self.readLinkState { _ in + self.linkBindings.boundPeer(for: link) } guard let boundPeerID else { return false } return boundPeerID != peerID diff --git a/bitchatTests/Services/BLELinkAuthStateTests.swift b/bitchatTests/Services/BLELinkAuthStateTests.swift new file mode 100644 index 00000000..c16d41a0 --- /dev/null +++ b/bitchatTests/Services/BLELinkAuthStateTests.swift @@ -0,0 +1,75 @@ +import BitFoundation +import Foundation +import Testing +@testable import bitchat + +struct BLELinkAuthStateTests { + private let peerID = PeerID(str: "1122334455667788") + private let link = BLEIngressLinkID.peripheral("periph-a") + + @Test + func authenticationBindsToTheExactLinkAndOwner() { + var auth = BLELinkAuthState() + auth.markAuthenticated(link, owner: peerID) + + #expect(auth.isAuthenticated(link, for: peerID)) + #expect(!auth.isAuthenticated(link, for: PeerID(str: "8899aabbccddeeff"))) + #expect(!auth.isAuthenticated(.peripheral("periph-b"), for: peerID)) + + auth.retireLink(link) + #expect(!auth.isAuthenticated(link, for: peerID)) + } + + @Test + func retireLinksOwnedByPeerReturnsAndRetiresThemAll() { + var auth = BLELinkAuthState() + auth.markAuthenticated(.peripheral("periph-a"), owner: peerID) + auth.markAuthenticated(.central("central-a"), owner: peerID) + auth.markAuthenticated(.central("central-b"), owner: PeerID(str: "8899aabbccddeeff")) + + let departed = Set(auth.retireLinks(ownedBy: peerID)) + + #expect(departed == [.peripheral("periph-a"), .central("central-a")]) + #expect(auth.links(ownedBy: peerID).isEmpty) + #expect(auth.isAuthenticated(.central("central-b"), for: PeerID(str: "8899aabbccddeeff"))) + } + + @Test + func rebindCooldownPermitsOncePerWindowAndAgesOut() { + var auth = BLELinkAuthState() + let start = Date(timeIntervalSince1970: 1_000) + + let first = auth.permitRebind(linkUUID: "periph-a", now: start, cooldown: 30) + #expect(first) + let withinWindow = auth.permitRebind(linkUUID: "periph-a", now: start.addingTimeInterval(10), cooldown: 30) + #expect(!withinWindow) + // A different link has its own allowance. + let otherLink = auth.permitRebind(linkUUID: "periph-b", now: start.addingTimeInterval(10), cooldown: 30) + #expect(otherLink) + // The window ages out. + let afterWindow = auth.permitRebind(linkUUID: "periph-a", now: start.addingTimeInterval(31), cooldown: 30) + #expect(afterWindow) + } + + @Test + func containmentCooldownsSurviveASessionReset() { + var auth = BLELinkAuthState() + let start = Date(timeIntervalSince1970: 2_000) + auth.markAuthenticated(link, owner: peerID) + let rebindBefore = auth.permitRebind(linkUUID: "periph-a", now: start, cooldown: 30) + let retirementBefore = auth.permitRedundantRetirement(peerID: peerID, now: start, cooldown: 30) + #expect(rebindBefore) + #expect(retirementBefore) + + // Panic/emergency resets wipe proofs and epochs — but a stable + // CoreBluetooth UUID must not earn a fresh rebind or retirement + // allowance just because the session state around it was wiped. + auth.removeAll() + + #expect(!auth.isAuthenticated(link, for: peerID)) + let rebindAfterReset = auth.permitRebind(linkUUID: "periph-a", now: start.addingTimeInterval(5), cooldown: 30) + let retirementAfterReset = auth.permitRedundantRetirement(peerID: peerID, now: start.addingTimeInterval(5), cooldown: 30) + #expect(!rebindAfterReset) + #expect(!retirementAfterReset) + } +} diff --git a/bitchatTests/Services/BLELinkBindingsTests.swift b/bitchatTests/Services/BLELinkBindingsTests.swift new file mode 100644 index 00000000..3730cb2a --- /dev/null +++ b/bitchatTests/Services/BLELinkBindingsTests.swift @@ -0,0 +1,111 @@ +import BitFoundation +import Testing +@testable import bitchat + +struct BLELinkBindingsTests { + private let peerID = PeerID(str: "1122334455667788") + private let otherPeerID = PeerID(str: "8899aabbccddeeff") + + @Test + func centralBindingExposesBoundPeerAndLinks() { + var bindings = BLELinkBindings() + + bindings.bindCentral("central-a", to: peerID) + + #expect(bindings.peer(forCentralUUID: "central-a") == peerID) + #expect(bindings.hasCentral(boundTo: peerID)) + #expect(bindings.boundPeer(for: .central("central-a")) == peerID) + #expect(bindings.links(to: peerID) == [.central("central-a")]) + } + + @Test + func linksReturnsAllBindingsForPeerAcrossRoles() { + var bindings = BLELinkBindings() + + bindings.bindCentral("central-a", to: peerID) + bindings.bindCentral("central-b", to: peerID) + bindings.bindCentral("central-c", to: otherPeerID) + bindings.bindPeripheral("periph-a", to: peerID) + + #expect(bindings.links(to: peerID) == [.central("central-a"), .central("central-b"), .peripheral("periph-a")]) + } + + @Test + func clearCentralsReturnsPreviouslyBoundPeerIDsAndClearsLookups() { + var bindings = BLELinkBindings() + + bindings.bindCentral("central-a", to: peerID) + bindings.bindCentral("central-b", to: otherPeerID) + + let removedPeerIDs = Set(bindings.clearCentrals()) + + #expect(removedPeerIDs == Set([peerID, otherPeerID])) + #expect(bindings.peer(forCentralUUID: "central-a") == nil) + #expect(bindings.links(to: peerID).isEmpty) + } + + @Test + func rotationRebindDropsTheRetiredIdentitysReverseMapping() { + var bindings = BLELinkBindings() + bindings.bindPeripheral("periph-a", to: peerID) + #expect(bindings.preferredPeripheralUUID(for: peerID) == "periph-a") + + // The link's owner rotates: the old identity must no longer claim + // this link as its preferred peripheral. + bindings.bindPeripheral("periph-a", to: otherPeerID) + + #expect(bindings.preferredPeripheralUUID(for: peerID) == nil) + #expect(bindings.preferredPeripheralUUID(for: otherPeerID) == "periph-a") + #expect(bindings.peer(forPeripheralID: "periph-a") == otherPeerID) + } + + @Test + func removingThePreferredLinkRepairsOntoTheChosenSurvivor() { + var bindings = BLELinkBindings() + bindings.bindPeripheral("periph-a", to: peerID) + bindings.bindPeripheral("periph-b", to: peerID) + // periph-b bound last: it is the preferred link. + #expect(bindings.preferredPeripheralUUID(for: peerID) == "periph-b") + + let removed = bindings.peripheralRemoved("periph-b") { remaining in + #expect(remaining == ["periph-a"]) + return remaining.first + } + + #expect(removed == peerID) + #expect(bindings.preferredPeripheralUUID(for: peerID) == "periph-a") + #expect(bindings.links(to: peerID) == [.peripheral("periph-a")]) + } + + @Test + func removingADuplicateLinkDoesNotStrandThePreferredOne() { + var bindings = BLELinkBindings() + bindings.bindPeripheral("periph-a", to: peerID) + bindings.bindPeripheral("periph-b", to: peerID) + + // Removing the non-preferred duplicate must leave the reverse map + // untouched (no repair callback consulted for a non-preferred link). + let removed = bindings.peripheralRemoved("periph-a") { _ in + Issue.record("survivor choice must not run for a non-preferred link") + return nil + } + + #expect(removed == peerID) + #expect(bindings.preferredPeripheralUUID(for: peerID) == "periph-b") + } + + @Test + func removingTheLastLinkClearsThePreferredMapping() { + var bindings = BLELinkBindings() + bindings.bindPeripheral("periph-a", to: peerID) + + let removed = bindings.peripheralRemoved("periph-a") { remaining in + #expect(remaining.isEmpty) + return nil + } + + #expect(removed == peerID) + #expect(bindings.preferredPeripheralUUID(for: peerID) == nil) + #expect(bindings.links(to: peerID).isEmpty) + } +} diff --git a/bitchatTests/Services/BLELinkStateStoreTests.swift b/bitchatTests/Services/BLELinkStateStoreTests.swift deleted file mode 100644 index 9a5179df..00000000 --- a/bitchatTests/Services/BLELinkStateStoreTests.swift +++ /dev/null @@ -1,46 +0,0 @@ -import BitFoundation -import Testing -@testable import bitchat - -struct BLELinkStateStoreTests { - @Test - func centralBindingExposesDirectLinkStateAndLinks() { - let store = BLELinkStateStore() - let peerID = PeerID(str: "1122334455667788") - - store.bindCentral("central-a", to: peerID) - - #expect(store.peerID(forCentralUUID: "central-a") == peerID) - #expect(store.directLinkState(for: peerID) == BLEDirectLinkState(hasPeripheral: false, hasCentral: true)) - #expect(store.links(to: peerID) == [.central("central-a")]) - } - - @Test - func linksReturnsAllCentralBindingsForPeer() { - let store = BLELinkStateStore() - let peerID = PeerID(str: "1122334455667788") - let otherPeerID = PeerID(str: "8899aabbccddeeff") - - store.bindCentral("central-a", to: peerID) - store.bindCentral("central-b", to: peerID) - store.bindCentral("central-c", to: otherPeerID) - - #expect(store.links(to: peerID) == [.central("central-a"), .central("central-b")]) - } - - @Test - func clearCentralsReturnsPreviouslyBoundPeerIDsAndClearsLookups() { - let store = BLELinkStateStore() - let firstPeerID = PeerID(str: "1122334455667788") - let secondPeerID = PeerID(str: "8899aabbccddeeff") - - store.bindCentral("central-a", to: firstPeerID) - store.bindCentral("central-b", to: secondPeerID) - - let removedPeerIDs = Set(store.clearCentrals()) - - #expect(removedPeerIDs == Set([firstPeerID, secondPeerID])) - #expect(store.peerID(forCentralUUID: "central-a") == nil) - #expect(store.links(to: firstPeerID).isEmpty) - } -} From 2f5b56ce5774c18c78c3594d35683c42b7fb863b Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Wed, 29 Jul 2026 20:23:32 +0100 Subject: [PATCH 02/23] Link layer slice 3: bindings and link-auth become engine-owned (the option-B domain flip) (#1547) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Cohere per-link Noise auth and rebind containment into BLELinkAuthState The authenticated-link owners, the reconnect revalidation policy, and the two rebind-containment cooldowns were four loose bleQueue-owned maps whose invariants lived in call-site discipline: every teardown path had to remember to retire the proof AND close the revalidation epoch (the pair appeared seven times), and both cooldowns hand-rolled the same prune-check-record dance. BLELinkAuthState owns them as whole transitions — retireLink, retireLinks(ownedBy:), permitRebind, permitRedundantRetirement — with the ownership question (bleQueue today, engine after the option-B flip) answered in one place. No behavior change; the one call-site reordering (redundant retirement computes the survivor before the cooldown check instead of after) is outcome-equivalent since the cooldown only ever recorded when a survivor existed. Co-Authored-By: Claude Fable 5 * Split identity-link bindings out of the physical link store BLELinkStateStore owned two different kinds of truth: what physical links exist (CB handles, connect lifecycles, characteristics, stream assemblers) and who each link belongs to (peer bindings in both roles plus the preferred-peripheral reverse map for directed sends and fanout collapse). The bindings now live on BLELinkBindings — same bleQueue ownership, whole-transition methods, direct tests for the rotation reverse-map cleanup and the preferred-link survivor repair that were previously only exercised end to end. Composed operations that need both truths (remove-with-repair, direct link state, the subscribed- central snapshot, bind-only-live-links) live on the transport as explicitly bleQueue-confined helpers. This is the structural half of the option-B boundary flip (docs/BLE-ARCHITECTURE-V3.md): ownership of the bindings can now move to the engine without touching what-links-exist. An audit of every physical clear/remove found three sites (emergency clear, both unauthorized branches) that needed explicit binding-clear pairing under the split — each now clears both. Co-Authored-By: Claude Fable 5 * Fix iOS-gated constructors and preserve containment cooldowns on reset CI caught what the macOS SwiftPM build cannot see: two #if os(iOS) sites still passed the peerID field that slice B1 removed from BLEPeripheralLinkState (willRestoreState in BLEService and armPendingBackgroundConnects in BLERadioController). Both fixed and verified with a local iOS simulator xcodebuild. Codex also caught a real regression: BLELinkAuthState.removeAll() cleared the rebind/retirement cooldown maps, which the original panic and emergency reset paths deliberately left alive. A stable CoreBluetooth UUID must not earn a fresh rebind allowance just because the session state around it was wiped. removeAll() now clears only the proofs and revalidation epochs, and BLELinkAuthStateTests pins the survival invariant along with the other auth-state transitions. Co-Authored-By: Claude Fable 5 * Link layer slice 3: the option-B domain flip — bindings and link-auth move to the engine The identity domain (BLELinkBindings + BLELinkAuthState) is now owned by the engine queue, with a DEBUG dispatchPrecondition trapping any access from another queue. bleQueue keeps only physical link state. What changed shape: - Receive path is sans-I/O: bleQueue decodes frames and hands (packet, linkID) up through ingestDecodedPacket (panic lifecycle captured at the handoff); attributeAndHandlePacket resolves the sender binding, rejects spoofed senders, applies raw-announce binding, and records ingress on the engine. Per-link frame order is preserved end to end (both queues serial), which supersedes the old batch-local TOCTOU binding in the notification path. - The rotation rebind is one engine slot: containment checks, proof retirement, binding flip, reconnect decision, and rotated-identity retirement run straight-line; only CoreBluetooth cancels hop to bleQueue. The engine->bleQueue->engine ping-pong is gone, along with the _test_afterVerifiedDirectRebindEnqueued pause hook — the test that used it now asserts the atomicity directly (a paused engine wedged the old gate design into a three-queue deadlock). - Authenticated-send eligibility (notifyOrEnqueueIfAccepted, writeOrEnqueueIfAccepted) is checked on the engine, serialized against rebinds by construction; only physical admission (updateValue/write/backpressure) runs on bleQueue. - Teardown splits into discardPeripheralLinkPhysical (bleQueue, inline in the delegates) + retirePeripheralLinkIdentity (engine hop with survivor repair reading liveness via readLinkState). A binding can briefly outlive its physical link; liveness queries join against the physical store and the queued retirement converges the two. - Gossip delegate sends enter the engine via onEngine — safe because mesh.sync sits above the engine in the sync order (production engine code only async-dispatches into the manager). - checkPeerConnectivity rides an engine slot from the bleQueue maintenance tick. No wire changes. 1,974 tests green (parallel and serial), iOS simulator build clean, Periphery clean. Co-Authored-By: Claude Fable 5 --------- Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchat/Services/BLE/BLELinkAuthState.swift | 6 +- bitchat/Services/BLE/BLELinkBindings.swift | 17 +- bitchat/Services/BLE/BLEService.swift | 882 +++++++++++--------- bitchatTests/BLEServiceCoreTests.swift | 52 +- docs/BLE-ARCHITECTURE-V3.md | 33 + 5 files changed, 538 insertions(+), 452 deletions(-) diff --git a/bitchat/Services/BLE/BLELinkAuthState.swift b/bitchat/Services/BLE/BLELinkAuthState.swift index ce31e350..3989c3c4 100644 --- a/bitchat/Services/BLE/BLELinkAuthState.swift +++ b/bitchat/Services/BLE/BLELinkAuthState.swift @@ -11,9 +11,9 @@ import Foundation /// stop a replayed announce from flip-flopping bindings or survivor /// selection. /// -/// bleQueue-confined today, alongside the link bindings it qualifies; -/// both move to the engine together in the option-B boundary flip -/// (docs/BLE-ARCHITECTURE-V3.md). +/// Engine-owned (option-B boundary, docs/BLE-ARCHITECTURE-V3.md), +/// alongside the link bindings it qualifies: BLEService debug-traps any +/// access off the engine queue. struct BLELinkAuthState { private var authenticatedOwners: [BLEIngressLinkID: PeerID] = [:] private var reconnectPolicy = BLENoiseReconnectPolicy() diff --git a/bitchat/Services/BLE/BLELinkBindings.swift b/bitchat/Services/BLE/BLELinkBindings.swift index d4c5342c..840acdfa 100644 --- a/bitchat/Services/BLE/BLELinkBindings.swift +++ b/bitchat/Services/BLE/BLELinkBindings.swift @@ -5,15 +5,18 @@ import Foundation /// belongs to, in both roles, plus each peer's preferred peripheral link /// for directed sends and fanout collapse. /// -/// Split from the physical link-state store so the option-B boundary flip -/// (docs/BLE-ARCHITECTURE-V3.md) can move ownership of *who owns a link* -/// to the engine without touching *what links exist*. bleQueue-confined -/// today, alongside the physical store and `BLELinkAuthState`. +/// Engine-owned (option-B boundary, docs/BLE-ARCHITECTURE-V3.md), +/// alongside `BLELinkAuthState`: *who owns a link* lives on the engine, +/// *what links exist* stays on bleQueue in the physical store. BLEService +/// debug-traps any access off the engine queue. /// /// Lifecycle contract: bindings are only created for live physical links -/// (callers guard existence) and are retired through -/// `peripheralRemoved`/`centralRemoved`/`clear*` when the physical link -/// goes, so binding queries never see departed links. +/// (callers check liveness through `readLinkState`) and are retired +/// through `peripheralRemoved`/`centralRemoved`/`clear*` on an engine hop +/// queued by the physical teardown. A binding can therefore briefly +/// outlive its departed link; queries that need liveness join against the +/// physical store, and everything converges once the queued retirement +/// runs. struct BLELinkBindings { private var peripheralPeers: [String: PeerID] = [:] private var centralPeers: [String: PeerID] = [:] diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index 5ad02cf9..cd366608 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -206,14 +206,35 @@ final class BLEService: NSObject { // 1. Consolidated BLE link tracking for both central and peripheral roles. private var linkStateStore = BLELinkStateStore() - // Per-link Noise authentication and rebind containment (bleQueue-owned, - // like the link store — courier handover needs the stronger fact that a + // The engine-owned identity domain: per-link Noise authentication + + // rebind containment (courier handover needs the stronger fact that a // session was established *on this current ingress link*, not merely - // that some session exists for the claimed ID). - private var linkAuth = BLELinkAuthState() - // Identity↔link bindings, split from the physical link store so the - // option-B flip can move ownership to the engine (bleQueue-owned). - private var linkBindings = BLELinkBindings() + // that some session exists for the claimed ID), and the identity↔link + // bindings that qualify every attribution decision. + // + // Owned by the engine queue since the option-B flip: bleQueue hands + // decoded packets up as (packet, linkID) and the engine attributes + // them; bleQueue never touches these. A binding can therefore briefly + // outlive its physical link (the delegate's retirement hop is async) — + // every query that needs liveness joins against the physical store, + // which the engine may sync-read via `readLinkState`. + private var _linkAuth = BLELinkAuthState() + private var _linkBindings = BLELinkBindings() + private var linkAuth: BLELinkAuthState { + get { assertLinkIdentityEngineOwned(); return _linkAuth } + set { assertLinkIdentityEngineOwned(); _linkAuth = newValue } + } + private var linkBindings: BLELinkBindings { + get { assertLinkIdentityEngineOwned(); return _linkBindings } + set { assertLinkIdentityEngineOwned(); _linkBindings = newValue } + } + /// Debug-traps any identity-domain access off the engine queue — the + /// mechanical form of the option-B ownership contract. + private func assertLinkIdentityEngineOwned() { + #if DEBUG + dispatchPrecondition(condition: .onQueue(messageQueue)) + #endif + } // BCH-01-004: Rate-limiting for subscription-triggered announces. private var subscriptionAnnounceLimiter = BLESubscriptionAnnounceLimiter() @@ -279,9 +300,6 @@ final class BLEService: NSObject { /// May block in tests to hold the serial message queue immediately before /// the deferred private-media admission check. var _test_beforePrivateMediaDeferredSend: ((String) -> Void)? - /// May block announce handling after verified-link rebind work is queued. - /// Tests use this boundary to prove rebind and reconnect are serialized. - var _test_afterVerifiedDirectRebindEnqueued: (() -> Void)? /// May block the convergence-recovery callback on its global-queue thread /// before it enqueues onto `messageQueue`. Tests use this boundary to /// force the quarantine-restore handler to win the dispatch race. @@ -367,12 +385,14 @@ final class BLEService: NSObject { /// Executes inline when already on the engine queue; otherwise blocks /// until the engine drains the work ahead of it. /// - /// Sync-edge order (deadlock freedom): main and test threads may - /// sync-wait on the engine; the engine sync-waits on bleQueue - /// (`readLinkState`) and on the crypto/identity services' internal - /// queues. None of those may ever sync-wait back on the engine — - /// bleQueue callers hop with `messageQueue.async` instead, and debug - /// builds trap any violation here. + /// Sync-edge order (deadlock freedom): main, test threads, and the + /// gossip manager's mesh.sync queue may sync-wait on the engine; the + /// engine sync-waits on bleQueue (`readLinkState`) and on the + /// crypto/identity services' internal queues. None of those may ever + /// sync-wait back on the engine — bleQueue callers hop with + /// `messageQueue.async` instead, and debug builds trap any violation + /// here. (The engine only ever async-dispatches into mesh.sync; its + /// queue.sync helpers are DEBUG test entry points on test threads.) private func onEngine(_ body: () -> T) -> T { #if DEBUG dispatchPrecondition(condition: .notOnQueue(bleQueue)) @@ -758,6 +778,10 @@ final class BLEService: NSObject { ingressLinks.removeAll() recentTrafficTracker.removeAll() scheduledRelays.cancelAll() + // Proofs and revalidation epochs die with the identity; the + // rebind/retirement cooldowns deliberately survive (see + // BLELinkAuthState.removeAll). + linkAuth.removeAll() // These callbacks belong to pre-panic transfer state. Invoking // them would let queued UI work recreate or resend wiped media. privateMediaSessions.panicReset() @@ -775,7 +799,6 @@ final class BLEService: NSObject { pendingPeripheralWrites.removeAll() pendingNotifications.removeAll() pendingWriteBuffers.removeAll() - linkAuth.removeAll() radio.reset() } disconnectNotifyDebouncer.removeAll() @@ -1051,6 +1074,10 @@ final class BLEService: NSObject { // Also clear pending message queues to avoid stale state across sessions pendingNoiseSessionQueues.removeAll() pendingDirectedRelays.removeAll() + // Identity domain is engine-owned: bindings and link proofs + // clear here, physical link state clears on bleQueue below. + linkBindings.removeAll() + linkAuth.removeAll() return (transfers: entries, pingTimeouts: pingTimeouts) } @@ -1066,8 +1093,6 @@ final class BLEService: NSObject { // Clear peripheral references (synchronized access to avoid races with BLE callbacks) bleQueue.sync { linkStateStore.clearAll() - linkBindings.removeAll() - linkAuth.removeAll() radio.reset() subscriptionAnnounceLimiter.removeAll() } @@ -2185,9 +2210,12 @@ final class BLEService: NSObject { } } - /// Serializes the final authenticated-link check with CoreBluetooth's - /// notification admission on `bleQueue`, closing the rebind/disconnect - /// race between fanout planning and the actual handoff. + /// The authenticated-link eligibility check runs here on the engine — + /// the queue that owns bindings and rebinds — so fanout planning and + /// the final check are serialized against identity changes by + /// construction. Only the physical admission (updateValue and the + /// backpressure queue) hops to `bleQueue`; a central that physically + /// departs in between is a harmless no-op delivery. private func notifyOrEnqueueIfAccepted( data: Data, centrals: [CBCentral], @@ -2195,18 +2223,19 @@ final class BLEService: NSObject { context: String, requiredAuthenticatedPeer: PeerID? ) -> Bool { - let accept = { [self] in - let eligible: [CBCentral] - if let peerID = requiredAuthenticatedPeer { - eligible = centrals.filter { central in - let link = BLEIngressLinkID.central(central.identifier.uuidString) - return linkAuth.isAuthenticated(link, for: peerID) - && linkBindings.peer(forCentralUUID: central.identifier.uuidString) == peerID - } - } else { - eligible = centrals + let eligible: [CBCentral] + if let peerID = requiredAuthenticatedPeer { + eligible = centrals.filter { central in + let link = BLEIngressLinkID.central(central.identifier.uuidString) + return linkAuth.isAuthenticated(link, for: peerID) + && linkBindings.peer(forCentralUUID: central.identifier.uuidString) == peerID } - guard !eligible.isEmpty else { return false } + } else { + eligible = centrals + } + guard !eligible.isEmpty else { return false } + + let accept = { [self] in if peripheralManager?.updateValue(data, for: characteristic, onSubscribedCentrals: eligible) == true { return true } @@ -2216,10 +2245,7 @@ final class BLEService: NSObject { context: context ) } - - if DispatchQueue.getSpecific(key: bleQueueKey) != nil { - return accept() - } + // queue-contract-ok: engine → bleQueue is the sanctioned sync direction. return bleQueue.sync(execute: accept) } @@ -2260,7 +2286,7 @@ final class BLEService: NSObject { let centralIDs = subscribedCentrals.map { $0.identifier.uuidString } let peripheralPeerBindings = Dictionary(uniqueKeysWithValues: connectedStates.compactMap { state -> (String, PeerID)? in let uuid = state.peripheral.identifier.uuidString - return readLinkState { _ in linkBindings.peer(forPeripheralID: uuid) }.map { (uuid, $0) } + return linkBindings.peer(forPeripheralID: uuid).map { (uuid, $0) } }) let plan = BLEOutboundLinkPlanner.plan( packet: packet, @@ -2273,10 +2299,7 @@ final class BLEService: NSObject { excludedLinks: excludedPeerLinks, peripheralPeerBindings: peripheralPeerBindings, centralPeerBindings: centralSnapshot.peerIDsByCentralUUID, - // Perf note: this is a third bleQueue hop per send; if send-path - // profiling ever flags it, fold it into snapshotPeripheralStates - // as a combined snapshot. - preferredPeripheralPerPeer: readLinkState { _ in linkBindings.preferredPeripheralBindings }, + preferredPeripheralPerPeer: linkBindings.preferredPeripheralBindings, directAnnounceTTL: messageTTL, directedOnlyPeer: directedOnlyPeer, requireDirectPeerLink: requireDirectPeerLink || requireNoiseAuthenticatedPeerLink @@ -2696,9 +2719,7 @@ final class BLEService: NSObject { // A valid departure retires transport state too; otherwise // canDeliverSecurely could remain true for a peer we just removed. clearNoiseSession(for: peerID) - readLinkState { _ in - _ = linkAuth.retireLinks(ownedBy: peerID) - } + _ = linkAuth.retireLinks(ownedBy: peerID) // Remove the peer when they leave peerRegistry.mutate { _ = $0.remove(peerID) } // Remove any stored announcement for sync purposes @@ -2903,12 +2924,22 @@ final class BLEService: NSObject { // MARK: - GossipSyncManager Delegate extension BLEService: GossipSyncManager.Delegate { + // Gossip calls arrive on the manager's own serial queue; sends read + // the engine-owned bindings, so they enter an engine slot. The sync + // hop is safe: mesh.sync sits above the engine in the sync order — + // production engine code only ever queue.async's into the manager + // (the queue.sync helpers are DEBUG test entry points that run on + // test threads), so no reverse edge exists. func sendPacket(_ packet: BitchatPacket) { - broadcastPacket(packet) + onEngine { + broadcastPacket(packet) + } } func sendPacket(to peerID: PeerID, packet: BitchatPacket) { - sendPacketDirected(packet, to: peerID) + onEngine { + sendPacketDirected(packet, to: peerID) + } } func signPacketForBroadcast(_ packet: BitchatPacket) -> BitchatPacket { @@ -3011,18 +3042,22 @@ extension BLEService: CBCentralManagerDelegate { // not issue stop/cancel commands now; they are rejected as API // misuse. Retire our link state locally instead. SecureLogger.info("📴 Bluetooth powered off - cleaning up central state", category: .session) - let peripheralStates = linkStateStore.peripheralStates - for state in peripheralStates { - let peripheralID = state.peripheral.identifier.uuidString + let peripheralIDs = linkStateStore.peripheralStates.map { $0.peripheral.identifier.uuidString } + for peripheralID in peripheralIDs { pendingPeripheralWrites.discardAll(for: peripheralID) - linkAuth.retireLink(.peripheral(peripheralID)) } linkStateStore.clearPeripherals() - let peerIDs = linkBindings.clearPeripherals() - // Notify UI of disconnections - for peerID in peerIDs { - notifyUI { [weak self] in - self?.notifyPeerDisconnectedDebounced(peerID) + messageQueue.async { [weak self] in + guard let self else { return } + for peripheralID in peripheralIDs { + self.linkAuth.retireLink(.peripheral(peripheralID)) + } + let peerIDs = self.linkBindings.clearPeripherals() + // Notify UI of disconnections + for peerID in peerIDs { + self.notifyUI { [weak self] in + self?.notifyPeerDisconnectedDebounced(peerID) + } } } @@ -3030,7 +3065,9 @@ extension BLEService: CBCentralManagerDelegate { // User denied Bluetooth permission SecureLogger.warning("🚫 Bluetooth unauthorized - user denied permission", category: .session) linkStateStore.clearPeripherals() - _ = linkBindings.clearPeripherals() + messageQueue.async { [weak self] in + _ = self?.linkBindings.clearPeripherals() + } case .unsupported: // Device doesn't support BLE @@ -3083,11 +3120,8 @@ extension BLEService: CBCentralManagerDelegate { func centralManager(_ central: CBCentralManager, didDisconnectPeripheral peripheral: CBPeripheral, error: Error?) { let peripheralID = peripheral.identifier.uuidString - - // Find the peer ID if we have it - let peerID = linkBindings.peer(forPeripheralID: peripheralID) - - SecureLogger.debug("📱 Disconnect: \(peerID?.id ?? peripheralID)\(error != nil ? " (\(error!.localizedDescription))" : "")", category: .session) + + SecureLogger.debug("📱 Disconnect: \(peripheralID)\(error != nil ? " (\(error!.localizedDescription))" : "")", category: .session) // If disconnect carried an error (often timeout), apply short backoff to avoid thrash if error != nil { @@ -3113,24 +3147,46 @@ extension BLEService: CBCentralManagerDelegate { } #endif - // Clean up references and peer mappings - tearDownPeripheralLink(peripheralID) - // A duplicate link can drop while the peer stays live on another - // (the dual-role central link, or a second bound link after a - // restore): peer-disconnect bookkeeping only runs once the peer's - // last live link is gone. removePeripheral just repaired the reverse - // map onto a connected survivor, so directLinkState is accurate - // here. The scan restart and connect-slot refill below stay - // unguarded — they respond to the physical drop regardless of - // remaining logical links. - let remainingLinks = peerID.map { directLinkState(for: $0) } - let peerStillLinked = (remainingLinks?.hasPeripheral ?? false) || (remainingLinks?.hasCentral ?? false) - if let peerID, !peerStillLinked { - // Do not remove peer; mark as not connected but retain for reachability - peerRegistry.mutate { $0.markDisconnected(peerID) } - refreshLocalTopology() - } + // Physical teardown now; identity retirement and peer-disconnect + // bookkeeping on the engine, which owns the bindings. The scan + // restart and connect-slot refill below stay on bleQueue — they + // respond to the physical drop regardless of remaining logical + // links. + discardPeripheralLinkPhysical(peripheralID) + messageQueue.async { [weak self] in + guard let self else { return } + // A duplicate link can drop while the peer stays live on + // another (the dual-role central link, or a second bound link + // after a restore): peer-disconnect bookkeeping only runs once + // the peer's last live link is gone. The retirement just + // repaired the reverse map onto a connected survivor, so + // directLinkState is accurate here. + let peerID = self.retirePeripheralLinkIdentity(peripheralID) + if let peerID { + SecureLogger.debug("📱 Disconnected link was bound to \(peerID.id.prefix(8))…", category: .session) + } + let remainingLinks = peerID.map { self.directLinkState(for: $0) } + let peerStillLinked = (remainingLinks?.hasPeripheral ?? false) || (remainingLinks?.hasCentral ?? false) + if let peerID, !peerStillLinked { + // Do not remove peer; mark as not connected but retain for reachability + self.peerRegistry.mutate { $0.markDisconnected(peerID) } + self.refreshLocalTopology() + } + // Notify delegate about disconnection on main thread (direct link dropped) + self.notifyUI { [weak self] in + guard let self = self else { return } + + // Get current peer list (after removal) + let currentPeerIDs = self.peerRegistry.peerIDs + + if let peerID, !peerStillLinked { + self.notifyPeerDisconnectedDebounced(peerID) + } + self.requestPeerDataPublish() + self.deliverTransportEvent(.peerListUpdated(currentPeerIDs)) + } + } // Restart scanning with allow duplicates for faster rediscovery if centralManager?.state == .poweredOn { @@ -3142,27 +3198,16 @@ extension BLEService: CBCentralManagerDelegate { } // Attempt to fill freed slot from queue bleQueue.async { [weak self] in self?.radio.tryConnectFromQueue() } - - // Notify delegate about disconnection on main thread (direct link dropped) - notifyUI { [weak self] in - guard let self = self else { return } - - // Get current peer list (after removal) - let currentPeerIDs = self.peerRegistry.peerIDs - - if let peerID, !peerStillLinked { - self.notifyPeerDisconnectedDebounced(peerID) - } - self.requestPeerDataPublish() - self.deliverTransportEvent(.peerListUpdated(currentPeerIDs)) - } } func centralManager(_ central: CBCentralManager, didFailToConnect peripheral: CBPeripheral, error: Error?) { let peripheralID = peripheral.identifier.uuidString - - // Clean up the references - tearDownPeripheralLink(peripheralID) + + // Clean up the references: physical now, identity on the engine. + discardPeripheralLinkPhysical(peripheralID) + messageQueue.async { [weak self] in + self?.retirePeripheralLinkIdentity(peripheralID) + } SecureLogger.error("❌ Failed to connect to peripheral: \(peripheral.name ?? "Unknown") [\(peripheralID)] - Error: \(error?.localizedDescription ?? "Unknown")", category: .session) radio.recordConnectionFailure(peripheralID: peripheralID) @@ -3190,48 +3235,59 @@ extension BLEService: BLERadioControllerDelegate { } func radioTearDownPeripheralLink(_ peripheralID: String) { - tearDownPeripheralLink(peripheralID) + // bleQueue (the controller's queue): physical discard now, identity + // retirement on the engine. + discardPeripheralLinkPhysical(peripheralID) + messageQueue.async { [weak self] in + self?.retirePeripheralLinkIdentity(peripheralID) + } } - /// Retires one peripheral link's transport bookkeeping: its write - /// backpressure, its Noise link proof and reconnect epoch, and the - /// link-state entry plus binding (which repairs the peer's reverse - /// mapping onto a surviving duplicate link). bleQueue-confined. - func tearDownPeripheralLink(_ peripheralID: String) { + /// bleQueue half of a peripheral-link teardown: the link's write + /// backpressure and its physical link-state entry. Identity retirement + /// (proof, epoch, binding repair) rides a separate engine hop — + /// `retirePeripheralLinkIdentity`. bleQueue-confined. + func discardPeripheralLinkPhysical(_ peripheralID: String) { pendingPeripheralWrites.discardAll(for: peripheralID) - linkAuth.retireLink(.peripheral(peripheralID)) - removePeripheralLink(peripheralID) + linkStateStore.removePeripheral(peripheralID) } - /// Physical removal plus binding retirement, one unit: the preferred - /// link repairs onto a connected survivor, preferring a writable one + /// Engine half of a peripheral-link teardown: retires the link's Noise + /// proof and revalidation epoch, and its binding — repairing the peer's + /// preferred link onto a connected survivor, preferring a writable one /// (a link mid-service-rediscovery would strand directed sends until - /// its characteristic comes back). bleQueue-confined. + /// its characteristic comes back). Returns the peer that owned the + /// binding. Engine-confined. @discardableResult - func removePeripheralLink(_ peripheralID: String) -> PeerID? { - linkStateStore.removePeripheral(peripheralID) + func retirePeripheralLinkIdentity(_ peripheralID: String) -> PeerID? { + linkAuth.retireLink(.peripheral(peripheralID)) return linkBindings.peripheralRemoved(peripheralID) { remaining in - let alive = remaining.compactMap { uuid -> (uuid: String, writable: Bool)? in - guard let state = linkStateStore.state(forPeripheralID: uuid), - state.isConnected else { return nil } - return (uuid, state.characteristic != nil) + let alive = readLinkState { store in + remaining.compactMap { uuid -> (uuid: String, writable: Bool)? in + guard let state = store.state(forPeripheralID: uuid), + state.isConnected else { return nil } + return (uuid, state.characteristic != nil) + } } return (alive.first(where: \.writable) ?? alive.first)?.uuid } } /// Binds only live physical links, preserving the store-era guard that - /// a binding can never outlive (or precede) its link. bleQueue-confined. + /// a binding can never precede its link (a lost race against a + /// concurrent physical removal is healed by that removal's queued + /// identity retirement). Engine-confined. func bindPeripheralLink(_ peripheralUUID: String, to peerID: PeerID) { - guard linkStateStore.state(forPeripheralID: peripheralUUID) != nil else { return } + guard readLinkState({ $0.state(forPeripheralID: peripheralUUID) }) != nil else { return } linkBindings.bindPeripheral(peripheralUUID, to: peerID) } - /// Whether the peer holds a live direct link in either role. - /// bleQueue-confined (physical liveness + bindings in one view). + /// Whether the peer holds a live direct link in either role: bindings + /// (engine) joined against physical liveness (readLinkState). + /// Engine-confined. func directLinkState(for peerID: PeerID) -> BLEDirectLinkState { let hasPeripheral = linkBindings.preferredPeripheralUUID(for: peerID) - .flatMap { linkStateStore.state(forPeripheralID: $0)?.isConnected } ?? false + .flatMap { uuid in readLinkState { $0.state(forPeripheralID: uuid)?.isConnected } } ?? false return BLEDirectLinkState( hasPeripheral: hasPeripheral, hasCentral: linkBindings.hasCentral(boundTo: peerID) @@ -3239,16 +3295,16 @@ extension BLEService: BLERadioControllerDelegate { } /// The peer's preferred peripheral link state, when physically present. - /// bleQueue-confined. + /// Engine-confined. func directPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? { linkBindings.preferredPeripheralUUID(for: peerID) - .flatMap { linkStateStore.state(forPeripheralID: $0) } + .flatMap { uuid in readLinkState { $0.state(forPeripheralID: uuid) } } } - /// Subscribed centrals with their bindings, one view. bleQueue-confined. + /// Subscribed centrals with their bindings, one view. Engine-confined. func subscribedCentralSnapshot() -> BLESubscribedCentralSnapshot { BLESubscribedCentralSnapshot( - centrals: linkStateStore.subscribedCentrals, + centrals: readLinkState(\.subscribedCentrals), peerIDsByCentralUUID: linkBindings.centralPeersByUUID ) } @@ -3376,22 +3432,22 @@ extension BLEService { } func _test_bindCentral(_ centralUUID: String, to peerID: PeerID) { - bleQueue.sync { linkBindings.bindCentral(centralUUID, to: peerID) } + onEngine { linkBindings.bindCentral(centralUUID, to: peerID) } } func _test_centralBinding(_ centralUUID: String) -> PeerID? { - bleQueue.sync { linkBindings.peer(forCentralUUID: centralUUID) } + onEngine { linkBindings.peer(forCentralUUID: centralUUID) } } func _test_markNoiseAuthenticatedCentral(_ centralUUID: String, to peerID: PeerID) { - bleQueue.sync { + onEngine { guard linkBindings.peer(forCentralUUID: centralUUID) == peerID else { return } linkAuth.markAuthenticated(.central(centralUUID), owner: peerID) } } func _test_isNoiseAuthenticatedCentral(_ centralUUID: String, for peerID: PeerID) -> Bool { - bleQueue.sync { + onEngine { linkAuth.isAuthenticated(.central(centralUUID), for: peerID) } } @@ -3702,72 +3758,25 @@ extension BLEService: CBPeripheralDelegate { SecureLogger.error("❌ Invalid BLE frame length; reset notification stream", category: .session) } - // Codex review identified TOCTOU in this patch. - // Enforce per-link sender binding immediately within the same notification batch. - // NOTE: `processNotificationPacket` may bind the stored peer ID when an announce - // is processed, but `state` above is a snapshot. Track a local binding that we update as soon as - // we see a binding-eligible announce so subsequent frames can't spoof a different sender. - var boundPeerID: PeerID? = linkBindings.peer(forPeripheralID: peripheralUUID) - + // Attribution — spoof rejection, announce binding, ingress + // recording — is engine work now (the engine owns the bindings). + // Frames hop up in decode order; the engine's serial slot ordering + // gives the same same-batch spoof protection the old bleQueue-side + // batch-local binding enforced: an announce that binds this link is + // attributed before every frame that rode behind it. for frame in result.frames { guard let packet = BinaryProtocol.decode(frame) else { let prefix = frame.prefix(16).map { String(format: "%02x", $0) }.joined(separator: " ") SecureLogger.error("❌ Failed to decode assembled notification frame (len=\(frame.count), prefix=\(prefix))", category: .session) continue } - - let claimedSenderID = PeerID(hexData: packet.senderID) - let context = acceptedIngressContext( - for: packet, - claimedSenderID: claimedSenderID, - boundPeerID: boundPeerID, + ingestDecodedPacket( + packet, + link: .peripheral(peripheralUUID), linkDescription: "Peripheral \(peripheralUUID.prefix(8))…" ) - - guard let context else { continue } - - // If this is a direct-link announce, bind immediately for the remainder of this batch. - if boundPeerID == nil, - packet.type == MessageType.announce.rawValue, - packet.ttl == messageTTL { - boundPeerID = claimedSenderID - bindPeripheralLink(peripheralUUID, to: claimedSenderID) - } - - if !recordIngressIfNew(packet, link: .peripheral(peripheralUUID), peerID: context.receivedFromPeerID) { - continue - } - processNotificationPacket( - packet, - from: peripheral, - peripheralUUID: peripheralUUID, - receivedFrom: context.receivedFromPeerID - ) } } - - private func processNotificationPacket(_ packet: BitchatPacket, from _: CBPeripheral, peripheralUUID: String, receivedFrom peerID: PeerID) { - let senderID = PeerID(hexData: packet.senderID) - - if packet.type != MessageType.announce.rawValue { - SecureLogger.debug("📦 Decoded notification packet type: \(packet.type) from sender: \(senderID.id.prefix(8))…", category: .session) - } - - if packet.type == MessageType.announce.rawValue, - packet.ttl == messageTTL { - // Only bind an unbound link here: this runs before signature - // verification, so a bound link must not be re-bound by a raw - // announce (spoofable). Rotation rebinds happen after the announce - // verifies (rebindLinkAfterVerifiedDirectAnnounce). - let boundPeerID = linkBindings.peer(forPeripheralID: peripheralUUID) - if boundPeerID == nil || boundPeerID == senderID { - bindPeripheralLink(peripheralUUID, to: senderID) - refreshLocalTopology() - } - } - - handleReceivedPacket(packet, from: peerID) - } func peripheral(_ peripheral: CBPeripheral, didWriteValueFor characteristic: CBCharacteristic, error: Error?) { if let error = error { @@ -3862,21 +3871,23 @@ extension BLEService: CBPeripheralManagerDelegate { // Bluetooth was turned off - clean up peripheral state SecureLogger.info("📴 Bluetooth powered off - cleaning up peripheral state", category: .session) // Clear subscribed centrals (they are now invalid) - let centralSnapshot = subscribedCentralSnapshot() - for central in centralSnapshot.centrals { - let centralID = central.identifier.uuidString - linkAuth.retireLink(.central(centralID)) - } + let centralIDs = linkStateStore.subscribedCentrals.map { $0.identifier.uuidString } pendingNotifications.removeAll() pendingWriteBuffers.removeAll() linkStateStore.clearCentrals() - let centralPeerIDs = linkBindings.clearCentrals() subscriptionAnnounceLimiter.removeAll() characteristic = nil - // Notify UI of disconnections - for peerID in centralPeerIDs { - notifyUI { [weak self] in - self?.notifyPeerDisconnectedDebounced(peerID) + messageQueue.async { [weak self] in + guard let self else { return } + for centralID in centralIDs { + self.linkAuth.retireLink(.central(centralID)) + } + let centralPeerIDs = self.linkBindings.clearCentrals() + // Notify UI of disconnections + for peerID in centralPeerIDs { + self.notifyUI { [weak self] in + self?.notifyPeerDisconnectedDebounced(peerID) + } } } @@ -3884,9 +3895,11 @@ extension BLEService: CBPeripheralManagerDelegate { // User denied Bluetooth permission SecureLogger.warning("🚫 Bluetooth unauthorized for peripheral role", category: .session) linkStateStore.clearCentrals() - _ = linkBindings.clearCentrals() subscriptionAnnounceLimiter.removeAll() characteristic = nil + messageQueue.async { [weak self] in + _ = self?.linkBindings.clearCentrals() + } case .unsupported: // Device doesn't support BLE peripheral role @@ -3992,38 +4005,41 @@ extension BLEService: CBPeripheralManagerDelegate { func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didUnsubscribeFrom characteristic: CBCharacteristic) { let centralID = central.identifier.uuidString SecureLogger.debug("📤 Central unsubscribed: \(centralID.prefix(8))…", category: .session) + // bleQueue: physical retirement now. pendingNotifications.removeTarget { $0.identifier.uuidString == centralID } - linkAuth.retireLink(.central(centralID)) linkStateStore.removeSubscribedCentral(central) - let removedPeerID = linkBindings.centralRemoved(centralID) - + // Ensure we're still advertising for other devices to find us if !isPanicSuspended, peripheral.isAdvertising == false { SecureLogger.debug("📡 Restarting advertising after central unsubscribed", category: .session) peripheral.startAdvertising(BLERadioController.advertisementData()) } - - // Find and disconnect the peer associated with this central - if let peerID = removedPeerID { + + // Identity retirement and peer-disconnect bookkeeping on the + // engine, which owns the bindings. + messageQueue.async { [weak self] in + guard let self else { return } + self.linkAuth.retireLink(.central(centralID)) + guard let peerID = self.linkBindings.centralRemoved(centralID) else { return } // The remote side retiring a redundant duplicate connection // arrives here as an unsubscribe while the peer stays live on // its other links; only the peer's last link disconnecting // counts. If every link truly dropped, the surviving-link // callbacks (didDisconnectPeripheral, or this one again) run // the bookkeeping. - guard linkBindings.links(to: peerID).isEmpty else { return } + guard self.linkBindings.links(to: peerID).isEmpty else { return } // Mark peer as not connected; retain for reachability - peerRegistry.mutate { $0.markDisconnected(peerID) } - - refreshLocalTopology() - + self.peerRegistry.mutate { $0.markDisconnected(peerID) } + + self.refreshLocalTopology() + // Update UI immediately - notifyUI { [weak self] in + self.notifyUI { [weak self] in guard let self = self else { return } - + // Get current peer list (after removal) let currentPeerIDs = self.peerRegistry.peerIDs - + self.notifyPeerDisconnectedDebounced(peerID) // Publish snapshots so UnifiedPeerService can refresh icons promptly self.requestPeerDataPublish() @@ -4150,37 +4166,16 @@ extension BLEService: CBPeripheralManagerDelegate { } private func processDecodedCentralWrite(_ packet: BitchatPacket, centralUUID: String, central: CBCentral) { - let claimedSenderID = PeerID(hexData: packet.senderID) - let context = acceptedIngressContext( - for: packet, - claimedSenderID: claimedSenderID, - boundPeerID: linkBindings.peer(forCentralUUID: centralUUID), + // bleQueue: physical bookkeeping only. A writer is a live central + // whether or not it subscribed; track it so directed replies and + // the fanout planner can reach it. + linkStateStore.addSubscribedCentral(central) + // Attribution is engine work (the engine owns the bindings). + ingestDecodedPacket( + packet, + link: .central(centralUUID), linkDescription: "Central \(centralUUID.prefix(8))…" ) - guard let context else { return } - - if packet.type != MessageType.announce.rawValue { - SecureLogger.debug("📦 Decoded (combined) packet type: \(packet.type) from sender: \(claimedSenderID.id.prefix(8))…", category: .session) - } - - linkStateStore.addSubscribedCentral(central) - - if packet.type == MessageType.announce.rawValue, - packet.ttl == messageTTL { - // Same rule as the peripheral path: raw announces only bind - // unbound links; rotation rebinds require a verified announce. - let boundPeerID = linkBindings.peer(forCentralUUID: centralUUID) - if boundPeerID == nil || boundPeerID == claimedSenderID { - linkBindings.bindCentral(centralUUID, to: claimedSenderID) - refreshLocalTopology() - } - } - - guard recordIngressIfNew(packet, link: .central(centralUUID), peerID: context.receivedFromPeerID) else { - return - } - - handleReceivedPacket(packet, from: context.receivedFromPeerID) } } @@ -4711,14 +4706,15 @@ extension BLEService { return plan.shouldSuppressFloodRelay } - /// Safely fetch the current direct-link state for a peer using the BLE queue. + /// The current direct-link state for a peer. Engine-confined (bindings + /// joined against physical liveness inside directLinkState). private func linkState(for peerID: PeerID) -> (hasPeripheral: Bool, hasCentral: Bool) { - let state = readLinkState { _ in directLinkState(for: peerID) } + let state = directLinkState(for: peerID) return (state.hasPeripheral, state.hasCentral) } private func links(to peerID: PeerID?) -> Set { - readLinkState { _ in linkBindings.links(to: peerID) } + linkBindings.links(to: peerID) } @@ -4726,19 +4722,16 @@ extension BLEService { /// Marks the exact physical ingress link that completed a fresh Noise /// handshake. An old session keyed only by peer ID is insufficient: a /// replayed announce can rebind an attacker's link to that ID. + /// Engine-confined. private func markNoiseAuthenticatedIngressLink(for packet: BitchatPacket, peerID: PeerID) { guard let link = ingressLinks.link(for: packet) else { return } - readLinkState { store in - guard linkBindings.boundPeer(for: link) == peerID else { return } - linkAuth.markAuthenticated(link, owner: peerID) - } + guard linkBindings.boundPeer(for: link) == peerID else { return } + linkAuth.markAuthenticated(link, owner: peerID) } private func isNoiseAuthenticatedIngressLink(for packet: BitchatPacket, peerID: PeerID) -> Bool { guard let link = ingressLinks.link(for: packet) else { return false } - return readLinkState { store in - linkAuth.isAuthenticated(link, for: peerID) && linkBindings.boundPeer(for: link) == peerID - } + return linkAuth.isAuthenticated(link, for: peerID) && linkBindings.boundPeer(for: link) == peerID } private func hasCurrentNoiseAuthenticatedLink(to peerID: PeerID) -> Bool { @@ -4746,37 +4739,36 @@ extension BLEService { } private func currentNoiseAuthenticatedLinks(to peerID: PeerID) -> Set { - readLinkState { store in - Set(linkAuth.links(ownedBy: peerID).filter { link in - linkBindings.boundPeer(for: link) == peerID - }) - } + Set(linkAuth.links(ownedBy: peerID).filter { link in + linkBindings.boundPeer(for: link) == peerID + }) } /// A peer-level session can outlive the physical link that established it. /// Revalidate a fresh direct link with an ordinary XX exchange, retiring /// cached sending keys atomically before message 1 can leave. /// - /// Takes the already-resolved ingress link: both callers run inside the - /// rebind's bleQueue critical section, which must never sync-wait on the - /// engine (the engine sync-waits on bleQueue via `readLinkState`). + /// Takes the already-resolved ingress link. Engine-confined: it runs + /// inside the rebind's engine slot, so no observer can see the new + /// binding while a cached peer-level sender is still considered + /// established. private func refreshNoiseSessionForVerifiedDirectLink( link: BLEIngressLinkID, peerID: PeerID ) { let hasEstablishedSession = noiseService.hasEstablishedSession(with: peerID) let authenticatedPeerLinks = currentNoiseAuthenticatedLinks(to: peerID) - let shouldRevalidate = readLinkState { store in - guard linkBindings.boundPeer(for: link) == peerID else { - return false - } - return linkAuth.shouldRevalidate( + let shouldRevalidate: Bool + if linkBindings.boundPeer(for: link) == peerID { + shouldRevalidate = linkAuth.shouldRevalidate( on: link, for: peerID, hasEstablishedSession: hasEstablishedSession, hasAuthenticatedPeerLink: !authenticatedPeerLinks.isEmpty, now: Date() ) + } else { + shouldRevalidate = false } guard shouldRevalidate else { return } @@ -5318,11 +5310,13 @@ extension BLEService { /// replay-rebound link, or process-local spool is not delivery. @discardableResult func deliverBridgedEnvelope(_ envelope: CourierEnvelope, to peerID: PeerID) -> Bool { - guard hasCurrentNoiseAuthenticatedLink(to: peerID) else { return false } guard let payload = envelope.encode() else { return false } let packet = makeCourierPacket(payload, to: peerID) return onEngine { - sendPacketDirected( + // Engine slot: the auth-link check and the directed send see one + // consistent view of the identity domain. + guard hasCurrentNoiseAuthenticatedLink(to: peerID) else { return false } + return sendPacketDirected( packet, to: peerID, requireDirectPeerLink: true, @@ -5813,7 +5807,10 @@ extension BLEService { } } - // MARK: Link capability snapshots (thread-safe via bleQueue) + // MARK: Link capability snapshots + // Physical link state is bleQueue-owned; the engine (and main) may + // sync-read it here. The bindings half of a combined view comes from + // the engine-owned identity domain directly. private func readLinkState(_ body: (BLELinkStateStore) -> T) -> T { if DispatchQueue.getSpecific(key: bleQueueKey) != nil { @@ -5824,7 +5821,7 @@ extension BLEService { } private func snapshotDirectPeripheralState(for peerID: PeerID) -> BLEPeripheralLinkState? { - readLinkState { _ in directPeripheralState(for: peerID) } + directPeripheralState(for: peerID) } private func snapshotPeripheralStates() -> [BLEPeripheralLinkState] { @@ -5832,7 +5829,7 @@ extension BLEService { } private func snapshotSubscribedCentrals() -> BLESubscribedCentralSnapshot { - readLinkState { _ in subscribedCentralSnapshot() } + subscribedCentralSnapshot() } // MARK: Helpers: IDs, selection, and write backpressure @@ -5868,6 +5865,11 @@ extension BLEService { /// peripheral's bounded retry queue. Unlike `writeOrEnqueue`, the return /// value distinguishes a retained queue item from one rejected or trimmed /// immediately, which lets durable courier state commit truthfully. + /// + /// The authenticated-link eligibility check runs on the engine (which + /// owns bindings and rebinds, so it is serialized against identity + /// changes by construction); only the physical admission hops to + /// `bleQueue`. private func writeOrEnqueueIfAccepted( _ data: Data, to peripheral: CBPeripheral, @@ -5875,20 +5877,20 @@ extension BLEService { priority: BLEOutboundWritePriority, requiredAuthenticatedPeer: PeerID? ) -> Bool { + let uuid = peripheral.identifier.uuidString + if let peerID = requiredAuthenticatedPeer { + let link = BLEIngressLinkID.peripheral(uuid) + guard linkBindings.peer(forPeripheralID: uuid) == peerID, + linkAuth.isAuthenticated(link, for: peerID) else { + return false + } + } let accept = { [self] in - let uuid = peripheral.identifier.uuidString guard let state = linkStateStore.state(forPeripheralID: uuid), state.isConnected, state.characteristic?.uuid == characteristic.uuid else { return false } - if let peerID = requiredAuthenticatedPeer { - let link = BLEIngressLinkID.peripheral(uuid) - guard linkBindings.peer(forPeripheralID: uuid) == peerID, - linkAuth.isAuthenticated(link, for: peerID) else { - return false - } - } if peripheral.canSendWriteWithoutResponse { peripheral.writeValue(data, for: characteristic, type: .withoutResponse) @@ -6467,7 +6469,81 @@ extension BLEService { } // MARK: Packet Reception - + + /// The bleQueue → engine handoff for every frame the link layer + /// decodes: the radio side hands up (packet, linkID) and all + /// attribution — binding lookup, spoof rejection, raw-announce + /// binding, ingress recording — happens on the engine, the queue that + /// owns the identity domain. Captures the panic lifecycle at the + /// handoff, like `handleReceivedPacket`. + /// + /// Per-link frame order is preserved end to end (bleQueue and the + /// engine are both serial), so an announce that binds a link is + /// attributed before the directed frames that ride behind it — the + /// same-batch spoof protection the old bleQueue-side attribution + /// enforced with a batch-local binding. + private func ingestDecodedPacket( + _ packet: BitchatPacket, + link: BLEIngressLinkID, + linkDescription: String + ) { + guard let lifecycleGeneration = capturePanicLifecycleGeneration() else { return } + messageQueue.async { [weak self] in + guard let self, + self.isCurrentPanicLifecycleGeneration(lifecycleGeneration) else { + return + } + self.attributeAndHandlePacket(packet, link: link, linkDescription: linkDescription) + } + } + + /// Engine-confined attribution: resolves the link's bound owner, + /// admits or rejects the claimed sender, lets a direct raw announce + /// bind an unbound link (rotation rebinds still require a verified + /// announce — `rebindLinkAfterVerifiedDirectAnnounce`), records + /// ingress, and hands the packet to the handler pipeline. + private func attributeAndHandlePacket( + _ packet: BitchatPacket, + link: BLEIngressLinkID, + linkDescription: String + ) { + let claimedSenderID = PeerID(hexData: packet.senderID) + let context = acceptedIngressContext( + for: packet, + claimedSenderID: claimedSenderID, + boundPeerID: linkBindings.boundPeer(for: link), + linkDescription: linkDescription + ) + guard let context else { return } + + if packet.type != MessageType.announce.rawValue { + SecureLogger.debug("📦 Decoded packet type: \(packet.type) from sender: \(claimedSenderID.id.prefix(8))… (\(linkDescription))", category: .session) + } + + if packet.type == MessageType.announce.rawValue, + packet.ttl == messageTTL { + // Raw announces only bind unbound links: this runs before + // signature verification, so a bound link must not be re-bound + // by a raw announce (spoofable). + let boundPeerID = linkBindings.boundPeer(for: link) + if boundPeerID == nil || boundPeerID == claimedSenderID { + switch link { + case .peripheral(let peripheralUUID): + bindPeripheralLink(peripheralUUID, to: claimedSenderID) + case .central(let centralUUID): + linkBindings.bindCentral(centralUUID, to: claimedSenderID) + } + refreshLocalTopology() + } + } + + guard recordIngressIfNew(packet, link: link, peerID: context.receivedFromPeerID) else { + return + } + + handleReceivedPacket(packet, from: context.receivedFromPeerID) + } + private func handleReceivedPacket(_ packet: BitchatPacket, from peerID: PeerID) { let isNoisePacket = packet.type == MessageType.noiseHandshake.rawValue || packet.type == MessageType.noiseEncrypted.rawValue @@ -6708,9 +6784,6 @@ extension BLEService { // consolidate duplicate same-role connections onto that link. if let result, result.isVerified, result.isDirectAnnounce { rebindLinkAfterVerifiedDirectAnnounce(packet, to: result.peerID) - #if DEBUG - _test_afterVerifiedDirectRebindEnqueued?() - #endif retireRedundantPeripheralLinks(packet, to: result.peerID) } @@ -6761,92 +6834,90 @@ extension BLEService { /// spoofed. A signature-verified direct announce proves the claimed /// sender owns the link it arrived on, so rebind the link to the new ID /// and retire the old identity. + /// Engine-confined: the whole rebind — containment checks, proof + /// retirement, binding flip, reconnect decision, and rotated-identity + /// retirement — is one engine slot, so no observer can see a + /// half-applied rotation. Only the physical connection cancels hop to + /// bleQueue. private func rebindLinkAfterVerifiedDirectAnnounce(_ packet: BitchatPacket, to peerID: PeerID) { guard let link = ingressLinks.link(for: packet) else { return } - bleQueue.async { [weak self] in - guard let self else { return } - let linkUUID: String - let previousPeerID: PeerID? - switch link { - case .peripheral(let peripheralUUID): - linkUUID = peripheralUUID - previousPeerID = self.linkBindings.peer(forPeripheralID: peripheralUUID) - case .central(let centralUUID): - linkUUID = centralUUID - previousPeerID = self.linkBindings.peer(forCentralUUID: centralUUID) - } - guard let previousPeerID else { return } - guard previousPeerID != peerID else { - self.refreshNoiseSessionForVerifiedDirectLink( - link: link, - peerID: peerID - ) - return - } - - // The signature does not authenticate directness (TTL is excluded - // from signing because relays mutate it), so a "verified direct" - // announce can be a replay of another peer's fresh announce with - // its TTL restored. Contain what a forged rebind could do: - // never steal an identity another live link already owns, and - // allow at most one rebind per link per cooldown window so two - // identities can't fight over a link in a replay flip-flop. - guard self.linkBindings.links(to: peerID).isEmpty else { - SecureLogger.warning("🚫 Refusing link rebind to \(peerID.id.prefix(8))…: identity already owns another live link", category: .security) - return - } - let now = Date() - guard self.linkAuth.permitRebind( - linkUUID: linkUUID, - now: now, - cooldown: TransportConfig.bleLinkRebindCooldownSeconds - ) else { - SecureLogger.warning("🚫 Refusing link rebind to \(peerID.id.prefix(8))…: rebind cooldown active for this link", category: .security) - return - } - - // A Noise proof belongs to the old physical binding. Never carry - // it across an announce-driven rebind, whose direct TTL is - // replayable; the new owner must complete a fresh handshake. - self.linkAuth.retireLink(link) - switch link { - case .peripheral(let peripheralUUID): - self.bindPeripheralLink(peripheralUUID, to: peerID) - case .central(let centralUUID): - self.linkBindings.bindCentral(centralUUID, to: peerID) - } - // Keep the rebind and reconnect decision in one bleQueue critical - // section. No observer may see the new binding while a cached - // peer-level sender is still considered established. - self.refreshNoiseSessionForVerifiedDirectLink( + let linkUUID: String + let previousPeerID: PeerID? + switch link { + case .peripheral(let peripheralUUID): + linkUUID = peripheralUUID + previousPeerID = linkBindings.peer(forPeripheralID: peripheralUUID) + case .central(let centralUUID): + linkUUID = centralUUID + previousPeerID = linkBindings.peer(forCentralUUID: centralUUID) + } + guard let previousPeerID else { return } + guard previousPeerID != peerID else { + refreshNoiseSessionForVerifiedDirectLink( link: link, peerID: peerID ) - SecureLogger.debug("🔄 Rebinding link after peer-ID rotation: \(previousPeerID.id.prefix(8))… → \(peerID.id.prefix(8))…", category: .session) - self.refreshLocalTopology() - // The announce that triggered this rebind was upserted as - // disconnected: the registry ran while the link still belonged - // to the previous ID (the ambiguous state BLEAnnounceHandler - // denies the connected shortcut). The rebind has now - // containment-checked the claim and the identity owns a live - // link, so promote it — otherwise a healed rotation leaves a - // live link that reads as disconnected until the next announce. - self.messageQueue.async { [weak self] in - self?.promoteReboundPeerToConnected(peerID) - } - // Any other peripheral links still bound to the rotated-away ID - // are stale duplicates of the same physical device (its restored - // connections outlived the relaunch that rotated the ID): cancel - // them now instead of leaving ghost links that spray duplicate - // traffic until the inactivity timeout. - self.cancelBoundPeripheralLinks(to: previousPeerID, keeping: linkUUID) - // Retire the rotated-away ID only once its last link is gone; a - // remaining stale link heals the same way or ages out. - guard self.linkBindings.links(to: previousPeerID).isEmpty else { return } - self.messageQueue.async { [weak self] in - self?.retireRotatedPeer(previousPeerID) - } + return } + + // The signature does not authenticate directness (TTL is excluded + // from signing because relays mutate it), so a "verified direct" + // announce can be a replay of another peer's fresh announce with + // its TTL restored. Contain what a forged rebind could do: + // never steal an identity another live link already owns, and + // allow at most one rebind per link per cooldown window so two + // identities can't fight over a link in a replay flip-flop. + guard linkBindings.links(to: peerID).isEmpty else { + SecureLogger.warning("🚫 Refusing link rebind to \(peerID.id.prefix(8))…: identity already owns another live link", category: .security) + return + } + let now = Date() + guard linkAuth.permitRebind( + linkUUID: linkUUID, + now: now, + cooldown: TransportConfig.bleLinkRebindCooldownSeconds + ) else { + SecureLogger.warning("🚫 Refusing link rebind to \(peerID.id.prefix(8))…: rebind cooldown active for this link", category: .security) + return + } + + // A Noise proof belongs to the old physical binding. Never carry + // it across an announce-driven rebind, whose direct TTL is + // replayable; the new owner must complete a fresh handshake. + linkAuth.retireLink(link) + switch link { + case .peripheral(let peripheralUUID): + bindPeripheralLink(peripheralUUID, to: peerID) + case .central(let centralUUID): + linkBindings.bindCentral(centralUUID, to: peerID) + } + // Same engine slot as the rebind: no observer may see the new + // binding while a cached peer-level sender is still considered + // established. + refreshNoiseSessionForVerifiedDirectLink( + link: link, + peerID: peerID + ) + SecureLogger.debug("🔄 Rebinding link after peer-ID rotation: \(previousPeerID.id.prefix(8))… → \(peerID.id.prefix(8))…", category: .session) + refreshLocalTopology() + // The announce that triggered this rebind was upserted as + // disconnected: the registry ran while the link still belonged + // to the previous ID (the ambiguous state BLEAnnounceHandler + // denies the connected shortcut). The rebind has now + // containment-checked the claim and the identity owns a live + // link, so promote it — otherwise a healed rotation leaves a + // live link that reads as disconnected until the next announce. + promoteReboundPeerToConnected(peerID) + // Any other peripheral links still bound to the rotated-away ID + // are stale duplicates of the same physical device (its restored + // connections outlived the relaunch that rotated the ID): cancel + // them now instead of leaving ghost links that spray duplicate + // traffic until the inactivity timeout. + cancelBoundPeripheralLinks(to: previousPeerID, keeping: linkUUID) + // Retire the rotated-away ID only once its last link is gone; a + // remaining stale link heals the same way or ages out. + guard linkBindings.links(to: previousPeerID).isEmpty else { return } + retireRotatedPeer(previousPeerID) } /// After a restore relaunch the same phone can reappear under a fresh @@ -6868,38 +6939,37 @@ extension BLEService { /// link either way. private func retireRedundantPeripheralLinks(_ packet: BitchatPacket, to peerID: PeerID) { let ingressLink = ingressLinks.link(for: packet) - bleQueue.async { [weak self] in - guard let self else { return } - let now = Date() - var ingressPeripheralUUID: String? - if case .peripheral(let uuid) = ingressLink { - ingressPeripheralUUID = uuid - } - guard let keptUUID = BLERedundantLinkPolicy.keptPeripheralUUID( - ingressPeripheralUUID: ingressPeripheralUUID, - mostRecentlyBoundUUID: self.linkBindings.preferredPeripheralUUID(for: peerID), - links: self.peripheralLinkPolicySnapshot(), - peerID: peerID - ) else { return } - - guard self.linkAuth.permitRedundantRetirement( - peerID: peerID, - now: now, - cooldown: TransportConfig.bleLinkRebindCooldownSeconds - ) else { return } - // The survivor becomes the peer's reverse-mapped link so directed - // sends follow the consolidation. - self.bindPeripheralLink(keptUUID, to: peerID) - self.cancelBoundPeripheralLinks(to: peerID, keeping: keptUUID) - self.refreshLocalTopology() + let now = Date() + var ingressPeripheralUUID: String? + if case .peripheral(let uuid) = ingressLink { + ingressPeripheralUUID = uuid } + guard let keptUUID = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: ingressPeripheralUUID, + mostRecentlyBoundUUID: linkBindings.preferredPeripheralUUID(for: peerID), + links: peripheralLinkPolicySnapshot(), + peerID: peerID + ) else { return } + + guard linkAuth.permitRedundantRetirement( + peerID: peerID, + now: now, + cooldown: TransportConfig.bleLinkRebindCooldownSeconds + ) else { return } + // The survivor becomes the peer's reverse-mapped link so directed + // sends follow the consolidation. + bindPeripheralLink(keptUUID, to: peerID) + cancelBoundPeripheralLinks(to: peerID, keeping: keptUUID) + refreshLocalTopology() } /// Cancels our central-role connections whose link is bound to `peerID`, - /// except `keptUUID`. bleQueue only. Each entry is removed from the link - /// store BEFORE cancelling so didDisconnectPeripheral sees no peer - /// binding and skips its peer-disconnect bookkeeping — the peer is still - /// live (on the kept link, or under its rotated identity). + /// except `keptUUID`. Engine-confined: each binding is retired BEFORE + /// the cancel is issued, so didDisconnectPeripheral's identity hop sees + /// no peer binding and skips its peer-disconnect bookkeeping — the peer + /// is still live (on the kept link, or under its rotated identity). + /// Only the physical discard and the CoreBluetooth cancel hop to + /// bleQueue. private func cancelBoundPeripheralLinks(to peerID: PeerID, keeping keptUUID: String?) { let retiring = BLERedundantLinkPolicy.peripheralUUIDsToRetire( links: peripheralLinkPolicySnapshot(), @@ -6907,25 +6977,36 @@ extension BLEService { keeping: keptUUID ?? "" ) for uuid in retiring { - guard let state = linkStateStore.state(forPeripheralID: uuid) else { continue } - tearDownPeripheralLink(uuid) + retirePeripheralLinkIdentity(uuid) SecureLogger.info( "🔗 Retiring redundant link \(uuid.prefix(8))… bound to \(peerID.id.prefix(8))…\(keptUUID.map { " (keeping \($0.prefix(8))…)" } ?? "")", category: .session ) - centralManager?.cancelPeripheralConnection(state.peripheral) + bleQueue.async { [weak self] in + guard let self, + let state = self.linkStateStore.state(forPeripheralID: uuid) else { return } + self.discardPeripheralLinkPhysical(uuid) + self.centralManager?.cancelPeripheralConnection(state.peripheral) + } } } - /// bleQueue only (reads the link store). + /// Engine-confined: physical link rows joined with their engine-owned + /// bindings. private func peripheralLinkPolicySnapshot() -> [BLERedundantLinkPolicy.PeripheralLink] { - linkStateStore.peripheralStates.map { - let uuid = $0.peripheral.identifier.uuidString - return BLERedundantLinkPolicy.PeripheralLink( - uuid: uuid, - peerID: linkBindings.peer(forPeripheralID: uuid), + let physical = readLinkState { store in + store.peripheralStates.map { + (uuid: $0.peripheral.identifier.uuidString, + isConnected: $0.isConnected, + hasCharacteristic: $0.characteristic != nil) + } + } + return physical.map { + BLERedundantLinkPolicy.PeripheralLink( + uuid: $0.uuid, + peerID: linkBindings.peer(forPeripheralID: $0.uuid), isConnected: $0.isConnected, - hasCharacteristic: $0.characteristic != nil + hasCharacteristic: $0.hasCharacteristic ) } } @@ -7008,10 +7089,7 @@ extension BLEService { // residual forged-presence window this leaves is accepted. guard let self else { return false } guard let link = self.ingressLinks.link(for: packet) else { return false } - let boundPeerID: PeerID? = self.readLinkState { _ in - self.linkBindings.boundPeer(for: link) - } - guard let boundPeerID else { return false } + guard let boundPeerID = self.linkBindings.boundPeer(for: link) else { return false } return boundPeerID != peerID }, withRegistryBarrier: { [weak self] body in @@ -7605,6 +7683,14 @@ extension BLEService { #endif private func checkPeerConnectivity() { + // Maintenance ticks on bleQueue; connectivity reconciliation reads + // the engine-owned bindings, so it rides an engine slot. + messageQueue.async { [weak self] in + self?.checkPeerConnectivityOnEngine() + } + } + + private func checkPeerConnectivityOnEngine() { let now = Date() let peerIDsForLinkState: [PeerID] = peerRegistry.peerIDs var cachedLinkStates: [PeerID: BLEPeerLinkPresence] = [:] diff --git a/bitchatTests/BLEServiceCoreTests.swift b/bitchatTests/BLEServiceCoreTests.swift index f0a573cd..13f2bb25 100644 --- a/bitchatTests/BLEServiceCoreTests.swift +++ b/bitchatTests/BLEServiceCoreTests.swift @@ -554,26 +554,19 @@ struct BLEServiceCoreTests { ) let replay = try #require(victim.signPacket(unsigned), "Failed to sign replayed announce") #expect(ble._test_recordIngressIfNew(packet: replay, linkID: attackerLink)) - let rebindGate = VerifiedDirectRebindGate() - ble._test_afterVerifiedDirectRebindEnqueued = rebindGate.pause - defer { - rebindGate.release() - ble._test_afterVerifiedDirectRebindEnqueued = nil - } ble._test_handlePacket(replay, fromPeerID: victimPeerID, preseedPeer: false) - let announcePaused = await TestHelpers.waitUntil( - { rebindGate.hasPaused }, + // The rebind, its Noise-proof retirement, and the ordinary + // reconnect preparation are one engine slot: no observer can see + // the new binding while the victim's stale sending keys are still + // available. Once the binding is visible, the keys must already be + // gone. + let rebound = await TestHelpers.waitUntil( + { ble._test_centralBinding(attackerLink) == victimPeerID }, timeout: TestConstants.longTimeout ) - try #require(announcePaused) - - // Rebind and ordinary reconnect preparation are one bleQueue - // critical section. Once the binding is visible, stale sending keys - // must already be unavailable. - #expect(ble._test_centralBinding(attackerLink) == victimPeerID) + try #require(rebound) #expect(!ble.canDeliverSecurely(to: victimPeerID)) - rebindGate.release() let outbound = OutboundPacketTap() ble._test_onOutboundPacket = { outbound.record($0) } @@ -1469,35 +1462,6 @@ private final class SessionReconcileCounter: @unchecked Sendable { } } -private final class VerifiedDirectRebindGate: @unchecked Sendable { - private let condition = NSCondition() - private var paused = false - private var released = false - - var hasPaused: Bool { - condition.lock() - defer { condition.unlock() } - return paused - } - - func pause() { - condition.lock() - paused = true - condition.broadcast() - while !released { - condition.wait() - } - condition.unlock() - } - - func release() { - condition.lock() - released = true - condition.broadcast() - condition.unlock() - } -} - private final class ReceivePacketHandoffGate: @unchecked Sendable { private let condition = NSCondition() private var paused = false diff --git a/docs/BLE-ARCHITECTURE-V3.md b/docs/BLE-ARCHITECTURE-V3.md index 60400ceb..d72df1bf 100644 --- a/docs/BLE-ARCHITECTURE-V3.md +++ b/docs/BLE-ARCHITECTURE-V3.md @@ -158,6 +158,39 @@ throughput is nowhere near what one serial queue sustains. (it makes no peer decisions); (b) bindings + link-auth migrate to the engine, converting `readLinkState` callers; (c) the delegates shrink to event emission and move behind the port. + + **(a) and (b) are done.** (a) landed as `BLERadioController` + (#1539). (b) landed in two steps: #1540 cohered the loose maps into + `BLELinkAuthState` + `BLELinkBindings` (still bleQueue-owned, + behavior-identical), and the option-B flip then moved ownership to + the engine. Since the flip: + + - `linkAuth`/`linkBindings` are engine-owned behind a DEBUG + `dispatchPrecondition` trap; bleQueue code cannot touch them. + - The receive path is in its sans-I/O shape: bleQueue decodes + frames and hands `(packet, linkID)` up through + `ingestDecodedPacket` (which captures the panic lifecycle at the + handoff); `attributeAndHandlePacket` resolves the sender binding, + admits or rejects the claimed sender, applies raw-announce + binding, and records ingress — all on the engine. Per-link frame + order is preserved end to end (both queues are serial), which + supersedes the old batch-local TOCTOU binding. + - The rotation rebind is one engine slot + (`rebindLinkAfterVerifiedDirectAnnounce`): containment checks, + proof retirement, binding flip, reconnect decision, and + rotated-identity retirement, with only CoreBluetooth cancels + hopping to bleQueue. + - Authenticated-send eligibility (`notifyOrEnqueueIfAccepted`, + `writeOrEnqueueIfAccepted`) is checked on the engine — serialized + against rebinds by construction — and only the physical admission + (updateValue / write / backpressure queues) runs on bleQueue. + - Teardown splits: bleQueue delegates do physical work inline + (`discardPeripheralLinkPhysical`) and queue the identity half + (`retirePeripheralLinkIdentity`, binding survivor repair) to the + engine. A binding can briefly outlive its physical link; queries + that need liveness join against the physical store via + `readLinkState` (the engine→bleQueue sync direction), and the + queued retirement converges the two. 2. **Sans-I/O engine core + simulator.** Make the engine formally `handle(event) -> [Effect]`, feed it from a `SimulatedLinkLayer`, and move the multi-node E2E suite onto deterministic simulation (no From cdebdd9347f133d463a2f86e41810766391c44e1 Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Thu, 30 Jul 2026 01:14:19 +0100 Subject: [PATCH 03/23] Link layer slice 4: deterministic multi-node mesh simulation (and the panic-announce bug it caught) (#1548) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Cohere per-link Noise auth and rebind containment into BLELinkAuthState The authenticated-link owners, the reconnect revalidation policy, and the two rebind-containment cooldowns were four loose bleQueue-owned maps whose invariants lived in call-site discipline: every teardown path had to remember to retire the proof AND close the revalidation epoch (the pair appeared seven times), and both cooldowns hand-rolled the same prune-check-record dance. BLELinkAuthState owns them as whole transitions — retireLink, retireLinks(ownedBy:), permitRebind, permitRedundantRetirement — with the ownership question (bleQueue today, engine after the option-B flip) answered in one place. No behavior change; the one call-site reordering (redundant retirement computes the survivor before the cooldown check instead of after) is outcome-equivalent since the cooldown only ever recorded when a survivor existed. Co-Authored-By: Claude Fable 5 * Split identity-link bindings out of the physical link store BLELinkStateStore owned two different kinds of truth: what physical links exist (CB handles, connect lifecycles, characteristics, stream assemblers) and who each link belongs to (peer bindings in both roles plus the preferred-peripheral reverse map for directed sends and fanout collapse). The bindings now live on BLELinkBindings — same bleQueue ownership, whole-transition methods, direct tests for the rotation reverse-map cleanup and the preferred-link survivor repair that were previously only exercised end to end. Composed operations that need both truths (remove-with-repair, direct link state, the subscribed- central snapshot, bind-only-live-links) live on the transport as explicitly bleQueue-confined helpers. This is the structural half of the option-B boundary flip (docs/BLE-ARCHITECTURE-V3.md): ownership of the bindings can now move to the engine without touching what-links-exist. An audit of every physical clear/remove found three sites (emergency clear, both unauthorized branches) that needed explicit binding-clear pairing under the split — each now clears both. Co-Authored-By: Claude Fable 5 * Fix iOS-gated constructors and preserve containment cooldowns on reset CI caught what the macOS SwiftPM build cannot see: two #if os(iOS) sites still passed the peerID field that slice B1 removed from BLEPeripheralLinkState (willRestoreState in BLEService and armPendingBackgroundConnects in BLERadioController). Both fixed and verified with a local iOS simulator xcodebuild. Codex also caught a real regression: BLELinkAuthState.removeAll() cleared the rebind/retirement cooldown maps, which the original panic and emergency reset paths deliberately left alive. A stable CoreBluetooth UUID must not earn a fresh rebind allowance just because the session state around it was wiped. removeAll() now clears only the proofs and revalidation epochs, and BLELinkAuthStateTests pins the survival invariant along with the other auth-state transitions. Co-Authored-By: Claude Fable 5 * Link layer slice 3: the option-B domain flip — bindings and link-auth move to the engine The identity domain (BLELinkBindings + BLELinkAuthState) is now owned by the engine queue, with a DEBUG dispatchPrecondition trapping any access from another queue. bleQueue keeps only physical link state. What changed shape: - Receive path is sans-I/O: bleQueue decodes frames and hands (packet, linkID) up through ingestDecodedPacket (panic lifecycle captured at the handoff); attributeAndHandlePacket resolves the sender binding, rejects spoofed senders, applies raw-announce binding, and records ingress on the engine. Per-link frame order is preserved end to end (both queues serial), which supersedes the old batch-local TOCTOU binding in the notification path. - The rotation rebind is one engine slot: containment checks, proof retirement, binding flip, reconnect decision, and rotated-identity retirement run straight-line; only CoreBluetooth cancels hop to bleQueue. The engine->bleQueue->engine ping-pong is gone, along with the _test_afterVerifiedDirectRebindEnqueued pause hook — the test that used it now asserts the atomicity directly (a paused engine wedged the old gate design into a three-queue deadlock). - Authenticated-send eligibility (notifyOrEnqueueIfAccepted, writeOrEnqueueIfAccepted) is checked on the engine, serialized against rebinds by construction; only physical admission (updateValue/write/backpressure) runs on bleQueue. - Teardown splits into discardPeripheralLinkPhysical (bleQueue, inline in the delegates) + retirePeripheralLinkIdentity (engine hop with survivor repair reading liveness via readLinkState). A binding can briefly outlive its physical link; liveness queries join against the physical store and the queued retirement converges the two. - Gossip delegate sends enter the engine via onEngine — safe because mesh.sync sits above the engine in the sync order (production engine code only async-dispatches into the manager). - checkPeerConnectivity rides an engine slot from the bleQueue maintenance tick. No wire changes. 1,974 tests green (parallel and serial), iOS simulator build clean, Periphery clean. Co-Authored-By: Claude Fable 5 * Link layer slice 4: deterministic multi-node mesh simulation — and the panic-announce bug it caught SimulatedMesh wires real CoreBluetooth-free BLEService engines edge-to-edge through the outbound packet tap and _test_ingestFrame (the production attribution path the B2 flip created), with per-edge synthetic link IDs and manual-scheduler time. Five multi-node tests run in ~40ms with no wall-clock waits: - announce exchange binds simulated links and connects peers - Noise sessions establish end-to-end (real crypto, both directions) - a public message relays across a line topology inside a TTL/frame budget (storm bound asserted) - an 8x duplicate flood delivers exactly once - a panic rotation rebinds the survivor's link exactly once and stays — the scenario that previously needed two phones and log archaeology Fidelity boundary (documented in the harness): no physical links, so fanout planning and backpressure are not exercised; attribution, binding, dedup, TTL, relay decisions, and sessions are the real engine code. The simulator found a real bug on its first run: the forced-announce throttle's lastSent survived a panic, so a rotation within bleForceAnnounceMinIntervalSeconds of the last announce silently swallowed the new identity's announce — leaving it invisible to the mesh until the next maintenance cycle. Today's device test only passed because the previous announce happened to be minutes old. BLEAnnounceThrottle gains reset(), called from the panic slot so the rotated identity owes no throttle debt; pinned by a unit test and the mesh rotation test. New DEBUG seams: _test_ingestFrame (production ingress attribution), _test_forceAnnounce, _test_fenceEngine. 1,980 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 --------- Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchat.xcodeproj/project.pbxproj | 13 +- .../Services/BLE/BLEAnnounceThrottle.swift | 9 + bitchat/Services/BLE/BLEService.swift | 26 +++ .../Services/BLEAnnounceThrottleTests.swift | 15 ++ bitchatTests/Simulation/SimulatedMesh.swift | 129 +++++++++++++ .../Simulation/SimulatedMeshTests.swift | 172 ++++++++++++++++++ docs/BLE-ARCHITECTURE-V3.md | 21 +++ 7 files changed, 377 insertions(+), 8 deletions(-) create mode 100644 bitchatTests/Simulation/SimulatedMesh.swift create mode 100644 bitchatTests/Simulation/SimulatedMeshTests.swift diff --git a/bitchat.xcodeproj/project.pbxproj b/bitchat.xcodeproj/project.pbxproj index e0738afc..d9239d66 100644 --- a/bitchat.xcodeproj/project.pbxproj +++ b/bitchat.xcodeproj/project.pbxproj @@ -94,7 +94,6 @@ isa = PBXFileSystemSynchronizedBuildFileExceptionSet; membershipExceptions = ( Info.plist, - bitchatShareExtension.entitlements, ); target = 57CA17A36A2532A6CFF367BB /* bitchatShareExtension */; }; @@ -379,6 +378,11 @@ E0A1B2C3D4E5F6012345678D /* relays/online_relays_gps.csv in Resources */, ); }; + 7E9B64F63F93443FB7BA12DF /* Resources */ = { + isa = PBXResourcesBuildPhase; + files = ( + ); + }; C5E027A42ECCDFD700BD6012 /* Resources */ = { isa = PBXResourcesBuildPhase; files = ( @@ -395,13 +399,6 @@ E0A1B2C3D4E5F6012345678E /* relays/online_relays_gps.csv in Resources */, ); }; - 7E9B64F63F93443FB7BA12DF /* Resources */ = { - isa = PBXResourcesBuildPhase; - buildActionMask = 2147483647; - files = ( - ); - runOnlyForDeploymentPostprocessing = 0; - }; /* End PBXResourcesBuildPhase section */ /* Begin PBXSourcesBuildPhase section */ diff --git a/bitchat/Services/BLE/BLEAnnounceThrottle.swift b/bitchat/Services/BLE/BLEAnnounceThrottle.swift index d6bf5490..4b064136 100644 --- a/bitchat/Services/BLE/BLEAnnounceThrottle.swift +++ b/bitchat/Services/BLE/BLEAnnounceThrottle.swift @@ -37,4 +37,13 @@ final class BLEAnnounceThrottle: @unchecked Sendable { return true } } + + /// Forgets the last-sent timestamp. A panic rotation calls this so the + /// new identity's first announce cannot be swallowed by the old + /// identity's throttle debt — otherwise a panic within the forced + /// minimum interval of the last announce leaves the rotated identity + /// invisible until the next maintenance cycle. + func reset() { + lock.withLock { lastSent = .distantPast } + } } diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index cd366608..75775e51 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -782,6 +782,11 @@ final class BLEService: NSObject { // rebind/retirement cooldowns deliberately survive (see // BLELinkAuthState.removeAll). linkAuth.removeAll() + // The new identity owes no announce-throttle debt: without this, + // a panic within the forced minimum interval of the last + // announce swallows the rotation announce and the new identity + // stays invisible until the next maintenance cycle. + announceThrottle.reset() // These callbacks belong to pre-panic transfer state. Invoking // them would let queued UI work recreate or resend wiped media. privateMediaSessions.panicReset() @@ -3353,6 +3358,27 @@ extension BLEService { } } + /// Simulated-link ingress: the full production attribution path — + /// binding lookup, spoof rejection, raw-announce binding, ingress + /// recording — for a frame arriving on a synthetic link. The + /// SimulatedMesh harness feeds every node through this, so multi-node + /// tests exercise the same engine code as CoreBluetooth ingress. + func _test_ingestFrame(_ packet: BitchatPacket, link: BLEIngressLinkID) { + ingestDecodedPacket(packet, link: link, linkDescription: "Simulated \(link)") + } + + /// Sends an unthrottled announce, exactly like the maintenance forced + /// path. SimulatedMesh uses this as the deterministic discovery step. + func _test_forceAnnounce() { + onEngine { sendAnnounceNow(forceSend: true) } + } + + /// Blocks until every engine slot enqueued so far has run — the + /// deterministic settling fence for simulated-mesh pumping. + func _test_fenceEngine() { + onEngine {} + } + func _test_emitTransportEvent( _ event: TransportEvent, completion: @escaping () -> Void, diff --git a/bitchatTests/Services/BLEAnnounceThrottleTests.swift b/bitchatTests/Services/BLEAnnounceThrottleTests.swift index 0ce23814..0e135a3b 100644 --- a/bitchatTests/Services/BLEAnnounceThrottleTests.swift +++ b/bitchatTests/Services/BLEAnnounceThrottleTests.swift @@ -68,6 +68,21 @@ struct BLEAnnounceThrottleTests { #expect(accepted.value == 1) #expect(throttle.elapsed(since: now.addingTimeInterval(3)) == 3) } + + @Test + func resetForgetsThrottleDebtSoARotationAnnounceIsNeverSwallowed() { + let throttle = BLEAnnounceThrottle( + normalMinimumInterval: 1, + forcedMinimumInterval: 1 + ) + let now = Date() + #expect(throttle.shouldSend(force: true, now: now)) + // A panic inside the forced window would be throttled... + #expect(!throttle.shouldSend(force: true, now: now.addingTimeInterval(0.2))) + // ...so the rotation resets the debt and announces immediately. + throttle.reset() + #expect(throttle.shouldSend(force: true, now: now.addingTimeInterval(0.3))) + } } private final class LockedCounter: @unchecked Sendable { diff --git a/bitchatTests/Simulation/SimulatedMesh.swift b/bitchatTests/Simulation/SimulatedMesh.swift new file mode 100644 index 00000000..47491d34 --- /dev/null +++ b/bitchatTests/Simulation/SimulatedMesh.swift @@ -0,0 +1,129 @@ +import BitFoundation +import Foundation +@testable import bitchat + +/// A deterministic multi-node mesh over real `BLEService` engines and no +/// CoreBluetooth: nodes are wired edge-to-edge through the outbound packet +/// tap and the production ingress-attribution path (`_test_ingestFrame`), +/// so announces bind links, signatures verify, Noise handshakes complete, +/// and rotation rebinds run exactly the engine code a radio would drive. +/// +/// Determinism model: outbound packets are buffered under a lock (the tap +/// fires on each sender's engine); the test thread pumps deliveries and +/// fences every engine between rounds. Timer-driven work (relay jitter, +/// deferred flushes) is released explicitly through each node's +/// `BLEEngineManualScheduler` via `advanceTime`. +/// +/// Fidelity boundary: there are no physical links, so per-link fanout +/// planning always reports failure to the sender (directed packets spool) +/// — every capture happens at the pre-planning tap. Protocol-level +/// behavior (attribution, binding, dedup, TTL, relay decisions, sessions) +/// is faithful; link-selection and backpressure behavior is not exercised. +final class SimulatedMesh { + struct Node { + let service: BLEService + let scheduler: BLEEngineManualScheduler + } + + private let lock = NSLock() + private var pendingDeliveries: [(from: Int, packet: BitchatPacket)] = [] + /// Total (packet, receiving-node) deliveries pumped — the storm bound. + private(set) var deliveredFrameCount = 0 + + private(set) var nodes: [Node] = [] + private var neighbors: [Set] = [] + + @discardableResult + func addNode(nickname: String) -> Node { + let keychain = MockKeychain() + let identityManager = MockIdentityManager(keychain) + let idBridge = NostrIdentityBridge(keychain: MockKeychainHelper()) + let scheduler = BLEEngineManualScheduler() + let service = BLEService( + keychain: keychain, + idBridge: idBridge, + identityManager: identityManager, + initializeBluetoothManagers: false, + engineScheduler: scheduler + ) + let index = nodes.count + let node = Node(service: service, scheduler: scheduler) + nodes.append(node) + neighbors.append([]) + service.setNickname(nickname) + service._test_onOutboundPacket = { [weak self] packet in + // Runs on the sender's engine; only buffer here — delivering + // inline would nest one engine inside another. + guard let self else { return } + self.lock.lock() + self.pendingDeliveries.append((from: index, packet: packet)) + self.lock.unlock() + } + return node + } + + func connect(_ a: Int, _ b: Int) { + neighbors[a].insert(b) + neighbors[b].insert(a) + } + + /// The synthetic link a frame from `sender` arrives on at `receiver`. + /// Stable per directed edge, like a CoreBluetooth central UUID. + func linkUUID(from sender: Int, at receiver: Int) -> String { + "SIM-\(sender)-TO-\(receiver)" + } + + func forceAnnounce(from index: Int) { + nodes[index].service._test_forceAnnounce() + pump() + } + + /// Pumps buffered deliveries until the mesh is quiescent: no pending + /// frames and every engine drained. Timer-deferred work stays pending + /// until `advanceTime`. + func pump(maxRounds: Int = 64) { + for _ in 0.. Int { + lock.lock() + defer { lock.unlock() } + return publicMessages.filter { $0 == content }.count + } + + func drainedPublicMessageCount(content: String, drains: Int = 50) async -> Int { + for _ in 0.. 0 { break } + await MainActor.run {} + } + return count(content: content) + } +} diff --git a/docs/BLE-ARCHITECTURE-V3.md b/docs/BLE-ARCHITECTURE-V3.md index d72df1bf..5dd2fbd8 100644 --- a/docs/BLE-ARCHITECTURE-V3.md +++ b/docs/BLE-ARCHITECTURE-V3.md @@ -201,6 +201,27 @@ throughput is nowhere near what one serial queue sustains. packet switch) ride this seam as handler-registered modules instead of getting closure-environment extractions now. + **The simulator half is done — simulator-first.** Because the B2 + receive path already hands `(packet, linkID)` up through one choke + point, `SimulatedMesh` (bitchatTests/Simulation/) wires real + CB-free `BLEService` engines edge-to-edge through the outbound tap + and `_test_ingestFrame` (the production attribution path), with + per-edge synthetic link IDs and manual-scheduler time. Five + deterministic multi-node tests run in ~40ms: announce/bind + convergence, end-to-end Noise establishment, line-topology relay + within a TTL/frame budget, duplicate-flood dedup, and the panic + rotation single-slot rebind + containment — the scenario that + previously required two phones. Fidelity boundary: no physical + links, so fanout planning/backpressure is not exercised; protocol + behavior is. On its first day the simulator found a real bug: the + forced-announce throttle survived panic, so a rotation within + `bleForceAnnounceMinIntervalSeconds` of the last announce left the + new identity invisible until the next maintenance cycle + (`BLEAnnounceThrottle.reset()` now runs in the panic slot). + Remaining from the original slice-C scope: the mechanical delegate + extraction behind explicit LinkEvent/LinkCommand types, and the + formal `handle(event) -> [Effect]` engine shape. + ## What this is not No wire changes: packet formats, signing (padding is signed), the From 4226f01503a14816bcaf45bd4161288034461ce3 Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Thu, 30 Jul 2026 09:27:34 +0100 Subject: [PATCH 04/23] =?UTF-8?q?Link=20layer=20slice=205:=20BLELinkEvent?= =?UTF-8?q?=20=E2=80=94=20the=20port=20has=20a=20name,=20the=20delegates?= =?UTF-8?q?=20have=20their=20own=20files=20(#1551)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Cohere per-link Noise auth and rebind containment into BLELinkAuthState The authenticated-link owners, the reconnect revalidation policy, and the two rebind-containment cooldowns were four loose bleQueue-owned maps whose invariants lived in call-site discipline: every teardown path had to remember to retire the proof AND close the revalidation epoch (the pair appeared seven times), and both cooldowns hand-rolled the same prune-check-record dance. BLELinkAuthState owns them as whole transitions — retireLink, retireLinks(ownedBy:), permitRebind, permitRedundantRetirement — with the ownership question (bleQueue today, engine after the option-B flip) answered in one place. No behavior change; the one call-site reordering (redundant retirement computes the survivor before the cooldown check instead of after) is outcome-equivalent since the cooldown only ever recorded when a survivor existed. Co-Authored-By: Claude Fable 5 * Split identity-link bindings out of the physical link store BLELinkStateStore owned two different kinds of truth: what physical links exist (CB handles, connect lifecycles, characteristics, stream assemblers) and who each link belongs to (peer bindings in both roles plus the preferred-peripheral reverse map for directed sends and fanout collapse). The bindings now live on BLELinkBindings — same bleQueue ownership, whole-transition methods, direct tests for the rotation reverse-map cleanup and the preferred-link survivor repair that were previously only exercised end to end. Composed operations that need both truths (remove-with-repair, direct link state, the subscribed- central snapshot, bind-only-live-links) live on the transport as explicitly bleQueue-confined helpers. This is the structural half of the option-B boundary flip (docs/BLE-ARCHITECTURE-V3.md): ownership of the bindings can now move to the engine without touching what-links-exist. An audit of every physical clear/remove found three sites (emergency clear, both unauthorized branches) that needed explicit binding-clear pairing under the split — each now clears both. Co-Authored-By: Claude Fable 5 * Fix iOS-gated constructors and preserve containment cooldowns on reset CI caught what the macOS SwiftPM build cannot see: two #if os(iOS) sites still passed the peerID field that slice B1 removed from BLEPeripheralLinkState (willRestoreState in BLEService and armPendingBackgroundConnects in BLERadioController). Both fixed and verified with a local iOS simulator xcodebuild. Codex also caught a real regression: BLELinkAuthState.removeAll() cleared the rebind/retirement cooldown maps, which the original panic and emergency reset paths deliberately left alive. A stable CoreBluetooth UUID must not earn a fresh rebind allowance just because the session state around it was wiped. removeAll() now clears only the proofs and revalidation epochs, and BLELinkAuthStateTests pins the survival invariant along with the other auth-state transitions. Co-Authored-By: Claude Fable 5 * Link layer slice 3: the option-B domain flip — bindings and link-auth move to the engine The identity domain (BLELinkBindings + BLELinkAuthState) is now owned by the engine queue, with a DEBUG dispatchPrecondition trapping any access from another queue. bleQueue keeps only physical link state. What changed shape: - Receive path is sans-I/O: bleQueue decodes frames and hands (packet, linkID) up through ingestDecodedPacket (panic lifecycle captured at the handoff); attributeAndHandlePacket resolves the sender binding, rejects spoofed senders, applies raw-announce binding, and records ingress on the engine. Per-link frame order is preserved end to end (both queues serial), which supersedes the old batch-local TOCTOU binding in the notification path. - The rotation rebind is one engine slot: containment checks, proof retirement, binding flip, reconnect decision, and rotated-identity retirement run straight-line; only CoreBluetooth cancels hop to bleQueue. The engine->bleQueue->engine ping-pong is gone, along with the _test_afterVerifiedDirectRebindEnqueued pause hook — the test that used it now asserts the atomicity directly (a paused engine wedged the old gate design into a three-queue deadlock). - Authenticated-send eligibility (notifyOrEnqueueIfAccepted, writeOrEnqueueIfAccepted) is checked on the engine, serialized against rebinds by construction; only physical admission (updateValue/write/backpressure) runs on bleQueue. - Teardown splits into discardPeripheralLinkPhysical (bleQueue, inline in the delegates) + retirePeripheralLinkIdentity (engine hop with survivor repair reading liveness via readLinkState). A binding can briefly outlive its physical link; liveness queries join against the physical store and the queued retirement converges the two. - Gossip delegate sends enter the engine via onEngine — safe because mesh.sync sits above the engine in the sync order (production engine code only async-dispatches into the manager). - checkPeerConnectivity rides an engine slot from the bleQueue maintenance tick. No wire changes. 1,974 tests green (parallel and serial), iOS simulator build clean, Periphery clean. Co-Authored-By: Claude Fable 5 * Link layer slice 4: deterministic multi-node mesh simulation — and the panic-announce bug it caught SimulatedMesh wires real CoreBluetooth-free BLEService engines edge-to-edge through the outbound packet tap and _test_ingestFrame (the production attribution path the B2 flip created), with per-edge synthetic link IDs and manual-scheduler time. Five multi-node tests run in ~40ms with no wall-clock waits: - announce exchange binds simulated links and connects peers - Noise sessions establish end-to-end (real crypto, both directions) - a public message relays across a line topology inside a TTL/frame budget (storm bound asserted) - an 8x duplicate flood delivers exactly once - a panic rotation rebinds the survivor's link exactly once and stays — the scenario that previously needed two phones and log archaeology Fidelity boundary (documented in the harness): no physical links, so fanout planning and backpressure are not exercised; attribution, binding, dedup, TTL, relay decisions, and sessions are the real engine code. The simulator found a real bug on its first run: the forced-announce throttle's lastSent survived a panic, so a rotation within bleForceAnnounceMinIntervalSeconds of the last announce silently swallowed the new identity's announce — leaving it invisible to the mesh until the next maintenance cycle. Today's device test only passed because the previous announce happened to be minutes old. BLEAnnounceThrottle gains reset(), called from the panic slot so the rotated identity owes no throttle debt; pinned by a unit test and the mesh rotation test. New DEBUG seams: _test_ingestFrame (production ingress attribution), _test_forceAnnounce, _test_fenceEngine. 1,980 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 * Link layer slice 5: name the port — BLELinkEvent, one engine entry, delegates in their own files The upward half of the link-layer port is now a type. BLELinkEvent enumerates everything the bleQueue link layer tells the engine: frameDecoded plus the four physical lifecycle transitions (peripheralLinkEnded, centralLinkEnded, allPeripheralLinksEnded, allCentralLinksEnded). Every bleQueue→engine crossing goes through emitLinkEvent into one engine consumer (handleLinkEvent) — the scattered messageQueue.async identity hops in the delegates collapse into event emission, and the engine-side retirement/bookkeeping logic now lives in one switch. The CoreBluetooth delegate extensions move to their own files as physical bookkeeping plus event emission: - BLEService+LinkLayerCentralRole.swift (CBCentralManagerDelegate + CBPeripheralDelegate) - BLEService+LinkLayerPeripheralRole.swift (CBPeripheralManagerDelegate + write accumulation) BLEService.swift drops from 7,836 to ~7,100 lines. The physical-domain members the role files share flip private→internal; the queue contract is enforced by the existing DEBUG traps and grep guards, not access control. (Two of the flips — isAppActive, logBluetoothStatus — only surfaced on the iOS build; macOS SwiftPM cannot see #if os(iOS) code. Verified with a local iOS simulator build.) The simulated mesh now drives lifecycle events through the identical enum a radio does: linkDropEventRetiresBindingAndReconnectHeals covers drop → identity retirement → last-link peer bookkeeping → re-announce heal, entirely through the port. New seam _test_resetAnnounceThrottle models elapsed wall-clock for the throttle (deliberately separate from _test_forceAnnounce so the panic-rotation test keeps its regression value: the production panic path must do its own reset). The panic test's containment re-announces reset throttles explicitly so those assertions exercise real delivered announces instead of silently throttled ones. noiseSessionEstablishesEndToEnd gains a bounded scheduler-time settle loop after a one-in-many parallel-suite flake (no wall-clock waits). Deliberately not done (recorded in docs/BLE-ARCHITECTURE-V3.md): a formal handle(event)->[Effect] system and further engine-domain file splits — both would flip the engine's private state to internal for cosmetic file counts; the effect formalization rides future feature- module extractions instead. 1,981 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 * Baseline logBluetoothStatus for the macOS Periphery scan Its callers are all inside #if os(iOS) (willRestoreState in both role files plus the app-state handlers), so the macOS-scheme scan sees the now-internal declaration with zero callers — the same class as the baselined candidateCount. Verified 1-USR diff; the previously private mangled variant was already baselined, which is why the pre-split scan never flagged it. Co-Authored-By: Claude Fable 5 --------- Co-authored-by: jack Co-authored-by: Claude Fable 5 --- .periphery.baseline.json | 2 +- bitchat/Services/BLE/BLELinkEvent.swift | 40 + .../BLE/BLEService+LinkLayerCentralRole.swift | 433 ++++++++ .../BLEService+LinkLayerPeripheralRole.swift | 320 ++++++ bitchat/Services/BLE/BLEService.swift | 973 +++--------------- bitchatTests/Simulation/SimulatedMesh.swift | 14 + .../Simulation/SimulatedMeshTests.swift | 44 +- docs/BLE-ARCHITECTURE-V3.md | 25 +- 8 files changed, 1009 insertions(+), 842 deletions(-) create mode 100644 bitchat/Services/BLE/BLELinkEvent.swift create mode 100644 bitchat/Services/BLE/BLEService+LinkLayerCentralRole.swift create mode 100644 bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift diff --git a/.periphery.baseline.json b/.periphery.baseline.json index af3885fb..9400fdf1 100644 --- a/.periphery.baseline.json +++ b/.periphery.baseline.json @@ -1 +1 @@ -{"v1":{"usrs":["param-buf-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-dataDir-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","param-len-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-socksPort-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","s:13BitFoundation16PeerCapabilitiesV8wifiBulkACvpZ","s:13BitFoundation18KeychainReadResultO18isRecoverableErrorSbvp","s:13BitFoundation23KeychainManagerProtocolP11secureClearyySSzF","s:18bitchatTests_macOS12MockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC11resetCountsyyF","s:18bitchatTests_macOS20TrackingMockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC25totalSecureClearCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC26secureClearStringCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC27_secureClearStringCallCount06_AB6D1M24FD239F2969C82F4108818260LLSivp","s:18bitchatTests_macOS24FailingCacheSaveKeychain33_22380C7A11A569A0B83FA83F34C498A7LLC11secureClearyySSzF","s:18bitchatTests_macOS24MockGeohashPresenceTimer33_483587EFB96650EE130EFB09BBA2A1AALLC7handleryycvp","s:3Tor0A7ManagerC21goDormantOnBackgroundyyF","s:7bitchat10AppRuntimeC24handleScreenshotCaptured33_C8B369AD8BC1D9963A50CEDA77A4332ALLyyF","s:7bitchat10AppRuntimeC33handleDidBecomeActiveNotificationyyF","s:7bitchat10BLEServiceC18logBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LLyySSF","s:7bitchat10BLEServiceC20centralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC22captureBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LL7contextySS_tF","s:7bitchat10BLEServiceC23peripheralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC29scheduleBluetoothStatusSample33_69191C53E68500C17D98DBCF2BDA7100LL5after7contextySd_SStF","s:7bitchat10QRScanViewV8isActiveSbvp","s:7bitchat15BLEPeerRegistryV5countSivp","s:7bitchat15KeychainManagerC11secureClearyySSzF","s:7bitchat15PaymentChipViewV7openURL33_10AC50641B1EBCD52E5092A2E521D236LL7SwiftUI13OpenURLActionVvp","s:7bitchat15TransportConfigO29uiBatchDispatchStaggerSecondsSdvpZ","s:7bitchat15TransportConfigO35uiShareExtensionDismissDelaySecondsSdvpZ","s:7bitchat15TransportConfigO38bleBackgroundPendingConnectSlotReserveSivpZ","s:7bitchat17GossipSyncManagerC10persistNowyyF","s:7bitchat17NostrRelayManagerC15InboundEventKey33_E4160FE8A9A2C9D6308EAAD5A8B5CB07LLV7eventIDSSvp","s:7bitchat18BLERadioControllerC14candidateCountSivp","s:7bitchat25LocationNotesDependenciesV3now10Foundation4DateVycvp","s:7bitchat25NWPathReachabilityMonitorC7monitor33_84633C9DBCAF57538179C1E04DB8E015LL7Network0bD0CSgvp"]}} \ No newline at end of file +{"v1":{"usrs":["param-buf-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-dataDir-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","param-len-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-socksPort-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","s:13BitFoundation16PeerCapabilitiesV8wifiBulkACvpZ","s:13BitFoundation18KeychainReadResultO18isRecoverableErrorSbvp","s:13BitFoundation23KeychainManagerProtocolP11secureClearyySSzF","s:18bitchatTests_macOS12MockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC11resetCountsyyF","s:18bitchatTests_macOS20TrackingMockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC25totalSecureClearCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC26secureClearStringCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC27_secureClearStringCallCount06_AB6D1M24FD239F2969C82F4108818260LLSivp","s:18bitchatTests_macOS24FailingCacheSaveKeychain33_22380C7A11A569A0B83FA83F34C498A7LLC11secureClearyySSzF","s:18bitchatTests_macOS24MockGeohashPresenceTimer33_483587EFB96650EE130EFB09BBA2A1AALLC7handleryycvp","s:3Tor0A7ManagerC21goDormantOnBackgroundyyF","s:7bitchat10AppRuntimeC24handleScreenshotCaptured33_C8B369AD8BC1D9963A50CEDA77A4332ALLyyF","s:7bitchat10AppRuntimeC33handleDidBecomeActiveNotificationyyF","s:7bitchat10BLEServiceC18logBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LLyySSF","s:7bitchat10BLEServiceC18logBluetoothStatusyySSF","s:7bitchat10BLEServiceC20centralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC22captureBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LL7contextySS_tF","s:7bitchat10BLEServiceC23peripheralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC29scheduleBluetoothStatusSample33_69191C53E68500C17D98DBCF2BDA7100LL5after7contextySd_SStF","s:7bitchat10QRScanViewV8isActiveSbvp","s:7bitchat15BLEPeerRegistryV5countSivp","s:7bitchat15KeychainManagerC11secureClearyySSzF","s:7bitchat15PaymentChipViewV7openURL33_10AC50641B1EBCD52E5092A2E521D236LL7SwiftUI13OpenURLActionVvp","s:7bitchat15TransportConfigO29uiBatchDispatchStaggerSecondsSdvpZ","s:7bitchat15TransportConfigO35uiShareExtensionDismissDelaySecondsSdvpZ","s:7bitchat15TransportConfigO38bleBackgroundPendingConnectSlotReserveSivpZ","s:7bitchat17GossipSyncManagerC10persistNowyyF","s:7bitchat17NostrRelayManagerC15InboundEventKey33_E4160FE8A9A2C9D6308EAAD5A8B5CB07LLV7eventIDSSvp","s:7bitchat18BLERadioControllerC14candidateCountSivp","s:7bitchat25LocationNotesDependenciesV3now10Foundation4DateVycvp","s:7bitchat25NWPathReachabilityMonitorC7monitor33_84633C9DBCAF57538179C1E04DB8E015LL7Network0bD0CSgvp"]}} \ No newline at end of file diff --git a/bitchat/Services/BLE/BLELinkEvent.swift b/bitchat/Services/BLE/BLELinkEvent.swift new file mode 100644 index 00000000..fdc8a6da --- /dev/null +++ b/bitchat/Services/BLE/BLELinkEvent.swift @@ -0,0 +1,40 @@ +import BitFoundation +import Foundation + +/// The upward half of the link-layer port: everything the bleQueue link +/// layer tells the engine, as one enumerable surface with one engine +/// entry point (`BLEService.handleLinkEvent`). CoreBluetooth delegates +/// shrink to physical bookkeeping plus event emission, and the simulated +/// mesh drives the engine through exactly the same seam. +/// +/// Naming follows the physical stores: a *peripheral link* is a +/// connection we own as central (keyed by the remote peripheral's UUID); +/// a *central link* is a remote central subscribed to our peripheral role +/// (keyed by its UUID). +enum BLELinkEvent { + /// A decoded frame arrived on a link. Attribution — binding lookup, + /// spoof rejection, raw-announce binding, ingress recording — is + /// engine work. Emission captures the panic lifecycle at the handoff. + case frameDecoded(BitchatPacket, link: BLEIngressLinkID, linkDescription: String) + + /// One peripheral link ended (disconnect, connect failure, or radio + /// policy teardown). The engine retires the link's identity half — + /// proof, epoch, binding with survivor repair — and, when + /// `runPeerBookkeeping` is set (real disconnects), marks the peer + /// disconnected once its last live link is gone and republishes the + /// peer list. + case peripheralLinkEnded(peripheralID: String, runPeerBookkeeping: Bool) + + /// A remote central unsubscribed. The engine retires the central + /// link's identity half and runs last-link peer bookkeeping. + case centralLinkEnded(centralUUID: String) + + /// The central role reset and every peripheral link is gone + /// (power-off retires proofs and notifies peers; an authorization + /// loss only drops the bindings). + case allPeripheralLinksEnded(peripheralIDs: [String], retireProofsAndNotify: Bool) + + /// The peripheral role reset and every central link is gone (same + /// power-off / authorization-loss split). + case allCentralLinksEnded(centralUUIDs: [String], retireProofsAndNotify: Bool) +} diff --git a/bitchat/Services/BLE/BLEService+LinkLayerCentralRole.swift b/bitchat/Services/BLE/BLEService+LinkLayerCentralRole.swift new file mode 100644 index 00000000..bf45a5dc --- /dev/null +++ b/bitchat/Services/BLE/BLEService+LinkLayerCentralRole.swift @@ -0,0 +1,433 @@ +// +// BLEService+LinkLayerCentralRole.swift +// bitchat +// +// This is free and unencumbered software released into the public domain. +// For more information, see +// + +import BitFoundation +import BitLogger +import CoreBluetooth +import Foundation + +// The bleQueue half of the link layer: CoreBluetooth delegate callbacks do +// physical bookkeeping (link-state store, buffers, radio policy) and report +// everything else to the engine through the link-event port +// (BLELinkEvent / emitLinkEvent). See docs/BLE-ARCHITECTURE-V3.md. + +// MARK: - CBCentralManagerDelegate + +extension BLEService: CBCentralManagerDelegate { + #if os(iOS) + func centralManager(_ central: CBCentralManager, willRestoreState dict: [String: Any]) { + let restoredPeripherals = (dict[CBCentralManagerRestoredStatePeripheralsKey] as? [CBPeripheral]) ?? [] + guard !isPanicSuspended else { + central.stopScan() + restoredPeripherals.forEach { + central.cancelPeripheralConnection($0) + } + return + } + let restoredServices = (dict[CBCentralManagerRestoredStateScanServicesKey] as? [CBUUID]) ?? [] + let restoredOptions = (dict[CBCentralManagerRestoredStateScanOptionsKey] as? [String: Any]) ?? [:] + let allowDuplicates = restoredOptions[CBCentralManagerScanOptionAllowDuplicatesKey] as? Bool + + SecureLogger.info( + "♻️ Central restore: peripherals=\(restoredPeripherals.count) services=\(restoredServices.count) allowDuplicates=\(String(describing: allowDuplicates))", + category: .session + ) + + for peripheral in restoredPeripherals { + let identifier = peripheral.identifier.uuidString + peripheral.delegate = self + let existing = linkStateStore.state(forPeripheralID: identifier) + let assembler = existing?.assembler ?? NotificationStreamAssembler() + let characteristic = existing?.characteristic + let wasConnecting = existing?.isConnecting ?? false + let wasConnected = existing?.isConnected ?? false + + let restoredState = BLEPeripheralLinkState( + peripheral: peripheral, + characteristic: characteristic, + isConnecting: wasConnecting || peripheral.state == .connecting, + isConnected: wasConnected || peripheral.state == .connected, + lastConnectionAttempt: existing?.lastConnectionAttempt, + assembler: assembler + ) + linkStateStore.setPeripheralState(restoredState, for: identifier) + + // Restored peripherals are the freshest wake-on-proximity + // candidates we have after a relaunch — without this the cache + // starts empty and backgrounding right after a restore arms + // nothing. Service rediscovery for restored-connected links waits + // for poweredOn: CoreBluetooth drops commands issued during + // restoration (API MISUSE warnings). + radio.recordRecentPeripheral(peripheral, peripheralID: identifier, at: Date()) + } + + // Via the sampler (not a direct capture): it refreshes the cached + // background budget on main first, so the restore log shows the real + // wake window instead of the init sentinel. + logBluetoothStatus("central-restore") + + if central.state == .poweredOn { + radio.startScanning() + } + } + #endif + + func centralManagerDidUpdateState(_ central: CBCentralManager) { + emitTransportEvent(.bluetoothStateUpdated(central.state)) + + switch central.state { + case .poweredOn: + guard !isPanicSuspended else { + central.stopScan() + return + } + // Links restored as connected have no characteristic in the new + // process; without rediscovery they sit connected-but-unusable + // until the peer disconnects. Runs here (not willRestoreState) + // because commands issued before poweredOn are dropped. + for state in linkStateStore.peripheralStates where state.isConnected + && state.characteristic == nil + && state.peripheral.state == .connected { + SecureLogger.info("♻️ Rediscovering services on restored link: \(state.peripheral.identifier.uuidString.prefix(8))…", category: .session) + state.peripheral.discoverServices([BLEService.serviceUUID]) + } + + // Start scanning - use allow duplicates for faster discovery when active + radio.startScanning() + + case .poweredOff: + // CoreBluetooth has already transitioned out of poweredOn. Do + // not issue stop/cancel commands now; they are rejected as API + // misuse. Retire our link state locally instead. + SecureLogger.info("📴 Bluetooth powered off - cleaning up central state", category: .session) + let peripheralIDs = linkStateStore.peripheralStates.map { $0.peripheral.identifier.uuidString } + for peripheralID in peripheralIDs { + pendingPeripheralWrites.discardAll(for: peripheralID) + } + linkStateStore.clearPeripherals() + emitLinkEvent(.allPeripheralLinksEnded(peripheralIDs: peripheralIDs, retireProofsAndNotify: true)) + + case .unauthorized: + // User denied Bluetooth permission + SecureLogger.warning("🚫 Bluetooth unauthorized - user denied permission", category: .session) + linkStateStore.clearPeripherals() + emitLinkEvent(.allPeripheralLinksEnded(peripheralIDs: [], retireProofsAndNotify: false)) + + case .unsupported: + // Device doesn't support BLE + SecureLogger.error("❌ Bluetooth LE not supported on this device", category: .session) + + case .resetting: + // Bluetooth stack is resetting - will get another state update when done + SecureLogger.info("🔄 Bluetooth stack resetting...", category: .session) + + case .unknown: + // Initial state before we know the actual state + SecureLogger.debug("❓ Bluetooth state unknown (initializing)", category: .session) + + @unknown default: + SecureLogger.warning("⚠️ Unknown Bluetooth state: \(central.state.rawValue)", category: .session) + } + } + + + func centralManager(_ central: CBCentralManager, didDiscover peripheral: CBPeripheral, advertisementData: [String: Any], rssi RSSI: NSNumber) { + radio.handleDiscovery(peripheral, advertisementData: advertisementData, rssi: RSSI) + } + + func centralManager(_ central: CBCentralManager, didConnect peripheral: CBPeripheral) { + guard !isPanicSuspended else { + central.cancelPeripheralConnection(peripheral) + return + } + let peripheralID = peripheral.identifier.uuidString + + #if os(iOS) + // A connect completing while backgrounded is the wake-on-proximity + // path doing its job — worth an info line for field verification. + if !isAppActive { + SecureLogger.info("🌙 Background wake: connected to \(peripheral.name ?? peripheralID) while backgrounded", category: .session) + } + #endif + + // Update state to connected + linkStateStore.markConnected(peripheral) + + // Reset backoff state on success + radio.recordConnectionSuccess(peripheralID: peripheralID) + + SecureLogger.debug("✅ Connected: \(peripheral.name ?? "Unknown") [\(peripheralID)]", category: .session) + + // Discover services + peripheral.discoverServices([BLEService.serviceUUID]) + } + + func centralManager(_ central: CBCentralManager, didDisconnectPeripheral peripheral: CBPeripheral, error: Error?) { + let peripheralID = peripheral.identifier.uuidString + + SecureLogger.debug("📱 Disconnect: \(peripheralID)\(error != nil ? " (\(error!.localizedDescription))" : "")", category: .session) + + // If disconnect carried an error (often timeout), apply short backoff to avoid thrash + if error != nil { + radio.recordDisconnectError(peripheralID: peripheralID, at: Date()) + } + + // Retain the handle: a dropped link is the best wake-on-proximity + // candidate if the app backgrounds before the peer returns. + radio.recordRecentPeripheral(peripheral, peripheralID: peripheralID, at: Date()) + + #if os(iOS) + // Link lost while backgrounded (peer walked away): re-arm a pending + // connect during this wake window so the peer's return wakes us again. + // Delayed past the disconnect-settle window to avoid reconnect thrash + // at range edge. + if !isAppActive { + bleQueue.asyncAfter(deadline: .now() + TransportConfig.bleDisconnectDiscoveryIgnoreSeconds) { [weak self] in + guard let self, !self.isAppActive else { return } + // Reserve 0: use the slot this disconnect freed even in a + // dense mesh, so the lost peer can wake us when it returns. + self.radio.armPendingBackgroundConnects(slotReserve: 0) + } + } + #endif + + // Physical teardown now; identity retirement and peer-disconnect + // bookkeeping ride the link-event port. The scan restart and + // connect-slot refill below stay on bleQueue — they respond to + // the physical drop regardless of remaining logical links. + discardPeripheralLinkPhysical(peripheralID) + emitLinkEvent(.peripheralLinkEnded(peripheralID: peripheralID, runPeerBookkeeping: true)) + + // Restart scanning with allow duplicates for faster rediscovery + if centralManager?.state == .poweredOn { + // Stop and restart scanning to ensure we get fresh discovery events + centralManager?.stopScan() + bleQueue.asyncAfter(deadline: .now() + TransportConfig.bleRestartScanDelaySeconds) { [weak self] in + self?.radio.startScanning() + } + } + // Attempt to fill freed slot from queue + bleQueue.async { [weak self] in self?.radio.tryConnectFromQueue() } + } + + func centralManager(_ central: CBCentralManager, didFailToConnect peripheral: CBPeripheral, error: Error?) { + let peripheralID = peripheral.identifier.uuidString + + // Clean up the references: physical now, identity via the port. + discardPeripheralLinkPhysical(peripheralID) + emitLinkEvent(.peripheralLinkEnded(peripheralID: peripheralID, runPeerBookkeeping: false)) + + SecureLogger.error("❌ Failed to connect to peripheral: \(peripheral.name ?? "Unknown") [\(peripheralID)] - Error: \(error?.localizedDescription ?? "Unknown")", category: .session) + radio.recordConnectionFailure(peripheralID: peripheralID) + // Try next candidate + bleQueue.async { [weak self] in self?.radio.tryConnectFromQueue() } + } +} + +// MARK: - CBPeripheralDelegate + +extension BLEService: CBPeripheralDelegate { + func peripheral(_ peripheral: CBPeripheral, didDiscoverServices error: Error?) { + guard !isPanicSuspended else { return } + if let error = error { + SecureLogger.error("❌ Error discovering services for \(peripheral.name ?? "Unknown"): \(error.localizedDescription)", category: .session) + // Retry service discovery after a delay + DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) { + guard peripheral.state == .connected else { return } + peripheral.discoverServices([BLEService.serviceUUID]) + } + return + } + + guard let services = peripheral.services else { + SecureLogger.warning("⚠️ No services discovered for \(peripheral.name ?? "Unknown")", category: .session) + return + } + + guard let service = services.first(where: { $0.uuid == BLEService.serviceUUID }) else { + // Not a BitChat peer - disconnect + centralManager?.cancelPeripheralConnection(peripheral) + return + } + + // Discovering BLE characteristics + peripheral.discoverCharacteristics([BLEService.characteristicUUID], for: service) + } + + func peripheral(_ peripheral: CBPeripheral, didDiscoverCharacteristicsFor service: CBService, error: Error?) { + guard !isPanicSuspended else { return } + if let error = error { + SecureLogger.error("❌ Error discovering characteristics for \(peripheral.name ?? "Unknown"): \(error.localizedDescription)", category: .session) + return + } + + guard let characteristic = service.characteristics?.first(where: { $0.uuid == BLEService.characteristicUUID }) else { + SecureLogger.warning("⚠️ No matching characteristic found for \(peripheral.name ?? "Unknown")", category: .session) + return + } + + // Found characteristic + + // Log characteristic properties for debugging + var properties: [String] = [] + if characteristic.properties.contains(.read) { properties.append("read") } + if characteristic.properties.contains(.write) { properties.append("write") } + if characteristic.properties.contains(.writeWithoutResponse) { properties.append("writeWithoutResponse") } + if characteristic.properties.contains(.notify) { properties.append("notify") } + if characteristic.properties.contains(.indicate) { properties.append("indicate") } + // Characteristic properties: \(properties.joined(separator: ", ")) + + // Verify characteristic supports reliable writes + if !characteristic.properties.contains(.write) { + SecureLogger.warning("⚠️ Characteristic doesn't support reliable writes (withResponse)!", category: .session) + } + + // Store characteristic in our consolidated structure + let peripheralID = peripheral.identifier.uuidString + linkStateStore.updateCharacteristic(characteristic, forPeripheralID: peripheralID) + + // Subscribe for notifications + if characteristic.properties.contains(.notify) { + peripheral.setNotifyValue(true, for: characteristic) + SecureLogger.debug("🔔 Subscribed to notifications from \(peripheral.name ?? "Unknown")", category: .session) + + // Send announce after subscription is confirmed (force send for new connection) + engineScheduler.schedule(after: TransportConfig.blePostSubscribeAnnounceDelaySeconds) { [weak self] in + self?.sendAnnounce(forceSend: true) + // Try flushing any spooled directed packets now that we have a link + self?.flushDirectedSpool() + } + } else { + SecureLogger.warning("⚠️ Characteristic does not support notifications", category: .session) + } + } + + func peripheral(_ peripheral: CBPeripheral, didUpdateValueFor characteristic: CBCharacteristic, error: Error?) { + guard !isPanicSuspended else { return } + if let error = error { + SecureLogger.error("❌ Error receiving notification: \(error.localizedDescription)", category: .session) + return + } + + guard let data = characteristic.value, !data.isEmpty else { + SecureLogger.warning("⚠️ No data in notification", category: .session) + return + } + + bufferNotificationChunk(data, from: peripheral) + } + + private func bufferNotificationChunk(_ chunk: Data, from peripheral: CBPeripheral) { + let peripheralUUID = peripheral.identifier.uuidString + + var state = linkStateStore.state(forPeripheralID: peripheralUUID) ?? BLEPeripheralLinkState( + peripheral: peripheral, + characteristic: nil, + isConnecting: false, + isConnected: peripheral.state == .connected, + lastConnectionAttempt: nil, + assembler: NotificationStreamAssembler() + ) + + var assembler = state.assembler + let result = assembler.append(chunk) + state.assembler = assembler + linkStateStore.setPeripheralState(state, for: peripheralUUID) + + for byte in result.droppedPrefixes { + SecureLogger.warning("⚠️ Dropping byte from BLE stream (unexpected prefix \(String(format: "%02x", byte)))", category: .session) + } + + if result.reset { + SecureLogger.error("❌ Invalid BLE frame length; reset notification stream", category: .session) + } + + // Attribution — spoof rejection, announce binding, ingress + // recording — is engine work now (the engine owns the bindings). + // Frames hop up in decode order; the engine's serial slot ordering + // gives the same same-batch spoof protection the old bleQueue-side + // batch-local binding enforced: an announce that binds this link is + // attributed before every frame that rode behind it. + for frame in result.frames { + guard let packet = BinaryProtocol.decode(frame) else { + let prefix = frame.prefix(16).map { String(format: "%02x", $0) }.joined(separator: " ") + SecureLogger.error("❌ Failed to decode assembled notification frame (len=\(frame.count), prefix=\(prefix))", category: .session) + continue + } + emitLinkEvent(.frameDecoded( + packet, + link: .peripheral(peripheralUUID), + linkDescription: "Peripheral \(peripheralUUID.prefix(8))…" + )) + } + } + + func peripheral(_ peripheral: CBPeripheral, didWriteValueFor characteristic: CBCharacteristic, error: Error?) { + if let error = error { + SecureLogger.error("❌ Write failed to \(peripheral.name ?? peripheral.identifier.uuidString): \(error.localizedDescription)", category: .session) + // Don't retry - just log the error + } else { + SecureLogger.debug("✅ Write confirmed to \(peripheral.name ?? peripheral.identifier.uuidString)", category: .session) + } + } + + func peripheralIsReady(toSendWriteWithoutResponse peripheral: CBPeripheral) { + guard !isPanicSuspended else { return } + // Resume queued writes for this peripheral - called when canSendWriteWithoutResponse becomes true again + if logRateLimiter.shouldLog(key: "peripheral-ready:\(peripheral.identifier.uuidString)") { + SecureLogger.debug("📤 Peripheral \(peripheral.name ?? peripheral.identifier.uuidString.prefix(8).description) ready for more writes", category: .session) + } + drainPendingWrites(for: peripheral) + } + + func peripheral(_ peripheral: CBPeripheral, didModifyServices invalidatedServices: [CBService]) { + guard !isPanicSuspended else { return } + SecureLogger.warning("⚠️ Services modified for \(peripheral.name ?? peripheral.identifier.uuidString)", category: .session) + + let shouldRediscover = BLEService.shouldRediscoverBitChatService( + invalidatedServiceUUIDs: invalidatedServices.map(\.uuid), + cachedServiceUUIDs: peripheral.services?.map(\.uuid) + ) + + guard shouldRediscover else { return } + + let peripheralID = peripheral.identifier.uuidString + linkStateStore.updatePeripheral(peripheralID) { + $0.characteristic = nil + $0.assembler = NotificationStreamAssembler() + } + + SecureLogger.debug("🔄 BitChat service changed for \(peripheral.name ?? peripheral.identifier.uuidString), rediscovering", category: .session) + peripheral.discoverServices([BLEService.serviceUUID]) + } + + func peripheral(_ peripheral: CBPeripheral, didUpdateNotificationStateFor characteristic: CBCharacteristic, error: Error?) { + guard !isPanicSuspended else { return } + if let error = error { + SecureLogger.error("❌ Error updating notification state: \(error.localizedDescription)", category: .session) + } else { + SecureLogger.debug("🔔 Notification state updated for \(peripheral.name ?? peripheral.identifier.uuidString): \(characteristic.isNotifying ? "ON" : "OFF")", category: .session) + + // If notifications are now on, send an announce to ensure this peer knows about us + if characteristic.isNotifying { + // Sending announce after subscription + self.sendAnnounce(forceSend: true) + } + } + } + +} + +extension BLEService { + static func shouldRediscoverBitChatService( + invalidatedServiceUUIDs: [CBUUID], + cachedServiceUUIDs: [CBUUID]? + ) -> Bool { + invalidatedServiceUUIDs.contains(serviceUUID) || cachedServiceUUIDs?.contains(serviceUUID) != true + } +} diff --git a/bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift b/bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift new file mode 100644 index 00000000..c55c30e4 --- /dev/null +++ b/bitchat/Services/BLE/BLEService+LinkLayerPeripheralRole.swift @@ -0,0 +1,320 @@ +// +// BLEService+LinkLayerPeripheralRole.swift +// bitchat +// +// This is free and unencumbered software released into the public domain. +// For more information, see +// + +import BitFoundation +import BitLogger +import CoreBluetooth +import Foundation + +// The bleQueue half of the link layer: CoreBluetooth delegate callbacks do +// physical bookkeeping (link-state store, buffers, radio policy) and report +// everything else to the engine through the link-event port +// (BLELinkEvent / emitLinkEvent). See docs/BLE-ARCHITECTURE-V3.md. + +// MARK: - CBPeripheralManagerDelegate + +extension BLEService: CBPeripheralManagerDelegate { + func peripheralManagerDidUpdateState(_ peripheral: CBPeripheralManager) { + SecureLogger.debug("📡 Peripheral manager state: \(peripheral.state.rawValue)", category: .session) + + switch peripheral.state { + case .poweredOn: + guard !isPanicSuspended else { + peripheral.stopAdvertising() + peripheral.removeAllServices() + characteristic = nil + return + } + // Remove all services first to ensure clean state + peripheral.removeAllServices() + + // Create characteristic + characteristic = CBMutableCharacteristic( + type: BLEService.characteristicUUID, + properties: [.notify, .write, .writeWithoutResponse, .read], + value: nil, + permissions: [.readable, .writeable] + ) + + // Create service + let service = CBMutableService(type: BLEService.serviceUUID, primary: true) + service.characteristics = [characteristic!] + + // Add service (advertising will start in didAdd delegate) + SecureLogger.debug("🔧 Adding BLE service...", category: .session) + peripheral.add(service) + + case .poweredOff: + // Bluetooth was turned off - clean up peripheral state + SecureLogger.info("📴 Bluetooth powered off - cleaning up peripheral state", category: .session) + // Clear subscribed centrals (they are now invalid) + let centralIDs = linkStateStore.subscribedCentrals.map { $0.identifier.uuidString } + pendingNotifications.removeAll() + pendingWriteBuffers.removeAll() + linkStateStore.clearCentrals() + subscriptionAnnounceLimiter.removeAll() + characteristic = nil + emitLinkEvent(.allCentralLinksEnded(centralUUIDs: centralIDs, retireProofsAndNotify: true)) + + case .unauthorized: + // User denied Bluetooth permission + SecureLogger.warning("🚫 Bluetooth unauthorized for peripheral role", category: .session) + linkStateStore.clearCentrals() + subscriptionAnnounceLimiter.removeAll() + characteristic = nil + emitLinkEvent(.allCentralLinksEnded(centralUUIDs: [], retireProofsAndNotify: false)) + + case .unsupported: + // Device doesn't support BLE peripheral role + SecureLogger.error("❌ Bluetooth LE peripheral role not supported", category: .session) + + case .resetting: + // Bluetooth stack is resetting + SecureLogger.info("🔄 Bluetooth peripheral stack resetting...", category: .session) + + case .unknown: + SecureLogger.debug("❓ Peripheral Bluetooth state unknown (initializing)", category: .session) + + @unknown default: + SecureLogger.warning("⚠️ Unknown peripheral Bluetooth state: \(peripheral.state.rawValue)", category: .session) + } + } + + #if os(iOS) + func peripheralManager(_ peripheral: CBPeripheralManager, willRestoreState dict: [String: Any]) { + guard !isPanicSuspended else { + peripheral.stopAdvertising() + peripheral.removeAllServices() + characteristic = nil + return + } + let restoredServices = (dict[CBPeripheralManagerRestoredStateServicesKey] as? [CBMutableService]) ?? [] + let restoredAdvertisement = (dict[CBPeripheralManagerRestoredStateAdvertisementDataKey] as? [String: Any]) ?? [:] + + SecureLogger.info( + "♻️ Peripheral restore: services=\(restoredServices.count) advertisingDataKeys=\(Array(restoredAdvertisement.keys))", + category: .session + ) + + // Attempt to recover characteristic from restored services + if characteristic == nil { + if let service = restoredServices.first(where: { $0.uuid == BLEService.serviceUUID }), + let restoredCharacteristic = service.characteristics?.first(where: { $0.uuid == BLEService.characteristicUUID }) as? CBMutableCharacteristic { + characteristic = restoredCharacteristic + } + } + + // Via the sampler for a fresh background budget (see central-restore). + logBluetoothStatus("peripheral-restore") + + if peripheral.state == .poweredOn && !peripheral.isAdvertising { + peripheral.startAdvertising(BLERadioController.advertisementData()) + } + } + #endif + + func peripheralManager(_ peripheral: CBPeripheralManager, didAdd service: CBService, error: Error?) { + guard !isPanicSuspended else { + peripheral.stopAdvertising() + return + } + if let error = error { + SecureLogger.error("❌ Failed to add service: \(error.localizedDescription)", category: .session) + return + } + + SecureLogger.debug("✅ Service added successfully, starting advertising", category: .session) + + // Start advertising after service is confirmed added + let adData = BLERadioController.advertisementData() + peripheral.startAdvertising(adData) + + SecureLogger.debug("📡 Started advertising (LocalName: \((adData[CBAdvertisementDataLocalNameKey] as? String) != nil ? "on" : "off"), ID: \(myPeerID.id.prefix(8))…)", category: .session) + } + + func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didSubscribeTo characteristic: CBCharacteristic) { + guard !isPanicSuspended else { return } + let centralUUID = central.identifier.uuidString + SecureLogger.debug("📥 Central subscribed: \(centralUUID.prefix(8))…", category: .session) + linkStateStore.addSubscribedCentral(central) + + // BCH-01-004: Rate-limit subscription-triggered announces to prevent enumeration attacks + let now = Date() + switch subscriptionAnnounceLimiter.decision(for: centralUUID, now: now) { + case .allowed: + break + case let .rateLimited(backoffSeconds, attemptCount, suppressAnnounce): + SecureLogger.warning("🛡️ BCH-01-004: Rate-limited announce for central \(centralUUID.prefix(8))... (backoff: \(Int(backoffSeconds))s, attempts: \(attemptCount))", category: .security) + if suppressAnnounce { + SecureLogger.warning("🚨 BCH-01-004: Possible enumeration attack from central \(centralUUID.prefix(8))... - suppressing announce", category: .security) + return + } + + // Still flush directed packets for legitimate mesh operation + engineScheduler.schedule(after: TransportConfig.blePostAnnounceDelaySeconds) { [weak self] in + self?.flushDirectedSpool() + } + return + } + + // Send announce to the newly subscribed central after a small delay + engineScheduler.schedule(after: TransportConfig.blePostAnnounceDelaySeconds) { [weak self] in + self?.sendAnnounce(forceSend: true) + // Flush any spooled directed packets now that we have a central subscribed + self?.flushDirectedSpool() + } + } + + func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didUnsubscribeFrom characteristic: CBCharacteristic) { + let centralID = central.identifier.uuidString + SecureLogger.debug("📤 Central unsubscribed: \(centralID.prefix(8))…", category: .session) + // bleQueue: physical retirement now. + pendingNotifications.removeTarget { $0.identifier.uuidString == centralID } + linkStateStore.removeSubscribedCentral(central) + + // Ensure we're still advertising for other devices to find us + if !isPanicSuspended, peripheral.isAdvertising == false { + SecureLogger.debug("📡 Restarting advertising after central unsubscribed", category: .session) + peripheral.startAdvertising(BLERadioController.advertisementData()) + } + + // Identity retirement and peer-disconnect bookkeeping ride the + // link-event port. + emitLinkEvent(.centralLinkEnded(centralUUID: centralID)) + } + + func peripheralManagerIsReady(toUpdateSubscribers peripheral: CBPeripheralManager) { + guard !isPanicSuspended else { return } + drainPendingNotifications(logPrefix: "✅ Sent") + } + + func logBackpressureSampled(_ message: @autoclosure () -> String) { + notificationBackpressureLogCount += 1 + if notificationBackpressureLogCount == 1 || + notificationBackpressureLogCount.isMultiple(of: TransportConfig.bleBackpressureLogInterval) { + SecureLogger.debug("\(message()) [backpressure event #\(notificationBackpressureLogCount)]", category: .session) + } + } + + func drainPendingNotifications(logPrefix: String) { + bleQueue.async { [weak self] in + guard let self = self, + let characteristic = self.characteristic, + !self.pendingNotifications.isEmpty else { return } + + let pending = self.pendingNotifications.takeAll() + let sentCount = self.sendPendingNotifications(pending, characteristic: characteristic) + + if sentCount > 0 { + self.logBackpressureSampled("\(logPrefix) \(sentCount) pending notifications from retry queue (\(self.pendingNotifications.count) still pending)") + } + } + } + + private func sendPendingNotifications(_ pending: [BLEPendingNotification], characteristic: CBMutableCharacteristic) -> Int { + var sentCount = 0 + + for (index, notification) in pending.enumerated() { + let success = peripheralManager?.updateValue( + notification.data, + for: characteristic, + onSubscribedCentrals: notification.targets + ) ?? false + + guard success else { + let remaining = Array(pending.dropFirst(index)) + pendingNotifications.prepend(remaining) + logBackpressureSampled("⚠️ Notification queue still full after \(sentCount) sent, re-queuing \(remaining.count) items") + break + } + + sentCount += 1 + } + + return sentCount + } + + func peripheralManager(_ peripheral: CBPeripheralManager, didReceiveWrite requests: [CBATTRequest]) { + // Suppress logs for single write requests to reduce noise + if requests.count > 1 { + SecureLogger.debug("📥 Received \(requests.count) write requests from central", category: .session) + } + + // IMPORTANT: Respond immediately to prevent timeouts! + // We must respond within a few milliseconds or the central will timeout + for request in requests { + peripheral.respond(to: request, withResult: .success) + } + guard !isPanicSuspended else { return } + + // Process writes. For long writes, CoreBluetooth may deliver multiple CBATTRequest values with offsets. + // Combine per-central request values by offset before decoding. + // Process directly on our message queue to match transport context + let grouped = Dictionary(grouping: requests, by: { $0.central.identifier.uuidString }) + for (centralUUID, group) in grouped { + // Sort by offset ascending + let sorted = group.sorted { $0.offset < $1.offset } + let hasMultiple = sorted.count > 1 || (sorted.first?.offset ?? 0) > 0 + let chunks = sorted.compactMap { request -> BLEInboundWriteChunk? in + guard let data = request.value, !data.isEmpty else { return nil } + return BLEInboundWriteChunk(offset: request.offset, data: data) + } + + let result = pendingWriteBuffers.append( + chunks: chunks, + for: centralUUID, + capBytes: TransportConfig.blePendingWriteBufferCapBytes + ) + + switch result { + case let .decoded(packet, metadata): + logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) + processDecodedCentralWrite(packet, centralUUID: centralUUID, central: sorted[0].central) + + case let .waiting(metadata): + logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) + logFailedSingleWriteIfNeeded(hasMultiple: hasMultiple, sortedRequests: sorted) + + case let .oversized(metadata): + logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) + SecureLogger.warning("⚠️ Dropping oversized pending write buffer (\(metadata.accumulatedBytes) bytes) for central \(centralUUID.prefix(8))…", category: .session) + logFailedSingleWriteIfNeeded(hasMultiple: hasMultiple, sortedRequests: sorted) + } + } + } + + private func logAccumulatedCentralWrite(_ metadata: BLEInboundWriteAppendMetadata, centralUUID: String) { + guard let packetType = metadata.packetType, + packetType != MessageType.announce.rawValue else { return } + + SecureLogger.debug( + "📥 Accumulated write from central \(centralUUID.prefix(8))…: size=\(metadata.accumulatedBytes) (+\(metadata.appendedBytes)) bytes (type=\(packetType)), offsets=\(metadata.offsets)", + category: .session + ) + } + + private func logFailedSingleWriteIfNeeded(hasMultiple: Bool, sortedRequests: [CBATTRequest]) { + guard !hasMultiple, let raw = sortedRequests.first?.value else { return } + + let prefix = raw.prefix(16).map { String(format: "%02x", $0) }.joined(separator: " ") + SecureLogger.error("❌ Failed to decode packet from central (len=\(raw.count), prefix=\(prefix))", category: .session) + } + + private func processDecodedCentralWrite(_ packet: BitchatPacket, centralUUID: String, central: CBCentral) { + // bleQueue: physical bookkeeping only. A writer is a live central + // whether or not it subscribed; track it so directed replies and + // the fanout planner can reach it. + linkStateStore.addSubscribedCentral(central) + // Attribution is engine work (the engine owns the bindings). + emitLinkEvent(.frameDecoded( + packet, + link: .central(centralUUID), + linkDescription: "Central \(centralUUID.prefix(8))…" + )) + } +} diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index 75775e51..1fb33389 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -204,7 +204,7 @@ final class BLEService: NSObject { // MARK: - Core State (5 Essential Collections) // 1. Consolidated BLE link tracking for both central and peripheral roles. - private var linkStateStore = BLELinkStateStore() + var linkStateStore = BLELinkStateStore() // The engine-owned identity domain: per-link Noise authentication + // rebind containment (courier handover needs the stronger fact that a @@ -237,7 +237,7 @@ final class BLEService: NSObject { } // BCH-01-004: Rate-limiting for subscription-triggered announces. - private var subscriptionAnnounceLimiter = BLESubscriptionAnnounceLimiter() + var subscriptionAnnounceLimiter = BLESubscriptionAnnounceLimiter() // 3. Peer Information (single source of truth). Lock-backed so the main // actor reads it directly instead of blocking on the engine queue. @@ -330,7 +330,7 @@ final class BLEService: NSObject { // Application state tracking (thread-safe) #if os(iOS) - private var isAppActive: Bool = true // Assume active initially + var isAppActive: Bool = true // Assume active initially /// Last `UIApplication.shared.backgroundTimeRemaining` sampled on the /// main thread, cached so bleQueue status logs can read it without ever /// dispatching to main (see `captureBluetoothStatus` for the invariant). @@ -344,9 +344,9 @@ final class BLEService: NSObject { // MARK: - Core BLE Objects - private var centralManager: CBCentralManager? - private var peripheralManager: CBPeripheralManager? - private var characteristic: CBMutableCharacteristic? + var centralManager: CBCentralManager? + var peripheralManager: CBPeripheralManager? + var characteristic: CBMutableCharacteristic? private let shouldInitializeBluetoothManagers: Bool private let panicLifecycleLock = NSLock() private var _isPanicSuspended: Bool @@ -377,8 +377,8 @@ final class BLEService: NSObject { private let messageQueueKey = DispatchSpecificKey() /// The only source of deferred engine work (see BLEEngineScheduling); /// injectable so tests drive protocol deadlines with a manual clock. - private let engineScheduler: BLEEngineScheduling - private let bleQueue = DispatchQueue(label: "mesh.bluetooth", qos: .userInitiated) + let engineScheduler: BLEEngineScheduling + let bleQueue = DispatchQueue(label: "mesh.bluetooth", qos: .userInitiated) private let bleQueueKey = DispatchSpecificKey() /// Runs `body` exclusively with respect to all engine-owned state. @@ -409,7 +409,7 @@ final class BLEService: NSObject { private var pendingNoiseSessionQueues = BLENoiseSessionQueues() // Queue for notifications that failed due to full queue (bleQueue-owned, // like the link state store: every producer and drain runs there). - private var pendingNotifications = BLEOutboundNotificationBuffer() + var pendingNotifications = BLEOutboundNotificationBuffer() // Backpressure logging fires per fragment during media transfers // (hundreds of lines per image); sampled via this counter, which is // only touched on bleQueue (no sync needed). @@ -417,7 +417,7 @@ final class BLEService: NSObject { // Accumulate long write chunks per central until a full frame decodes // (bleQueue-owned) - private var pendingWriteBuffers = BLEInboundWriteBuffer() + var pendingWriteBuffers = BLEInboundWriteBuffer() // Relay jitter scheduling to reduce redundant floods private var scheduledRelays = BLEScheduledRelayStore() // Track short-lived traffic bursts to adapt announces/scanning under load @@ -435,10 +435,10 @@ final class BLEService: NSObject { // delivery so a duplicate costs one decrypt instead of a delivery + ack // + handshake each. Engine-confined. private var openedCourierMessageIDs = BoundedIDSet(capacity: TransportConfig.courierOpenedMessageIDCap) - private let logRateLimiter = BLELogRateLimiter(defaultMinimumInterval: 5) + let logRateLimiter = BLELogRateLimiter(defaultMinimumInterval: 5) // Per-peripheral write backpressure (bleQueue-owned) - private var pendingPeripheralWrites = BLEOutboundWriteBuffer() + var pendingPeripheralWrites = BLEOutboundWriteBuffer() // Debounce duplicate disconnect notifies private var disconnectNotifyDebouncer = BLEPeerEventDebouncer() // Store-and-forward for directed messages when we have no links @@ -475,7 +475,7 @@ final class BLEService: NSObject { // MARK: - Radio (central-role policy: discovery admission, connection // budget, connect timeouts, background connects, scan duty, advertising) - private lazy var radio = BLERadioController( + lazy var radio = BLERadioController( queue: bleQueue, linkStateStore: linkStateStore, recentTraffic: recentTrafficTracker @@ -596,7 +596,7 @@ final class BLEService: NSObject { } } - private var isPanicSuspended: Bool { + var isPanicSuspended: Bool { panicLifecycleLock.lock() defer { panicLifecycleLock.unlock() } return _isPanicSuspended @@ -2415,7 +2415,7 @@ final class BLEService: NSObject { } } - private func flushDirectedSpool() { + func flushDirectedSpool() { guard !isPanicSuspended else { return } // Runs from bleQueue maintenance: hop to the engine asynchronously // (bleQueue must never sync-wait on the engine). Move items out and @@ -2741,7 +2741,7 @@ final class BLEService: NSObject { } return true } - private func sendAnnounce(forceSend: Bool = false) { + func sendAnnounce(forceSend: Bool = false) { guard !isPanicSuspended else { return } // Announce construction reads the replaceable Noise service and several // related state snapshots. Serialize the whole operation with identity @@ -2958,272 +2958,6 @@ extension BLEService: GossipSyncManager.Delegate { } } -// MARK: - CBCentralManagerDelegate - -extension BLEService: CBCentralManagerDelegate { - #if os(iOS) - func centralManager(_ central: CBCentralManager, willRestoreState dict: [String: Any]) { - let restoredPeripherals = (dict[CBCentralManagerRestoredStatePeripheralsKey] as? [CBPeripheral]) ?? [] - guard !isPanicSuspended else { - central.stopScan() - restoredPeripherals.forEach { - central.cancelPeripheralConnection($0) - } - return - } - let restoredServices = (dict[CBCentralManagerRestoredStateScanServicesKey] as? [CBUUID]) ?? [] - let restoredOptions = (dict[CBCentralManagerRestoredStateScanOptionsKey] as? [String: Any]) ?? [:] - let allowDuplicates = restoredOptions[CBCentralManagerScanOptionAllowDuplicatesKey] as? Bool - - SecureLogger.info( - "♻️ Central restore: peripherals=\(restoredPeripherals.count) services=\(restoredServices.count) allowDuplicates=\(String(describing: allowDuplicates))", - category: .session - ) - - for peripheral in restoredPeripherals { - let identifier = peripheral.identifier.uuidString - peripheral.delegate = self - let existing = linkStateStore.state(forPeripheralID: identifier) - let assembler = existing?.assembler ?? NotificationStreamAssembler() - let characteristic = existing?.characteristic - let wasConnecting = existing?.isConnecting ?? false - let wasConnected = existing?.isConnected ?? false - - let restoredState = BLEPeripheralLinkState( - peripheral: peripheral, - characteristic: characteristic, - isConnecting: wasConnecting || peripheral.state == .connecting, - isConnected: wasConnected || peripheral.state == .connected, - lastConnectionAttempt: existing?.lastConnectionAttempt, - assembler: assembler - ) - linkStateStore.setPeripheralState(restoredState, for: identifier) - - // Restored peripherals are the freshest wake-on-proximity - // candidates we have after a relaunch — without this the cache - // starts empty and backgrounding right after a restore arms - // nothing. Service rediscovery for restored-connected links waits - // for poweredOn: CoreBluetooth drops commands issued during - // restoration (API MISUSE warnings). - radio.recordRecentPeripheral(peripheral, peripheralID: identifier, at: Date()) - } - - // Via the sampler (not a direct capture): it refreshes the cached - // background budget on main first, so the restore log shows the real - // wake window instead of the init sentinel. - logBluetoothStatus("central-restore") - - if central.state == .poweredOn { - radio.startScanning() - } - } - #endif - - func centralManagerDidUpdateState(_ central: CBCentralManager) { - emitTransportEvent(.bluetoothStateUpdated(central.state)) - - switch central.state { - case .poweredOn: - guard !isPanicSuspended else { - central.stopScan() - return - } - // Links restored as connected have no characteristic in the new - // process; without rediscovery they sit connected-but-unusable - // until the peer disconnects. Runs here (not willRestoreState) - // because commands issued before poweredOn are dropped. - for state in linkStateStore.peripheralStates where state.isConnected - && state.characteristic == nil - && state.peripheral.state == .connected { - SecureLogger.info("♻️ Rediscovering services on restored link: \(state.peripheral.identifier.uuidString.prefix(8))…", category: .session) - state.peripheral.discoverServices([BLEService.serviceUUID]) - } - - // Start scanning - use allow duplicates for faster discovery when active - radio.startScanning() - - case .poweredOff: - // CoreBluetooth has already transitioned out of poweredOn. Do - // not issue stop/cancel commands now; they are rejected as API - // misuse. Retire our link state locally instead. - SecureLogger.info("📴 Bluetooth powered off - cleaning up central state", category: .session) - let peripheralIDs = linkStateStore.peripheralStates.map { $0.peripheral.identifier.uuidString } - for peripheralID in peripheralIDs { - pendingPeripheralWrites.discardAll(for: peripheralID) - } - linkStateStore.clearPeripherals() - messageQueue.async { [weak self] in - guard let self else { return } - for peripheralID in peripheralIDs { - self.linkAuth.retireLink(.peripheral(peripheralID)) - } - let peerIDs = self.linkBindings.clearPeripherals() - // Notify UI of disconnections - for peerID in peerIDs { - self.notifyUI { [weak self] in - self?.notifyPeerDisconnectedDebounced(peerID) - } - } - } - - case .unauthorized: - // User denied Bluetooth permission - SecureLogger.warning("🚫 Bluetooth unauthorized - user denied permission", category: .session) - linkStateStore.clearPeripherals() - messageQueue.async { [weak self] in - _ = self?.linkBindings.clearPeripherals() - } - - case .unsupported: - // Device doesn't support BLE - SecureLogger.error("❌ Bluetooth LE not supported on this device", category: .session) - - case .resetting: - // Bluetooth stack is resetting - will get another state update when done - SecureLogger.info("🔄 Bluetooth stack resetting...", category: .session) - - case .unknown: - // Initial state before we know the actual state - SecureLogger.debug("❓ Bluetooth state unknown (initializing)", category: .session) - - @unknown default: - SecureLogger.warning("⚠️ Unknown Bluetooth state: \(central.state.rawValue)", category: .session) - } - } - - - func centralManager(_ central: CBCentralManager, didDiscover peripheral: CBPeripheral, advertisementData: [String: Any], rssi RSSI: NSNumber) { - radio.handleDiscovery(peripheral, advertisementData: advertisementData, rssi: RSSI) - } - - func centralManager(_ central: CBCentralManager, didConnect peripheral: CBPeripheral) { - guard !isPanicSuspended else { - central.cancelPeripheralConnection(peripheral) - return - } - let peripheralID = peripheral.identifier.uuidString - - #if os(iOS) - // A connect completing while backgrounded is the wake-on-proximity - // path doing its job — worth an info line for field verification. - if !isAppActive { - SecureLogger.info("🌙 Background wake: connected to \(peripheral.name ?? peripheralID) while backgrounded", category: .session) - } - #endif - - // Update state to connected - linkStateStore.markConnected(peripheral) - - // Reset backoff state on success - radio.recordConnectionSuccess(peripheralID: peripheralID) - - SecureLogger.debug("✅ Connected: \(peripheral.name ?? "Unknown") [\(peripheralID)]", category: .session) - - // Discover services - peripheral.discoverServices([BLEService.serviceUUID]) - } - - func centralManager(_ central: CBCentralManager, didDisconnectPeripheral peripheral: CBPeripheral, error: Error?) { - let peripheralID = peripheral.identifier.uuidString - - SecureLogger.debug("📱 Disconnect: \(peripheralID)\(error != nil ? " (\(error!.localizedDescription))" : "")", category: .session) - - // If disconnect carried an error (often timeout), apply short backoff to avoid thrash - if error != nil { - radio.recordDisconnectError(peripheralID: peripheralID, at: Date()) - } - - // Retain the handle: a dropped link is the best wake-on-proximity - // candidate if the app backgrounds before the peer returns. - radio.recordRecentPeripheral(peripheral, peripheralID: peripheralID, at: Date()) - - #if os(iOS) - // Link lost while backgrounded (peer walked away): re-arm a pending - // connect during this wake window so the peer's return wakes us again. - // Delayed past the disconnect-settle window to avoid reconnect thrash - // at range edge. - if !isAppActive { - bleQueue.asyncAfter(deadline: .now() + TransportConfig.bleDisconnectDiscoveryIgnoreSeconds) { [weak self] in - guard let self, !self.isAppActive else { return } - // Reserve 0: use the slot this disconnect freed even in a - // dense mesh, so the lost peer can wake us when it returns. - self.radio.armPendingBackgroundConnects(slotReserve: 0) - } - } - #endif - - // Physical teardown now; identity retirement and peer-disconnect - // bookkeeping on the engine, which owns the bindings. The scan - // restart and connect-slot refill below stay on bleQueue — they - // respond to the physical drop regardless of remaining logical - // links. - discardPeripheralLinkPhysical(peripheralID) - messageQueue.async { [weak self] in - guard let self else { return } - // A duplicate link can drop while the peer stays live on - // another (the dual-role central link, or a second bound link - // after a restore): peer-disconnect bookkeeping only runs once - // the peer's last live link is gone. The retirement just - // repaired the reverse map onto a connected survivor, so - // directLinkState is accurate here. - let peerID = self.retirePeripheralLinkIdentity(peripheralID) - if let peerID { - SecureLogger.debug("📱 Disconnected link was bound to \(peerID.id.prefix(8))…", category: .session) - } - let remainingLinks = peerID.map { self.directLinkState(for: $0) } - let peerStillLinked = (remainingLinks?.hasPeripheral ?? false) || (remainingLinks?.hasCentral ?? false) - if let peerID, !peerStillLinked { - // Do not remove peer; mark as not connected but retain for reachability - self.peerRegistry.mutate { $0.markDisconnected(peerID) } - self.refreshLocalTopology() - } - - // Notify delegate about disconnection on main thread (direct link dropped) - self.notifyUI { [weak self] in - guard let self = self else { return } - - // Get current peer list (after removal) - let currentPeerIDs = self.peerRegistry.peerIDs - - if let peerID, !peerStillLinked { - self.notifyPeerDisconnectedDebounced(peerID) - } - self.requestPeerDataPublish() - self.deliverTransportEvent(.peerListUpdated(currentPeerIDs)) - } - } - - // Restart scanning with allow duplicates for faster rediscovery - if centralManager?.state == .poweredOn { - // Stop and restart scanning to ensure we get fresh discovery events - centralManager?.stopScan() - bleQueue.asyncAfter(deadline: .now() + TransportConfig.bleRestartScanDelaySeconds) { [weak self] in - self?.radio.startScanning() - } - } - // Attempt to fill freed slot from queue - bleQueue.async { [weak self] in self?.radio.tryConnectFromQueue() } - } - - func centralManager(_ central: CBCentralManager, didFailToConnect peripheral: CBPeripheral, error: Error?) { - let peripheralID = peripheral.identifier.uuidString - - // Clean up the references: physical now, identity on the engine. - discardPeripheralLinkPhysical(peripheralID) - messageQueue.async { [weak self] in - self?.retirePeripheralLinkIdentity(peripheralID) - } - - SecureLogger.error("❌ Failed to connect to peripheral: \(peripheral.name ?? "Unknown") [\(peripheralID)] - Error: \(error?.localizedDescription ?? "Unknown")", category: .session) - radio.recordConnectionFailure(peripheralID: peripheralID) - // Try next candidate - bleQueue.async { [weak self] in self?.radio.tryConnectFromQueue() } - } -} - -extension BLEService { -} - // MARK: - Radio controller integration extension BLEService: BLERadioControllerDelegate { @@ -3241,11 +2975,9 @@ extension BLEService: BLERadioControllerDelegate { func radioTearDownPeripheralLink(_ peripheralID: String) { // bleQueue (the controller's queue): physical discard now, identity - // retirement on the engine. + // retirement via the port. discardPeripheralLinkPhysical(peripheralID) - messageQueue.async { [weak self] in - self?.retirePeripheralLinkIdentity(peripheralID) - } + emitLinkEvent(.peripheralLinkEnded(peripheralID: peripheralID, runPeerBookkeeping: false)) } /// bleQueue half of a peripheral-link teardown: the link's write @@ -3315,14 +3047,6 @@ extension BLEService: BLERadioControllerDelegate { } } -private extension BLEService { - static func shouldRediscoverBitChatService( - invalidatedServiceUUIDs: [CBUUID], - cachedServiceUUIDs: [CBUUID]? - ) -> Bool { - invalidatedServiceUUIDs.contains(serviceUUID) || cachedServiceUUIDs?.contains(serviceUUID) != true - } -} #if DEBUG // Test-only helper to inject packets into the receive pipeline @@ -3364,7 +3088,7 @@ extension BLEService { /// SimulatedMesh harness feeds every node through this, so multi-node /// tests exercise the same engine code as CoreBluetooth ingress. func _test_ingestFrame(_ packet: BitchatPacket, link: BLEIngressLinkID) { - ingestDecodedPacket(packet, link: link, linkDescription: "Simulated \(link)") + emitLinkEvent(.frameDecoded(packet, link: link, linkDescription: "Simulated \(link)")) } /// Sends an unthrottled announce, exactly like the maintenance forced @@ -3373,6 +3097,16 @@ extension BLEService { onEngine { sendAnnounceNow(forceSend: true) } } + /// Clears the announce throttle's wall-clock debt — the simulator's + /// stand-in for "enough real time has passed", since scheduler time + /// cannot move the throttle's Date-based window. Deliberately NOT + /// part of `_test_forceAnnounce`: the panic-rotation mesh test relies + /// on the production panic path performing its own reset, and a + /// blanket reset here would mask that regression. + func _test_resetAnnounceThrottle() { + announceThrottle.reset() + } + /// Blocks until every engine slot enqueued so far has run — the /// deterministic settling fence for simulated-mesh pumping. func _test_fenceEngine() { @@ -3666,544 +3400,6 @@ extension BLEService { } #endif -// MARK: - CBPeripheralDelegate - -extension BLEService: CBPeripheralDelegate { - func peripheral(_ peripheral: CBPeripheral, didDiscoverServices error: Error?) { - guard !isPanicSuspended else { return } - if let error = error { - SecureLogger.error("❌ Error discovering services for \(peripheral.name ?? "Unknown"): \(error.localizedDescription)", category: .session) - // Retry service discovery after a delay - DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) { - guard peripheral.state == .connected else { return } - peripheral.discoverServices([BLEService.serviceUUID]) - } - return - } - - guard let services = peripheral.services else { - SecureLogger.warning("⚠️ No services discovered for \(peripheral.name ?? "Unknown")", category: .session) - return - } - - guard let service = services.first(where: { $0.uuid == BLEService.serviceUUID }) else { - // Not a BitChat peer - disconnect - centralManager?.cancelPeripheralConnection(peripheral) - return - } - - // Discovering BLE characteristics - peripheral.discoverCharacteristics([BLEService.characteristicUUID], for: service) - } - - func peripheral(_ peripheral: CBPeripheral, didDiscoverCharacteristicsFor service: CBService, error: Error?) { - guard !isPanicSuspended else { return } - if let error = error { - SecureLogger.error("❌ Error discovering characteristics for \(peripheral.name ?? "Unknown"): \(error.localizedDescription)", category: .session) - return - } - - guard let characteristic = service.characteristics?.first(where: { $0.uuid == BLEService.characteristicUUID }) else { - SecureLogger.warning("⚠️ No matching characteristic found for \(peripheral.name ?? "Unknown")", category: .session) - return - } - - // Found characteristic - - // Log characteristic properties for debugging - var properties: [String] = [] - if characteristic.properties.contains(.read) { properties.append("read") } - if characteristic.properties.contains(.write) { properties.append("write") } - if characteristic.properties.contains(.writeWithoutResponse) { properties.append("writeWithoutResponse") } - if characteristic.properties.contains(.notify) { properties.append("notify") } - if characteristic.properties.contains(.indicate) { properties.append("indicate") } - // Characteristic properties: \(properties.joined(separator: ", ")) - - // Verify characteristic supports reliable writes - if !characteristic.properties.contains(.write) { - SecureLogger.warning("⚠️ Characteristic doesn't support reliable writes (withResponse)!", category: .session) - } - - // Store characteristic in our consolidated structure - let peripheralID = peripheral.identifier.uuidString - linkStateStore.updateCharacteristic(characteristic, forPeripheralID: peripheralID) - - // Subscribe for notifications - if characteristic.properties.contains(.notify) { - peripheral.setNotifyValue(true, for: characteristic) - SecureLogger.debug("🔔 Subscribed to notifications from \(peripheral.name ?? "Unknown")", category: .session) - - // Send announce after subscription is confirmed (force send for new connection) - engineScheduler.schedule(after: TransportConfig.blePostSubscribeAnnounceDelaySeconds) { [weak self] in - self?.sendAnnounce(forceSend: true) - // Try flushing any spooled directed packets now that we have a link - self?.flushDirectedSpool() - } - } else { - SecureLogger.warning("⚠️ Characteristic does not support notifications", category: .session) - } - } - - func peripheral(_ peripheral: CBPeripheral, didUpdateValueFor characteristic: CBCharacteristic, error: Error?) { - guard !isPanicSuspended else { return } - if let error = error { - SecureLogger.error("❌ Error receiving notification: \(error.localizedDescription)", category: .session) - return - } - - guard let data = characteristic.value, !data.isEmpty else { - SecureLogger.warning("⚠️ No data in notification", category: .session) - return - } - - bufferNotificationChunk(data, from: peripheral) - } - - private func bufferNotificationChunk(_ chunk: Data, from peripheral: CBPeripheral) { - let peripheralUUID = peripheral.identifier.uuidString - - var state = linkStateStore.state(forPeripheralID: peripheralUUID) ?? BLEPeripheralLinkState( - peripheral: peripheral, - characteristic: nil, - isConnecting: false, - isConnected: peripheral.state == .connected, - lastConnectionAttempt: nil, - assembler: NotificationStreamAssembler() - ) - - var assembler = state.assembler - let result = assembler.append(chunk) - state.assembler = assembler - linkStateStore.setPeripheralState(state, for: peripheralUUID) - - for byte in result.droppedPrefixes { - SecureLogger.warning("⚠️ Dropping byte from BLE stream (unexpected prefix \(String(format: "%02x", byte)))", category: .session) - } - - if result.reset { - SecureLogger.error("❌ Invalid BLE frame length; reset notification stream", category: .session) - } - - // Attribution — spoof rejection, announce binding, ingress - // recording — is engine work now (the engine owns the bindings). - // Frames hop up in decode order; the engine's serial slot ordering - // gives the same same-batch spoof protection the old bleQueue-side - // batch-local binding enforced: an announce that binds this link is - // attributed before every frame that rode behind it. - for frame in result.frames { - guard let packet = BinaryProtocol.decode(frame) else { - let prefix = frame.prefix(16).map { String(format: "%02x", $0) }.joined(separator: " ") - SecureLogger.error("❌ Failed to decode assembled notification frame (len=\(frame.count), prefix=\(prefix))", category: .session) - continue - } - ingestDecodedPacket( - packet, - link: .peripheral(peripheralUUID), - linkDescription: "Peripheral \(peripheralUUID.prefix(8))…" - ) - } - } - - func peripheral(_ peripheral: CBPeripheral, didWriteValueFor characteristic: CBCharacteristic, error: Error?) { - if let error = error { - SecureLogger.error("❌ Write failed to \(peripheral.name ?? peripheral.identifier.uuidString): \(error.localizedDescription)", category: .session) - // Don't retry - just log the error - } else { - SecureLogger.debug("✅ Write confirmed to \(peripheral.name ?? peripheral.identifier.uuidString)", category: .session) - } - } - - func peripheralIsReady(toSendWriteWithoutResponse peripheral: CBPeripheral) { - guard !isPanicSuspended else { return } - // Resume queued writes for this peripheral - called when canSendWriteWithoutResponse becomes true again - if logRateLimiter.shouldLog(key: "peripheral-ready:\(peripheral.identifier.uuidString)") { - SecureLogger.debug("📤 Peripheral \(peripheral.name ?? peripheral.identifier.uuidString.prefix(8).description) ready for more writes", category: .session) - } - drainPendingWrites(for: peripheral) - } - - func peripheral(_ peripheral: CBPeripheral, didModifyServices invalidatedServices: [CBService]) { - guard !isPanicSuspended else { return } - SecureLogger.warning("⚠️ Services modified for \(peripheral.name ?? peripheral.identifier.uuidString)", category: .session) - - let shouldRediscover = BLEService.shouldRediscoverBitChatService( - invalidatedServiceUUIDs: invalidatedServices.map(\.uuid), - cachedServiceUUIDs: peripheral.services?.map(\.uuid) - ) - - guard shouldRediscover else { return } - - let peripheralID = peripheral.identifier.uuidString - linkStateStore.updatePeripheral(peripheralID) { - $0.characteristic = nil - $0.assembler = NotificationStreamAssembler() - } - - SecureLogger.debug("🔄 BitChat service changed for \(peripheral.name ?? peripheral.identifier.uuidString), rediscovering", category: .session) - peripheral.discoverServices([BLEService.serviceUUID]) - } - - func peripheral(_ peripheral: CBPeripheral, didUpdateNotificationStateFor characteristic: CBCharacteristic, error: Error?) { - guard !isPanicSuspended else { return } - if let error = error { - SecureLogger.error("❌ Error updating notification state: \(error.localizedDescription)", category: .session) - } else { - SecureLogger.debug("🔔 Notification state updated for \(peripheral.name ?? peripheral.identifier.uuidString): \(characteristic.isNotifying ? "ON" : "OFF")", category: .session) - - // If notifications are now on, send an announce to ensure this peer knows about us - if characteristic.isNotifying { - // Sending announce after subscription - self.sendAnnounce(forceSend: true) - } - } - } - -} - -// MARK: - CBPeripheralManagerDelegate - -extension BLEService: CBPeripheralManagerDelegate { - func peripheralManagerDidUpdateState(_ peripheral: CBPeripheralManager) { - SecureLogger.debug("📡 Peripheral manager state: \(peripheral.state.rawValue)", category: .session) - - switch peripheral.state { - case .poweredOn: - guard !isPanicSuspended else { - peripheral.stopAdvertising() - peripheral.removeAllServices() - characteristic = nil - return - } - // Remove all services first to ensure clean state - peripheral.removeAllServices() - - // Create characteristic - characteristic = CBMutableCharacteristic( - type: BLEService.characteristicUUID, - properties: [.notify, .write, .writeWithoutResponse, .read], - value: nil, - permissions: [.readable, .writeable] - ) - - // Create service - let service = CBMutableService(type: BLEService.serviceUUID, primary: true) - service.characteristics = [characteristic!] - - // Add service (advertising will start in didAdd delegate) - SecureLogger.debug("🔧 Adding BLE service...", category: .session) - peripheral.add(service) - - case .poweredOff: - // Bluetooth was turned off - clean up peripheral state - SecureLogger.info("📴 Bluetooth powered off - cleaning up peripheral state", category: .session) - // Clear subscribed centrals (they are now invalid) - let centralIDs = linkStateStore.subscribedCentrals.map { $0.identifier.uuidString } - pendingNotifications.removeAll() - pendingWriteBuffers.removeAll() - linkStateStore.clearCentrals() - subscriptionAnnounceLimiter.removeAll() - characteristic = nil - messageQueue.async { [weak self] in - guard let self else { return } - for centralID in centralIDs { - self.linkAuth.retireLink(.central(centralID)) - } - let centralPeerIDs = self.linkBindings.clearCentrals() - // Notify UI of disconnections - for peerID in centralPeerIDs { - self.notifyUI { [weak self] in - self?.notifyPeerDisconnectedDebounced(peerID) - } - } - } - - case .unauthorized: - // User denied Bluetooth permission - SecureLogger.warning("🚫 Bluetooth unauthorized for peripheral role", category: .session) - linkStateStore.clearCentrals() - subscriptionAnnounceLimiter.removeAll() - characteristic = nil - messageQueue.async { [weak self] in - _ = self?.linkBindings.clearCentrals() - } - - case .unsupported: - // Device doesn't support BLE peripheral role - SecureLogger.error("❌ Bluetooth LE peripheral role not supported", category: .session) - - case .resetting: - // Bluetooth stack is resetting - SecureLogger.info("🔄 Bluetooth peripheral stack resetting...", category: .session) - - case .unknown: - SecureLogger.debug("❓ Peripheral Bluetooth state unknown (initializing)", category: .session) - - @unknown default: - SecureLogger.warning("⚠️ Unknown peripheral Bluetooth state: \(peripheral.state.rawValue)", category: .session) - } - } - - #if os(iOS) - func peripheralManager(_ peripheral: CBPeripheralManager, willRestoreState dict: [String: Any]) { - guard !isPanicSuspended else { - peripheral.stopAdvertising() - peripheral.removeAllServices() - characteristic = nil - return - } - let restoredServices = (dict[CBPeripheralManagerRestoredStateServicesKey] as? [CBMutableService]) ?? [] - let restoredAdvertisement = (dict[CBPeripheralManagerRestoredStateAdvertisementDataKey] as? [String: Any]) ?? [:] - - SecureLogger.info( - "♻️ Peripheral restore: services=\(restoredServices.count) advertisingDataKeys=\(Array(restoredAdvertisement.keys))", - category: .session - ) - - // Attempt to recover characteristic from restored services - if characteristic == nil { - if let service = restoredServices.first(where: { $0.uuid == BLEService.serviceUUID }), - let restoredCharacteristic = service.characteristics?.first(where: { $0.uuid == BLEService.characteristicUUID }) as? CBMutableCharacteristic { - characteristic = restoredCharacteristic - } - } - - // Via the sampler for a fresh background budget (see central-restore). - logBluetoothStatus("peripheral-restore") - - if peripheral.state == .poweredOn && !peripheral.isAdvertising { - peripheral.startAdvertising(BLERadioController.advertisementData()) - } - } - #endif - - func peripheralManager(_ peripheral: CBPeripheralManager, didAdd service: CBService, error: Error?) { - guard !isPanicSuspended else { - peripheral.stopAdvertising() - return - } - if let error = error { - SecureLogger.error("❌ Failed to add service: \(error.localizedDescription)", category: .session) - return - } - - SecureLogger.debug("✅ Service added successfully, starting advertising", category: .session) - - // Start advertising after service is confirmed added - let adData = BLERadioController.advertisementData() - peripheral.startAdvertising(adData) - - SecureLogger.debug("📡 Started advertising (LocalName: \((adData[CBAdvertisementDataLocalNameKey] as? String) != nil ? "on" : "off"), ID: \(myPeerID.id.prefix(8))…)", category: .session) - } - - func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didSubscribeTo characteristic: CBCharacteristic) { - guard !isPanicSuspended else { return } - let centralUUID = central.identifier.uuidString - SecureLogger.debug("📥 Central subscribed: \(centralUUID.prefix(8))…", category: .session) - linkStateStore.addSubscribedCentral(central) - - // BCH-01-004: Rate-limit subscription-triggered announces to prevent enumeration attacks - let now = Date() - switch subscriptionAnnounceLimiter.decision(for: centralUUID, now: now) { - case .allowed: - break - case let .rateLimited(backoffSeconds, attemptCount, suppressAnnounce): - SecureLogger.warning("🛡️ BCH-01-004: Rate-limited announce for central \(centralUUID.prefix(8))... (backoff: \(Int(backoffSeconds))s, attempts: \(attemptCount))", category: .security) - if suppressAnnounce { - SecureLogger.warning("🚨 BCH-01-004: Possible enumeration attack from central \(centralUUID.prefix(8))... - suppressing announce", category: .security) - return - } - - // Still flush directed packets for legitimate mesh operation - engineScheduler.schedule(after: TransportConfig.blePostAnnounceDelaySeconds) { [weak self] in - self?.flushDirectedSpool() - } - return - } - - // Send announce to the newly subscribed central after a small delay - engineScheduler.schedule(after: TransportConfig.blePostAnnounceDelaySeconds) { [weak self] in - self?.sendAnnounce(forceSend: true) - // Flush any spooled directed packets now that we have a central subscribed - self?.flushDirectedSpool() - } - } - - func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didUnsubscribeFrom characteristic: CBCharacteristic) { - let centralID = central.identifier.uuidString - SecureLogger.debug("📤 Central unsubscribed: \(centralID.prefix(8))…", category: .session) - // bleQueue: physical retirement now. - pendingNotifications.removeTarget { $0.identifier.uuidString == centralID } - linkStateStore.removeSubscribedCentral(central) - - // Ensure we're still advertising for other devices to find us - if !isPanicSuspended, peripheral.isAdvertising == false { - SecureLogger.debug("📡 Restarting advertising after central unsubscribed", category: .session) - peripheral.startAdvertising(BLERadioController.advertisementData()) - } - - // Identity retirement and peer-disconnect bookkeeping on the - // engine, which owns the bindings. - messageQueue.async { [weak self] in - guard let self else { return } - self.linkAuth.retireLink(.central(centralID)) - guard let peerID = self.linkBindings.centralRemoved(centralID) else { return } - // The remote side retiring a redundant duplicate connection - // arrives here as an unsubscribe while the peer stays live on - // its other links; only the peer's last link disconnecting - // counts. If every link truly dropped, the surviving-link - // callbacks (didDisconnectPeripheral, or this one again) run - // the bookkeeping. - guard self.linkBindings.links(to: peerID).isEmpty else { return } - // Mark peer as not connected; retain for reachability - self.peerRegistry.mutate { $0.markDisconnected(peerID) } - - self.refreshLocalTopology() - - // Update UI immediately - self.notifyUI { [weak self] in - guard let self = self else { return } - - // Get current peer list (after removal) - let currentPeerIDs = self.peerRegistry.peerIDs - - self.notifyPeerDisconnectedDebounced(peerID) - // Publish snapshots so UnifiedPeerService can refresh icons promptly - self.requestPeerDataPublish() - self.deliverTransportEvent(.peerListUpdated(currentPeerIDs)) - } - } - } - - func peripheralManagerIsReady(toUpdateSubscribers peripheral: CBPeripheralManager) { - guard !isPanicSuspended else { return } - drainPendingNotifications(logPrefix: "✅ Sent") - } - - private func logBackpressureSampled(_ message: @autoclosure () -> String) { - notificationBackpressureLogCount += 1 - if notificationBackpressureLogCount == 1 || - notificationBackpressureLogCount.isMultiple(of: TransportConfig.bleBackpressureLogInterval) { - SecureLogger.debug("\(message()) [backpressure event #\(notificationBackpressureLogCount)]", category: .session) - } - } - - private func drainPendingNotifications(logPrefix: String) { - bleQueue.async { [weak self] in - guard let self = self, - let characteristic = self.characteristic, - !self.pendingNotifications.isEmpty else { return } - - let pending = self.pendingNotifications.takeAll() - let sentCount = self.sendPendingNotifications(pending, characteristic: characteristic) - - if sentCount > 0 { - self.logBackpressureSampled("\(logPrefix) \(sentCount) pending notifications from retry queue (\(self.pendingNotifications.count) still pending)") - } - } - } - - private func sendPendingNotifications(_ pending: [BLEPendingNotification], characteristic: CBMutableCharacteristic) -> Int { - var sentCount = 0 - - for (index, notification) in pending.enumerated() { - let success = peripheralManager?.updateValue( - notification.data, - for: characteristic, - onSubscribedCentrals: notification.targets - ) ?? false - - guard success else { - let remaining = Array(pending.dropFirst(index)) - pendingNotifications.prepend(remaining) - logBackpressureSampled("⚠️ Notification queue still full after \(sentCount) sent, re-queuing \(remaining.count) items") - break - } - - sentCount += 1 - } - - return sentCount - } - - func peripheralManager(_ peripheral: CBPeripheralManager, didReceiveWrite requests: [CBATTRequest]) { - // Suppress logs for single write requests to reduce noise - if requests.count > 1 { - SecureLogger.debug("📥 Received \(requests.count) write requests from central", category: .session) - } - - // IMPORTANT: Respond immediately to prevent timeouts! - // We must respond within a few milliseconds or the central will timeout - for request in requests { - peripheral.respond(to: request, withResult: .success) - } - guard !isPanicSuspended else { return } - - // Process writes. For long writes, CoreBluetooth may deliver multiple CBATTRequest values with offsets. - // Combine per-central request values by offset before decoding. - // Process directly on our message queue to match transport context - let grouped = Dictionary(grouping: requests, by: { $0.central.identifier.uuidString }) - for (centralUUID, group) in grouped { - // Sort by offset ascending - let sorted = group.sorted { $0.offset < $1.offset } - let hasMultiple = sorted.count > 1 || (sorted.first?.offset ?? 0) > 0 - let chunks = sorted.compactMap { request -> BLEInboundWriteChunk? in - guard let data = request.value, !data.isEmpty else { return nil } - return BLEInboundWriteChunk(offset: request.offset, data: data) - } - - let result = pendingWriteBuffers.append( - chunks: chunks, - for: centralUUID, - capBytes: TransportConfig.blePendingWriteBufferCapBytes - ) - - switch result { - case let .decoded(packet, metadata): - logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) - processDecodedCentralWrite(packet, centralUUID: centralUUID, central: sorted[0].central) - - case let .waiting(metadata): - logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) - logFailedSingleWriteIfNeeded(hasMultiple: hasMultiple, sortedRequests: sorted) - - case let .oversized(metadata): - logAccumulatedCentralWrite(metadata, centralUUID: centralUUID) - SecureLogger.warning("⚠️ Dropping oversized pending write buffer (\(metadata.accumulatedBytes) bytes) for central \(centralUUID.prefix(8))…", category: .session) - logFailedSingleWriteIfNeeded(hasMultiple: hasMultiple, sortedRequests: sorted) - } - } - } - - private func logAccumulatedCentralWrite(_ metadata: BLEInboundWriteAppendMetadata, centralUUID: String) { - guard let packetType = metadata.packetType, - packetType != MessageType.announce.rawValue else { return } - - SecureLogger.debug( - "📥 Accumulated write from central \(centralUUID.prefix(8))…: size=\(metadata.accumulatedBytes) (+\(metadata.appendedBytes)) bytes (type=\(packetType)), offsets=\(metadata.offsets)", - category: .session - ) - } - - private func logFailedSingleWriteIfNeeded(hasMultiple: Bool, sortedRequests: [CBATTRequest]) { - guard !hasMultiple, let raw = sortedRequests.first?.value else { return } - - let prefix = raw.prefix(16).map { String(format: "%02x", $0) }.joined(separator: " ") - SecureLogger.error("❌ Failed to decode packet from central (len=\(raw.count), prefix=\(prefix))", category: .session) - } - - private func processDecodedCentralWrite(_ packet: BitchatPacket, centralUUID: String, central: CBCentral) { - // bleQueue: physical bookkeeping only. A writer is a live central - // whether or not it subscribed; track it so directed replies and - // the fanout planner can reach it. - linkStateStore.addSubscribedCentral(central) - // Attribution is engine work (the engine owns the bindings). - ingestDecodedPacket( - packet, - link: .central(centralUUID), - linkDescription: "Central \(centralUUID.prefix(8))…" - ) - } -} // MARK: - Advertising Builders & Alias Rotation @@ -4320,7 +3516,7 @@ extension BLEService { } } - private func emitTransportEvent( + func emitTransportEvent( _ event: TransportEvent, shouldDeliver: (() -> Bool)? = nil, completion: (() -> Void)? = nil, @@ -4405,7 +3601,7 @@ extension BLEService { } } - private func logBluetoothStatus(_ context: String) { + func logBluetoothStatus(_ context: String) { scheduleBluetoothStatusSample(after: 0, context: context) } @@ -5946,7 +5142,7 @@ extension BLEService { return bleQueue.sync(execute: accept) } - private func drainPendingWrites(for peripheral: CBPeripheral) { + func drainPendingWrites(for peripheral: CBPeripheral) { let uuid = peripheral.identifier.uuidString bleQueue.async { [weak self] in guard let self = self else { return } @@ -6494,6 +5690,111 @@ extension BLEService { ) } + // MARK: Link-event port (bleQueue → engine) + + /// The single upward entry of the link-layer port: the bleQueue side + /// (CoreBluetooth delegates, radio policy) and the simulated mesh + /// report everything through here. Frames capture the panic lifecycle + /// at the handoff; lifecycle events ride plain engine slots (the + /// panic path clears their state wholesale either way). + func emitLinkEvent(_ event: BLELinkEvent) { + if case let .frameDecoded(packet, link, linkDescription) = event { + ingestDecodedPacket(packet, link: link, linkDescription: linkDescription) + return + } + messageQueue.async { [weak self] in + self?.handleLinkEvent(event) + } + } + + /// Engine-confined consumer of the link-layer port: identity + /// retirement, survivor repair, and peer-disconnect bookkeeping for + /// every physical lifecycle transition the link layer reports. + private func handleLinkEvent(_ event: BLELinkEvent) { + switch event { + case .frameDecoded: + // Routed through ingestDecodedPacket by emitLinkEvent; frames + // never reach the lifecycle switch. + assertionFailure("frameDecoded must enter via emitLinkEvent") + + case let .peripheralLinkEnded(peripheralID, runPeerBookkeeping): + let peerID = retirePeripheralLinkIdentity(peripheralID) + guard runPeerBookkeeping else { return } + if let peerID { + SecureLogger.debug("📱 Disconnected link was bound to \(peerID.id.prefix(8))…", category: .session) + } + // A duplicate link can drop while the peer stays live on + // another (the dual-role central link, or a second bound link + // after a restore): peer-disconnect bookkeeping only runs once + // the peer's last live link is gone. The retirement just + // repaired the reverse map onto a connected survivor, so + // directLinkState is accurate here. + let remainingLinks = peerID.map { directLinkState(for: $0) } + let peerStillLinked = (remainingLinks?.hasPeripheral ?? false) || (remainingLinks?.hasCentral ?? false) + if let peerID, !peerStillLinked { + // Do not remove peer; mark as not connected but retain for reachability + peerRegistry.mutate { $0.markDisconnected(peerID) } + refreshLocalTopology() + } + notifyUI { [weak self] in + guard let self = self else { return } + let currentPeerIDs = self.peerRegistry.peerIDs + if let peerID, !peerStillLinked { + self.notifyPeerDisconnectedDebounced(peerID) + } + self.requestPeerDataPublish() + self.deliverTransportEvent(.peerListUpdated(currentPeerIDs)) + } + + case let .centralLinkEnded(centralUUID): + linkAuth.retireLink(.central(centralUUID)) + guard let peerID = linkBindings.centralRemoved(centralUUID) else { return } + // The remote side retiring a redundant duplicate connection + // arrives as an unsubscribe while the peer stays live on its + // other links; only the peer's last link disconnecting counts. + guard linkBindings.links(to: peerID).isEmpty else { return } + peerRegistry.mutate { $0.markDisconnected(peerID) } + refreshLocalTopology() + notifyUI { [weak self] in + guard let self = self else { return } + let currentPeerIDs = self.peerRegistry.peerIDs + self.notifyPeerDisconnectedDebounced(peerID) + self.requestPeerDataPublish() + self.deliverTransportEvent(.peerListUpdated(currentPeerIDs)) + } + + case let .allPeripheralLinksEnded(peripheralIDs, retireProofsAndNotify): + guard retireProofsAndNotify else { + _ = linkBindings.clearPeripherals() + return + } + for peripheralID in peripheralIDs { + linkAuth.retireLink(.peripheral(peripheralID)) + } + let peerIDs = linkBindings.clearPeripherals() + for peerID in peerIDs { + notifyUI { [weak self] in + self?.notifyPeerDisconnectedDebounced(peerID) + } + } + + case let .allCentralLinksEnded(centralUUIDs, retireProofsAndNotify): + guard retireProofsAndNotify else { + _ = linkBindings.clearCentrals() + return + } + for centralUUID in centralUUIDs { + linkAuth.retireLink(.central(centralUUID)) + } + let peerIDs = linkBindings.clearCentrals() + for peerID in peerIDs { + notifyUI { [weak self] in + self?.notifyPeerDisconnectedDebounced(peerID) + } + } + } + } + // MARK: Packet Reception /// The bleQueue → engine handoff for every frame the link layer diff --git a/bitchatTests/Simulation/SimulatedMesh.swift b/bitchatTests/Simulation/SimulatedMesh.swift index 47491d34..d9f418fb 100644 --- a/bitchatTests/Simulation/SimulatedMesh.swift +++ b/bitchatTests/Simulation/SimulatedMesh.swift @@ -126,4 +126,18 @@ final class SimulatedMesh { } pump() } + + /// Advances scheduler time one second per round until `condition` + /// holds (or the round budget runs out — the caller's assertion then + /// reports the real failure). Protocol exchanges normally settle in + /// one or two rounds; under a heavily loaded parallel suite, engine + /// slots can interleave with wall-clock-windowed crypto decisions and + /// need a retry cycle or two more. Deterministic: rounds are scheduler + /// time, never sleeps. + func settleUntil(maxRounds: Int = 20, _ condition: () -> Bool) { + for _ in 0.. [Effect]` engine shape. + **The upward port is named and the delegates live behind it.** + `BLELinkEvent` (frameDecoded + the four physical lifecycle + transitions) is the enumerable bleQueue→engine surface; every + crossing goes through `emitLinkEvent` into one engine consumer + (`handleLinkEvent`), and the simulated mesh drives lifecycle events + through the identical enum a radio does (see + `linkDropEventRetiresBindingAndReconnectHeals`). The CoreBluetooth + delegate extensions moved to their own files — + `BLEService+LinkLayerCentralRole.swift` / + `BLEService+LinkLayerPeripheralRole.swift` — as physical + bookkeeping plus event emission; the physical-domain members they + share are `internal` with the queue contract enforced by the + existing traps and grep guards rather than access control. + + **Deliberately not done:** a formal `handle(event) -> [Effect]` + effect system, and splitting the engine-domain feature handlers + into more files. Both would flip the engine's private state + (noiseService, peerRegistry, the identity domain) to internal for + purely cosmetic file counts — the domains are already uniform + (one queue, one rule set) and mechanically guarded. The effect + formalization should ride actual feature-module extractions when a + feature earns its own module, not precede them. ## What this is not From e2b409e466f3a20ef99deb120f0dca362102fb53 Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Thu, 30 Jul 2026 15:21:59 +0100 Subject: [PATCH 05/23] Fix #1538: release stale bindings on rotation instead of leaving a ghost identity (#1554) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Cohere per-link Noise auth and rebind containment into BLELinkAuthState The authenticated-link owners, the reconnect revalidation policy, and the two rebind-containment cooldowns were four loose bleQueue-owned maps whose invariants lived in call-site discipline: every teardown path had to remember to retire the proof AND close the revalidation epoch (the pair appeared seven times), and both cooldowns hand-rolled the same prune-check-record dance. BLELinkAuthState owns them as whole transitions — retireLink, retireLinks(ownedBy:), permitRebind, permitRedundantRetirement — with the ownership question (bleQueue today, engine after the option-B flip) answered in one place. No behavior change; the one call-site reordering (redundant retirement computes the survivor before the cooldown check instead of after) is outcome-equivalent since the cooldown only ever recorded when a survivor existed. Co-Authored-By: Claude Fable 5 * Split identity-link bindings out of the physical link store BLELinkStateStore owned two different kinds of truth: what physical links exist (CB handles, connect lifecycles, characteristics, stream assemblers) and who each link belongs to (peer bindings in both roles plus the preferred-peripheral reverse map for directed sends and fanout collapse). The bindings now live on BLELinkBindings — same bleQueue ownership, whole-transition methods, direct tests for the rotation reverse-map cleanup and the preferred-link survivor repair that were previously only exercised end to end. Composed operations that need both truths (remove-with-repair, direct link state, the subscribed- central snapshot, bind-only-live-links) live on the transport as explicitly bleQueue-confined helpers. This is the structural half of the option-B boundary flip (docs/BLE-ARCHITECTURE-V3.md): ownership of the bindings can now move to the engine without touching what-links-exist. An audit of every physical clear/remove found three sites (emergency clear, both unauthorized branches) that needed explicit binding-clear pairing under the split — each now clears both. Co-Authored-By: Claude Fable 5 * Fix iOS-gated constructors and preserve containment cooldowns on reset CI caught what the macOS SwiftPM build cannot see: two #if os(iOS) sites still passed the peerID field that slice B1 removed from BLEPeripheralLinkState (willRestoreState in BLEService and armPendingBackgroundConnects in BLERadioController). Both fixed and verified with a local iOS simulator xcodebuild. Codex also caught a real regression: BLELinkAuthState.removeAll() cleared the rebind/retirement cooldown maps, which the original panic and emergency reset paths deliberately left alive. A stable CoreBluetooth UUID must not earn a fresh rebind allowance just because the session state around it was wiped. removeAll() now clears only the proofs and revalidation epochs, and BLELinkAuthStateTests pins the survival invariant along with the other auth-state transitions. Co-Authored-By: Claude Fable 5 * Link layer slice 3: the option-B domain flip — bindings and link-auth move to the engine The identity domain (BLELinkBindings + BLELinkAuthState) is now owned by the engine queue, with a DEBUG dispatchPrecondition trapping any access from another queue. bleQueue keeps only physical link state. What changed shape: - Receive path is sans-I/O: bleQueue decodes frames and hands (packet, linkID) up through ingestDecodedPacket (panic lifecycle captured at the handoff); attributeAndHandlePacket resolves the sender binding, rejects spoofed senders, applies raw-announce binding, and records ingress on the engine. Per-link frame order is preserved end to end (both queues serial), which supersedes the old batch-local TOCTOU binding in the notification path. - The rotation rebind is one engine slot: containment checks, proof retirement, binding flip, reconnect decision, and rotated-identity retirement run straight-line; only CoreBluetooth cancels hop to bleQueue. The engine->bleQueue->engine ping-pong is gone, along with the _test_afterVerifiedDirectRebindEnqueued pause hook — the test that used it now asserts the atomicity directly (a paused engine wedged the old gate design into a three-queue deadlock). - Authenticated-send eligibility (notifyOrEnqueueIfAccepted, writeOrEnqueueIfAccepted) is checked on the engine, serialized against rebinds by construction; only physical admission (updateValue/write/backpressure) runs on bleQueue. - Teardown splits into discardPeripheralLinkPhysical (bleQueue, inline in the delegates) + retirePeripheralLinkIdentity (engine hop with survivor repair reading liveness via readLinkState). A binding can briefly outlive its physical link; liveness queries join against the physical store and the queued retirement converges the two. - Gossip delegate sends enter the engine via onEngine — safe because mesh.sync sits above the engine in the sync order (production engine code only async-dispatches into the manager). - checkPeerConnectivity rides an engine slot from the bleQueue maintenance tick. No wire changes. 1,974 tests green (parallel and serial), iOS simulator build clean, Periphery clean. Co-Authored-By: Claude Fable 5 * Link layer slice 4: deterministic multi-node mesh simulation — and the panic-announce bug it caught SimulatedMesh wires real CoreBluetooth-free BLEService engines edge-to-edge through the outbound packet tap and _test_ingestFrame (the production attribution path the B2 flip created), with per-edge synthetic link IDs and manual-scheduler time. Five multi-node tests run in ~40ms with no wall-clock waits: - announce exchange binds simulated links and connects peers - Noise sessions establish end-to-end (real crypto, both directions) - a public message relays across a line topology inside a TTL/frame budget (storm bound asserted) - an 8x duplicate flood delivers exactly once - a panic rotation rebinds the survivor's link exactly once and stays — the scenario that previously needed two phones and log archaeology Fidelity boundary (documented in the harness): no physical links, so fanout planning and backpressure are not exercised; attribution, binding, dedup, TTL, relay decisions, and sessions are the real engine code. The simulator found a real bug on its first run: the forced-announce throttle's lastSent survived a panic, so a rotation within bleForceAnnounceMinIntervalSeconds of the last announce silently swallowed the new identity's announce — leaving it invisible to the mesh until the next maintenance cycle. Today's device test only passed because the previous announce happened to be minutes old. BLEAnnounceThrottle gains reset(), called from the panic slot so the rotated identity owes no throttle debt; pinned by a unit test and the mesh rotation test. New DEBUG seams: _test_ingestFrame (production ingress attribution), _test_forceAnnounce, _test_fenceEngine. 1,980 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 * Link layer slice 5: name the port — BLELinkEvent, one engine entry, delegates in their own files The upward half of the link-layer port is now a type. BLELinkEvent enumerates everything the bleQueue link layer tells the engine: frameDecoded plus the four physical lifecycle transitions (peripheralLinkEnded, centralLinkEnded, allPeripheralLinksEnded, allCentralLinksEnded). Every bleQueue→engine crossing goes through emitLinkEvent into one engine consumer (handleLinkEvent) — the scattered messageQueue.async identity hops in the delegates collapse into event emission, and the engine-side retirement/bookkeeping logic now lives in one switch. The CoreBluetooth delegate extensions move to their own files as physical bookkeeping plus event emission: - BLEService+LinkLayerCentralRole.swift (CBCentralManagerDelegate + CBPeripheralDelegate) - BLEService+LinkLayerPeripheralRole.swift (CBPeripheralManagerDelegate + write accumulation) BLEService.swift drops from 7,836 to ~7,100 lines. The physical-domain members the role files share flip private→internal; the queue contract is enforced by the existing DEBUG traps and grep guards, not access control. (Two of the flips — isAppActive, logBluetoothStatus — only surfaced on the iOS build; macOS SwiftPM cannot see #if os(iOS) code. Verified with a local iOS simulator build.) The simulated mesh now drives lifecycle events through the identical enum a radio does: linkDropEventRetiresBindingAndReconnectHeals covers drop → identity retirement → last-link peer bookkeeping → re-announce heal, entirely through the port. New seam _test_resetAnnounceThrottle models elapsed wall-clock for the throttle (deliberately separate from _test_forceAnnounce so the panic-rotation test keeps its regression value: the production panic path must do its own reset). The panic test's containment re-announces reset throttles explicitly so those assertions exercise real delivered announces instead of silently throttled ones. noiseSessionEstablishesEndToEnd gains a bounded scheduler-time settle loop after a one-in-many parallel-suite flake (no wall-clock waits). Deliberately not done (recorded in docs/BLE-ARCHITECTURE-V3.md): a formal handle(event)->[Effect] system and further engine-domain file splits — both would flip the engine's private state to internal for cosmetic file counts; the effect formalization rides future feature- module extractions instead. 1,981 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 * Baseline logBluetoothStatus for the macOS Periphery scan Its callers are all inside #if os(iOS) (willRestoreState in both role files plus the app-state handlers), so the macOS-scheme scan sees the now-internal declaration with zero callers — the same class as the baselined candidateCount. Verified 1-USR diff; the previously private mangled variant was already baselined, which is why the pre-split scan never flagged it. Co-Authored-By: Claude Fable 5 * Fix #1538: release stale bindings on rotation instead of leaving a ghost With two live links to one phone, a panic rotation healed only the link the verified announce arrived on. The second link kept its binding to the retired identity, so that dead ID stayed in the peer list — and was kept alive by the NEW identity's own traffic, since a bound link attributes non-announce frames to its bound peer. It only healed when the stale link physically dropped. The issue proposed exempting the containment rule via retiredBy[X] = Y so the second link could rebind. Two problems: the exemption's stated precondition (X removed by retireRotatedPeer) can never hold in this scenario — the retire is gated on X having no remaining links, which is false precisely because the stale link exists — and it would loosen a security rule to fix a liveness bug. Instead the rotation now RELEASES every link still bound to the rotated-away identity (unbind + retire that link's Noise proof) and retires the identity. No containment rule changes: unbinding is strictly less trusting than any binding, and it is correct under both readings of a second link bound to the retired ID — same physical device (the field case), or one link is a spoofer holding a forged binding, since a peer ID is a Noise-key fingerprint and two devices cannot both legitimately own it. Released links reconverge through the ordinary unbound-link path: the next raw direct announce binds them to whoever they actually carry. Reproduced and fixed under the slice-4 simulator, which is why this lands as tests rather than another two-phone session: - duplicateLinkPanicRotationLeavesNoGhostAndHealsBothLinks fails without the fix (ghost in both knownPeers and getConnectedPeers, duplicate link still bound to the dead ID) - replayedVerifiedAnnounceCannotStealALinkOrEvictTheVictim pins the #1401 containment rule against exactly the attack this fix had to avoid re-opening, with a positive control proving the refusal is the containment check and not duplicate suppression Harness gains connectDuplicateLinks (two links to one peer, modelled in the central role — the links we cannot cancel, and the only role whose bindings a CB-free harness can form), silence (range loss without a link event, so a packet can be captured that the far side never saw), and emittedPackets (the attacker's capture buffer). Residual, documented at the fix: an attacker who binds their own link to X by replaying X's raw announce can drive a rebind there and so evict X's registry entry; X's next announce restores it, and the per-link rebind cooldown bounds the rate. This is the same class of capability the containment already accepts, not a new one. 1,983 tests green, Periphery clean, iOS simulator build clean. Closes #1538 Co-Authored-By: Claude Fable 5 --------- Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchat/Services/BLE/BLEService.swift | 57 ++++++++- bitchatTests/Simulation/SimulatedMesh.swift | 69 ++++++++-- .../Simulation/SimulatedMeshTests.swift | 118 ++++++++++++++++++ 3 files changed, 234 insertions(+), 10 deletions(-) diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index 1fb33389..5f29ade3 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -3199,6 +3199,14 @@ extension BLEService { onEngine { linkBindings.peer(forCentralUUID: centralUUID) } } + func _test_linkBinding(_ link: BLEIngressLinkID) -> PeerID? { + onEngine { linkBindings.boundPeer(for: link) } + } + + func _test_knownPeerIDs() -> [PeerID] { + peerRegistry.peerIDs + } + func _test_markNoiseAuthenticatedCentral(_ centralUUID: String, to peerID: PeerID) { onEngine { guard linkBindings.peer(forCentralUUID: centralUUID) == peerID else { return } @@ -6241,12 +6249,55 @@ extension BLEService { // them now instead of leaving ghost links that spray duplicate // traffic until the inactivity timeout. cancelBoundPeripheralLinks(to: previousPeerID, keeping: linkUUID) - // Retire the rotated-away ID only once its last link is gone; a - // remaining stale link heals the same way or ages out. - guard linkBindings.links(to: previousPeerID).isEmpty else { return } + // Links we cannot cancel (the remote owns its central connections) + // must still stop claiming the dead identity, or it lingers as a + // ghost peer that the NEW identity's own traffic keeps refreshing + // (issue #1538). + releaseLinksBoundToRotatedPeer(previousPeerID) retireRotatedPeer(previousPeerID) } + /// Unbinds every link still bound to an identity a verified direct + /// announce just rotated away from, and retires those links' Noise + /// proofs. + /// + /// Release, deliberately not rebind: a rotation announce proves only + /// that *its own* link's device now presents as the new ID, so binding + /// a different link to that ID on this evidence is exactly what the + /// #1401 containment rule ("never steal an identity another live link + /// already owns") forbids — and that rule stays intact. Unbinding is + /// strictly less trusting than any binding, and it is correct under + /// both readings of a second link bound to the retired ID: either it is + /// the same physical device (dual links to one phone, the field case), + /// or one of the two links is a spoofer holding a forged binding — + /// since a peer ID is derived from a Noise key fingerprint, two devices + /// cannot both legitimately own it. Dropping the binding is right in + /// the first case and a win in the second. + /// + /// Released links then converge through the ordinary unbound-link path: + /// the next raw direct announce on the link binds it to whoever it + /// actually carries. Until then the link's frames attribute to their + /// claimed sender rather than to a dead ID. + /// + /// Residual (unchanged in kind from what the containment already + /// accepts): an attacker who has bound their own link to X — possible + /// by replaying X's raw announce onto an unbound link — can drive a + /// rebind on it and so evict X's registry entry. X's next announce + /// re-binds its real links and restores presence, and the per-link + /// rebind cooldown bounds the repetition rate. + private func releaseLinksBoundToRotatedPeer(_ peerID: PeerID) { + for link in linkBindings.links(to: peerID) { + linkAuth.retireLink(link) + switch link { + case .peripheral(let peripheralUUID): + // No survivor: every link this peer holds is being released. + _ = linkBindings.peripheralRemoved(peripheralUUID) { _ in nil } + case .central(let centralUUID): + _ = linkBindings.centralRemoved(centralUUID) + } + } + } + /// After a restore relaunch the same phone can reappear under a fresh /// peripheral UUID while its restored connection lives on, leaving /// several live central-role connections to one peer that each carry diff --git a/bitchatTests/Simulation/SimulatedMesh.swift b/bitchatTests/Simulation/SimulatedMesh.swift index d9f418fb..1d5c5094 100644 --- a/bitchatTests/Simulation/SimulatedMesh.swift +++ b/bitchatTests/Simulation/SimulatedMesh.swift @@ -32,6 +32,16 @@ final class SimulatedMesh { private(set) var nodes: [Node] = [] private var neighbors: [Set] = [] + private var duplicateLinkEdges: Set = [] + private var emitted: [[BitchatPacket]] = [] + + /// Every packet a node has put on the wire — the attacker's capture + /// buffer for replay tests. + func emittedPackets(from index: Int) -> [BitchatPacket] { + lock.lock() + defer { lock.unlock() } + return emitted[index] + } @discardableResult func addNode(nickname: String) -> Node { @@ -50,6 +60,7 @@ final class SimulatedMesh { let node = Node(service: service, scheduler: scheduler) nodes.append(node) neighbors.append([]) + emitted.append([]) service.setNickname(nickname) service._test_onOutboundPacket = { [weak self] packet in // Runs on the sender's engine; only buffer here — delivering @@ -57,6 +68,7 @@ final class SimulatedMesh { guard let self else { return } self.lock.lock() self.pendingDeliveries.append((from: index, packet: packet)) + self.emitted[index].append(packet) self.lock.unlock() } return node @@ -67,12 +79,56 @@ final class SimulatedMesh { neighbors[b].insert(a) } - /// The synthetic link a frame from `sender` arrives on at `receiver`. - /// Stable per directed edge, like a CoreBluetooth central UUID. + /// Radio silence: stops delivering between two nodes without reporting + /// any link event, so existing bindings persist exactly as they do when + /// a peer walks out of range before its link times out. Lets a test + /// capture a packet the far side never received. + func silence(_ a: Int, _ b: Int) { + neighbors[a].remove(b) + neighbors[b].remove(a) + } + + /// Models two live links to the same phone (issue #1538): every frame + /// from the neighbour arrives twice, on two link IDs that both bind to + /// the sender. + /// + /// Both are central links — the remote's connections to our peripheral + /// role. That is deliberate and faithful to the defect: central links + /// are the ones we cannot cancel (they belong to the remote), so they + /// are exactly the links the peripheral-cancel path cannot reach after + /// a rotation. Peripheral-role bindings additionally require physical + /// link state keyed by a real CBPeripheral, which no CB-free harness + /// can fabricate. + func connectDuplicateLinks(_ a: Int, _ b: Int) { + connect(a, b) + duplicateLinkEdges.insert(Self.edgeKey(a, b)) + } + + /// The synthetic central link a frame from `sender` arrives on at + /// `receiver`. Stable per directed edge, like a CoreBluetooth central + /// UUID. func linkUUID(from sender: Int, at receiver: Int) -> String { "SIM-\(sender)-TO-\(receiver)" } + /// Order-independent edge key. + private static func edgeKey(_ a: Int, _ b: Int) -> String { + "\(min(a, b))-\(max(a, b))" + } + + /// The second link of a duplicate-link edge. + func duplicateLinkUUID(from sender: Int, at receiver: Int) -> String { + "SIM-DUP-\(sender)-TO-\(receiver)" + } + + private func links(from sender: Int, at receiver: Int) -> [BLEIngressLinkID] { + var links: [BLEIngressLinkID] = [.central(linkUUID(from: sender, at: receiver))] + if duplicateLinkEdges.contains(Self.edgeKey(sender, receiver)) { + links.append(.central(duplicateLinkUUID(from: sender, at: receiver))) + } + return links + } + func forceAnnounce(from index: Int) { nodes[index].service._test_forceAnnounce() pump() @@ -100,11 +156,10 @@ final class SimulatedMesh { for (from, packet) in batch { for receiver in neighbors[from] { - deliveredFrameCount += 1 - nodes[receiver].service._test_ingestFrame( - packet, - link: .central(linkUUID(from: from, at: receiver)) - ) + for link in links(from: from, at: receiver) { + deliveredFrameCount += 1 + nodes[receiver].service._test_ingestFrame(packet, link: link) + } } } nodes.forEach { $0.service._test_fenceEngine() } diff --git a/bitchatTests/Simulation/SimulatedMeshTests.swift b/bitchatTests/Simulation/SimulatedMeshTests.swift index 58ac11fe..c03ed21f 100644 --- a/bitchatTests/Simulation/SimulatedMeshTests.swift +++ b/bitchatTests/Simulation/SimulatedMeshTests.swift @@ -140,6 +140,124 @@ struct SimulatedMeshTests { #expect(a.service.getConnectedPeers().contains(b.service.myPeerID)) } + /// Issue #1538: with two live links to the same phone, a panic + /// rotation used to heal only the link the verified announce arrived + /// on. The second link kept its binding to + /// the retired identity, which therefore stayed in the peer list as a + /// ghost — and, worse, kept being refreshed by the *new* identity's + /// traffic (a bound link attributes non-announce frames to its bound + /// peer, so the dead ID looked alive for as long as the link lived). + @Test + func duplicateLinkPanicRotationLeavesNoGhostAndHealsBothLinks() { + let mesh = SimulatedMesh() + let a = mesh.addNode(nickname: "alice") + let b = mesh.addNode(nickname: "bob") + mesh.connectDuplicateLinks(0, 1) + mesh.announceAll() + + let centralLink = BLEIngressLinkID.central(mesh.linkUUID(from: 1, at: 0)) + let duplicateLink = BLEIngressLinkID.central(mesh.duplicateLinkUUID(from: 1, at: 0)) + let oldBobID = b.service.myPeerID + // Both links bind to bob: raw direct announces bind unbound links, + // and that happens before duplicate suppression. + #expect(a.service._test_linkBinding(centralLink) == oldBobID) + #expect(a.service._test_linkBinding(duplicateLink) == oldBobID) + + b.service.suspendForPanicReset() + b.service.resetIdentityForPanic(currentNickname: "anon", restartServices: false) + b.service.completePanicReset(restartServices: false) + mesh.pump() + let newBobID = b.service.myPeerID + #expect(newBobID != oldBobID) + + // One verified direct announce must retire the old identity + // outright — no ghost survives on the link it did not arrive on. + mesh.forceAnnounce(from: 1) + mesh.settleUntil { !a.service._test_knownPeerIDs().contains(oldBobID) } + #expect(!a.service._test_knownPeerIDs().contains(oldBobID)) + #expect(a.service._test_linkBinding(centralLink) != oldBobID) + #expect(a.service._test_linkBinding(duplicateLink) != oldBobID) + + // Both links converge onto the new identity as its announces land + // (the released link binds through the ordinary unbound-link path, + // so no containment rule has to be relaxed). + for _ in 0..<4 { + b.service._test_resetAnnounceThrottle() + mesh.forceAnnounce(from: 1) + mesh.advanceTime(by: 1) + } + #expect(a.service._test_linkBinding(centralLink) == newBobID) + #expect(a.service._test_linkBinding(duplicateLink) == newBobID) + #expect(a.service.getConnectedPeers() == [newBobID]) + } + + /// The #1401 containment rule, pinned against the attack the #1538 fix + /// had to avoid re-opening: a captured verified direct announce replayed + /// onto a link the attacker controls must NOT bind that link to the + /// victim while the victim holds a live link of its own — and must not + /// evict the victim either (the rotation release only runs after a + /// rebind the containment actually permitted). + @Test + func replayedVerifiedAnnounceCannotStealALinkOrEvictTheVictim() { + let mesh = SimulatedMesh() + let alice = mesh.addNode(nickname: "alice") + let bob = mesh.addNode(nickname: "bob") + let mallory = mesh.addNode(nickname: "mallory") + mesh.connect(0, 1) + mesh.connect(0, 2) + mesh.announceAll() + + let bobLink = BLEIngressLinkID.central(mesh.linkUUID(from: 1, at: 0)) + let malloryLink = BLEIngressLinkID.central(mesh.linkUUID(from: 2, at: 0)) + #expect(alice.service._test_linkBinding(bobLink) == bob.service.myPeerID) + #expect(alice.service._test_linkBinding(malloryLink) == mallory.service.myPeerID) + + // Mallory captures a signed direct announce alice has NOT seen, so + // duplicate suppression cannot mask the containment check: bob + // announces while out of alice's range, and mallory replays it on + // her own link. Directness is forgeable; the signature is real. + mesh.silence(0, 1) + bob.service._test_resetAnnounceThrottle() + mesh.forceAnnounce(from: 1) + let replay = mesh.emittedPackets(from: 1).last { + $0.type == MessageType.announce.rawValue && $0.ttl == TransportConfig.messageTTLDefault + } + guard let replay else { + Issue.record("bob emitted no direct announce to capture") + return + } + alice.service._test_ingestFrame(replay, link: malloryLink) + mesh.pump() + mesh.advanceTime(by: 1) + + // The link is not stolen, and bob keeps both his binding and his + // place in the peer list. + #expect(alice.service._test_linkBinding(malloryLink) == mallory.service.myPeerID) + #expect(alice.service._test_linkBinding(bobLink) == bob.service.myPeerID) + #expect(alice.service._test_knownPeerIDs().contains(bob.service.myPeerID)) + #expect(alice.service.getConnectedPeers().contains(bob.service.myPeerID)) + + // Positive control — proves the refusal above was the containment + // rule and not duplicate suppression: once bob holds no live link, + // the very same replayed announce on the very same link does take + // effect. (Long-standing accepted residual: a stolen link carries + // only Noise ciphertext, and the rebind retires the link's proof.) + alice.service.emitLinkEvent(.centralLinkEnded(centralUUID: mesh.linkUUID(from: 1, at: 0))) + alice.service._test_fenceEngine() + bob.service._test_resetAnnounceThrottle() + mesh.forceAnnounce(from: 1) + let secondReplay = mesh.emittedPackets(from: 1).last { + $0.type == MessageType.announce.rawValue && $0.ttl == TransportConfig.messageTTLDefault + } + #expect(secondReplay?.timestamp != replay.timestamp) + if let secondReplay { + alice.service._test_ingestFrame(secondReplay, link: malloryLink) + mesh.pump() + mesh.advanceTime(by: 1) + } + #expect(alice.service._test_linkBinding(malloryLink) == bob.service.myPeerID) + } + @Test func panicRotationRebindsSurvivorExactlyOnceAndStays() { let mesh = SimulatedMesh() From b49400ff0cbdc8b4f7ea8e1e26b3c5b216edb7b1 Mon Sep 17 00:00:00 2001 From: Jozef Koval Date: Thu, 30 Jul 2026 18:56:32 +0200 Subject: [PATCH 06/23] Fix $$ escaping that broke every Xcode just recipe (#1525) --- Justfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Justfile b/Justfile index 9b1d3a31..a3d6f6b6 100644 --- a/Justfile +++ b/Justfile @@ -26,7 +26,7 @@ check-clean-safety: check: check-clean-safety @echo "Checking prerequisites..." @command -v xcodebuild >/dev/null 2>&1 || (echo "❌ xcodebuild not found. Install full Xcode." && exit 1) - @developer_dir="$$(xcode-select -p 2>/dev/null)"; case "$$developer_dir" in *.app/Contents/Developer) ;; *) echo "❌ Full Xcode is not selected. Run: sudo xcode-select -s /Applications/Xcode.app/Contents/Developer"; exit 1;; esac + @developer_dir="$(xcode-select -p 2>/dev/null)"; case "$developer_dir" in *.app/Contents/Developer) ;; *) echo "❌ Full Xcode is not selected. Run: sudo xcode-select -s /Applications/Xcode.app/Contents/Developer"; exit 1;; esac @xcodebuild -version @echo "✅ Development environment ready (a signing identity is not required for just build)" @@ -35,7 +35,7 @@ build: check @xcodebuild -project "{{project}}" -scheme "{{macos_scheme}}" -configuration Debug -derivedDataPath "{{derived_data}}" CODE_SIGNING_ALLOWED=NO build run: build - @app="{{derived_data}}/Build/Products/Debug/bitchat.app"; test -d "$$app" || (echo "❌ Built app not found at $$app" && exit 1); open "$$app" + @app="{{derived_data}}/Build/Products/Debug/bitchat.app"; test -d "$app" || (echo "❌ Built app not found at $app" && exit 1); open "$app" # Backward-compatible alias for the old quick-run recipe. dev-run: run From e8f95e9a88864ddad7d5a557ac4722b5a44a5ec1 Mon Sep 17 00:00:00 2001 From: Kudala Bharani Kumar Reddy Date: Thu, 30 Jul 2026 12:56:35 -0400 Subject: [PATCH 07/23] Fix built-in relay actor isolation (#1528) --- bitchat/Nostr/NostrRelayManager.swift | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/bitchat/Nostr/NostrRelayManager.swift b/bitchat/Nostr/NostrRelayManager.swift index fca24465..6601b863 100644 --- a/bitchat/Nostr/NostrRelayManager.swift +++ b/bitchat/Nostr/NostrRelayManager.swift @@ -153,14 +153,18 @@ final class NostrRelayManager: ObservableObject { // Built-in relays carry private-message envelopes, so avoid relays known to // reject the kinds they use. - private static let builtInRelays = [ + nonisolated private static let builtInRelays = [ "wss://relay.damus.io", "wss://nos.lol", "wss://relay.primal.net", "wss://offchain.pub" // For local testing, you can add: "ws://localhost:8080" ] - private static let builtInRelaySet = Set(builtInRelays.compactMap { NostrRelayURL.normalized($0) }) + /// Exposed so the relay settings UI can reject re-adding a built-in. + /// `nonisolated` because it is an immutable constant with no actor state. + nonisolated static let builtInRelayURLs = Set( + builtInRelays.compactMap { NostrRelayURL.normalized($0) } + ) /// The relays private messages target: the built-in set plus any added by /// hand. Four hardcoded hostnames are four names for a censor to block, so @@ -182,10 +186,6 @@ final class NostrRelayManager: ObservableObject { defaultRelaySet = Set(defaultRelays) } - /// Exposed so the relay settings UI can reject re-adding a built-in. - /// `nonisolated` because it is an immutable constant with no actor state. - nonisolated static var builtInRelayURLs: Set { builtInRelaySet } - @Published private(set) var relays: [Relay] = [] @Published private(set) var isConnected = false /// Whether a relay that carries private messages is connected. DMs From ab835e58c9dd5e984ce1bf3b3acdb72c6b4ebc52 Mon Sep 17 00:00:00 2001 From: Taksh Kothari Date: Thu, 30 Jul 2026 22:26:39 +0530 Subject: [PATCH 08/23] Don't suggest blocked people in @-mentions (#1543) * Keep blocked peers out of @-mention suggestions Blocked mesh nicknames and blocked geohash pubkeys no longer show up in the composer autocomplete list. Co-authored-by: Cursor * Fix blocked-mention test resetting private(set) state Co-authored-by: Cursor --------- Co-authored-by: Cursor --- .../ViewModels/ChatComposerCoordinator.swift | 20 ++++++++-- .../ChatComposerCoordinatorContextTests.swift | 38 +++++++++++++++++++ 2 files changed, 55 insertions(+), 3 deletions(-) diff --git a/bitchat/ViewModels/ChatComposerCoordinator.swift b/bitchat/ViewModels/ChatComposerCoordinator.swift index c554a9e3..d0d347f2 100644 --- a/bitchat/ViewModels/ChatComposerCoordinator.swift +++ b/bitchat/ViewModels/ChatComposerCoordinator.swift @@ -31,6 +31,10 @@ protocol ChatComposerContext: AnyObject { /// The transport's own nickname (excluded from autocomplete candidates). var meshNickname: String { get } func meshPeerNicknames() -> [PeerID: String] + /// True when this mesh nickname belongs to a blocked peer. + func isMeshNicknameBlocked(_ nickname: String) -> Bool + /// True when this geohash pubkey is blocked for location chats. + func isNostrBlocked(pubkeyHexLowercased: String) -> Bool // MARK: Geohash identity (shared with the other contexts) var geoNicknames: [String: String] { get } @@ -40,8 +44,8 @@ protocol ChatComposerContext: AnyObject { extension ChatViewModel: ChatComposerContext { // `autocompleteSuggestions`, `autocompleteRange`, `showAutocomplete`, // `selectedAutocompleteIndex`, `nickname`, `myPeerID`, `activeChannel`, - // `geoNicknames`, `meshPeerNicknames()`, and - // `deriveNostrIdentity(forGeohash:)` are shared requirements with the + // `geoNicknames`, `meshPeerNicknames()`, `isNostrBlocked(pubkeyHexLowercased:)`, + // and `deriveNostrIdentity(forGeohash:)` are shared requirements with the // other contexts or satisfied by existing `ChatViewModel` members. The // members below flatten nested service accesses into intent-named calls. @@ -60,6 +64,13 @@ extension ChatViewModel: ChatComposerContext { var meshNickname: String { meshService.myNickname } + + func isMeshNicknameBlocked(_ nickname: String) -> Bool { + for (peerID, nick) in meshService.getPeerNicknames() where nick == nickname { + if isPeerBlocked(peerID) { return true } + } + return false + } } @MainActor @@ -136,11 +147,14 @@ private extension ChatComposerCoordinator { switch context.activeChannel { case .mesh: let values = context.meshPeerNicknames().values - return Array(values.filter { $0 != context.meshNickname }) + return Array(values.filter { nick in + nick != context.meshNickname && !context.isMeshNicknameBlocked(nick) + }) case .location(let channel): var tokens = Set() for (pubkey, nick) in context.geoNicknames { + guard !context.isNostrBlocked(pubkeyHexLowercased: pubkey) else { continue } tokens.insert("\(nick)#\(pubkey.suffix(4))") } if let identity = try? context.deriveNostrIdentity(forGeohash: channel.geohash) { diff --git a/bitchatTests/ChatComposerCoordinatorContextTests.swift b/bitchatTests/ChatComposerCoordinatorContextTests.swift index 24624897..d38ddc8a 100644 --- a/bitchatTests/ChatComposerCoordinatorContextTests.swift +++ b/bitchatTests/ChatComposerCoordinatorContextTests.swift @@ -52,9 +52,19 @@ private final class MockChatComposerContext: ChatComposerContext { var activeChannel: ChannelID = .mesh var meshNickname = "me" var meshNicknamesByPeerID: [PeerID: String] = [:] + var blockedMeshNicknames: Set = [] + var blockedNostrPubkeys: Set = [] func meshPeerNicknames() -> [PeerID: String] { meshNicknamesByPeerID } + func isMeshNicknameBlocked(_ nickname: String) -> Bool { + blockedMeshNicknames.contains(nickname) + } + + func isNostrBlocked(pubkeyHexLowercased: String) -> Bool { + blockedNostrPubkeys.contains(pubkeyHexLowercased.lowercased()) + } + // Geohash identity var geoNicknames: [String: String] = [:] static let dummyIdentity = NostrIdentity( @@ -120,6 +130,34 @@ struct ChatComposerCoordinatorContextTests { #expect(context.queriedPeerCandidates == [["carol#dddd"]]) } + @Test @MainActor + func updateAutocomplete_excludesBlockedMeshAndGeohashPeers() { + let context = MockChatComposerContext() + let coordinator = ChatComposerCoordinator(context: context) + context.meshNicknamesByPeerID = [ + PeerID(str: "1111111111111111"): "alice", + PeerID(str: "2222222222222222"): "eve", + PeerID(str: "3333333333333333"): "me" + ] + context.blockedMeshNicknames = ["eve"] + context.queryResult = (["@alice"], NSRange(location: 0, length: 3)) + + coordinator.updateAutocomplete(for: "@a", cursorPosition: 2) + #expect(context.queriedPeerCandidates == [["alice"]]) + + let geoContext = MockChatComposerContext() + let geoCoordinator = ChatComposerCoordinator(context: geoContext) + geoContext.activeChannel = .location(GeohashChannel(level: .city, geohash: "u4pruydq")) + geoContext.geoNicknames = [ + "aaaabbbbccccdddd": "carol", + "bbbbccccddddeeee": "blocked" + ] + geoContext.blockedNostrPubkeys = ["bbbbccccddddeeee"] + + geoCoordinator.updateAutocomplete(for: "@", cursorPosition: 1) + #expect(geoContext.queriedPeerCandidates == [["carol#dddd"]]) + } + @Test @MainActor func completeNickname_appliesSuggestionResetsStateAndReturnsCursor() { let context = MockChatComposerContext() From 81837d7202663762d016eca0f6471da7b067b0e8 Mon Sep 17 00:00:00 2001 From: Vidit Kulshrestha <91754462+viditkulsh@users.noreply.github.com> Date: Thu, 30 Jul 2026 22:26:42 +0530 Subject: [PATCH 09/23] Make DeliveryStatus non-optional with an explicit .notSentYet state (#1503) BitchatMessage.deliveryStatus was Optional, with nil implicitly meaning 'no tracking' for public messages. Every consumer had to branch on the absent case, ranking needed an optional-aware helper, and the UI treated nil as an invisible state (#644). Model delivery as a total state machine instead: - New DeliveryStatus.notSentYet: created but not yet handed to any transport. Public messages initialize to it; private messages keep their historical .sending default. - BitchatMessage.deliveryStatus becomes non-optional. Archives written while the field was optional decode with the absent key mapped to .notSentYet. The wire format is untouched (toBinaryPayload never carried the field). - deliveryStatusRank drops its optional parameter; .notSentYet ranks below .failed, preserving the existing dedup preference order. - Conversation.shouldSkipStatusUpdate treats a write back to .notSentYet as a downgrade and skips it. - The status indicator renders exactly as before: .notSentYet draws nothing in message rows (the state nil used to represent), and DeliveryStatusView gains a glyph and description for it only so the view stays total. Tests: initialization defaults, legacy-archive decoding, round-trip, the extended rank order, and the new downgrade rule. Fixes #644 --- bitchat/App/ConversationStore.swift | 7 ++- bitchat/Services/PrivateChatManager.swift | 14 ++--- .../ViewModels/ChatLifecycleCoordinator.swift | 4 +- .../Views/Components/DeliveryStatusView.swift | 10 ++++ .../Views/Components/TextMessageView.swift | 14 ++--- bitchat/Views/Media/MediaMessageView.swift | 36 ++++++----- bitchat/Views/MessageListView.swift | 2 +- .../ChatViewModelDeliveryStatusTests.swift | 22 ++++--- .../BLEFileTransferHandlerTests.swift | 2 +- .../BitFoundation/BitchatMessage.swift | 8 ++- .../BitFoundation/DeliveryStatus.swift | 3 + .../DeliveryStatusNotSentYetTests.swift | 59 +++++++++++++++++++ 12 files changed, 130 insertions(+), 51 deletions(-) create mode 100644 localPackages/BitFoundation/Tests/BitFoundationTests/DeliveryStatusNotSentYetTests.swift diff --git a/bitchat/App/ConversationStore.swift b/bitchat/App/ConversationStore.swift index eb174120..76e71813 100644 --- a/bitchat/App/ConversationStore.swift +++ b/bitchat/App/ConversationStore.swift @@ -230,8 +230,7 @@ final class Conversation: ObservableObject, Identifiable { // MARK: Internals - static func shouldSkipStatusUpdate(current: DeliveryStatus?, new: DeliveryStatus) -> Bool { - guard let current else { return false } + static func shouldSkipStatusUpdate(current: DeliveryStatus, new: DeliveryStatus) -> Bool { if current == new { return true } // Never downgrade to a weaker delivery state. Ordering of certainty: @@ -254,6 +253,10 @@ final class Conversation: ObservableObject, Identifiable { return true case (.sent, .sending): return true + case (_, .notSentYet): + // .notSentYet is the pre-transport initial state; once a message + // has any real status, resetting to it is always a downgrade. + return true default: return false } diff --git a/bitchat/Services/PrivateChatManager.swift b/bitchat/Services/PrivateChatManager.swift index 977bdcb3..dcf4631b 100644 --- a/bitchat/Services/PrivateChatManager.swift +++ b/bitchat/Services/PrivateChatManager.swift @@ -203,14 +203,12 @@ final class PrivateChatManager: ObservableObject { func syncReadReceiptsForSentMessages(peerID: PeerID, nickname: String, externalReceipts: inout Set) { for message in messages(for: peerID) { if message.sender == nickname { - if let status = message.deliveryStatus { - switch status { - case .read, .delivered: - externalReceipts.insert(message.id) - sentReadReceipts.insert(message.id) - case .failed, .partiallyDelivered, .sending, .sent, .carried: - break - } + switch message.deliveryStatus { + case .read, .delivered: + externalReceipts.insert(message.id) + sentReadReceipts.insert(message.id) + case .notSentYet, .failed, .partiallyDelivered, .sending, .sent, .carried: + break } } } diff --git a/bitchat/ViewModels/ChatLifecycleCoordinator.swift b/bitchat/ViewModels/ChatLifecycleCoordinator.swift index 1ea87a41..a2d8e8ea 100644 --- a/bitchat/ViewModels/ChatLifecycleCoordinator.swift +++ b/bitchat/ViewModels/ChatLifecycleCoordinator.swift @@ -360,9 +360,9 @@ private extension ChatLifecycleCoordinator { } } - func deliveryStatusRank(_ status: DeliveryStatus?) -> Int { - guard let status else { return 0 } + func deliveryStatusRank(_ status: DeliveryStatus) -> Int { switch status { + case .notSentYet: return 0 case .failed: return 1 case .sending: return 2 case .sent: return 3 diff --git a/bitchat/Views/Components/DeliveryStatusView.swift b/bitchat/Views/Components/DeliveryStatusView.swift index e106d2c1..ad8039e9 100644 --- a/bitchat/Views/Components/DeliveryStatusView.swift +++ b/bitchat/Views/Components/DeliveryStatusView.swift @@ -15,6 +15,8 @@ extension DeliveryStatus { /// the glyphs alone are unexplained 10pt icons. var bitchatDescription: String { switch self { + case .notSentYet: + return String(localized: "content.delivery.not_sent_yet", defaultValue: "Not sent yet", comment: "Delivery status description for a message that has not entered any send pipeline") case .sending: return String(localized: "content.delivery.sending", comment: "Delivery status description while a private message is being sent") case .sent: @@ -72,6 +74,13 @@ struct DeliveryStatusView: View { @ViewBuilder private var statusGlyph: some View { switch status { + case .notSentYet: + // Normally hidden by callers; shown as a hollow dotted circle if + // it ever surfaces so the state is visible rather than invisible. + Image(systemName: "circle.dotted") + .font(.bitchatSystem(size: 10)) + .foregroundColor(secondaryTextColor.opacity(0.6)) + case .sending: Image(systemName: "circle") .font(.bitchatSystem(size: 10)) @@ -125,6 +134,7 @@ struct DeliveryStatusView: View { #Preview { let statuses: [DeliveryStatus] = [ + .notSentYet, .sending, .sent, .carried, diff --git a/bitchat/Views/Components/TextMessageView.swift b/bitchat/Views/Components/TextMessageView.swift index 48ccb427..a16e3ac6 100644 --- a/bitchat/Views/Components/TextMessageView.swift +++ b/bitchat/Views/Components/TextMessageView.swift @@ -23,7 +23,7 @@ struct TextMessageView: View { /// SAME instance would otherwise compare "unchanged" and this row's body /// would be skipped even though the parent list re-rendered. Snapshotting /// the enum makes the change visible to SwiftUI's structural diff. - private let deliveryStatus: DeliveryStatus? + private let deliveryStatus: DeliveryStatus @State private var expandedMessageIDs: Set = [] @State private var showDeliveryDetail = false @@ -68,11 +68,11 @@ struct TextMessageView: View { // .help() tooltips only exist on macOS, so iOS users get the // explanation as a caption under the row instead. if message.isPrivate && conversationUIModel.isSentByCurrentUser(message), - let status = deliveryStatus { + deliveryStatus != .notSentYet { Button { showDeliveryDetail.toggle() } label: { - DeliveryStatusView(status: status) + DeliveryStatusView(status: deliveryStatus) .padding(.leading, 4) .contentShape(Rectangle()) } @@ -86,15 +86,15 @@ struct TextMessageView: View { // Failure reasons stay visible without a tap; other statuses // reveal on demand. if message.isPrivate && conversationUIModel.isSentByCurrentUser(message), - let status = deliveryStatus { - if case .failed = status { - Text(verbatim: status.bitchatDescription) + deliveryStatus != .notSentYet { + if case .failed = deliveryStatus { + Text(verbatim: deliveryStatus.bitchatDescription) .bitchatFont(size: 11) .foregroundColor(Color.red.opacity(0.9)) .fixedSize(horizontal: false, vertical: true) .padding(.top, 2) } else if showDeliveryDetail { - Text(verbatim: status.bitchatDescription) + Text(verbatim: deliveryStatus.bitchatDescription) .bitchatFont(size: 11) .foregroundColor(palette.secondary) .fixedSize(horizontal: false, vertical: true) diff --git a/bitchat/Views/Media/MediaMessageView.swift b/bitchat/Views/Media/MediaMessageView.swift index 2b12ee24..2e2d1429 100644 --- a/bitchat/Views/Media/MediaMessageView.swift +++ b/bitchat/Views/Media/MediaMessageView.swift @@ -20,7 +20,7 @@ struct MediaMessageView: View { /// is a reference type mutated in place, and SwiftUI compares reference /// fields by identity, so without the snapshot a status-only change /// (send progress, delivered → read) would not re-render this row. - private let deliveryStatus: DeliveryStatus? + private let deliveryStatus: DeliveryStatus @State private var showDeliveryDetail = false @Binding var imagePreviewURL: URL? @@ -57,11 +57,11 @@ struct MediaMessageView: View { // .help() tooltips only exist on macOS, so iOS users get the // explanation as a caption under the row instead. if message.isPrivate && conversationUIModel.isSentByCurrentUser(message), - let status = deliveryStatus { + deliveryStatus != .notSentYet { Button { showDeliveryDetail.toggle() } label: { - DeliveryStatusView(status: status) + DeliveryStatusView(status: deliveryStatus) .padding(.leading, 4) .contentShape(Rectangle()) } @@ -75,14 +75,14 @@ struct MediaMessageView: View { // Failure reasons stay visible without a tap; other statuses // reveal on demand. if message.isPrivate && conversationUIModel.isSentByCurrentUser(message), - let status = deliveryStatus { - if case .failed = status { - Text(verbatim: status.bitchatDescription) + deliveryStatus != .notSentYet { + if case .failed = deliveryStatus { + Text(verbatim: deliveryStatus.bitchatDescription) .bitchatFont(size: 11) .foregroundColor(Color.red.opacity(0.9)) .fixedSize(horizontal: false, vertical: true) } else if showDeliveryDetail { - Text(verbatim: status.bitchatDescription) + Text(verbatim: deliveryStatus.bitchatDescription) .bitchatFont(size: 11) .foregroundColor(palette.secondary) .fixedSize(horizontal: false, vertical: true) @@ -132,26 +132,24 @@ struct MediaMessageView: View { } } - private func mediaSendState(for deliveryStatus: DeliveryStatus?, isFromMe: Bool) -> (isSending: Bool, progress: Double?, canCancel: Bool) { + private func mediaSendState(for deliveryStatus: DeliveryStatus, isFromMe: Bool) -> (isSending: Bool, progress: Double?, canCancel: Bool) { // A received message is never in a send state: BitchatMessage defaults // private messages to .sending, so an incoming message's status must // not drive the reveal mask or disable the reveal tap. guard isFromMe else { return (false, nil, false) } var isSending = false var progress: Double? - if let status = deliveryStatus { - switch status { - case .sending: + switch deliveryStatus { + case .sending: + isSending = true + progress = 0 + case .partiallyDelivered(let reached, let total): + if total > 0 { isSending = true - progress = 0 - case .partiallyDelivered(let reached, let total): - if total > 0 { - isSending = true - progress = Double(reached) / Double(total) - } - case .sent, .carried, .read, .delivered, .failed: - break + progress = Double(reached) / Double(total) } + case .notSentYet, .sent, .carried, .read, .delivered, .failed: + break } let canCancel = isSending && conversationUIModel.isSentByCurrentUser(message) let clamped = progress.map { max(0, min(1, $0)) } diff --git a/bitchat/Views/MessageListView.swift b/bitchat/Views/MessageListView.swift index 2742aebd..6e1c6b95 100644 --- a/bitchat/Views/MessageListView.swift +++ b/bitchat/Views/MessageListView.swift @@ -430,7 +430,7 @@ private extension MessageListView { guard message.isPrivate, conversationUIModel.isSentByCurrentUser(message), conversationUIModel.mediaAttachment(for: message) == nil, - case .some(.failed) = message.deliveryStatus + case .failed = message.deliveryStatus else { return false } return true } diff --git a/bitchatTests/ChatViewModelDeliveryStatusTests.swift b/bitchatTests/ChatViewModelDeliveryStatusTests.swift index 15a1edea..409b897f 100644 --- a/bitchatTests/ChatViewModelDeliveryStatusTests.swift +++ b/bitchatTests/ChatViewModelDeliveryStatusTests.swift @@ -147,6 +147,10 @@ struct ChatViewModelDeliveryStatusTests { #expect(Conversation.shouldSkipStatusUpdate(current: .sent, new: .sending)) // ...but a retry after a real failure stays visible. #expect(!Conversation.shouldSkipStatusUpdate(current: .failed(reason: "no route"), new: .sending)) + // .notSentYet is the pre-transport initial state: leaving it is always + // allowed, returning to it never is. + #expect(!Conversation.shouldSkipStatusUpdate(current: .notSentYet, new: .sending)) + #expect(Conversation.shouldSkipStatusUpdate(current: .sent, new: .notSentYet)) } @Test @MainActor @@ -729,9 +733,10 @@ struct ChatViewModelDeliveryStatusTests { @Test @MainActor func statusRank_orderingIsCorrect() async { // This tests the implicit ordering used in refreshVisibleMessages - // failed < sending < sent < carried < partiallyDelivered < delivered < read + // notSentYet < failed < sending < sent < carried < partiallyDelivered < delivered < read let statuses: [DeliveryStatus] = [ + .notSentYet, .failed(reason: "test"), .sending, .sent, @@ -745,13 +750,14 @@ struct ChatViewModelDeliveryStatusTests { // This is more of a documentation test to ensure the ranking logic is understood for (index, status) in statuses.enumerated() { switch status { - case .failed: #expect(index == 0) - case .sending: #expect(index == 1) - case .sent: #expect(index == 2) - case .carried: #expect(index == 3) - case .partiallyDelivered: #expect(index == 4) - case .delivered: #expect(index == 5) - case .read: #expect(index == 6) + case .notSentYet: #expect(index == 0) + case .failed: #expect(index == 1) + case .sending: #expect(index == 2) + case .sent: #expect(index == 3) + case .carried: #expect(index == 4) + case .partiallyDelivered: #expect(index == 5) + case .delivered: #expect(index == 6) + case .read: #expect(index == 7) } } } diff --git a/bitchatTests/Services/BLEFileTransferHandlerTests.swift b/bitchatTests/Services/BLEFileTransferHandlerTests.swift index ea3b3554..835bcdba 100644 --- a/bitchatTests/Services/BLEFileTransferHandlerTests.swift +++ b/bitchatTests/Services/BLEFileTransferHandlerTests.swift @@ -222,7 +222,7 @@ struct BLEFileTransferHandlerTests { #expect(message?.isPrivate == false) #expect(message?.senderPeerID == remotePeerID) #expect(message?.timestamp == Date(timeIntervalSince1970: 900)) - #expect(message?.deliveryStatus == nil) + #expect(message?.deliveryStatus == .notSentYet) } @Test diff --git a/localPackages/BitFoundation/Sources/BitFoundation/BitchatMessage.swift b/localPackages/BitFoundation/Sources/BitFoundation/BitchatMessage.swift index cf7039fa..064cd5da 100644 --- a/localPackages/BitFoundation/Sources/BitFoundation/BitchatMessage.swift +++ b/localPackages/BitFoundation/Sources/BitFoundation/BitchatMessage.swift @@ -29,7 +29,7 @@ public final class BitchatMessage: Codable { public let recipientNickname: String? public let senderPeerID: PeerID? public let mentions: [String]? // Array of mentioned nicknames - public var deliveryStatus: DeliveryStatus? // Delivery tracking + public var deliveryStatus: DeliveryStatus // Delivery tracking /// True when this message reached us across a mesh bridge (signed by its /// author for an internet rendezvous) rather than over local radio. public let isBridged: Bool @@ -64,7 +64,9 @@ public final class BitchatMessage: Codable { recipientNickname = try container.decodeIfPresent(String.self, forKey: .recipientNickname) senderPeerID = try container.decodeIfPresent(PeerID.self, forKey: .senderPeerID) mentions = try container.decodeIfPresent([String].self, forKey: .mentions) - deliveryStatus = try container.decodeIfPresent(DeliveryStatus.self, forKey: .deliveryStatus) + // Archives written while the field was optional omit it for public + // messages; absent means the message never entered a send pipeline. + deliveryStatus = try container.decodeIfPresent(DeliveryStatus.self, forKey: .deliveryStatus) ?? .notSentYet // Absent in archives written before bridging existed. isBridged = try container.decodeIfPresent(Bool.self, forKey: .isBridged) ?? false } @@ -93,7 +95,7 @@ public final class BitchatMessage: Codable { self.recipientNickname = recipientNickname self.senderPeerID = senderPeerID self.mentions = mentions - self.deliveryStatus = deliveryStatus ?? (isPrivate ? .sending : nil) + self.deliveryStatus = deliveryStatus ?? (isPrivate ? .sending : .notSentYet) self.isBridged = isBridged } } diff --git a/localPackages/BitFoundation/Sources/BitFoundation/DeliveryStatus.swift b/localPackages/BitFoundation/Sources/BitFoundation/DeliveryStatus.swift index 32fa4e76..ded2efa9 100644 --- a/localPackages/BitFoundation/Sources/BitFoundation/DeliveryStatus.swift +++ b/localPackages/BitFoundation/Sources/BitFoundation/DeliveryStatus.swift @@ -9,6 +9,7 @@ import struct Foundation.Date public enum DeliveryStatus: Codable, Equatable, Hashable { + case notSentYet // Created but not yet handed to any transport case sending case sent // Left our device case carried // Sealed envelope handed to a courier; best-effort physical delivery @@ -19,6 +20,8 @@ public enum DeliveryStatus: Codable, Equatable, Hashable { public var displayText: String { switch self { + case .notSentYet: + return "Not sent yet" case .sending: return "Sending..." case .sent: diff --git a/localPackages/BitFoundation/Tests/BitFoundationTests/DeliveryStatusNotSentYetTests.swift b/localPackages/BitFoundation/Tests/BitFoundationTests/DeliveryStatusNotSentYetTests.swift new file mode 100644 index 00000000..71a7d36a --- /dev/null +++ b/localPackages/BitFoundation/Tests/BitFoundationTests/DeliveryStatusNotSentYetTests.swift @@ -0,0 +1,59 @@ +// +// DeliveryStatusNotSentYetTests.swift +// bitchatTests +// +// DeliveryStatus is a total state machine: every message carries a concrete +// status from creation. Public messages start .notSentYet, private messages +// keep their historical .sending default, and archives persisted while the +// field was optional decode with the absent field mapped to .notSentYet. +// This is free and unencumbered software released into the public domain. +// For more information, see +// + +import Testing +import Foundation +@testable import BitFoundation + +struct DeliveryStatusNotSentYetTests { + + private func makeMessage(isPrivate: Bool, deliveryStatus: DeliveryStatus? = nil) -> BitchatMessage { + BitchatMessage( + sender: "alice", + content: "hello", + timestamp: Date(timeIntervalSince1970: 1_000), + isRelay: false, + isPrivate: isPrivate, + deliveryStatus: deliveryStatus + ) + } + + @Test + func publicMessagesStartNotSentYetAndPrivateStartSending() { + #expect(makeMessage(isPrivate: false).deliveryStatus == .notSentYet) + #expect(makeMessage(isPrivate: true).deliveryStatus == .sending) + // An explicit status always wins over the defaults. + #expect(makeMessage(isPrivate: false, deliveryStatus: .sent).deliveryStatus == .sent) + } + + @Test + func decodingLegacyArchiveWithoutStatusYieldsNotSentYet() throws { + // Pre-existing archives omitted the key for public messages while the + // field was optional; absent must map to .notSentYet, not fail. + let encoded = try JSONEncoder().encode(makeMessage(isPrivate: false)) + var json = try #require( + JSONSerialization.jsonObject(with: encoded) as? [String: Any] + ) + json.removeValue(forKey: "deliveryStatus") + let legacyData = try JSONSerialization.data(withJSONObject: json) + + let decoded = try JSONDecoder().decode(BitchatMessage.self, from: legacyData) + #expect(decoded.deliveryStatus == .notSentYet) + } + + @Test + func decodingRoundTripPreservesConcreteStatus() throws { + let message = makeMessage(isPrivate: true, deliveryStatus: .delivered(to: "bob", at: Date(timeIntervalSince1970: 2_000))) + let decoded = try JSONDecoder().decode(BitchatMessage.self, from: JSONEncoder().encode(message)) + #expect(decoded.deliveryStatus == .delivered(to: "bob", at: Date(timeIntervalSince1970: 2_000))) + } +} From 4ef5558d7bd275ffb9e54ee2969e639e3a5c71e8 Mon Sep 17 00:00:00 2001 From: Vidit Kulshrestha <91754462+viditkulsh@users.noreply.github.com> Date: Thu, 30 Jul 2026 22:26:45 +0530 Subject: [PATCH 10/23] Replace try! regex construction with a non-trapping SafeRegex helper (#1501) MessageFormattingEngine and MessageDeduplicationService compiled eight bundled regex literals with try!, so a bad pattern would crash the app at startup - in the middle of the message-render path (#645). Add SafeRegex.compile: it compiles the pattern normally, and on failure logs through SecureLogger and returns a never-matching regex ('(?!)'), so a broken pattern degrades that one formatting feature instead of trapping. Pattern properties stay non-optional, so no call-site churn across ChatMessageFormatter, MessageTextHelpers, and ChatComposerCoordinator. The compile-time guarantee try! provided moves into tests: each production pattern is asserted to compile and match a known-good sample, so a typo in a pattern now fails CI instead of crashing users. Part of #645 (the remaining try! sites; NoiseSessionManager's force-unwrap is addressed separately in #1456). --- .../MessageDeduplicationService.swift | 10 ++- .../Services/MessageFormattingEngine.swift | 28 ++------ bitchat/Utils/SafeRegex.swift | 36 +++++++++++ bitchatTests/Services/SafeRegexTests.swift | 64 +++++++++++++++++++ 4 files changed, 111 insertions(+), 27 deletions(-) create mode 100644 bitchat/Utils/SafeRegex.swift create mode 100644 bitchatTests/Services/SafeRegexTests.swift diff --git a/bitchat/Services/MessageDeduplicationService.swift b/bitchat/Services/MessageDeduplicationService.swift index c6773461..693365ca 100644 --- a/bitchat/Services/MessageDeduplicationService.swift +++ b/bitchat/Services/MessageDeduplicationService.swift @@ -104,12 +104,10 @@ final class LRUDeduplicationCache { enum ContentNormalizer { /// Regex to simplify HTTP URLs by stripping query strings and fragments - private static let simplifyHTTPURL: NSRegularExpression = { - try! NSRegularExpression( - pattern: "https?://[^\\s?#]+(?:[?#][^\\s]*)?", - options: [.caseInsensitive] - ) - }() + private static let simplifyHTTPURL = SafeRegex.compile( + "https?://[^\\s?#]+(?:[?#][^\\s]*)?", + options: [.caseInsensitive] + ) /// Normalizes content for deduplication comparison. /// - Parameters: diff --git a/bitchat/Services/MessageFormattingEngine.swift b/bitchat/Services/MessageFormattingEngine.swift index 43adcb19..8f77bfa5 100644 --- a/bitchat/Services/MessageFormattingEngine.swift +++ b/bitchat/Services/MessageFormattingEngine.swift @@ -39,37 +39,23 @@ final class MessageFormattingEngine { /// Precompiled regex patterns for message content parsing enum Patterns { - static let hashtag: NSRegularExpression = { - try! NSRegularExpression(pattern: "#([a-zA-Z0-9_]+)", options: []) - }() + static let hashtag = SafeRegex.compile("#([a-zA-Z0-9_]+)") - static let mention: NSRegularExpression = { - try! NSRegularExpression(pattern: "@([\\p{L}0-9_]+(?:#[a-fA-F0-9]{4})?)", options: []) - }() + static let mention = SafeRegex.compile("@([\\p{L}0-9_]+(?:#[a-fA-F0-9]{4})?)") - static let cashu: NSRegularExpression = { - try! NSRegularExpression(pattern: "\\bcashu[AB][A-Za-z0-9._-]{40,}\\b", options: []) - }() + static let cashu = SafeRegex.compile("\\bcashu[AB][A-Za-z0-9._-]{40,}\\b") - static let bolt11: NSRegularExpression = { - try! NSRegularExpression(pattern: "(?i)\\bln(bc|tb|bcrt)[0-9][a-z0-9]{50,}\\b", options: []) - }() + static let bolt11 = SafeRegex.compile("(?i)\\bln(bc|tb|bcrt)[0-9][a-z0-9]{50,}\\b") - static let lnurl: NSRegularExpression = { - try! NSRegularExpression(pattern: "(?i)\\blnurl1[a-z0-9]{20,}\\b", options: []) - }() + static let lnurl = SafeRegex.compile("(?i)\\blnurl1[a-z0-9]{20,}\\b") - static let lightningScheme: NSRegularExpression = { - try! NSRegularExpression(pattern: "(?i)\\blightning:[^\\s]+", options: []) - }() + static let lightningScheme = SafeRegex.compile("(?i)\\blightning:[^\\s]+") static let linkDetector: NSDataDetector? = { try? NSDataDetector(types: NSTextCheckingResult.CheckingType.link.rawValue) }() - static let quickCashuPresence: NSRegularExpression = { - try! NSRegularExpression(pattern: "\\bcashu[AB][A-Za-z0-9._-]{40,}\\b", options: []) - }() + static let quickCashuPresence = SafeRegex.compile("\\bcashu[AB][A-Za-z0-9._-]{40,}\\b") } // MARK: - Match Types diff --git a/bitchat/Utils/SafeRegex.swift b/bitchat/Utils/SafeRegex.swift new file mode 100644 index 00000000..125f2f80 --- /dev/null +++ b/bitchat/Utils/SafeRegex.swift @@ -0,0 +1,36 @@ +// +// SafeRegex.swift +// bitchat +// +// Non-trapping construction for the app's compiled-in regex patterns. +// This is free and unencumbered software released into the public domain. +// For more information, see +// + +import BitLogger +import Foundation + +enum SafeRegex { + /// Compiles a bundled pattern. On failure it logs and returns a regex + /// that can never match, so a bad pattern degrades that one feature + /// instead of crashing at startup. + static func compile(_ pattern: String, options: NSRegularExpression.Options = []) -> NSRegularExpression { + do { + return try NSRegularExpression(pattern: pattern, options: options) + } catch { + SecureLogger.error("Regex pattern failed to compile, matching disabled: \(pattern) (\(error))", category: .session) + return neverMatching + } + } + + /// `(?!)` — an empty negative lookahead — always compiles and can never match. + private static let neverMatching: NSRegularExpression = { + if let regex = try? NSRegularExpression(pattern: "(?!)", options: []) { + return regex + } + // Unreachable: "(?!)" is a valid ICU pattern. The inherited plain + // initializer (empty pattern) is the least-bad non-trapping fallback + // if ICU itself were ever broken. + return NSRegularExpression() + }() +} diff --git a/bitchatTests/Services/SafeRegexTests.swift b/bitchatTests/Services/SafeRegexTests.swift new file mode 100644 index 00000000..fe92a6b8 --- /dev/null +++ b/bitchatTests/Services/SafeRegexTests.swift @@ -0,0 +1,64 @@ +// +// SafeRegexTests.swift +// bitchatTests +// +// SafeRegex must never trap: valid patterns compile normally, invalid ones +// degrade to a regex that matches nothing. The production-pattern test keeps +// the compile-time guarantee try! used to provide - a typo in any bundled +// pattern fails here instead of crashing the app at startup. +// This is free and unencumbered software released into the public domain. +// For more information, see +// + +import Foundation +import Testing +@testable import bitchat + +struct SafeRegexTests { + + private func matchCount(_ regex: NSRegularExpression, _ text: String) -> Int { + regex.numberOfMatches(in: text, options: [], range: NSRange(text.startIndex..., in: text)) + } + + @Test + func validPatternCompilesAndMatches() { + let regex = SafeRegex.compile("#([a-zA-Z0-9_]+)") + #expect(matchCount(regex, "tag #bitchat here") == 1) + } + + @Test + func invalidPatternDegradesToNeverMatching() { + let regex = SafeRegex.compile("(unclosed") + #expect(matchCount(regex, "(unclosed anything") == 0) + #expect(matchCount(regex, "") == 0) + } + + @Test + func productionPatternsCompileAndMatchTheirTargets() { + // A pattern that failed to compile would have degraded to + // never-matching, so each positive match proves the literal compiled. + #expect(matchCount(MessageFormattingEngine.Patterns.hashtag, "see #mesh") == 1) + #expect(matchCount(MessageFormattingEngine.Patterns.mention, "hi @alice#ab12") == 1) + + let cashuToken = "cashuA" + String(repeating: "x", count: 45) + #expect(matchCount(MessageFormattingEngine.Patterns.cashu, cashuToken) == 1) + #expect(matchCount(MessageFormattingEngine.Patterns.quickCashuPresence, cashuToken) == 1) + + let bolt11 = "lnbc1" + String(repeating: "q", count: 55) + #expect(matchCount(MessageFormattingEngine.Patterns.bolt11, bolt11) == 1) + + let lnurl = "lnurl1" + String(repeating: "q", count: 25) + #expect(matchCount(MessageFormattingEngine.Patterns.lnurl, lnurl) == 1) + + #expect(matchCount(MessageFormattingEngine.Patterns.lightningScheme, "pay lightning:abc123") == 1) + } + + @Test + func contentNormalizerStillSimplifiesURLs() { + // Exercises ContentNormalizer's regex through its public entry point: + // same URL with different query strings must normalize identically. + let a = ContentNormalizer.normalizedKey("check https://example.com/page?q=1") + let b = ContentNormalizer.normalizedKey("check https://example.com/page?q=2") + #expect(a == b) + } +} From e7f4ef091277af19f0873ab8dc7016d52ff1622f Mon Sep 17 00:00:00 2001 From: Taksh Kothari Date: Thu, 30 Jul 2026 22:26:48 +0530 Subject: [PATCH 11/23] fix: show verified seal next to sender names in chat (#1506) Surface fingerprint verification in the message timeline so a verified contact is distinguishable from an impersonator without opening the fingerprint sheet. Co-authored-by: Cursor --- bitchat/ViewModels/ChatMessageFormatter.swift | 36 +++++++++++++++++-- 1 file changed, 34 insertions(+), 2 deletions(-) diff --git a/bitchat/ViewModels/ChatMessageFormatter.swift b/bitchat/ViewModels/ChatMessageFormatter.swift index 62723d7a..a2259b08 100644 --- a/bitchat/ViewModels/ChatMessageFormatter.swift +++ b/bitchat/ViewModels/ChatMessageFormatter.swift @@ -41,7 +41,9 @@ final class ChatMessageFormatter { }() let isDark = colorScheme == .dark - if let cachedText = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf, variant: theme.formatCacheVariant) { + let isVerifiedSender = !isSelf && isVerifiedSender(of: message) + let cacheVariant = theme.formatCacheVariant + (isVerifiedSender ? "-vf" : "") + if let cachedText = message.getCachedFormattedText(isDark: isDark, isSelf: isSelf, variant: cacheVariant) { return cachedText } @@ -66,6 +68,9 @@ final class ChatMessageFormatter { suffixStyle.foregroundColor = baseColor.opacity(0.6) result.append(AttributedString(suffix).mergingAttributes(suffixStyle)) } + if isVerifiedSender { + appendVerifiedSeal(to: &result, baseColor: baseColor, design: design) + } result.append(AttributedString("> ").mergingAttributes(senderStyle)) let content = message.content @@ -335,7 +340,7 @@ final class ChatMessageFormatter { result.append(timestamp.mergingAttributes(timestampStyle)) } - message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf, variant: theme.formatCacheVariant) + message.setCachedFormattedText(result, isDark: isDark, isSelf: isSelf, variant: cacheVariant) return result } @@ -356,6 +361,7 @@ final class ChatMessageFormatter { let isDark = colorScheme == .dark let baseColor: Color = isSelf ? .orange : peerColor(for: message, isDark: isDark) + let isVerifiedSender = !isSelf && isVerifiedSender(of: message) if message.sender == "system" { var style = AttributeContainer() @@ -381,6 +387,9 @@ final class ChatMessageFormatter { suffixStyle.foregroundColor = baseColor.opacity(0.6) result.append(AttributedString(suffix).mergingAttributes(suffixStyle)) } + if isVerifiedSender { + appendVerifiedSeal(to: &result, baseColor: baseColor, design: design) + } result.append(AttributedString("> ").mergingAttributes(senderStyle)) return result } @@ -427,6 +436,29 @@ final class ChatMessageFormatter { } private extension ChatMessageFormatter { + /// Whether the message sender has a fingerprint the user has verified. + /// Used for the in-chat seal next to `<@name>` so verification is visible + /// without opening the fingerprint sheet (#1439). + func isVerifiedSender(of message: BitchatMessage) -> Bool { + guard let peerID = message.senderPeerID, + let fingerprint = viewModel.getFingerprint(for: peerID) else { + return false + } + return viewModel.peerIdentityStore.isVerified(fingerprint) + } + + func appendVerifiedSeal( + to result: inout AttributedString, + baseColor: Color, + design: Font.Design + ) { + var sealStyle = AttributeContainer() + // Match the peer-list verified seal: filled checkmark in the sender tint. + sealStyle.foregroundColor = baseColor + sealStyle.font = .bitchatSystem(size: 11, weight: .semibold, design: design) + result.append(AttributedString(" ✓").mergingAttributes(sealStyle)) + } + func peerColor(for message: BitchatMessage, isDark: Bool) -> Color { if let spid = message.senderPeerID { if spid.isGeoChat || spid.isGeoDM { From e2bd13a7f2deaca6b73fd2ea5ceb688b31548ef1 Mon Sep 17 00:00:00 2001 From: Taksh Kothari Date: Thu, 30 Jul 2026 22:26:52 +0530 Subject: [PATCH 12/23] chore: fix receive typo and refresh relay count in README (#1510) Correct a confirmation label typo in the public-chat E2E suite and bump the README relay-network claim to match the current GPS relay list. Co-authored-by: Cursor --- README.md | 2 +- bitchatTests/EndToEnd/PublicChatE2ETests.swift | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b9b6e000..36f50be2 100644 --- a/README.md +++ b/README.md @@ -51,7 +51,7 @@ BitChat uses a **hybrid messaging architecture** with two complementary transpor - **Global Reach**: Connect with users worldwide via internet relays - **Location Channels**: Geographic chat rooms using geohash coordinates -- **290+ Relay Network**: Distributed across the globe for reliability +- **440+ Relay Network**: Distributed across the globe for reliability - **BitChat Private Envelopes**: App-specific encrypted private messages over Nostr relays - **Ephemeral Keys**: Fresh cryptographic identity per geohash area diff --git a/bitchatTests/EndToEnd/PublicChatE2ETests.swift b/bitchatTests/EndToEnd/PublicChatE2ETests.swift index b67901d2..4dfdf53f 100644 --- a/bitchatTests/EndToEnd/PublicChatE2ETests.swift +++ b/bitchatTests/EndToEnd/PublicChatE2ETests.swift @@ -50,7 +50,7 @@ struct PublicChatE2ETests { var bobReceivedMessage = false var charlieReceivedMessage = false - await confirmation("Both recieve message", expectedCount: 2) { receiveMessage in + await confirmation("Both receive message", expectedCount: 2) { receiveMessage in bob.messageDeliveryHandler = { message in if message.content == TestConstants.testMessage1 { if !bobReceivedMessage { From 6c8499a603b3961d8a3ace2db7607d9ec127f0de Mon Sep 17 00:00:00 2001 From: Vidit Kulshrestha <91754462+viditkulsh@users.noreply.github.com> Date: Thu, 30 Jul 2026 22:44:53 +0530 Subject: [PATCH 13/23] Normalize nicknames to Unicode NFC at storage and comparison boundaries (#1502) * Replace try! regex construction with a non-trapping SafeRegex helper MessageFormattingEngine and MessageDeduplicationService compiled eight bundled regex literals with try!, so a bad pattern would crash the app at startup - in the middle of the message-render path (#645). Add SafeRegex.compile: it compiles the pattern normally, and on failure logs through SecureLogger and returns a never-matching regex ('(?!)'), so a broken pattern degrades that one formatting feature instead of trapping. Pattern properties stay non-optional, so no call-site churn across ChatMessageFormatter, MessageTextHelpers, and ChatComposerCoordinator. The compile-time guarantee try! provided moves into tests: each production pattern is asserted to compile and match a known-good sample, so a typo in a pattern now fails CI instead of crashing users. Part of #645 (the remaining try! sites; NoiseSessionManager's force-unwrap is addressed separately in #1456). * Normalize nicknames to Unicode NFC at storage and comparison boundaries A nickname containing an accent can arrive in two canonically equivalent but bytewise different forms: precomposed (U+00E9) or decomposed (e + U+0301), depending on the keyboard and platform that produced it. Nicknames were stored and compared without normalization, so visually identical names silently failed to match: mentions of your own name did not highlight or notify, /msg and /block could not resolve the peer, autocomplete skipped candidates, and geohash DM resolution failed (#214). Fix by canonicalizing to NFC (String.normalizedNickname) at every boundary where a nickname enters storage - own nickname (ChatViewModel didSet, alongside the existing trim), verified announce ingest (BLEPeerRegistry), geohash presence (LocationPresenceStore), and InputValidator.validateNickname - and by normalizing both sides at comparison sites that can still see pre-normalization data (persisted favorites, message-content mentions): peer resolution in UnifiedPeerService and ChatPeerIdentityCoordinator, the three mention checks, and autocomplete prefix matching. The wire codec (AnnouncementPacket) is deliberately untouched: announces are signature-verified against raw bytes, so canonicalization happens at the storage layer, never during parsing. Fixes #214 --- bitchat/App/LocationPresenceStore.swift | 3 +- bitchat/Services/AutocompleteService.swift | 6 +-- bitchat/Services/BLE/BLEPeerRegistry.swift | 2 +- .../Services/MessageFormattingEngine.swift | 3 +- bitchat/Services/UnifiedPeerService.swift | 5 +- bitchat/Utils/InputValidator.swift | 5 +- bitchat/Utils/String+Nickname.swift | 8 +++ bitchat/ViewModels/ChatMessageFormatter.swift | 3 +- .../ChatPeerIdentityCoordinator.swift | 3 ++ .../ChatPublicConversationCoordinator.swift | 9 ++-- bitchat/ViewModels/ChatViewModel.swift | 10 ++-- bitchatTests/NicknameNormalizationTests.swift | 53 +++++++++++++++++++ 12 files changed, 92 insertions(+), 18 deletions(-) create mode 100644 bitchatTests/NicknameNormalizationTests.swift diff --git a/bitchat/App/LocationPresenceStore.swift b/bitchat/App/LocationPresenceStore.swift index b4f6aaef..b67731ba 100644 --- a/bitchat/App/LocationPresenceStore.swift +++ b/bitchat/App/LocationPresenceStore.swift @@ -36,6 +36,7 @@ final class LocationPresenceStore: ObservableObject { return } + let nickname = nickname.normalizedNickname let key = pubkeyHex.lowercased() if geoNicknames[key] != nil { geoNicknames[key] = nickname @@ -64,7 +65,7 @@ final class LocationPresenceStore: ObservableObject { let lower = key.lowercased() guard seen.insert(lower).inserted else { continue } ordered.append(lower) - normalized[lower] = value + normalized[lower] = value.normalizedNickname } if ordered.count > geoNicknameCapacity { let kept = Array(ordered.suffix(geoNicknameCapacity)) diff --git a/bitchat/Services/AutocompleteService.swift b/bitchat/Services/AutocompleteService.swift index 9ae47df9..6c55f34e 100644 --- a/bitchat/Services/AutocompleteService.swift +++ b/bitchat/Services/AutocompleteService.swift @@ -55,10 +55,10 @@ final class AutocompleteService { let fullRange = match.range(at: 0) let captureRange = match.range(at: 1) - let prefix = nsText.substring(with: captureRange).lowercased() - + let prefix = nsText.substring(with: captureRange).normalizedNickname.lowercased() + let suggestions = peers - .filter { $0.lowercased().hasPrefix(prefix) } + .filter { $0.normalizedNickname.lowercased().hasPrefix(prefix) } .sorted() .prefix(5) .map { "@\($0)" } diff --git a/bitchat/Services/BLE/BLEPeerRegistry.swift b/bitchat/Services/BLE/BLEPeerRegistry.swift index 679b419e..62113a59 100644 --- a/bitchat/Services/BLE/BLEPeerRegistry.swift +++ b/bitchat/Services/BLE/BLEPeerRegistry.swift @@ -223,7 +223,7 @@ struct BLEPeerRegistry { peers[peerID] = BLEPeerInfo( peerID: existing?.peerID ?? peerID, - nickname: nickname, + nickname: nickname.normalizedNickname, isConnected: isConnected, noisePublicKey: noisePublicKey, // Never drop an already-pinned signing key. diff --git a/bitchat/Services/MessageFormattingEngine.swift b/bitchat/Services/MessageFormattingEngine.swift index 8f77bfa5..88a32e3c 100644 --- a/bitchat/Services/MessageFormattingEngine.swift +++ b/bitchat/Services/MessageFormattingEngine.swift @@ -110,11 +110,12 @@ final class MessageFormattingEngine { ) // Format content + let myNickname = context.nickname.normalizedNickname let contentResult = formatContent( message.content, baseColor: baseColor, isSelf: isSelf, - isMentioned: message.mentions?.contains(context.nickname) ?? false + isMentioned: message.mentions?.contains { $0.normalizedNickname == myNickname } ?? false ) result.append(contentResult) diff --git a/bitchat/Services/UnifiedPeerService.swift b/bitchat/Services/UnifiedPeerService.swift index 879dc866..c22c7e43 100644 --- a/bitchat/Services/UnifiedPeerService.swift +++ b/bitchat/Services/UnifiedPeerService.swift @@ -236,8 +236,11 @@ final class UnifiedPeerService: ObservableObject, TransportPeerEventsDelegate { /// Get peer ID for nickname func getPeerID(for nickname: String) -> PeerID? { + // Normalize both sides: the query may come from typed content and + // stored names may predate NFC-at-ingest (e.g. persisted favorites). + let target = nickname.normalizedNickname for peer in peers { - if peer.displayName == nickname || peer.nickname == nickname { + if peer.displayName.normalizedNickname == target || peer.nickname.normalizedNickname == target { return peer.peerID } } diff --git a/bitchat/Utils/InputValidator.swift b/bitchat/Utils/InputValidator.swift index e9c86868..929cfee5 100644 --- a/bitchat/Utils/InputValidator.swift +++ b/bitchat/Utils/InputValidator.swift @@ -39,9 +39,10 @@ struct InputValidator { return trimmed } - /// Validates nickname + /// Validates nickname and returns it in canonical (NFC) form so + /// visually identical names always compare equal. static func validateNickname(_ nickname: String) -> String? { - return validateUserString(nickname, maxLength: Limits.maxNicknameLength) + return validateUserString(nickname, maxLength: Limits.maxNicknameLength)?.normalizedNickname } // MARK: - Protocol Field Validation diff --git a/bitchat/Utils/String+Nickname.swift b/bitchat/Utils/String+Nickname.swift index b586aa66..9a652667 100644 --- a/bitchat/Utils/String+Nickname.swift +++ b/bitchat/Utils/String+Nickname.swift @@ -9,6 +9,14 @@ import Foundation extension String { + /// Canonical form for nickname storage and comparison (Unicode NFC). + /// "café" typed with a combining accent and "café" typed precomposed + /// must resolve to the same user wherever nicknames are stored or + /// matched (mentions, DM resolution, autocomplete, geo presence). + var normalizedNickname: String { + precomposedStringWithCanonicalMapping + } + /// Split a nickname into base and a '#abcd' suffix if present func splitSuffix() -> (String, String) { let name = self.replacingOccurrences(of: "@", with: "") diff --git a/bitchat/ViewModels/ChatMessageFormatter.swift b/bitchat/ViewModels/ChatMessageFormatter.swift index a2259b08..ae663f84 100644 --- a/bitchat/ViewModels/ChatMessageFormatter.swift +++ b/bitchat/ViewModels/ChatMessageFormatter.swift @@ -188,7 +188,8 @@ final class ChatMessageFormatter { allMatches.sort { $0.range.location < $1.range.location } var lastEnd = content.startIndex - let isMentioned = message.mentions?.contains(viewModel.nickname) ?? false + let myNickname = viewModel.nickname.normalizedNickname + let isMentioned = message.mentions?.contains { $0.normalizedNickname == myNickname } ?? false for (range, type) in allMatches { guard let swiftRange = Range(range, in: content) else { continue } diff --git a/bitchat/ViewModels/ChatPeerIdentityCoordinator.swift b/bitchat/ViewModels/ChatPeerIdentityCoordinator.swift index 93b0f32a..65b30df9 100644 --- a/bitchat/ViewModels/ChatPeerIdentityCoordinator.swift +++ b/bitchat/ViewModels/ChatPeerIdentityCoordinator.swift @@ -501,6 +501,9 @@ final class ChatPeerIdentityCoordinator { @MainActor func getPeerIDForNickname(_ nickname: String) -> PeerID? { + // Queries arrive from typed commands and message content, so bring + // them to the same canonical (NFC) form nicknames are stored in. + let nickname = nickname.normalizedNickname switch context.activeChannel { case .location: if nickname.contains("#"), diff --git a/bitchat/ViewModels/ChatPublicConversationCoordinator.swift b/bitchat/ViewModels/ChatPublicConversationCoordinator.swift index 301c4bee..d12e2c1d 100644 --- a/bitchat/ViewModels/ChatPublicConversationCoordinator.swift +++ b/bitchat/ViewModels/ChatPublicConversationCoordinator.swift @@ -506,14 +506,15 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate { } func checkForMentions(_ message: BitchatMessage) { - var myTokens: Set = [context.nickname] + let myNickname = context.nickname.normalizedNickname + var myTokens: Set = [myNickname] let meshPeers = context.meshPeerNicknames() - let collisions = meshPeers.values.filter { $0.hasPrefix(context.nickname + "#") } + let collisions = meshPeers.values.filter { $0.normalizedNickname.hasPrefix(myNickname + "#") } if !collisions.isEmpty { let suffix = "#" + String(context.myPeerID.id.prefix(4)) - myTokens = [context.nickname + suffix] + myTokens = [myNickname + suffix] } - let isMentioned = message.mentions?.contains(where: myTokens.contains) ?? false + let isMentioned = message.mentions?.contains { myTokens.contains($0.normalizedNickname) } ?? false if isMentioned && message.sender != context.nickname { SecureLogger.info("🔔 Mention from \(message.sender)", category: .session) diff --git a/bitchat/ViewModels/ChatViewModel.swift b/bitchat/ViewModels/ChatViewModel.swift index d794ea3f..12adfda9 100644 --- a/bitchat/ViewModels/ChatViewModel.swift +++ b/bitchat/ViewModels/ChatViewModel.swift @@ -176,10 +176,12 @@ final class ChatViewModel: ObservableObject, BitchatDelegate, SynchronousMessage var networkActivationAllowed: Bool { !panicRecoveryBlocked } @Published var nickname: String = "" { didSet { - // Trim whitespace whenever nickname is set; whitespace-only becomes "" - let trimmed = nickname.trimmedOrNilIfEmpty ?? "" - if trimmed != nickname { - nickname = trimmed + // Canonicalize whenever nickname is set: trim whitespace + // (whitespace-only becomes "") and apply Unicode NFC so accented + // names match regardless of how they were typed. + let cleaned = (nickname.trimmedOrNilIfEmpty ?? "").normalizedNickname + if cleaned != nickname { + nickname = cleaned return } // Update mesh service nickname if it's initialized diff --git a/bitchatTests/NicknameNormalizationTests.swift b/bitchatTests/NicknameNormalizationTests.swift new file mode 100644 index 00000000..a32225b9 --- /dev/null +++ b/bitchatTests/NicknameNormalizationTests.swift @@ -0,0 +1,53 @@ +// +// NicknameNormalizationTests.swift +// bitchatTests +// +// Nicknames must compare equal regardless of how the user's keyboard +// produced them: "café" as precomposed U+00E9 and as "e" + combining +// U+0301 are canonically equivalent but bytewise different, which broke +// mention matching, DM resolution, and autocomplete (#214). Storage and +// comparison both canonicalize to NFC via String.normalizedNickname. +// This is free and unencumbered software released into the public domain. +// For more information, see +// + +import Foundation +import Testing +@testable import bitchat + +struct NicknameNormalizationTests { + /// "café" with a combining acute accent (NFD form) + private let decomposed = "cafe\u{0301}" + /// "café" with precomposed é (NFC form) + private let precomposed = "caf\u{00E9}" + + @Test + func canonicallyEquivalentFormsNormalizeIdentically() { + // Sanity: the raw forms really are different strings byte-wise … + #expect(decomposed.unicodeScalars.count != precomposed.unicodeScalars.count) + // … and normalization unifies them. + #expect(decomposed.normalizedNickname == precomposed.normalizedNickname) + #expect(decomposed.normalizedNickname == precomposed) + } + + @Test + func asciiNicknamesPassThroughUnchanged() { + #expect("alice_42".normalizedNickname == "alice_42") + #expect("".normalizedNickname == "") + } + + @Test + func validateNicknameReturnsCanonicalForm() { + #expect(InputValidator.validateNickname(decomposed) == precomposed) + #expect(InputValidator.validateNickname(" \(decomposed) ") == precomposed) + // Validation behavior is otherwise unchanged. + #expect(InputValidator.validateNickname(" ") == nil) + } + + @Test + func collisionSuffixSplittingSurvivesNormalization() { + let (base, suffix) = (decomposed.normalizedNickname + "#ab12").splitSuffix() + #expect(base == precomposed) + #expect(suffix == "#ab12") + } +} From 6414a59851a1be266a9a637e2d5019fd8704f211 Mon Sep 17 00:00:00 2001 From: krish rathi <148011352+krishrathi1@users.noreply.github.com> Date: Thu, 30 Jul 2026 22:44:57 +0530 Subject: [PATCH 14/23] fix(ble): don't spend the fragment scheduler's slot budget on blocked requests (#1530) reservePendingStarts() decremented availableSlots for every dequeued pending transfer before checking whether it would actually be admitted. A request blocked because its transferId is already active (a resend of in-flight content sitting at the front of the queue) still consumed a slot even though it was deferred back into the queue rather than started -- so a single blocked front-of-queue item could zero out the budget and end the loop before ever reaching a later, unrelated, genuinely startable pending transfer. That transfer then sat starved until some other transfer happened to complete and trigger another pass, rather than starting immediately when real capacity was already available. Move the decrement to the point where a transfer is actually admitted into activeTransfers, so only genuine starts spend the budget. --- ...BLEOutboundFragmentTransferScheduler.swift | 8 +++- ...tboundFragmentTransferSchedulerTests.swift | 42 +++++++++++++++++++ 2 files changed, 48 insertions(+), 2 deletions(-) diff --git a/bitchat/Services/BLE/BLEOutboundFragmentTransferScheduler.swift b/bitchat/Services/BLE/BLEOutboundFragmentTransferScheduler.swift index 722e55c4..5176149a 100644 --- a/bitchat/Services/BLE/BLEOutboundFragmentTransferScheduler.swift +++ b/bitchat/Services/BLE/BLEOutboundFragmentTransferScheduler.swift @@ -261,8 +261,6 @@ struct BLEOutboundFragmentTransferScheduler { continue } - availableSlots -= 1 - guard activeTransfers.count < maxConcurrentTransfers else { pendingTransfers.insert(request, at: 0) results.append(.queued(request: request, transferId: transferId, position: .front)) @@ -270,11 +268,17 @@ struct BLEOutboundFragmentTransferScheduler { } guard activeTransfers[transferId] == nil else { + // Blocked on an already-active copy of this content: leave + // the slot budget untouched so a later, unrelated pending + // transfer can still start in this same pass instead of + // being starved until some other transfer happens to + // complete. blockedFront.append(request) results.append(.queued(request: request, transferId: transferId, position: .front)) continue } + availableSlots -= 1 activeTransfers[transferId] = ActiveTransferState( totalFragments: 0, sentFragments: 0, diff --git a/bitchatTests/Services/BLEOutboundFragmentTransferSchedulerTests.swift b/bitchatTests/Services/BLEOutboundFragmentTransferSchedulerTests.swift index 8ceb1ac9..27670408 100644 --- a/bitchatTests/Services/BLEOutboundFragmentTransferSchedulerTests.swift +++ b/bitchatTests/Services/BLEOutboundFragmentTransferSchedulerTests.swift @@ -260,6 +260,48 @@ struct BLEOutboundFragmentTransferSchedulerTests { } } + @Test + func blockedDuplicateAtFrontOfQueueDoesNotStarveALaterUnrelatedPendingTransfer() { + // Bug: reservePendingStarts spent the slot budget on a pending + // request the moment it was dequeued, before checking whether that + // request would actually be admitted. A resend of still-active + // content sitting at the front of the queue therefore consumed a + // slot even though it was deferred back to the queue rather than + // started -- starving an unrelated, genuinely startable transfer + // right behind it until some other transfer happened to complete. + var scheduler = BLEOutboundFragmentTransferScheduler() + let t1 = makeRequest(type: MessageType.fileTransfer.rawValue, transferId: "t1", payload: "file-a") + let t2 = makeRequest(type: MessageType.fileTransfer.rawValue, transferId: "t2", payload: "file-b") + let dupT1 = makeRequest(type: MessageType.fileTransfer.rawValue, transferId: "t1", payload: "file-a") + let unrelated = makeRequest(type: MessageType.fileTransfer.rawValue, transferId: "t3", payload: "file-c") + + _ = scheduler.submit(t1, maxConcurrentTransfers: 2) + _ = scheduler.submit(t2, maxConcurrentTransfers: 2) + #expect(scheduler.activeCount == 2) + + // Both slots are full, so a resend of "t1" (still active) and an + // unrelated transfer both land in the pending queue, in that order. + _ = scheduler.submit(dupT1, maxConcurrentTransfers: 2) + _ = scheduler.submit(unrelated, maxConcurrentTransfers: 2) + #expect(scheduler.pendingCount == 2) + + // "t2" finishes; "t1" stays active, so the queued "t1" resend at the + // front of the queue is still blocked when we reserve pending starts. + let didActivate = scheduler.activateReservedTransfer(id: "t2", totalFragments: 1, workItems: []) + #expect(didActivate) + #expect(scheduler.markFragmentSent(transferId: "t2") == .complete(sentFragments: 1, totalFragments: 1)) + + let starts = scheduler.reservePendingStarts(maxConcurrentTransfers: 2) + + let startedTransferIds: [String] = starts.compactMap { + if case let .start(_, reservedTransferId) = $0 { return reservedTransferId } + return nil + } + #expect(startedTransferIds == ["t3"], "the unrelated pending transfer must start in the same pass despite the blocked front item") + #expect(scheduler.activeCount == 2, "t1 (still running) and the newly-started t3") + #expect(scheduler.pendingCount == 1, "only the blocked t1 resend remains queued") + } + @Test func removeAllReturnsActiveWorkItemsAndDropsPendingTransfers() { var scheduler = BLEOutboundFragmentTransferScheduler() From 1d0dc5822112c74a9ec30d8f31f84075956e57e5 Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Thu, 30 Jul 2026 21:21:46 +0100 Subject: [PATCH 15/23] Make the completion-grace restart test deterministic (#1563) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit immediateLegacyRestartDuringCompletionGrace injected a 0.03s initiator completion grace period and needed the restart initiation to arrive inside it. Constructing the restarted service (keypair generation) sits between starting that clock and processing the message, so on a starved CI runner the window expired first, the initiation was processed as a legitimate fresh handshake, and the nil-expectations cascaded — the most-sighted flake in CI (7 runs across #1502, #1477, #883, #1364, and main). The test now injects a grace period no test run can outlive, so the in-grace suppression and the duplicate-initiation coalescing are decided deterministically, and fires the deferred recovery through a DEBUG hook on NoiseSessionManager instead of waiting out the real timer. The hook cancels the scheduled work item before requesting recovery, so the converged-once assertion cannot double-fire either. Verified (count-checked via xcresulttool): the full 30-test NoiseEncryptionServiceTests suite green on the iOS simulator, and 30/30 x 5 consecutive runs under 16x CPU oversubscription (a 6th run was lost to a simulator app-launch refusal under load — no tests executed). The old test did not reproduce locally in 2 suite runs under the same load; the starvation needs the slow 2-core CI runner, so the diagnosis rests on the mechanism plus the identical assertion signature in all seven CI sightings. Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchat/Noise/NoiseSessionManager.swift | 21 +++++++++++++++++++ bitchat/Services/NoiseEncryptionService.swift | 4 ++++ .../NoiseEncryptionServiceTests.swift | 10 +++++++-- 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/bitchat/Noise/NoiseSessionManager.swift b/bitchat/Noise/NoiseSessionManager.swift index e8609aed..6e2b3c23 100644 --- a/bitchat/Noise/NoiseSessionManager.swift +++ b/bitchat/Noise/NoiseSessionManager.swift @@ -1028,6 +1028,27 @@ final class NoiseSessionManager { .cancel() } + #if DEBUG + /// Fires a pending suppressed-initiation recovery immediately instead of + /// waiting out the completion-grace timer, so tests can inject a grace + /// period too large to lose against a starved runner and still exercise + /// the recovery path deterministically. + func _test_fireSuppressedInitiationRecovery(for peerID: PeerID) { + managerQueue.sync(flags: .barrier) { + guard let pending = suppressedInitiationRecoveryTimeouts + .removeValue(forKey: peerID) else { + return + } + pending.cancel() + guard let current = sessions[peerID], + current.isEstablished() else { + return + } + requestHandshakeRecovery(for: peerID) + } + } + #endif + private func requestHandshakeRecovery( for peerID: PeerID, after delay: TimeInterval = 0 diff --git a/bitchat/Services/NoiseEncryptionService.swift b/bitchat/Services/NoiseEncryptionService.swift index 1bf2b574..5ee7608d 100644 --- a/bitchat/Services/NoiseEncryptionService.swift +++ b/bitchat/Services/NoiseEncryptionService.swift @@ -1089,6 +1089,10 @@ final class NoiseEncryptionService { func _test_initiateAutomaticRekey(for peerID: PeerID) throws { try initiateAutomaticRekey(for: peerID) } + + func _test_fireSuppressedInitiationRecovery(for peerID: PeerID) { + sessionManager._test_fireSuppressedInitiationRecovery(for: peerID) + } #endif deinit { diff --git a/bitchatTests/Services/NoiseEncryptionServiceTests.swift b/bitchatTests/Services/NoiseEncryptionServiceTests.swift index a2031983..c0cd293f 100644 --- a/bitchatTests/Services/NoiseEncryptionServiceTests.swift +++ b/bitchatTests/Services/NoiseEncryptionServiceTests.swift @@ -962,15 +962,20 @@ struct NoiseEncryptionServiceTests { @Test("Immediate legacy restart during completion grace converges once") func immediateLegacyRestartDuringCompletionGrace() async throws { + // The grace period must still be open when the restart initiation + // arrives below. A small value races the wall clock on a starved + // runner, so inject one no test run can outlive; the recovery half + // is then fired explicitly instead of waiting out the timer. + let unlosableGracePeriod: TimeInterval = 600 let firstKeychain = MockKeychain() let secondKeychain = MockKeychain() let first = NoiseEncryptionService( keychain: firstKeychain, - recentInitiatorCompletionGracePeriod: 0.03 + recentInitiatorCompletionGracePeriod: unlosableGracePeriod ) let second = NoiseEncryptionService( keychain: secondKeychain, - recentInitiatorCompletionGracePeriod: 0.03 + recentInitiatorCompletionGracePeriod: unlosableGracePeriod ) let firstPeerID = PeerID(publicKey: first.getStaticPublicKeyData()) let secondPeerID = PeerID(publicKey: second.getStaticPublicKeyData()) @@ -1035,6 +1040,7 @@ struct NoiseEncryptionServiceTests { ) #expect(lower.hasEstablishedSession(with: higherPeerID)) + lower._test_fireSuppressedInitiationRecovery(for: higherPeerID) let requested = await TestHelpers.waitUntil( { recovery.messages.count == 1 }, timeout: TestConstants.longTimeout From 5780405dce58810f6f33dc98c907f12ab523fbfb Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Thu, 30 Jul 2026 21:21:49 +0100 Subject: [PATCH 16/23] Fix the SimulatedMesh announce-loss flake (#1564) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SimulatedMesh.addNode installed the outbound tap one statement after setNickname, but setNickname force-announces asynchronously on the engine. When a starved runner let that slot run inside the gap, the announce was emitted invisibly while still stamping the wall-clock announce throttle, and announceAll's forced announce — arriving well inside the 0.15s forced minimum interval — was swallowed. No discovery traffic ever reached the mesh, so bindings stayed nil and peer lists empty: the exact 4-issue signature that failed three main runs and one PR run on July 30. Reproduced deterministically by forcing the ordering with a 5ms sleep after setNickname: all 8 SimulatedMesh tests fail on the old harness and pass on the fixed one. Fixes: install the tap before setNickname so an early nickname announce is captured instead of lost; reset each node's throttle in announceAll so wall-clock throttle debt can never swallow the discovery round (forceAnnounce(from:) deliberately keeps no-reset — the panic-rotation tests pin the production reset behavior through it); and take the lock around addNode's array appends, which could race the tap reading `emitted` on an earlier node's engine. Verified: suite green normally, 8/8 tests x 6 runs under 16x CPU oversubscription, and 8/8 under the adversarial forced ordering — all count-verified via xcresulttool (an earlier single-test -only-testing filter silently matched zero tests, so every result here was re-checked against reported test counts). Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchatTests/Simulation/SimulatedMesh.swift | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/bitchatTests/Simulation/SimulatedMesh.swift b/bitchatTests/Simulation/SimulatedMesh.swift index 1d5c5094..6caf379d 100644 --- a/bitchatTests/Simulation/SimulatedMesh.swift +++ b/bitchatTests/Simulation/SimulatedMesh.swift @@ -58,10 +58,19 @@ final class SimulatedMesh { ) let index = nodes.count let node = Node(service: service, scheduler: scheduler) + // An earlier node's engine can fire its tap (which reads `emitted` + // under the lock) while this append reallocates the array. + lock.lock() nodes.append(node) neighbors.append([]) emitted.append([]) - service.setNickname(nickname) + lock.unlock() + // The tap must be live before `setNickname` below: setNickname + // force-announces asynchronously on the engine, and if that slot + // ran in the gap before a later tap install, the announce was + // emitted invisibly while still stamping the wall-clock announce + // throttle — swallowing `announceAll`'s forced announce on a + // starved runner (the CI flake this ordering fixes). service._test_onOutboundPacket = { [weak self] packet in // Runs on the sender's engine; only buffer here — delivering // inline would nest one engine inside another. @@ -71,6 +80,7 @@ final class SimulatedMesh { self.emitted[index].append(packet) self.lock.unlock() } + service.setNickname(nickname) return node } @@ -175,8 +185,16 @@ final class SimulatedMesh { } /// Full discovery round: every node announces, traffic settles. + /// + /// Resets each node's announce throttle first: the throttle window is + /// wall-clock, so any announce that already ran (setNickname's, in + /// `addNode`) would otherwise swallow this forced one whenever the two + /// land within the forced minimum interval — which is always, on any + /// runner. `forceAnnounce(from:)` deliberately does NOT reset — the + /// panic-rotation tests pin the production reset behavior through it. func announceAll() { for node in nodes { + node.service._test_resetAnnounceThrottle() node.service._test_forceAnnounce() } pump() From f269617004b981f0b4f12263663d66537188fcfe Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Fri, 31 Jul 2026 10:30:51 +0100 Subject: [PATCH 17/23] =?UTF-8?q?Fix=20the=20retire=E2=86=94reconnect=20os?= =?UTF-8?q?cillation:=20redundant-link=20survivor=20is=20the=20newest=20co?= =?UTF-8?q?nnection=20(#1566)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Cohere per-link Noise auth and rebind containment into BLELinkAuthState The authenticated-link owners, the reconnect revalidation policy, and the two rebind-containment cooldowns were four loose bleQueue-owned maps whose invariants lived in call-site discipline: every teardown path had to remember to retire the proof AND close the revalidation epoch (the pair appeared seven times), and both cooldowns hand-rolled the same prune-check-record dance. BLELinkAuthState owns them as whole transitions — retireLink, retireLinks(ownedBy:), permitRebind, permitRedundantRetirement — with the ownership question (bleQueue today, engine after the option-B flip) answered in one place. No behavior change; the one call-site reordering (redundant retirement computes the survivor before the cooldown check instead of after) is outcome-equivalent since the cooldown only ever recorded when a survivor existed. Co-Authored-By: Claude Fable 5 * Split identity-link bindings out of the physical link store BLELinkStateStore owned two different kinds of truth: what physical links exist (CB handles, connect lifecycles, characteristics, stream assemblers) and who each link belongs to (peer bindings in both roles plus the preferred-peripheral reverse map for directed sends and fanout collapse). The bindings now live on BLELinkBindings — same bleQueue ownership, whole-transition methods, direct tests for the rotation reverse-map cleanup and the preferred-link survivor repair that were previously only exercised end to end. Composed operations that need both truths (remove-with-repair, direct link state, the subscribed- central snapshot, bind-only-live-links) live on the transport as explicitly bleQueue-confined helpers. This is the structural half of the option-B boundary flip (docs/BLE-ARCHITECTURE-V3.md): ownership of the bindings can now move to the engine without touching what-links-exist. An audit of every physical clear/remove found three sites (emergency clear, both unauthorized branches) that needed explicit binding-clear pairing under the split — each now clears both. Co-Authored-By: Claude Fable 5 * Fix iOS-gated constructors and preserve containment cooldowns on reset CI caught what the macOS SwiftPM build cannot see: two #if os(iOS) sites still passed the peerID field that slice B1 removed from BLEPeripheralLinkState (willRestoreState in BLEService and armPendingBackgroundConnects in BLERadioController). Both fixed and verified with a local iOS simulator xcodebuild. Codex also caught a real regression: BLELinkAuthState.removeAll() cleared the rebind/retirement cooldown maps, which the original panic and emergency reset paths deliberately left alive. A stable CoreBluetooth UUID must not earn a fresh rebind allowance just because the session state around it was wiped. removeAll() now clears only the proofs and revalidation epochs, and BLELinkAuthStateTests pins the survival invariant along with the other auth-state transitions. Co-Authored-By: Claude Fable 5 * Link layer slice 3: the option-B domain flip — bindings and link-auth move to the engine The identity domain (BLELinkBindings + BLELinkAuthState) is now owned by the engine queue, with a DEBUG dispatchPrecondition trapping any access from another queue. bleQueue keeps only physical link state. What changed shape: - Receive path is sans-I/O: bleQueue decodes frames and hands (packet, linkID) up through ingestDecodedPacket (panic lifecycle captured at the handoff); attributeAndHandlePacket resolves the sender binding, rejects spoofed senders, applies raw-announce binding, and records ingress on the engine. Per-link frame order is preserved end to end (both queues serial), which supersedes the old batch-local TOCTOU binding in the notification path. - The rotation rebind is one engine slot: containment checks, proof retirement, binding flip, reconnect decision, and rotated-identity retirement run straight-line; only CoreBluetooth cancels hop to bleQueue. The engine->bleQueue->engine ping-pong is gone, along with the _test_afterVerifiedDirectRebindEnqueued pause hook — the test that used it now asserts the atomicity directly (a paused engine wedged the old gate design into a three-queue deadlock). - Authenticated-send eligibility (notifyOrEnqueueIfAccepted, writeOrEnqueueIfAccepted) is checked on the engine, serialized against rebinds by construction; only physical admission (updateValue/write/backpressure) runs on bleQueue. - Teardown splits into discardPeripheralLinkPhysical (bleQueue, inline in the delegates) + retirePeripheralLinkIdentity (engine hop with survivor repair reading liveness via readLinkState). A binding can briefly outlive its physical link; liveness queries join against the physical store and the queued retirement converges the two. - Gossip delegate sends enter the engine via onEngine — safe because mesh.sync sits above the engine in the sync order (production engine code only async-dispatches into the manager). - checkPeerConnectivity rides an engine slot from the bleQueue maintenance tick. No wire changes. 1,974 tests green (parallel and serial), iOS simulator build clean, Periphery clean. Co-Authored-By: Claude Fable 5 * Link layer slice 4: deterministic multi-node mesh simulation — and the panic-announce bug it caught SimulatedMesh wires real CoreBluetooth-free BLEService engines edge-to-edge through the outbound packet tap and _test_ingestFrame (the production attribution path the B2 flip created), with per-edge synthetic link IDs and manual-scheduler time. Five multi-node tests run in ~40ms with no wall-clock waits: - announce exchange binds simulated links and connects peers - Noise sessions establish end-to-end (real crypto, both directions) - a public message relays across a line topology inside a TTL/frame budget (storm bound asserted) - an 8x duplicate flood delivers exactly once - a panic rotation rebinds the survivor's link exactly once and stays — the scenario that previously needed two phones and log archaeology Fidelity boundary (documented in the harness): no physical links, so fanout planning and backpressure are not exercised; attribution, binding, dedup, TTL, relay decisions, and sessions are the real engine code. The simulator found a real bug on its first run: the forced-announce throttle's lastSent survived a panic, so a rotation within bleForceAnnounceMinIntervalSeconds of the last announce silently swallowed the new identity's announce — leaving it invisible to the mesh until the next maintenance cycle. Today's device test only passed because the previous announce happened to be minutes old. BLEAnnounceThrottle gains reset(), called from the panic slot so the rotated identity owes no throttle debt; pinned by a unit test and the mesh rotation test. New DEBUG seams: _test_ingestFrame (production ingress attribution), _test_forceAnnounce, _test_fenceEngine. 1,980 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 * Link layer slice 5: name the port — BLELinkEvent, one engine entry, delegates in their own files The upward half of the link-layer port is now a type. BLELinkEvent enumerates everything the bleQueue link layer tells the engine: frameDecoded plus the four physical lifecycle transitions (peripheralLinkEnded, centralLinkEnded, allPeripheralLinksEnded, allCentralLinksEnded). Every bleQueue→engine crossing goes through emitLinkEvent into one engine consumer (handleLinkEvent) — the scattered messageQueue.async identity hops in the delegates collapse into event emission, and the engine-side retirement/bookkeeping logic now lives in one switch. The CoreBluetooth delegate extensions move to their own files as physical bookkeeping plus event emission: - BLEService+LinkLayerCentralRole.swift (CBCentralManagerDelegate + CBPeripheralDelegate) - BLEService+LinkLayerPeripheralRole.swift (CBPeripheralManagerDelegate + write accumulation) BLEService.swift drops from 7,836 to ~7,100 lines. The physical-domain members the role files share flip private→internal; the queue contract is enforced by the existing DEBUG traps and grep guards, not access control. (Two of the flips — isAppActive, logBluetoothStatus — only surfaced on the iOS build; macOS SwiftPM cannot see #if os(iOS) code. Verified with a local iOS simulator build.) The simulated mesh now drives lifecycle events through the identical enum a radio does: linkDropEventRetiresBindingAndReconnectHeals covers drop → identity retirement → last-link peer bookkeeping → re-announce heal, entirely through the port. New seam _test_resetAnnounceThrottle models elapsed wall-clock for the throttle (deliberately separate from _test_forceAnnounce so the panic-rotation test keeps its regression value: the production panic path must do its own reset). The panic test's containment re-announces reset throttles explicitly so those assertions exercise real delivered announces instead of silently throttled ones. noiseSessionEstablishesEndToEnd gains a bounded scheduler-time settle loop after a one-in-many parallel-suite flake (no wall-clock waits). Deliberately not done (recorded in docs/BLE-ARCHITECTURE-V3.md): a formal handle(event)->[Effect] system and further engine-domain file splits — both would flip the engine's private state to internal for cosmetic file counts; the effect formalization rides future feature- module extractions instead. 1,981 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 * Baseline logBluetoothStatus for the macOS Periphery scan Its callers are all inside #if os(iOS) (willRestoreState in both role files plus the app-state handlers), so the macOS-scheme scan sees the now-internal declaration with zero callers — the same class as the baselined candidateCount. Verified 1-USR diff; the previously private mangled variant was already baselined, which is why the pre-split scan never flagged it. Co-Authored-By: Claude Fable 5 * Fix #1538: release stale bindings on rotation instead of leaving a ghost With two live links to one phone, a panic rotation healed only the link the verified announce arrived on. The second link kept its binding to the retired identity, so that dead ID stayed in the peer list — and was kept alive by the NEW identity's own traffic, since a bound link attributes non-announce frames to its bound peer. It only healed when the stale link physically dropped. The issue proposed exempting the containment rule via retiredBy[X] = Y so the second link could rebind. Two problems: the exemption's stated precondition (X removed by retireRotatedPeer) can never hold in this scenario — the retire is gated on X having no remaining links, which is false precisely because the stale link exists — and it would loosen a security rule to fix a liveness bug. Instead the rotation now RELEASES every link still bound to the rotated-away identity (unbind + retire that link's Noise proof) and retires the identity. No containment rule changes: unbinding is strictly less trusting than any binding, and it is correct under both readings of a second link bound to the retired ID — same physical device (the field case), or one link is a spoofer holding a forged binding, since a peer ID is a Noise-key fingerprint and two devices cannot both legitimately own it. Released links reconverge through the ordinary unbound-link path: the next raw direct announce binds them to whoever they actually carry. Reproduced and fixed under the slice-4 simulator, which is why this lands as tests rather than another two-phone session: - duplicateLinkPanicRotationLeavesNoGhostAndHealsBothLinks fails without the fix (ghost in both knownPeers and getConnectedPeers, duplicate link still bound to the dead ID) - replayedVerifiedAnnounceCannotStealALinkOrEvictTheVictim pins the #1401 containment rule against exactly the attack this fix had to avoid re-opening, with a positive control proving the refusal is the containment check and not duplicate suppression Harness gains connectDuplicateLinks (two links to one peer, modelled in the central role — the links we cannot cancel, and the only role whose bindings a CB-free harness can form), silence (range loss without a link event, so a packet can be captured that the far side never saw), and emittedPackets (the attacker's capture buffer). Residual, documented at the fix: an attacker who binds their own link to X by replaying X's raw announce can drive a rebind there and so evict X's registry entry; X's next announce restores it, and the per-link rebind cooldown bounds the rate. This is the same class of capability the containment already accepts, not a new one. 1,983 tests green, Periphery clean, iOS simulator build clean. Closes #1538 Co-Authored-By: Claude Fable 5 * Fix the retire↔reconnect oscillation: redundant-link survivor is the newest connection Field-observed July 31 on main: with a restored old-address link and a fresh-address duplicate to the same phone, redundant-link consolidation kept choosing the restored link as survivor (it carried the announce ingress and the binding) and cancelling the fresh one — which the radio promptly rediscovered and reconnected, because the fresh link sits on the BLE address the peer still advertises. Retire, reconnect, repeat at the retirement cooldown (~1/min) until the ingress happened to flip. Battery and airtime noise on every restore-with-duplicates. BLERedundantLinkPolicy now prefers the most recently CONNECTED candidate. Only the newest connection lives on the currently advertised address; the older-address link cannot return once cancelled, so consolidation converges on the first pass. BLEPeripheralLinkState gains lastConnectedAt (set by markConnected; nil for restored links, whose connect predates the process — exactly the 'stale address' signal). Security note: physical connect recency is a signal an announce replay cannot nominate, unlike the previous ingress-link preference — the announce anchors (ingress, then most recently bound) are demoted to tie-breakers and the fallback for all-restored links. Writability still trumps everything: a newest link mid-service-rediscovery is never kept over a writable duplicate. Containment (bound-links-only, one retirement per peer per cooldown, peer keeps a live link) unchanged. Six policy tests pin the new order, including the field scenario (restored link holding both announce anchors loses to the fresh connection) and the legacy fallback. 1,988 tests green, Periphery clean, iOS simulator build clean. Co-Authored-By: Claude Fable 5 * Defer consolidation while the newest connection is still mid-discovery Codex P2 on #1566: a fresh duplicate that has connected but not yet finished service discovery was excluded from the writable candidate set, so the policy kept the older writable (restored) link and cancelled the freshly advertised connection — recreating the retire↔reconnect oscillation inside the discovery window. Now, when the physically newest connection is not writable yet while a writable duplicate exists, consolidation defers to a later announce instead of guessing. Also documents that RSSI is deliberately not a policy input (Chessing234's rule-pinning ask) and pins the defer window, the restored-anchor variant, the co-newest writable tie, and the all-unwritable recency path with tests. Co-Authored-By: Claude Fable 5 --------- Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchat/Services/BLE/BLELinkStateStore.swift | 10 +- .../Services/BLE/BLERedundantLinkPolicy.swift | 81 +++++++++- bitchat/Services/BLE/BLEService.swift | 6 +- .../BLERedundantLinkPolicyTests.swift | 144 +++++++++++++++++- 4 files changed, 228 insertions(+), 13 deletions(-) diff --git a/bitchat/Services/BLE/BLELinkStateStore.swift b/bitchat/Services/BLE/BLELinkStateStore.swift index ebf39114..79440a64 100644 --- a/bitchat/Services/BLE/BLELinkStateStore.swift +++ b/bitchat/Services/BLE/BLELinkStateStore.swift @@ -8,6 +8,12 @@ struct BLEPeripheralLinkState { var isConnecting: Bool var isConnected: Bool var lastConnectionAttempt: Date? + /// When didConnect last fired for this link. Nil for links restored + /// already-connected (their connect predates this process), which is + /// exactly the signal redundant-link consolidation needs: a restored + /// link lives on an old BLE address the peer no longer advertises, + /// so it must never be kept over a freshly connected duplicate. + var lastConnectedAt: Date? = nil var assembler: NotificationStreamAssembler } @@ -112,11 +118,12 @@ final class BLELinkStateStore { ) } - func markConnected(_ peripheral: CBPeripheral) { + func markConnected(_ peripheral: CBPeripheral, at now: Date = Date()) { let peripheralID = peripheral.identifier.uuidString if updatePeripheral(peripheralID, { $0.isConnecting = false $0.isConnected = true + $0.lastConnectedAt = now }) == nil { setPeripheralState( BLEPeripheralLinkState( @@ -125,6 +132,7 @@ final class BLELinkStateStore { isConnecting: false, isConnected: true, lastConnectionAttempt: nil, + lastConnectedAt: now, assembler: NotificationStreamAssembler() ), for: peripheralID diff --git a/bitchat/Services/BLE/BLERedundantLinkPolicy.swift b/bitchat/Services/BLE/BLERedundantLinkPolicy.swift index 6a053b5a..7bf5c3f4 100644 --- a/bitchat/Services/BLE/BLERedundantLinkPolicy.swift +++ b/bitchat/Services/BLE/BLERedundantLinkPolicy.swift @@ -21,24 +21,53 @@ enum BLERedundantLinkPolicy { /// A link mid-service-rediscovery (didModifyServices cleared it) /// must never be kept over a writable duplicate. let hasCharacteristic: Bool + /// When didConnect last fired for this link in this process. Nil + /// for restored links, whose connect predates the relaunch. + let lastConnectedAt: Date? - init(uuid: String, peerID: PeerID?, isConnected: Bool, hasCharacteristic: Bool) { + init( + uuid: String, + peerID: PeerID?, + isConnected: Bool, + hasCharacteristic: Bool, + lastConnectedAt: Date? = nil + ) { self.uuid = uuid self.peerID = peerID self.isConnected = isConnected self.hasCharacteristic = hasCharacteristic + self.lastConnectedAt = lastConnectedAt } } /// The link to keep when a peer has several connected bound peripheral - /// links, or nil when there is nothing to consolidate. Prefers the - /// ingress link of the verified direct announce that triggered the check - /// (the strongest liveness proof available), falling back to the peer's - /// most recently bound link — but only among writable links while any - /// exist: keeping a characteristic-less link and cancelling the writable + /// links, or nil when there is nothing to consolidate. + /// + /// Prefers the most recently CONNECTED candidate. Duplicates arise when + /// the peer reappears under a fresh BLE address (privacy address + /// rotation) while an older connection — typically state-restored — + /// lives on: only the newest connection sits on the address the peer + /// still advertises. Cancelling that one instead just gets it + /// rediscovered and reconnected, a retire↔reconnect oscillation at the + /// retirement cooldown (field-observed July 31); the older-address link + /// cannot return once cancelled, so consolidation converges immediately. + /// Physical connect recency is also a signal an announce replay cannot + /// nominate, unlike the previous ingress-link preference — announce + /// anchors (ingress, then most recently bound) now only break ties and + /// serve links with no connect timestamp at all. Link "health" signals + /// like RSSI are deliberately not inputs: they are transient and the + /// stale-address link often reads stronger; connect recency is the only + /// signal that tracks address currency. + /// + /// The survivor must be writable while any writable candidate exists: + /// keeping a characteristic-less link and cancelling the writable /// duplicate would strand outbound traffic on the central link until - /// rediscovery finishes. When neither anchor is a viable candidate, - /// consolidation waits for a later announce rather than guessing. + /// rediscovery finishes. But when the physically NEWEST connection is + /// the one that is not writable yet (service discovery still running), + /// consolidation defers entirely — selecting an older writable link + /// would cancel the freshly advertised connection and recreate the + /// oscillation. When no candidate is identifiable, consolidation waits + /// for a later announce rather than guessing. static func keptPeripheralUUID( ingressPeripheralUUID: String?, mostRecentlyBoundUUID: String?, @@ -51,6 +80,42 @@ enum BLERedundantLinkPolicy { let writable = bound.filter(\.hasCharacteristic) let candidates = writable.isEmpty ? bound : writable + // The newest connection is still mid-service-discovery while a + // writable (typically restored, stale-address) duplicate exists: + // defer to a later announce instead of keeping the older link and + // cancelling the one connection on the currently advertised address. + if !writable.isEmpty, + let newestBoundDate = bound.compactMap(\.lastConnectedAt).max(), + !writable.contains(where: { $0.lastConnectedAt == newestBoundDate }) { + return nil + } + + if let newestDate = candidates.compactMap(\.lastConnectedAt).max() { + let newest = candidates.filter { $0.lastConnectedAt == newestDate } + if newest.count == 1 { + return newest[0].uuid + } + return anchoredChoice( + among: newest, + ingressPeripheralUUID: ingressPeripheralUUID, + mostRecentlyBoundUUID: mostRecentlyBoundUUID + ) ?? newest.map(\.uuid).min() + } + + return anchoredChoice( + among: candidates, + ingressPeripheralUUID: ingressPeripheralUUID, + mostRecentlyBoundUUID: mostRecentlyBoundUUID + ) + } + + /// The pre-timestamp anchors: the verified announce's ingress link, + /// then the peer's most recently bound link. + private static func anchoredChoice( + among candidates: [PeripheralLink], + ingressPeripheralUUID: String?, + mostRecentlyBoundUUID: String? + ) -> String? { if let ingressPeripheralUUID, candidates.contains(where: { $0.uuid == ingressPeripheralUUID }) { return ingressPeripheralUUID } diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index 5f29ade3..8891b40e 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -6376,7 +6376,8 @@ extension BLEService { store.peripheralStates.map { (uuid: $0.peripheral.identifier.uuidString, isConnected: $0.isConnected, - hasCharacteristic: $0.characteristic != nil) + hasCharacteristic: $0.characteristic != nil, + lastConnectedAt: $0.lastConnectedAt) } } return physical.map { @@ -6384,7 +6385,8 @@ extension BLEService { uuid: $0.uuid, peerID: linkBindings.peer(forPeripheralID: $0.uuid), isConnected: $0.isConnected, - hasCharacteristic: $0.hasCharacteristic + hasCharacteristic: $0.hasCharacteristic, + lastConnectedAt: $0.lastConnectedAt ) } } diff --git a/bitchatTests/Services/BLERedundantLinkPolicyTests.swift b/bitchatTests/Services/BLERedundantLinkPolicyTests.swift index db23a5e8..d544535b 100644 --- a/bitchatTests/Services/BLERedundantLinkPolicyTests.swift +++ b/bitchatTests/Services/BLERedundantLinkPolicyTests.swift @@ -7,8 +7,8 @@ struct BLERedundantLinkPolicyTests { private let peer = PeerID(str: "1122334455667788") private let otherPeer = PeerID(str: "8877665544332211") - private func link(_ uuid: String, _ peerID: PeerID?, connected: Bool = true, writable: Bool = true) -> BLERedundantLinkPolicy.PeripheralLink { - BLERedundantLinkPolicy.PeripheralLink(uuid: uuid, peerID: peerID, isConnected: connected, hasCharacteristic: writable) + private func link(_ uuid: String, _ peerID: PeerID?, connected: Bool = true, writable: Bool = true, connectedAt: Date? = nil) -> BLERedundantLinkPolicy.PeripheralLink { + BLERedundantLinkPolicy.PeripheralLink(uuid: uuid, peerID: peerID, isConnected: connected, hasCharacteristic: writable, lastConnectedAt: connectedAt) } @Test @@ -131,4 +131,144 @@ struct BLERedundantLinkPolicyTests { ) #expect(Set(retiring) == Set(["p-stale-1", "p-stale-2"])) } + + // MARK: Connect-recency preference (the July 31 retire↔reconnect fix) + + @Test + func newestConnectionWinsOverIngressAndBindingAnchors() { + // Field oscillation: the restored old-address link (no connect + // timestamp) carried the announce ingress AND the binding, so it + // kept winning — and the cancelled fresh-address link kept getting + // rediscovered and reconnected. Physical connect recency must beat + // both announce anchors. + let now = Date() + let kept = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: "p-restored", + mostRecentlyBoundUUID: "p-restored", + links: [ + link("p-restored", peer), + link("p-fresh", peer, connectedAt: now) + ], + peerID: peer + ) + #expect(kept == "p-fresh") + } + + @Test + func amongTimestampedLinksTheNewestWins() { + let now = Date() + let kept = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: "p-older", + mostRecentlyBoundUUID: "p-older", + links: [ + link("p-older", peer, connectedAt: now.addingTimeInterval(-30)), + link("p-newer", peer, connectedAt: now) + ], + peerID: peer + ) + #expect(kept == "p-newer") + } + + @Test + func newestLinkMidDiscoveryDefersInsteadOfKeepingOlderWritable() { + // The fresh connection hasn't finished service discovery, so it is + // not writable yet. Keeping the older writable (restored) link now + // would cancel the one connection on the currently advertised + // address and recreate the oscillation — defer to a later announce. + let now = Date() + let kept = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: "p-writable", + mostRecentlyBoundUUID: "p-writable", + links: [ + link("p-writable", peer, connectedAt: now.addingTimeInterval(-30)), + link("p-fresh-bare", peer, writable: false, connectedAt: now) + ], + peerID: peer + ) + #expect(kept == nil) + } + + @Test + func restoredWritableAnchorAlsoDefersToFreshUnwritableLink() { + // Same discovery window as above, but the writable duplicate is a + // restored link with no connect timestamp at all — the exact field + // topology. It must not win just because the fresh link is bare. + let kept = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: "p-restored", + mostRecentlyBoundUUID: "p-restored", + links: [ + link("p-restored", peer), + link("p-fresh-bare", peer, writable: false, connectedAt: Date()) + ], + peerID: peer + ) + #expect(kept == nil) + } + + @Test + func coNewestWritableLinkStillWinsOverBareTwin() { + // Two links share the newest timestamp and one is writable: no + // discovery window to wait out — the writable co-newest survives. + let now = Date() + let kept = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: nil, + mostRecentlyBoundUUID: nil, + links: [ + link("p-bare", peer, writable: false, connectedAt: now), + link("p-writable", peer, connectedAt: now) + ], + peerID: peer + ) + #expect(kept == "p-writable") + } + + @Test + func allUnwritableDuplicatesConsolidateByConnectRecency() { + // No writable link exists at all: nothing can be stranded, so the + // newest connection consolidates immediately. + let now = Date() + let kept = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: "p-older", + mostRecentlyBoundUUID: "p-older", + links: [ + link("p-older", peer, writable: false, connectedAt: now.addingTimeInterval(-30)), + link("p-newer", peer, writable: false, connectedAt: now) + ], + peerID: peer + ) + #expect(kept == "p-newer") + } + + @Test + func allRestoredLinksFallBackToAnnounceAnchors() { + // No connect timestamps at all (every link restored): the legacy + // ingress-then-binding preference still decides. + let kept = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: "p-ingress", + mostRecentlyBoundUUID: "p-bound", + links: [link("p-ingress", peer), link("p-bound", peer)], + peerID: peer + ) + #expect(kept == "p-ingress") + } + + @Test + func timestampTiesBreakByAnchorsThenDeterministically() { + let now = Date() + let anchored = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: "p-b", + mostRecentlyBoundUUID: nil, + links: [link("p-a", peer, connectedAt: now), link("p-b", peer, connectedAt: now)], + peerID: peer + ) + #expect(anchored == "p-b") + + let unanchored = BLERedundantLinkPolicy.keptPeripheralUUID( + ingressPeripheralUUID: nil, + mostRecentlyBoundUUID: nil, + links: [link("p-b", peer, connectedAt: now), link("p-a", peer, connectedAt: now)], + peerID: peer + ) + #expect(unanchored == "p-a") + } } From 3a75567f5c15d3cf70d4bd48175a68666bb17ff4 Mon Sep 17 00:00:00 2001 From: Taksh Kothari Date: Fri, 31 Jul 2026 15:34:55 +0530 Subject: [PATCH 18/23] fix: stop EnvironmentObject crash in the people sheet (#1567) * fix: re-inject environment objects into the people sheet Sheets hosting a NavigationStack can drop inherited EnvironmentObjects on some iOS versions, crashing ContentPeopleListView / MessageListView (#1558). Co-authored-by: Cursor * test: note people-sheet environment contract in smoke mount Make the #1558 regression visible next to the ContentView / people-sheet smoke mounts so a future env-object trim is harder to miss. Co-authored-by: Cursor --------- Co-authored-by: Cursor Co-authored-by: jack <212554440+jackjackbits@users.noreply.github.com> --- bitchat/Views/ContentView.swift | 22 ++++++++++++++++++++++ bitchatTests/ViewSmokeTests.swift | 3 +++ 2 files changed, 25 insertions(+) diff --git a/bitchat/Views/ContentView.swift b/bitchat/Views/ContentView.swift index 4efb0d34..1fe95c75 100644 --- a/bitchat/Views/ContentView.swift +++ b/bitchat/Views/ContentView.swift @@ -92,6 +92,9 @@ struct ContentView: View { @EnvironmentObject private var conversationUIModel: ConversationUIModel @EnvironmentObject private var locationChannelsModel: LocationChannelsModel @EnvironmentObject private var sharedContentImportModel: SharedContentImportModel + @EnvironmentObject private var peerListModel: PeerListModel + @EnvironmentObject private var publicChatModel: PublicChatModel + @EnvironmentObject private var privateInboxModel: PrivateInboxModel @StateObject private var voiceRecordingVM = VoiceRecordingViewModel() @State private var messageText = "" @@ -297,6 +300,17 @@ struct ContentView: View { showImagePicker: $showImagePicker, imagePickerSourceType: $imagePickerSourceType ) + // Sheets + NavigationStack can drop inherited EnvironmentObjects on + // some iOS versions (#1558). Re-inject every model the sheet tree + // reads so ContentPeopleListView / MessageListView never crash. + .environmentObject(appChromeModel) + .environmentObject(privateConversationModel) + .environmentObject(verificationModel) + .environmentObject(conversationUIModel) + .environmentObject(locationChannelsModel) + .environmentObject(peerListModel) + .environmentObject(publicChatModel) + .environmentObject(privateInboxModel) #else ContentPeopleSheetView( showSidebar: $showSidebar, @@ -314,6 +328,14 @@ struct ContentView: View { onSendMessage: sendMessage, showMacImagePicker: $showMacImagePicker ) + .environmentObject(appChromeModel) + .environmentObject(privateConversationModel) + .environmentObject(verificationModel) + .environmentObject(conversationUIModel) + .environmentObject(locationChannelsModel) + .environmentObject(peerListModel) + .environmentObject(publicChatModel) + .environmentObject(privateInboxModel) #endif } .sheet(isPresented: $appChromeModel.isAppInfoPresented) { diff --git a/bitchatTests/ViewSmokeTests.swift b/bitchatTests/ViewSmokeTests.swift index ec7b3b62..eab6d989 100644 --- a/bitchatTests/ViewSmokeTests.swift +++ b/bitchatTests/ViewSmokeTests.swift @@ -542,6 +542,9 @@ struct ViewSmokeTests { ]) try? await Task.sleep(nanoseconds: 50_000_000) + // ContentView + people sheet must mount with the full feature-model + // set (peerList / publicChat / privateInbox included). Missing any of + // those crashes the NavigationStack sheet on some iOS versions (#1558). _ = mount(installSmokeEnvironment(ContentView(), featureModels: featureModels)) _ = mount(installSmokeEnvironment(ContentPeopleSheetHarness(), featureModels: featureModels)) From 7b39d72beca06350f2f9534fb135e3aa7e327162 Mon Sep 17 00:00:00 2001 From: heyaim <223061694+heyaim@users.noreply.github.com> Date: Fri, 31 Jul 2026 05:40:02 -0500 Subject: [PATCH 19/23] Give media the explicit file-protection class other stores use (#1552) Media payload writes used .atomic alone and inherited the container default; the courier store, outbox, gossip archive, and receipt index all state their protection class at the write site. Media now follows the same convention: until-first-user-authentication on payload writes and on every site that creates a media directory (the store's helpers, live captures, the outgoing writers, and the files/ root creators), so recordings that save as they go inherit it. A best-effort launch migration stamps files written by older builds, applying only to items at the container default or weaker so it can never downgrade, running detached after the retention sweep from #1484. On stock devices the container default already yields this class, so behavior does not change; the protection is now stated in the code instead of inherited. Full iOS suite green; macOS builds; swiftlint adds no violations. Co-authored-by: jack <212554440+jackjackbits@users.noreply.github.com> --- bitchat/App/AppRuntime.swift | 19 +-- bitchat/Features/media/ImageUtils.swift | 2 +- .../Features/voice/VoiceCaptureSession.swift | 2 +- bitchat/Features/voice/VoiceRecorder.swift | 2 +- bitchat/Models/BitchatMessage+Media.swift | 2 +- .../Services/BLE/BLEIncomingFileStore.swift | 109 +++++++++++++++++- .../ViewModels/ChatLiveVoiceCoordinator.swift | 6 +- .../ChatMediaTransferCoordinator.swift | 2 +- .../Services/MediaRetentionTests.swift | 79 +++++++++++++ 9 files changed, 205 insertions(+), 18 deletions(-) diff --git a/bitchat/App/AppRuntime.swift b/bitchat/App/AppRuntime.swift index b7c20511..0158ea0a 100644 --- a/bitchat/App/AppRuntime.swift +++ b/bitchat/App/AppRuntime.swift @@ -152,18 +152,23 @@ final class AppRuntime: ObservableObject { NetworkActivationService.shared.start() GeohashPresenceService.shared.start() checkForSharedContent() - expireAgedMedia() + performMediaMaintenance() record(.launched) record(.startupCompleted) } - /// Drops media that has outlived the retention window. Off the main thread - /// and best-effort: the sweep walks the media tree, and nothing at launch - /// depends on its result. - private func expireAgedMedia() { - Task(priority: .utility) { - BLEIncomingFileStore().expireAgedMedia() + /// Drops media that has outlived the retention window, then applies the + /// explicit protection class to files that older builds wrote without + /// one. Expiry runs first so the migration never touches files the + /// sweep is about to delete. Detached because `AppRuntime` is + /// main-actor and both passes go file by file through the media tree; + /// best-effort, nothing at launch depends on their results. + private func performMediaMaintenance() { + Task.detached(priority: .utility) { + let store = BLEIncomingFileStore() + store.expireAgedMedia() + store.migrateFileProtectionIfNeeded() } } diff --git a/bitchat/Features/media/ImageUtils.swift b/bitchat/Features/media/ImageUtils.swift index b49f92ca..a6eb25d1 100644 --- a/bitchat/Features/media/ImageUtils.swift +++ b/bitchat/Features/media/ImageUtils.swift @@ -206,7 +206,7 @@ enum ImageUtils { } else { directory = try applicationFilesDirectory().appendingPathComponent("images/outgoing", isDirectory: true) } - try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: nil) + try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: BLEIncomingFileStore.mediaProtectionAttributes) return directory.appendingPathComponent(fileName) } diff --git a/bitchat/Features/voice/VoiceCaptureSession.swift b/bitchat/Features/voice/VoiceCaptureSession.swift index b49c3beb..75451552 100644 --- a/bitchat/Features/voice/VoiceCaptureSession.swift +++ b/bitchat/Features/voice/VoiceCaptureSession.swift @@ -244,7 +244,7 @@ final class PTTLiveVoiceSession: VoiceCaptureSession { let directory = base .appendingPathComponent("files", isDirectory: true) .appendingPathComponent("voicenotes/outgoing", isDirectory: true) - try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: nil) + try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: BLEIncomingFileStore.mediaProtectionAttributes) return directory.appendingPathComponent("voice_\(burstID.hexEncodedString()).m4a") } } diff --git a/bitchat/Features/voice/VoiceRecorder.swift b/bitchat/Features/voice/VoiceRecorder.swift index 80412856..909879cd 100644 --- a/bitchat/Features/voice/VoiceRecorder.swift +++ b/bitchat/Features/voice/VoiceRecorder.swift @@ -300,7 +300,7 @@ actor VoiceRecorder { let baseDirectory = try outputDirectory ?? applicationFilesDirectory().appendingPathComponent("voicenotes/outgoing", isDirectory: true) - try FileManager.default.createDirectory(at: baseDirectory, withIntermediateDirectories: true, attributes: nil) + try FileManager.default.createDirectory(at: baseDirectory, withIntermediateDirectories: true, attributes: BLEIncomingFileStore.mediaProtectionAttributes) return baseDirectory.appendingPathComponent(fileName) } diff --git a/bitchat/Models/BitchatMessage+Media.swift b/bitchat/Models/BitchatMessage+Media.swift index a718e484..16e35a79 100644 --- a/bitchat/Models/BitchatMessage+Media.swift +++ b/bitchat/Models/BitchatMessage+Media.swift @@ -24,7 +24,7 @@ extension BitchatMessage { do { let base = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true) let filesDir = base.appendingPathComponent("files", isDirectory: true) - try FileManager.default.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil) + try FileManager.default.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: BLEIncomingFileStore.mediaProtectionAttributes) self.filesDir = filesDir } catch { filesDir = nil diff --git a/bitchat/Services/BLE/BLEIncomingFileStore.swift b/bitchat/Services/BLE/BLEIncomingFileStore.swift index 826a391c..08ee3649 100644 --- a/bitchat/Services/BLE/BLEIncomingFileStore.swift +++ b/bitchat/Services/BLE/BLEIncomingFileStore.swift @@ -140,6 +140,20 @@ struct BLEIncomingFileStore: @unchecked Sendable { /// orphans a previous session left behind. static let liveCapturePrefix = "voice_live_" + /// Media payloads follow the same at-rest posture as the app's other + /// persistence layers (courier, outbox, receipt index): protected until + /// first unlock, so the launch-time retention sweep can still run after + /// a reboot. Applied to the media directories so recordings that save + /// as they go (live captures, `AVAudioRecorder`) inherit it, and stated + /// explicitly at the payload write site like every other store. + static var mediaProtectionAttributes: [FileAttributeKey: Any]? { + #if os(iOS) + return [.protectionKey: FileProtectionType.completeUntilFirstUserAuthentication] + #else + return nil + #endif + } + /// Exposed so callers that write progressively into the store's /// directories (live voice captures) share the same file manager. let fileManager: FileManager @@ -223,7 +237,7 @@ struct BLEIncomingFileStore: @unchecked Sendable { isDirectory: true ), withIntermediateDirectories: true, - attributes: nil + attributes: Self.mediaProtectionAttributes ) } } catch { @@ -268,7 +282,7 @@ struct BLEIncomingFileStore: @unchecked Sendable { /// write progressively instead of via `save` (live voice captures). func incomingDirectory(subdirectory: String) throws -> URL { let directory = try filesDirectory().appendingPathComponent(subdirectory, isDirectory: true) - try fileManager.createDirectory(at: directory, withIntermediateDirectories: true, attributes: nil) + try fileManager.createDirectory(at: directory, withIntermediateDirectories: true, attributes: Self.mediaProtectionAttributes) return directory } @@ -284,7 +298,7 @@ struct BLEIncomingFileStore: @unchecked Sendable { do { let base = try filesDirectory().appendingPathComponent(subdirectory, isDirectory: true) - try fileManager.createDirectory(at: base, withIntermediateDirectories: true, attributes: nil) + try fileManager.createDirectory(at: base, withIntermediateDirectories: true, attributes: Self.mediaProtectionAttributes) let sanitized = sanitizedFileName( preferredName, defaultName: "\(defaultPrefix)_\(Self.timestampString(from: dateProvider()))", @@ -306,7 +320,11 @@ struct BLEIncomingFileStore: @unchecked Sendable { ), forceRandomizedName: reservedPaths == nil ) - try data.write(to: destination, options: .atomic) + var options: Data.WritingOptions = [.atomic] + #if os(iOS) + options.insert(.completeFileProtectionUntilFirstUserAuthentication) + #endif + try data.write(to: destination, options: options) payloadCoordination.pendingDeliveryPaths.insert( destination.standardizedFileURL.path ) @@ -650,9 +668,90 @@ struct BLEIncomingFileStore: @unchecked Sendable { return removed } + /// Stamps the media directories and any resident payloads with the + /// explicit protection class, covering files written by builds that + /// relied on the container default. Runs every launch: re-stamping an + /// equal class is a metadata no-op, and anything carrying a stronger + /// class is left alone, so repetition is cheap and can never downgrade. + /// In-flight live captures are skipped for symmetry with the retention + /// sweep; they receive the class at creation and need no repair. + /// Best-effort like the sweep it runs alongside; a file that cannot be + /// stamped is logged, not fatal, and the migration moves on to the next + /// item. Returns the number of items stamped so the launch path and + /// tests can observe coverage. + @discardableResult + func migrateFileProtectionIfNeeded() -> Int { + #if os(iOS) + guard let attributes = Self.mediaProtectionAttributes else { return 0 } + var stamped = 0 + guard let base = try? filesDirectory() else { return 0 } + for subdirectory in Self.mediaSubdirectories { + let dir = base.appendingPathComponent(subdirectory, isDirectory: true) + guard fileManager.fileExists(atPath: dir.path) else { continue } + let files = (try? fileManager.contentsOfDirectory( + at: dir, + includingPropertiesForKeys: [.isRegularFileKey, .isDirectoryKey, .fileProtectionKey], + options: [.skipsHiddenFiles] + )) ?? [] + stamped += stampProtectionIfWeaker(dir, requireRegularFile: false, attributes: attributes) + for fileURL in files { + guard !fileURL.lastPathComponent.hasPrefix(Self.liveCapturePrefix) else { continue } + stamped += stampProtectionIfWeaker(fileURL, requireRegularFile: true, attributes: attributes) + } + } + return stamped + #else + return 0 + #endif + } + + #if os(iOS) + /// Applies the class to one item, but only when the item currently sits + /// at the container default or weaker. The list names the classes that + /// are safe to replace; anything else, including classes added in later + /// iOS versions, is left alone. Only regular files are stamped when + /// `requireRegularFile` is set (and only real directories otherwise), + /// matching the caution the legacy-file removal path applies; symlinks + /// and other non-regular files are left untouched. + private func stampProtectionIfWeaker( + _ itemURL: URL, + requireRegularFile: Bool, + attributes: [FileAttributeKey: Any] + ) -> Int { + let values = try? itemURL.resourceValues( + forKeys: [.isRegularFileKey, .isDirectoryKey, .fileProtectionKey] + ) + if requireRegularFile { + guard values?.isRegularFile == true else { return 0 } + } else { + guard values?.isDirectory == true else { return 0 } + } + if let current = values?.fileProtection, + current != .none, + current != .completeUntilFirstUserAuthentication { + return 0 + } + do { + try fileManager.setAttributes(attributes, ofItemAtPath: itemURL.path) + return 1 + } catch let error as CocoaError where error.code == .fileNoSuchFile { + // Quota eviction or a deletion commit on another store instance + // can delete an item out from under this migration; that is not + // a failure. + return 0 + } catch { + SecureLogger.warning( + "⚠️ Failed to migrate media file protection: \(error)", + category: .security + ) + return 0 + } + } + #endif + private func filesDirectory() throws -> URL { let filesDir = try rootDirectory().appendingPathComponent("files", isDirectory: true) - try fileManager.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil) + try fileManager.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: Self.mediaProtectionAttributes) return filesDir } diff --git a/bitchat/ViewModels/ChatLiveVoiceCoordinator.swift b/bitchat/ViewModels/ChatLiveVoiceCoordinator.swift index c3ec5ce9..78fa83e1 100644 --- a/bitchat/ViewModels/ChatLiveVoiceCoordinator.swift +++ b/bitchat/ViewModels/ChatLiveVoiceCoordinator.swift @@ -353,7 +353,11 @@ final class ChatLiveVoiceCoordinator { // Eviction skips voice_live_* names, so partials still streaming in // are safe no matter which caller triggers enforcement. fileStore.enforceQuota(reservingBytes: TransportConfig.pttMaxBurstBytes) - fileManager.createFile(atPath: fileURL.path, contents: nil) + fileManager.createFile( + atPath: fileURL.path, + contents: nil, + attributes: BLEIncomingFileStore.mediaProtectionAttributes + ) guard let handle = try? FileHandle(forWritingTo: fileURL) else { SecureLogger.error("PTT: cannot open capture file for burst \(burstID.hexEncodedString())", category: .session) try? fileManager.removeItem(at: fileURL) diff --git a/bitchat/ViewModels/ChatMediaTransferCoordinator.swift b/bitchat/ViewModels/ChatMediaTransferCoordinator.swift index 1d663044..84295135 100644 --- a/bitchat/ViewModels/ChatMediaTransferCoordinator.swift +++ b/bitchat/ViewModels/ChatMediaTransferCoordinator.swift @@ -1899,7 +1899,7 @@ private extension ChatMediaTransferCoordinator { try FileManager.default.createDirectory( at: filesDirectory, withIntermediateDirectories: true, - attributes: nil + attributes: BLEIncomingFileStore.mediaProtectionAttributes ) return filesDirectory } diff --git a/bitchatTests/Services/MediaRetentionTests.swift b/bitchatTests/Services/MediaRetentionTests.swift index 18b33ca7..6c92af10 100644 --- a/bitchatTests/Services/MediaRetentionTests.swift +++ b/bitchatTests/Services/MediaRetentionTests.swift @@ -114,4 +114,83 @@ struct MediaRetentionTests { func defaultRetentionIsSevenDays() { #expect(BLEIncomingFileStore.defaultMediaRetention == 7 * 24 * 60 * 60) } + + #if os(iOS) + /// Media was the one persistence layer that never stated a protection + /// class at its write site, so payloads inherited the container + /// default. Saves must survive the added write option, + /// and on device the class must read back. The simulator's filesystem + /// does not model data protection (the attribute reads back nil there), + /// so the readback assertion is device-only. + @Test + func savedMediaSurvivesExplicitProtectionClass() throws { + let root = makeRoot() + defer { try? FileManager.default.removeItem(at: root) } + let store = BLEIncomingFileStore(baseDirectory: root) + + let payload = Data([0xFF, 0xD8, 0xFF, 0xD9]) + let saved = try #require(store.save( + data: payload, + preferredName: "note.m4a", + subdirectory: "voicenotes/incoming", + fallbackExtension: "m4a", + defaultPrefix: "voice" + )) + + #expect(try Data(contentsOf: saved) == payload) + #if !targetEnvironment(simulator) + let protection = try FileManager.default.attributesOfItem( + atPath: saved.path + )[.protectionKey] as? FileProtectionType + #expect(protection == .completeUntilFirstUserAuthentication) + #endif + } + + /// Files written before payloads carried an explicit class are stamped + /// by the launch-time migration that follows the retention sweep: the + /// directory plus each resident file, without error. In-flight live + /// captures are left alone, exactly as the sweep leaves them: the + /// coordinator may still be writing to one through an open FileHandle, + /// and new captures receive the class at creation. Readback is device-only for the same + /// reason as above. + @Test + func migrationStampsPreexistingMediaAndSkipsLiveCaptures() throws { + let root = makeRoot() + defer { try? FileManager.default.removeItem(at: root) } + let store = BLEIncomingFileStore(baseDirectory: root) + let incoming = try store.incomingDirectory(subdirectory: "voicenotes/incoming") + + let legacy = try write( + "received.m4a", + in: incoming, + modified: Date(timeIntervalSinceNow: -60) + ) + _ = try write( + "\(BLEIncomingFileStore.liveCapturePrefix)00112233445566ff_dm.aac", + in: incoming, + modified: Date(timeIntervalSinceNow: -60) + ) + + // Exactly the directory itself plus the legacy file; strict equality + // is what proves the live capture was not stamped. + #expect(store.migrateFileProtectionIfNeeded() == 2) + #expect(FileManager.default.fileExists(atPath: legacy.path)) + #if !targetEnvironment(simulator) + let protection = try FileManager.default.attributesOfItem( + atPath: legacy.path + )[.protectionKey] as? FileProtectionType + #expect(protection == .completeUntilFirstUserAuthentication) + #endif + } + + /// A store with no media on disk has nothing to stamp. + @Test + func migrationWithNoMediaIsANoOp() { + let root = makeRoot() + defer { try? FileManager.default.removeItem(at: root) } + let store = BLEIncomingFileStore(baseDirectory: root) + + #expect(store.migrateFileProtectionIfNeeded() == 0) + } + #endif } From 59a9f628dfdb0d1c34dd947516577eaab97c348e Mon Sep 17 00:00:00 2001 From: Vincenzo Palazzo Date: Fri, 31 Jul 2026 12:50:21 +0200 Subject: [PATCH 20/23] test: pin that unknown file TLVs are skipped, not fatal (#1550) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `BitchatFilePacket.decode` skips tags it does not recognise (`case nil: continue`), which is what keeps the TLV list a floor rather than a ceiling: a field the sender considered optional costs the receiver that field, not the whole file. Nothing pinned it. The behaviour is load-bearing for any peer, version or third-party client that adds a field this build has not seen, and it is also where the two implementations diverge — the Android decoder returns null on an unknown tag, which is why `PrivateMediaMessageIdentity` has to derive its receipt key from fields already on the wire instead of adding one. Worth a test on the side that gets it right so it cannot quietly drift into the strict behaviour. Two cases, both hand-built so they do not depend on our own encoder: an unknown TLV between MIME_TYPE and CONTENT (where an encoder appending content last would put it), and one trailing CONTENT. Changing `case nil: continue` to `return nil` fails both. Co-authored-by: jack <212554440+jackjackbits@users.noreply.github.com> --- .../Protocols/BitchatFilePacketTests.swift | 64 +++++++++++++++++++ 1 file changed, 64 insertions(+) diff --git a/bitchatTests/Protocols/BitchatFilePacketTests.swift b/bitchatTests/Protocols/BitchatFilePacketTests.swift index 2476647f..22ea83f9 100644 --- a/bitchatTests/Protocols/BitchatFilePacketTests.swift +++ b/bitchatTests/Protocols/BitchatFilePacketTests.swift @@ -75,6 +75,70 @@ final class BitchatFilePacketTests: XCTestCase { XCTAssertEqual(decoded.content, content) } + /// The TLV tag list is a floor, not a ceiling: a decoder that bails on the + /// first tag it does not know makes the format unextendable, because a field + /// the sender considered optional costs the receiver the whole file. This + /// decoder skips them (`case nil: continue`) and that has to stay true — it + /// is load-bearing for any peer, version or third-party client that adds a + /// field we have not seen. `PrivateMediaMessageIdentity` exists precisely + /// because the Android decoder does *not* do this, so the asymmetry is real + /// and worth pinning on the side that gets it right. + func testDecodeSkipsUnknownTLVTypesInsteadOfDroppingTheFile() throws { + let content = Data((0..<64).map { UInt8($0) }) + let unknownValue = Data("some-message-id".utf8) + var data = Data() + + // fileName + data.append(0x01) + data.append(contentsOf: [0x00, 0x09]) + data.append(Data("photo.jpg".utf8)) + // fileSize + data.append(0x02) + data.append(contentsOf: [0x00, 0x04]) + data.append(contentsOf: [0x00, 0x00, 0x00, UInt8(content.count)]) + // mimeType + data.append(0x03) + data.append(contentsOf: [0x00, 0x0A]) + data.append(Data("image/jpeg".utf8)) + // An unknown tag, where an encoder appending content last would put it + data.append(0x05) + data.append(contentsOf: [0x00, UInt8(unknownValue.count)]) + data.append(unknownValue) + // content + data.append(0x04) + data.append(contentsOf: [0x00, 0x00, 0x00, UInt8(content.count)]) + data.append(content) + + let decoded = try XCTUnwrap(BitchatFilePacket.decode(data)) + XCTAssertEqual(decoded.fileName, "photo.jpg") + XCTAssertEqual(decoded.mimeType, "image/jpeg") + XCTAssertEqual(decoded.fileSize, UInt64(content.count)) + XCTAssertEqual(decoded.content, content) + } + + /// Same contract for an extension that trails the content, which a decoder + /// stopping at the first unknown tag would also lose. + func testDecodeSkipsAnUnknownTLVTrailingTheContent() throws { + let content = Data(repeating: 0x7F, count: 16) + var data = Data() + + data.append(0x01) + data.append(contentsOf: [0x00, 0x08]) + data.append(Data("note.m4a".utf8)) + data.append(0x04) + data.append(contentsOf: [0x00, 0x00, 0x00, UInt8(content.count)]) + data.append(content) + data.append(0x7F) + data.append(contentsOf: [0x00, 0x04]) + data.append(Data([0x11, 0x11, 0x11, 0x11])) + + let decoded = try XCTUnwrap(BitchatFilePacket.decode(data)) + XCTAssertEqual(decoded.fileName, "note.m4a") + XCTAssertNil(decoded.mimeType) + XCTAssertEqual(decoded.fileSize, UInt64(content.count)) + XCTAssertEqual(decoded.content, content) + } + func testPrivateMediaMessageIdentityConvergesAcrossPeerIDAliases() throws { let senderKey = Data(repeating: 0x11, count: 32) let recipientKey = Data(repeating: 0x22, count: 32) From 6f323637745488604f540657cdb2f46a924ffb24 Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Fri, 31 Jul 2026 11:50:24 +0100 Subject: [PATCH 21/23] Deflake VoiceRecorderTests: replace timed semaphores with async events (#1572) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit waitUntilActivationBegan hardcoded a 5-second DispatchSemaphore timeout — below the 10s house floor and invisible to TestTimingHygieneTests (it's a semaphore wait, not a helper-timeout parameter). On a starved runner the window expired before the recorder's session-acquire task was scheduled, failing cancelWhileSessionAcquireIsInFlightNeverCreates- ARecorder — 7 sightings, including three in the last two days (#1506 and #1528 merge runs, #1550's PR run). The fix is extracted verbatim from #1107 (mmalmi), which carries it but is blocked on a V3 rebase: both test gates (activation and padding) drop their DispatchSemaphore + timeout for an untimed async-event wait (VoiceRecorderAsyncEvent), so there is no timing constant left to starve — the test framework's own timeout is the backstop. Extracting it unblocks CI now; #1107's rebase will see this file already matching its branch. Verified (count-checked via xcresulttool): 7/7 VoiceRecorderTests on the iOS simulator, and 7/7 x 5 consecutive runs under 16x CPU oversubscription. Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchatTests/VoiceRecorderTests.swift | 71 ++++++++++++++++----------- 1 file changed, 41 insertions(+), 30 deletions(-) diff --git a/bitchatTests/VoiceRecorderTests.swift b/bitchatTests/VoiceRecorderTests.swift index c9b6839e..68069f11 100644 --- a/bitchatTests/VoiceRecorderTests.swift +++ b/bitchatTests/VoiceRecorderTests.swift @@ -10,10 +10,41 @@ import Foundation import Testing @testable import bitchat +/// One-shot event that bridges synchronous production seams to async tests +/// without blocking a shared dispatch worker while waiting for the seam. +private final class VoiceRecorderAsyncEvent: @unchecked Sendable { + private let lock = NSLock() + private var isSignaled = false + private var waiters: [CheckedContinuation] = [] + + func wait() async { + await withCheckedContinuation { continuation in + let resumeImmediately = lock.withLock { () -> Bool in + guard !isSignaled else { return true } + waiters.append(continuation) + return false + } + if resumeImmediately { + continuation.resume() + } + } + } + + func signal() { + let continuations = lock.withLock { () -> [CheckedContinuation] in + guard !isSignaled else { return [] } + isSignaled = true + defer { waiters.removeAll() } + return waiters + } + continuations.forEach { $0.resume() } + } +} + private final class VoiceRecorderTestSession: SessionApplying, @unchecked Sendable { private let lock = NSLock() private let activationGate = DispatchSemaphore(value: 0) - private let activationBeganGate = DispatchSemaphore(value: 0) + private let activationBegan = VoiceRecorderAsyncEvent() private let shouldGateFirstActivation: Bool private var gatedFirstActivation = false private var _activationCalls: [Bool] = [] @@ -34,23 +65,13 @@ private final class VoiceRecorderTestSession: SessionApplying, @unchecked Sendab return true } if shouldWait { - activationBeganGate.signal() + activationBegan.signal() activationGate.wait() } } - func waitUntilActivationBegan( - timeout: DispatchTimeInterval = .seconds(5) - ) async -> Bool { - await withCheckedContinuation { continuation in - DispatchQueue.global(qos: .userInitiated).async { - continuation.resume( - returning: self.activationBeganGate.wait( - timeout: DispatchTime.now() + timeout - ) == .success - ) - } - } + func waitUntilActivationBegan() async { + await activationBegan.wait() } func resumeActivation() { @@ -155,7 +176,7 @@ private final class TestVoiceAudioRecorderFactory: VoiceAudioRecorderCreating { /// this remains deterministic when the full test suite saturates the executor. private final class VoiceRecorderPaddingGate: @unchecked Sendable { private let lock = NSLock() - private let enteredGate = DispatchSemaphore(value: 0) + private let entered = VoiceRecorderAsyncEvent() private var isOpen = false private var openWaiters: [CheckedContinuation] = [] @@ -166,25 +187,15 @@ private final class VoiceRecorderPaddingGate: @unchecked Sendable { openWaiters.append(continuation) return false } - enteredGate.signal() + entered.signal() if resumeImmediately { continuation.resume() } } } - func waitUntilEntered( - timeout: DispatchTimeInterval = .seconds(5) - ) async -> Bool { - await withCheckedContinuation { continuation in - DispatchQueue.global(qos: .userInitiated).async { - continuation.resume( - returning: self.enteredGate.wait( - timeout: DispatchTime.now() + timeout - ) == .success - ) - } - } + func waitUntilEntered() async { + await entered.wait() } func open() { @@ -223,7 +234,7 @@ struct VoiceRecorderTests { let owner = VoiceRecorder.RecordingOwner() let startTask = Task { try await voiceRecorder.startRecording(owner: owner) } - #expect(await session.waitUntilActivationBegan()) + await session.waitUntilActivationBegan() await voiceRecorder.cancelRecording(owner: owner) session.resumeActivation() @@ -321,7 +332,7 @@ struct VoiceRecorderTests { try await finishingHold.start() let firstURL = try #require(factory.urls.first) let finishTask = Task { await finishingHold.finish() } - #expect(await paddingGate.waitUntilEntered()) + await paddingGate.waitUntilEntered() await #expect(throws: VoiceRecorder.RecorderError.recordingInProgress) { try await rejectedHold.start() From 9edb7c26ef7bdcf3bb29e7907b38997f8d5cd0fa Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Fri, 31 Jul 2026 14:29:47 +0100 Subject: [PATCH 22/23] Silence the four release-build warnings (#1583) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All four surfaced in the 1.7.1 RC window and are behavior-neutral: - sendPacket(to:) discarded sendPacketDirected's Bool through generic onEngine, tripping unused-result (from #1547's engine-domain flip). - Both _test_drain*Pipeline helpers captured non-Sendable self in @Sendable dispatch closures; they only need the queue, which is Sendable — capture that instead. - removeEphemeralSession returned removeValue's result out of the barrier closure, tripping unused-result on sync(flags:execute:). Co-authored-by: jack Co-authored-by: Claude Fable 5 --- bitchat/Identity/SecureIdentityStateManager.swift | 2 +- bitchat/Services/BLE/BLEService.swift | 14 +++++++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/bitchat/Identity/SecureIdentityStateManager.swift b/bitchat/Identity/SecureIdentityStateManager.swift index 966f210a..4204e940 100644 --- a/bitchat/Identity/SecureIdentityStateManager.swift +++ b/bitchat/Identity/SecureIdentityStateManager.swift @@ -663,7 +663,7 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol { func removeEphemeralSession(peerID: PeerID) { queue.sync(flags: .barrier) { - self.ephemeralSessions.removeValue(forKey: peerID) + _ = self.ephemeralSessions.removeValue(forKey: peerID) } } diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index 8891b40e..752d9758 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -2943,7 +2943,7 @@ extension BLEService: GossipSyncManager.Delegate { func sendPacket(to peerID: PeerID, packet: BitchatPacket) { onEngine { - sendPacketDirected(packet, to: peerID) + _ = sendPacketDirected(packet, to: peerID) } } @@ -3336,9 +3336,12 @@ extension BLEService { } func _test_drainPrivateMediaSendPipeline() async { + // Capture only the (Sendable) queue, not self, so the @Sendable + // dispatch closures carry no non-Sendable state. + let queue = messageQueue await withCheckedContinuation { continuation in - self.messageQueue.async { [weak self] in - self?.messageQueue.async { + queue.async { + queue.async { continuation.resume() } } @@ -3357,9 +3360,10 @@ extension BLEService { } func _test_drainNoiseMessagePipeline() async { + let queue = messageQueue await withCheckedContinuation { continuation in - self.messageQueue.async { - self.messageQueue.async { + queue.async { + queue.async { continuation.resume() } } From 948d6a85b9f254760c475a64f02fe8899e4f3d7f Mon Sep 17 00:00:00 2001 From: jack <212554440+jackjackbits@users.noreply.github.com> Date: Sat, 1 Aug 2026 09:41:15 +0100 Subject: [PATCH 23/23] Peer ID rotation: working primitives + spec for iOS/Android review (#1487) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * docs: specify peer ID rotation for cross-platform review Draft protocol spec for review by both iOS and Android before any implementation. Nothing here is implemented; this is the artifact to agree on, since the change is a wire revision neither platform can ship alone. The headline correction, because it is easy to get wrong: rotating the peer ID alone accomplishes nothing. The announce carries the Noise static key, the Ed25519 signing key and the nickname in cleartext, so a rotated ID is re-linked to the same device on its first announce. Rotation and announce confidentiality have to land together. The second thing an implementer needs to know up front is that peerID == SHA-256(noiseStaticKey)[0..8] is not a convention, it is the mechanism that makes peer IDs unforgeable, enforced in the announce preflight and again at handshake completion. Making IDs independent of the key fails both checks for every peer, so a replacement binding has to ship in the same change. The spec proposes one: an Ed25519 proof over (context, epoch, rotating ID, static key) carried inside the completed Noise session via the existing AuthenticatedPeerStatePacket, checked against a pinned signing key — strictly stronger than today's self-signed announce. Design summary: hour-epoch IDs derived from private key material via HKDF+HMAC so no observer can predict or link them; pairwise recognition tags from the X25519 shared secret so mutual favourites still recognise each other with no handshake, padded to fixed slots so the tag count does not leak how many favourites someone has; strangers discovered by handshake-first-identify-second over Noise XX, whose static keys are already encrypted on the wire. Nickname moves inside the session and the neighbour list is dropped rather than rotated. Includes a verified impact inventory separating what breaks hard (the handshake check, the announce preflight, the disk outbox keyed by peer ID, private-media stable IDs and their deletion tombstones, the initiator tie-break, fingerprint-prefix lookups) from what degrades gracefully and what is already safe because it keys on fingerprints or Noise keys. Rollout uses the two mechanisms already proven in this repo: a PeerCapabilities bit (11 is next; 10 is burned) with capabilitiesWereExplicitlyAdvertised to tell an old client from a new one with the bit off, and observed-version gating as used for source routing. Two findings surfaced while writing this and are recorded in the spec. CourierEnvelope.recipientTag is HMAC keyed on the recipient's *public* static key, and since that key is broadcast in cleartext today, any observer in radio range can compute a peer's courier tags for any day — so the whitepaper's "cannot link it across days" does not currently hold, and the pattern must not be copied. And NoiseEncryptionService's buildAnnounceSignature/verifyAnnounceSignature/canonicalAnnounceBytes are present but production-dead, called only from tests; the binding above deliberately uses a different context string so the two can never be confused. Eight open questions are left explicitly unresolved, including the rotation period, whether unsigned v2 announces are an acceptable posture, and whether Android's decoder tolerates trailing bytes the way iOS's does (which decides whether padding coverage can ship ungated). Co-Authored-By: Claude Opus 5 * Implement the peer ID rotation primitives Code is a better thing to argue with than prose, so the spec now has a working, tested base under it. Every number and context string is a concrete proposal you can reject by changing one function and watching a test vector move. What is implemented: - PeerIDRotation: hour epochs with a ±1 matching window, the rotation secret from the Noise static *private* key, per-epoch peer IDs, pairwise recognition keys and tags from an X25519 shared secret, the fixed-width tag block with CSPRNG padding and constant-time matching, and the canonical bytes for the identity binding. - AnnounceV2Packet (announceV2 = 0x05): TLV wire format carrying an epoch, a 64-byte tag block, capabilities and an optional bridge cell — and nothing else. No nickname, no public keys, no neighbour list. Rejects a wrong-width tag block on both encode and decode, since a short block would disclose how many mutual favourites someone has, and rejects non-canonical capability encodings the way AuthenticatedPeerStatePacket does. Unknown TLVs are skipped for forward compatibility. - 37 tests, three of which are hex vectors cross-checked against an independent implementation written from the spec alone (Python hmac/hashlib, HKDF extract-then-expand, empty salt) and matching byte for byte. That is the property Android needs: the document is sufficient to reproduce the numbers without reading this code. What is deliberately NOT implemented: nothing emits a v2 announce, and BLEService parses the type and explicitly ignores it. Consuming presence needs both the replacement identity binding and a decision on how unverified presence appears in the peer list, and accepting it now would put unauthenticated entries in front of people. Adding the message type forced three policy decisions, all reviewable: - Not gossip-synced. Syncing presence would defeat the point — a device never in radio range could collect tag blocks, turning a local beacon into a network-wide one. - Not padded. At ~75 bytes the smallest bucket would triple the airtime of the most frequent packet in the protocol; the format is already near-constant width, and fixing the capability and geohash field widths would be cheaper than padding. - Parsed but ignored on receive, as above. Notably the v2 announce is *smaller* than v1 (~75 vs ~229 bytes): dropping two 32-byte keys, the neighbour list and the signature more than pays for 64 bytes of tags, so unlinkability here costs less airtime rather than more. Co-Authored-By: Claude Opus 5 * Mark the rotation primitives periphery:ignore The dead-code scan correctly flagged both new types as unused, which they intentionally are: they exist to be reviewed and argued with before the protocol change they belong to can ship. Annotated in place rather than added to .periphery.baseline.json so the reason sits next to the code and disappears with it, following the existing convention in MessageRouter. Both notes say to delete the annotation once the mesh starts using the type. `periphery scan --strict` locally: no unused code detected. Co-Authored-By: Claude Opus 5 * Fix two P1 flaws in the recognition tag design (Codex #1487) Both findings are correct and both were real. This is the argument for shipping code next to the prose: neither was obvious in the design text. **Tags were symmetric, which leaked the social graph.** `HMAC(K_AB, epoch)` produces the same 8 bytes for both parties, so an observer who saw one value in two different announces would learn those two devices are mutual favourites, and could link their two rotating IDs to each other — handing over exactly the graph the design exists to hide, plus a cross-epoch correlation handle. Tags are now directional: the MAC covers the ordered sender and recipient static public keys, so A→B and B→A differ. Both parties can still compute both directions because both hold both keys. **Tags were replayable under any ID.** A tag depending only on (pair, epoch) could be lifted from a recorded announce and replayed in a fresh announce under an attacker-chosen ID; the recipient would match and treat that ID as the favourite, and since epoch-1 is accepted it would keep working into the next period. The MAC now covers the announced peer ID, which reduces this to replaying the victim's own presence. That residual is unfixable while announces are unsigned, so the spec now states plainly that recognition is a hint only: presence may be populated, but routing a DM or showing a verified badge must wait for a handshake whose static key equals the favourite that produced the match. O4 is rewritten around that, with the two alternatives named (per-epoch ephemeral signing key, or a freshness nonce echoed by the recipient). Tests: two regression cases named for the findings, plus a wrong-direction-does-not-match case so the directional fix cannot silently become cosmetic. The vector table now gives both directions, because their difference is the security property — an implementation that produces one value for both has reintroduced the flaw. Recomputed independently in Python from the spec and matched byte for byte. Co-Authored-By: Claude Opus 5 * docs: record that padding changes are cross-platform coordinated O7 began as a question about whether Android tolerates trailing bytes. The firmer answer, found while attempting the padding fix unilaterally: toBinaryDataForSigning encodes with padding enabled, so the padding bytes are inside the signed material for every signed packet. Changing the algorithm changes the signed byte stream and breaks verification against any peer that has not made the identical change. So both outstanding padding fixes — coverage beyond Noise frames, and the gap where a frame needing over 255 bytes of padding ships unpadded — are wire changes requiring both platforms, not local cleanups. O7 now says so, and names the two things to settle. Also updates the related-work section: dropping the neighbour list and randomizing origin TTL did turn out to be unilateral and have landed separately. Co-Authored-By: Claude Opus 5 * Close the review findings on the rotation spec **P1 — the binding proof was replayable onto another session.** The §4.5 verifier checklist omitted the check that the proof's noiseStaticPublicKey equals the remote static key the Noise session actually established. The proof is a self-contained signed blob with nothing tying it to the session it arrives on, so a peer M that had seen A's proof could replay it verbatim inside M's own session with B; B would verify A's signature, see a well-formed binding, and on first contact TOFU-pin A's signing key against M's fingerprint. Added as the first item in the checklist, with the attack written out, because "signed" and "bound to this conversation" are different properties and the difference is easy to lose in a bullet list. **announceV2 is 0x2C, not 0x05.** 0x05 only looks free. It has been recycled twice — announce, then bulkTransferResponse, then fragmentStart until #446 — so an old peer could still map it to a fragment header and misparse presence as a partial message. Values above voiceFrame = 0x29 have only ever been allocated forward, and 0x2A/0x2B belong to the courier spray-ack work, leaving 0x2C. Confirmed never used anywhere in this repository's history. **Outbound priority is now stated, not inherited.** announceV2 fell through to `default: .high`. High is the right answer — presence is small, time-bounded to its epoch and useless once stale — but for a type nothing emits yet, a fall-through means the choice gets made without anyone seeing it. **Reverted unexplained pbxproj churn.** Xcode had rewritten resource-phase ordering and dropped a share-extension entitlements membership exception; none of it belongs in this PR. The file now matches main byte for byte. **O7 said "payloads" where the arithmetic is over encoded frames.** The 241-256 / 497-768 / 1009-1792 ranges are what `pad` receives, which is the whole encoded packet, not the payload alone. **Added O9: a seized device recomputes every past peer ID.** K_rot is long-lived, so peerID_e is computable for any epoch by whoever holds it — someone who seizes a phone, or pulls the static key from a backup, can go back over historical radio captures and identify which were this device. Rotation defends against the passive observer, not against later key compromise. A hash ratchet would give forward secrecy for the ID stream at the cost of state that must survive restarts, tolerate clock jumps, and resynchronise after a gap — a real trade rather than an obvious win, so it is written down as a question rather than silently adopted. Co-Authored-By: Claude Opus 5 * docs: rotation capability bit is 14 now — 11-13 claimed by in-flight work Co-Authored-By: Claude Fable 5 --------- Co-authored-by: jack Co-authored-by: Claude Opus 5 --- .../BLE/BLEOutboundPacketPolicy.swift | 17 +- bitchat/Services/BLE/BLEService.swift | 11 +- bitchat/Sync/SyncTypeFlags.swift | 5 + docs/PEER-ID-ROTATION.md | 342 +++++++++++++++ .../BitFoundation/AnnounceV2Packet.swift | 158 +++++++ .../Sources/BitFoundation/MessageType.swift | 18 + .../BitFoundation/PeerIDRotation.swift | 315 ++++++++++++++ .../AnnounceV2PacketTests.swift | 159 +++++++ .../PeerIDRotationTests.swift | 408 ++++++++++++++++++ 9 files changed, 1431 insertions(+), 2 deletions(-) create mode 100644 docs/PEER-ID-ROTATION.md create mode 100644 localPackages/BitFoundation/Sources/BitFoundation/AnnounceV2Packet.swift create mode 100644 localPackages/BitFoundation/Sources/BitFoundation/PeerIDRotation.swift create mode 100644 localPackages/BitFoundation/Tests/BitFoundationTests/AnnounceV2PacketTests.swift create mode 100644 localPackages/BitFoundation/Tests/BitFoundationTests/PeerIDRotationTests.swift diff --git a/bitchat/Services/BLE/BLEOutboundPacketPolicy.swift b/bitchat/Services/BLE/BLEOutboundPacketPolicy.swift index ddcc4abc..fa0853d6 100644 --- a/bitchat/Services/BLE/BLEOutboundPacketPolicy.swift +++ b/bitchat/Services/BLE/BLEOutboundPacketPolicy.swift @@ -15,7 +15,15 @@ enum BLEOutboundPacketPolicy { // voiceFrame is deliberately unpadded: padding to the 512 block would // push every ~490-byte signed voice packet over the MTU into the // fragment path. - case .none, .announce, .message, .leave, .requestSync, .fragment, .fileTransfer, .courierEnvelope, .boardPost, .ping, .pong, .nostrCarrier, .prekeyBundle, .groupMessage, .voiceFrame: + // + // announceV2 is unpadded too, but for a different reason and it is worth + // revisiting: it is ~75 bytes, so the smallest bucket would triple the + // airtime of the most frequently sent packet in the protocol. Its length + // is already near-constant by construction (the tag block is fixed + // width); the residual variation is the capability width and whether a + // bridge geohash is present. Making those fixed-width would be cheaper + // than padding. See docs/PEER-ID-ROTATION.md. + case .none, .announce, .announceV2, .message, .leave, .requestSync, .fragment, .fileTransfer, .courierEnvelope, .boardPost, .ping, .pong, .nostrCarrier, .prekeyBundle, .groupMessage, .voiceFrame: return false } } @@ -27,6 +35,13 @@ enum BLEOutboundPacketPolicy { return .fragment(totalFragments: fragmentTotalCount(from: packet.payload)) case .fileTransfer: return .fileTransfer + case .announceV2: + // Stated rather than inherited from `default`. Presence is small, + // time-bounded to its epoch, and useless once stale, so it belongs + // with the other control traffic at high priority — but that should + // be a decision on the record, not a fall-through, since this type + // is not emitted yet and nobody would notice the choice being made. + return .high default: return .high } diff --git a/bitchat/Services/BLE/BLEService.swift b/bitchat/Services/BLE/BLEService.swift index 752d9758..0c4ecfb1 100644 --- a/bitchat/Services/BLE/BLEService.swift +++ b/bitchat/Services/BLE/BLEService.swift @@ -5983,7 +5983,16 @@ extension BLEService { switch context.messageType { case .announce: handleAnnounce(packet, from: senderID) - + + case .announceV2: + // Parsed and ignored on purpose. The wire format and derivations are + // implemented and tested (see PeerIDRotation, AnnounceV2Packet), but + // consuming presence from it needs the replacement identity binding + // and the peer-list policy for unverified presence, both of which are + // still open questions in docs/PEER-ID-ROTATION.md. Accepting it now + // would add unauthenticated entries to the peer list. + break + case .message: handleMessage(packet, from: senderID) diff --git a/bitchat/Sync/SyncTypeFlags.swift b/bitchat/Sync/SyncTypeFlags.swift index c2c96a1c..4dbbb53a 100644 --- a/bitchat/Sync/SyncTypeFlags.swift +++ b/bitchat/Sync/SyncTypeFlags.swift @@ -57,6 +57,11 @@ struct SyncTypeFlags: OptionSet { // Live voice is only useful now; replaying stale audio frames via // sync would waste airtime (receivers drop them as stale anyway). case .voiceFrame: return nil + // Rotating-ID presence is valid only inside its epoch, and gossiping it + // would defeat the point: a synced announce would let a device that was + // never in radio range collect tag blocks, turning a local presence + // beacon into a network-wide one. + case .announceV2: return nil // Prekey bundles gossip like board posts. The bitfield is a // wire-tolerant little-endian UInt64 (1-8 bytes, unknown high bits // ignored by `type(forBit:)`), so bits 8+ need no format change: old diff --git a/docs/PEER-ID-ROTATION.md b/docs/PEER-ID-ROTATION.md new file mode 100644 index 00000000..b71de1ed --- /dev/null +++ b/docs/PEER-ID-ROTATION.md @@ -0,0 +1,342 @@ +# Peer ID Rotation Specification + +**Status:** Draft for cross-platform review. The derivations and the wire format **are implemented and tested**; nothing is wired into the shipping mesh. +**Audience:** bitchat iOS and bitchat Android maintainers. +**Requires agreement before going further.** This changes the wire protocol, so neither platform can ship it alone. + +**Where the code is:** + +| Piece | File | +|---|---| +| Epochs, ID derivation, recognition tags, tag block, binding message | `localPackages/BitFoundation/Sources/BitFoundation/PeerIDRotation.swift` | +| `announceV2 = 0x2C` wire format | `localPackages/BitFoundation/Sources/BitFoundation/AnnounceV2Packet.swift` | +| Executable test vectors | `localPackages/BitFoundation/Tests/BitFoundationTests/PeerIDRotationTests.swift` | +| Wire-format tests | `localPackages/BitFoundation/Tests/BitFoundationTests/AnnounceV2PacketTests.swift` | + +The code is deliberately an **opinionated working base, not a finished feature**. Every number and context string in it is a concrete proposal you can disagree with by changing one function and watching a test vector move. What is *not* implemented is the part that carries risk: nothing emits a v2 announce, and `BLEService` parses the type and explicitly ignores it, because consuming it needs both the replacement identity binding (§4.5) and a decision on how unverified presence appears in the peer list (O4). + +Three policy decisions were forced by the compiler when the new message type was added, and are worth reviewing as part of this: + +- **Not gossip-synced** (`SyncTypeFlags`). Syncing presence would defeat the purpose: a device never in radio range could collect tag blocks, turning a local beacon into a network-wide one. +- **Not padded** (`BLEOutboundPacketPolicy`). At ~75 bytes the smallest bucket would triple the airtime of the most frequent packet in the protocol. The format is already near-constant width; making the capability and geohash fields fixed-width would be cheaper than padding. Open for argument. +- **Parsed but ignored** on receive (`BLEService`), as above. + +--- + +## 1. The problem + +Today a passive listener with a BLE dongle, standing in a crowd, can do the following with no cryptographic attack and no active participation: + +1. **Detect that a phone is running bitchat.** The service UUID is a fixed constant. +2. **Assign that phone a permanent identifier.** The 8-byte sender ID in every packet header is `SHA-256(noiseStaticPublicKey)[0..8]`, and the Noise static key is generated once and kept in the keychain. It does not rotate. Same phone, same bytes, next week, next city. +3. **Learn the phone's long-term public keys and its self-chosen nickname.** The announce carries the 32-byte Noise static key, the 32-byte Ed25519 signing key, and the nickname, all in cleartext, re-broadcast every 4–30 seconds and on demand to anything that connects and subscribes. +4. **Reconstruct who was standing near whom.** The announce also carries up to ten neighbour IDs, so one receiver gets the local adjacency graph without needing several receivers or signal-strength trilateration. + +For the people this app is explicitly built for, (2) and (4) are the dangerous ones. A protest attendee's phone announces a stable pseudonym and its social graph to anyone within radio range. + +iOS BLE address randomization does not help. It randomizes the link-layer address underneath an application layer that publishes a stable identifier above it. + +**The correction that matters most:** rotating the peer ID *alone* accomplishes nothing. As long as the announce carries the static keys in cleartext, a rotated ID is re-linked to the same device on its first announce. Rotation and announce confidentiality have to land together or not at all. + +## 2. Goals and non-goals + +**Goals** + +- **G1.** A passive listener cannot link two observations of the same device across rotation periods. +- **G2.** A passive listener cannot learn a device's long-term identity keys or nickname. +- **G3.** Peers who already know each other (mutual favourites) still recognise each other automatically, without an interactive handshake, so existing UX does not regress. +- **G4.** Strangers can still discover and handshake, so the mesh still forms among people who have never met. +- **G5.** Old and new clients interoperate. A mixed mesh keeps working, in both directions, with no flag day. +- **G6.** Rotation does not make identity spoofing easier than it is today. + +**Non-goals, explicitly out of scope here** + +- Hiding *that* bitchat is in use. The service UUID is a separate problem; BLE requires something discoverable. Tracked separately. +- Traffic-analysis resistance in general: padding coverage, send-time jitter, TTL randomization, and the neighbour-list leak each need their own change. Rotation does not fix them and they do not fix rotation. +- Resistance to an active attacker who connects and completes a handshake. Anyone you handshake with learns your identity; that is what a handshake is for. + +## 3. What currently binds an identity, and why rotation breaks it + +This is the part most likely to be underestimated, so it is stated precisely. + +`peerID == SHA-256(noiseStaticPublicKey)[0..8]` is not merely a convention. It is **the mechanism that makes peer IDs unforgeable**, and it is enforced in two places: + +**Announce preflight** — `BLEAnnounceHandlingPolicy.swift:32-35`: + +```swift +let derivedPeerID = PeerID(publicKey: announcement.noisePublicKey) +guard derivedPeerID == peerID else { return .reject(.senderMismatch(derivedPeerID: derivedPeerID)) } +``` + +**Handshake completion** — `NoiseSessionManager.swift:1106-1122`: + +```swift +private func authenticatedRemoteKey(_ remoteKey: Curve25519.KeyAgreement.PublicKey, + matches claimedPeerID: PeerID) -> Bool { + let rawKey = remoteKey.rawRepresentation + if claimedPeerID.isShort { return PeerID(publicKey: rawKey) == claimedPeerID } + … +} +``` + +Failure throws `NoiseSessionError.peerIdentityMismatch`. + +If the peer ID becomes independent of the key, **both checks fail for every peer** and there is nothing left proving that a sender ID belongs to the sender. Any rotation design must therefore ship a *replacement* binding in the same change. This is why the work is a protocol revision and not a patch. + +Note also what the existing announce signature does and does not prove. The packet signature covers the sender ID (`BitchatPacket.toBinaryDataForSigning()` zeroes only TTL and the RSR flag), but it is verified against the Ed25519 key carried *inside the same announce* — a self-signature. The code says so plainly (`BLEAnnounceHandlingPolicy.swift:94-103`): an attacker can replay a victim's peer ID and Noise key with their own signing key and a valid self-signature, and only trust-on-first-use pinning of the signing key stops it. So today's binding is "derived ID + TOFU", and a replacement must be at least that strong. + +## 4. Design + +### 4.1 Epochs + +Rotation is on a wall-clock schedule so that two devices that have never met agree on the current period without negotiation. + +``` +epoch = floor(unixTimeSeconds / ROTATION_PERIOD) +ROTATION_PERIOD = 3600 (1 hour, proposed — see open question O1) +``` + +`epoch` is a `UInt32`, big-endian wherever it is hashed. Implementations MUST accept `epoch-1`, `epoch`, and `epoch+1` when matching (the ±1 window absorbs clock skew and boundary crossings), following the precedent already set by courier recipient tags (`CourierEnvelope.candidateTags`). + +### 4.2 The rotating peer ID + +``` +K_rot = HKDF-SHA256(ikm: noiseStaticPrivateKey, + salt: "", + info: "bitchat-peer-rotation-v1", + length: 32) + +peerID_e = HMAC-SHA256(key: K_rot, + message: "bitchat-peer-id-v2" || uint32be(epoch))[0..8] +``` + +Properties: + +- Derived from the **private** key, so no observer can compute or predict it, and two epochs' IDs are unlinkable. +- Deterministic, so the device recomputes the same ID after a restart within the same epoch. +- Still 8 bytes, so the packet header layout is unchanged. + +**It must be derived from private key material.** Deriving from the *public* key would let anyone who has ever seen that key compute every past and future ID, which is worse than doing nothing because it would look like protection. This mistake already exists in the codebase: `CourierEnvelope.recipientTag` is `HMAC(key: recipient's **public** static key, epochDay)`, and since that public key is broadcast in cleartext today, any observer in radio range can compute a peer's courier tags for any day. The whitepaper's claim that couriers "cannot link it across days" does not currently hold. Fixing that is out of scope here but should be tracked; do not copy the pattern. + +### 4.3 Recognising peers you already know + +With the static keys off the air, mutual favourites need another way to spot each other. Each announce carries a set of **pairwise recognition tags**. For a device A announcing under `peerID_e` to mutual favourite B: + +``` +S_AB = X25519(A_noiseStaticPrivate, B_noiseStaticPublic) // == X25519(B_priv, A_pub) +K_AB = HKDF-SHA256(ikm: S_AB, salt: "", info: "bitchat-recognition-v1", length: 32) + +tag_A→B = HMAC-SHA256(key: K_AB, + message: uint32be(epoch) + || A_noiseStaticPublic (32) + || B_noiseStaticPublic (32) + || peerID_e (8))[0..8] +``` + +A includes `tag_A→B` in its announce. B computes the same value independently — it holds the same shared secret and both public keys — and matches it against inbound announces. Only A and B can compute it, because it needs one of the two private keys. + +Two properties of that MAC input are load-bearing, and an earlier draft of this document got both wrong. They were caught in review of #1487, which is the argument for shipping the code alongside the prose. + +**Ordered keys make the tag directional.** The earlier form was `HMAC(K_AB, epoch)`, which is symmetric: A and B would broadcast the *identical* 8 bytes. An observer who saw one value appear in two different announces would learn that those two devices are mutual favourites, and could link their two rotating IDs to each other — handing over precisely the social graph this design exists to hide, and providing a cross-epoch correlation handle. Ordering the keys yields distinct A→B and B→A values, and both parties can still compute both directions because both hold both public keys. + +**`peerID_e` binds the tag to the announce carrying it.** Without it a tag depends only on (pair, epoch), so an attacker could lift A's tag out of a recorded announce and replay it in a fresh announce under an ID of their own choosing; B would match and treat that ID as A. Because `epoch-1` is also accepted, the spoof would stay usable into the following period. Binding to the ID reduces this from impersonation-as-any-ID to replaying A's own presence. + +**Residual risk, unfixable while announces are unsigned:** an attacker can rebroadcast A's exact announce within the epoch window, making A appear present when absent. Recognition is therefore a **hint only**. A match may populate presence, but anything consequential — routing a DM, showing a verified badge — MUST wait for a completed handshake whose static key equals the favourite that produced the match. See O4. + +Rules: + +- Tags are **unordered**. Implementations MUST NOT infer anything from position. +- The tag list MUST be padded with uniform random 8-byte values to a fixed count `TAG_SLOTS = 8`, so the number of tags does not disclose how many mutual favourites a device has. Random padding is indistinguishable from a real tag to anyone who cannot compute it. +- With more than `TAG_SLOTS` mutual favourites, a device MUST rotate which favourites occupy the slots across successive announces so all of them eventually see a tag. (Selection strategy is an implementation detail; convergence is not — see O2.) +- A device MUST NOT include a tag for a one-directional favourite, since that would disclose interest to someone who has not reciprocated. + +### 4.4 Strangers + +Nothing identifying is broadcast for strangers. Discovery still works: + +1. A hears an announce from unknown `peerID_e` advertising the rotation capability. +2. A initiates Noise **XX** to that ID. +3. In XX, the responder's static key is sent in message 2 *after* `ee`, and the initiator's in message 3 — both encrypted. A passive observer learns neither. +4. On completion, both sides learn the peer's real static key and fingerprint, exactly as they do today (`handleSessionEstablished`), and the existing `AuthenticatedPeerStatePacket` (Noise payload `0x21`) carries the Ed25519 signing key and capability claims *inside* the session, where they are proven rather than asserted. + +So the model becomes **handshake first, identify second**, for anyone who is not already a mutual favourite. + +### 4.5 The replacement binding + +Inside the completed handshake, each side proves that the rotating ID it was using belongs to its static key: + +``` +proof = Ed25519-Sign(signingPrivateKey, + "bitchat-peerid-binding-v1" + || uint32be(epoch) + || peerID_e (8 bytes) + || noiseStaticPublicKey (32 bytes)) +``` + +Sent as a new TLV in `AuthenticatedPeerStatePacket`, whose existing structure already carries a version byte, a canonicality-checked capability TLV, and the 32-byte signing key. The receiver verifies: + +- **that the `noiseStaticPublicKey` inside the proof is byte-equal to the remote static key the Noise session actually established** — see below, this one is load-bearing, and +- the signature against the signing key in the same packet, **and** +- that the signing key matches whatever it has already pinned for this fingerprint, using the existing trust ladder (authenticated key, then TOFU pin), and +- that `peerID_e` equals the ID the session was actually conducted under, and +- that `epoch` is within the ±1 window. + +An earlier draft of this list omitted the first check, which left a hole worth spelling out because it is the kind that survives review. The proof is a self-contained signed blob: nothing in the signature ties it to *the session it arrives on*. So a peer M who has observed A's proof — it travels inside a session, but M can be a peer A legitimately talked to — could replay A's proof verbatim inside M's own session with B. Without the static-key check, B verifies A's signature successfully, sees a well-formed binding, and on **first contact** TOFU-pins A's signing key against M's fingerprint. From then on B attributes M's identity to A's key. Comparing the proof's static key against the key the handshake actually produced closes it: M cannot substitute A's key without also being A. + +This replaces `authenticatedRemoteKey`'s derivation check with an explicit signed statement. With the static-key check present it is strictly stronger than today's self-signed announce, because the signing key is checked against a pin rather than taken from the same message. Without it, it is weaker — a reminder that "signed" and "bound to this conversation" are different properties. + +Note the canonical-bytes helper for this already half-exists: `NoiseEncryptionService.buildAnnounceSignature` / `verifyAnnounceSignature` / `canonicalAnnounceBytes`, with context `"bitchat-announce-v1"`, are present but unreferenced in production (only tests call them). They sign `context‖peerID(8)‖noiseKey(32)‖ed25519Key(32)‖nickname‖timestampMs`. The binding above is deliberately a **different context string** and a different field set, so the two can never be confused; the dead code should be deleted or repurposed explicitly rather than silently reused. + +### 4.6 The announce, before and after + +**Today** (`AnnouncementPacket`, TLVs in `Packets.swift:33-40`), all cleartext: + +| T | Field | Width | +|---|---|---| +| `0x01` | nickname | var | +| `0x02` | Noise static public key | 32 | +| `0x03` | Ed25519 signing public key | 32 | +| `0x04` | direct neighbours | N × 8, max 10 | +| `0x05` | capabilities | 1–8 | +| `0x06` | bridge geohash | var | + +`0x01`, `0x02`, `0x03` are **required** by the decoder (`Packets.swift:147`). + +**Proposed v2 announce.** Because the existing decoder hard-requires the three identity TLVs, a v2 announce cannot simply omit them — that is a parse failure, not a graceful degrade. It therefore needs a distinct message type: **`announceV2 = 0x2C`**. + +An earlier draft proposed `0x05` on the grounds that it is unassigned today and sits next to `announce = 0x01`. That was wrong. `0x05` has already been recycled twice — `announce`, then `bulkTransferResponse`, then `fragmentStart` until #446 — so a sufficiently old peer may still map it to a fragment header and misparse presence as a partial message. Values above `voiceFrame = 0x29` have only ever been allocated forward, which is the safe direction; `0x2A`/`0x2B` are spoken for by the courier spray-ack work, leaving `0x2C`. Verified never used anywhere in this repository's history (see O3). + +TLVs, all cleartext but none identifying: + +| T | Field | Width | Notes | +|---|---|---|---| +| `0x01` | epoch | 4 | `uint32be`; lets a receiver match without guessing | +| `0x02` | recognition tags | `TAG_SLOTS` × 8 = 64 | unordered, random-padded | +| `0x03` | capabilities | 1–8 | same minimal-LE encoding as today | +| `0x04` | bridge geohash | ≤12 | unchanged semantics | + +Deliberately absent: nickname, both public keys, neighbour list. + +Worth noting because it is counter-intuitive: **the v2 announce is smaller than the v1 announce**, despite carrying 64 bytes of tags. A v1 announce with a 10-byte nickname and a full neighbour list is roughly 165 payload bytes plus a 64-byte signature; a v2 announce is roughly 75 bytes and unsigned. Dropping two 32-byte keys, the neighbour list, and the signature more than pays for the tag block, so this reduces airtime rather than adding to it. + +- **Nickname** moves inside the session (`AuthenticatedPeerStatePacket`). A nickname is a self-chosen, often reused human label; broadcasting it in cleartext is a linkage vector on its own. +- **Neighbour list** is dropped entirely. It exists to seed source routing, and its documented fallback is flooding. Publishing the adjacency graph of a crowd is not a reasonable price for routing efficiency. (Dropping it is independently backward compatible — the TLV is optional on decode — and can ship ahead of this spec.) + +**The v2 announce is unsigned.** This is a real trade-off and needs review (O4). There is no key to verify a signature against without disclosing one, so a v2 announce asserts nothing except "somebody is here, and here are some tags". Consequences: + +- An attacker can emit v2 announces with arbitrary IDs and random tags — cheap peer-list noise. This is bounded by the existing announce rate limiting, per-central subscription limiting, and connection rate limits, but it is weaker than today. +- An attacker **cannot** impersonate a specific known peer, because it cannot compute that peer's recognition tags without one of the two private keys. +- An attacker cannot get a Noise session, so it cannot send messages, only occupy a peer-list slot. + +Mitigation for review: treat a v2 announce as *unverified presence* only, and do not surface it in the peer list until either a recognition tag matches or a handshake completes. That preserves today's property that the peer list reflects authenticated peers. + +## 5. Compatibility and rollout + +The repo already has the two mechanisms this needs, both proven in production. + +**Capability bit.** `PeerCapabilities` is a `UInt64` `OptionSet` with minimal little-endian wire encoding, at least one byte, so "no TLV" and "empty set" stay distinguishable. Crucially `BLEPeerRegistry.capabilitiesWereExplicitlyAdvertised(for:)` distinguishes *old client that sent no TLV* from *new client with the bit off*. Add `peerIDRotation` at the next free bit — **bit 14** at the time of writing: bit 10 is burned and MUST NOT be reused, bit 11 is claimed by the Nostr double-ratchet work (#1107), bit 12 by courier spray receipts (#1438), and bit 13 is reserved for stickers (#1544). Re-check the claim table in `PeerCapabilities.swift` before assigning; whichever platform implements first pins the number in a shared test vector. + +**Observed-version gating.** `MeshTopologyTracker.recordObservedVersion(_:for:)` records the highest protocol version seen from each node, and `computeRoute(…, requiringVersion:)` refuses paths through nodes not observed at that version. `docs/SOURCE_ROUTING.md` records this as the shipped pattern for a compatible rollout. The same shape applies here. + +**Phased plan.** + +| Phase | Behaviour | +|---|---| +| 1 | Both platforms ship the ability to **parse** v2 announces and advertise the capability, while still sending v1. Purely additive; a v2 announce from a test build is understood rather than dropped. | +| 2 | Send v1 **and** v2 announces, alternating. New clients prefer v2 and ignore the v1 from a peer they have recognised via v2; old clients see only the v1. Costs airtime, buys a no-flag-day transition. | +| 3 | Once telemetry-free judgement says adoption is sufficient, a setting (default on) suppresses v1 announces. A device that suppresses v1 becomes invisible to old clients — that is the intended cost of unlinkability, and it must be stated in the UI, not buried. | + +During phases 2–3 a device runs **both** a stable v1 ID and a rotating v2 ID. They must never appear as two peers; a peer recognised by both paths has to collapse to one entry. The repo has the beginnings of this in `MessageRouter.peerIDAliases` and `ChatPeerIdentityCoordinator.migrateChatState`, but they were built for panic-reset rotation, not steady-state rotation. + +## 6. Impact inventory + +This is what an implementer must handle. Every item below was verified against the iOS source; Android should expect its own equivalents. + +### 6.1 Must be fixed or the feature is broken + +| Area | Why | iOS reference | +|---|---|---| +| **Handshake identity check** | `authenticatedRemoteKey` re-derives the ID from the static key and fails for every peer once IDs are independent. Replace with §4.5. | `NoiseSessionManager.swift:1106-1122`, enforced `:714-718` | +| **Announce preflight** | Same derivation check rejects any announce whose ID is not the key's hash. | `BLEAnnounceHandlingPolicy.swift:32-35` | +| **Sealed message outbox** | Queued DM plaintext is keyed by peer ID on disk and survives app kill. A recipient's rotation orphans their queue. Needs re-keying by **fingerprint** (stable) with the peer ID as a lookup hint. This is the single worst offender. | `MessageOutboxStore.swift:66`, `:704-707`, `:746` | +| **Private-media durable IDs** | `stableID` hashes sender and recipient short IDs, and the durable receipt ledger keys accept/tombstone records on it. Rotation silently breaks dedup **and user deletion tombstones**, so deleted media could be re-accepted. | `BitchatFilePacket.swift:183-231`, `BLEPrivateMediaReceiptStore.swift` | +| **Initiator tie-break** | Crossed-initiation resolution compares `localPeerID < peerID`. Both sides must reach the same verdict; a rotation mid-negotiation flips it asymmetrically. Needs a rotation-stable comparison key (fingerprint). | `NoiseSessionManager.swift:83`, `:569`, `:582`, `:603` | +| **Fingerprint-prefix lookups** | Several paths recover a peer from `fingerprint.hasPrefix(peerID)`. These silently return empty, and one of them is what lets a public message from a not-yet-registered peer be accepted at all. | `SecureIdentityStateManager.swift:437-444`; `ChatGroupCoordinator.swift:98-102`, `:432`; `FavoritesPersistenceService.swift:188-195`; `BLEService.swift:2552`, `:2823` | +| **`PeerID.routingData`** | Falls back to `toShort()`, i.e. fingerprint-derived routing bytes. | `PeerID.swift:190-202` | + +### 6.2 Degrades gracefully but needs handling + +| Area | Effect | iOS reference | +|---|---|---| +| **Noise sessions** | A rotation mid-session leaves an established session under the old ID. Rotation should either be deferred while sessions are live or migrate them explicitly. | `NoiseEncryptionService.swift:1010-1019` | +| **Fragment reassembly** | The reassembly key mixes the 8-byte sender ID, so a rotation mid-transfer strands every in-flight assembly until the 30 s timeout. Defer rotation while fragments are in flight. | `BLEFragmentAssemblyBuffer.swift:4-47` | +| **Dedup LRU** | Keys embed the sender ID, so the same packet crossing a rotation boundary can be reprocessed once. Bounded and probably acceptable. | `BLEReceivePipeline.swift:21` | +| **Source routes / topology** | A remote rotation invalidates cached adjacency, and a rotated relay no longer finds itself in an in-flight v2 route, falling back to flooding. Already the documented fallback. | `MeshTopologyTracker.swift`, `BLERouteForwardingPolicy.swift:62` | +| **Gossip archive** | Archived raw packets keep the old sender ID forever, and packet IDs are sender-derived, so attribution and purge-by-peer break for pre-rotation history. | `GossipMessageArchive.swift`, `PacketIdUtil.swift:8-17` | +| **Read receipts** | The wire receipt carries an 8-byte `readerID`; one sent before and matched after a rotation will not correlate. | `ReadReceipt.swift:47-64` | + +### 6.3 Already safe — no work needed + +Keyed by fingerprint, Noise key, or Ed25519 key rather than peer ID: the identity cache and every map in it (social identities, verified fingerprints, vouches, blocks), favourites (keyed by Noise static key), courier envelopes and recipient tags, prekey bundles, board posts, bridge drop dedup, group rosters, vouch attestations, and all geohash/location state (keyed by Nostr pubkey). Peer registry, link state, and all Noise session maps are in-memory and session-scoped. + +## 7. Test vectors + +These live as assertions in `PeerIDRotationTests.swift`, so they run on every build rather than rotting in a table. + +All three were **cross-checked against an independent implementation written from this document alone** — Python `hmac`/`hashlib`, HKDF as extract-then-expand with an empty salt — and matched byte for byte. That is the property that matters: the spec text is sufficient to reproduce the numbers without reading the Swift. + +With `noiseStaticPrivateKey = 0102…20` (bytes 1 through 32): + +``` +rotationSecret = HKDF-SHA256(ikm: 0102…20, salt: , + info: "bitchat-peer-rotation-v1", len: 32) + = fb82dfec0c0a2a4677beca44e2f72c80e7c5de773dd5fce6ee47af83d3c25f09 + +peerID(epoch=100) = HMAC-SHA256(rotationSecret, + "bitchat-peer-id-v2" || uint32be(100))[0..8] + = f7c08c528506a374 +``` + +With a recognition key derived from a shared secret of 32 × `0x42`, sender key +32 × `0x0A`, recipient key 32 × `0x0B`, and announced ID 8 × `0xA1`: + +``` +recognitionKey = HKDF-SHA256(ikm: 42×32, salt: , + info: "bitchat-recognition-v1", len: 32) + +tag_A→B(epoch=100) = HMAC-SHA256(recognitionKey, + uint32be(100) || 0A×32 || 0B×32 || A1×8)[0..8] + = 4568f61d61d6cbfb + +tag_B→A(epoch=100) (same key, keys swapped) + = 5313c7731f629959 +``` + +Both directions are given because their *difference* is the security property: if +an implementation produces the same value for both, it has reintroduced the +symmetric-tag flaw. + +Also asserted, and worth reproducing on Android because they are the properties rather than the numbers: both sides of a real X25519 pair derive the identical tag from opposite key halves; consecutive epochs produce unrelated IDs; the ±1 epoch window matches across a boundary but two epochs out does not; the tag block is always 64 bytes regardless of how many tags it carries; a match is found regardless of slot position; and the binding message is fixed-width so a short input cannot shift a later field into an earlier field's position. + +Still to be written jointly: a full `announceV2` packet as a hex blob, and the §4.5 signature over a fixed key. Whichever platform writes a vector, the other MUST reproduce it from this document rather than from the first platform's code. + +## 8. Open questions for review + +- **O1 — Rotation period.** One hour is a guess balancing unlinkability against churn. Shorter means less linkable and more session/route disruption; longer the reverse. Is there a period that is clearly right, or should it be a build constant both platforms pin? +- **O2 — More than `TAG_SLOTS` favourites.** What is the required convergence guarantee — "every mutual favourite sees a tag within N announces"? Should the slot rotation be deterministic from the epoch so it is testable? +- **O3 — New message type vs. announce version byte.** A distinct `MessageType` is cleanest given the decoder's required TLVs, but it consumes a type value and means two announce paths. Would a version TLV inside the existing type, with the identity TLVs made optional on both platforms first, be preferable? +- **O4 — Unsigned v2 announces.** Binding tags to the announced peer ID removes impersonation-as-any-ID, but a recorded announce can still be rebroadcast verbatim within the epoch window, so a peer can be made to look present when absent. Is "presence is a hint; nothing consequential until a handshake whose static key matches the favourite that produced the match" acceptable? The alternatives are an ephemeral per-epoch signing key with a proof-of-continuity, or a freshness nonce echoed by the recipient — both more machinery and more bytes. +- **O5 — Rotation while a session is live.** Defer rotation until sessions are idle, or rotate and migrate? Deferring is simpler and safer, but a long-lived session pins the ID for its lifetime, which weakens G1 for exactly the people who talk most. +- **O6 — Nickname timing.** Moving the nickname into the session means a stranger's name appears only after a handshake. Is that acceptable UX on both platforms, or does the peer list need a "someone nearby" placeholder state? +- **O7 — Padding is a coordinated change, not a local one.** This started as a question about decoder tolerance and turned into something firmer. `BitchatPacket.toBinaryDataForSigning()` encodes with padding enabled, so **the padding bytes are inside the signed material for every signed packet**. Changing the padding algorithm therefore changes the signed byte stream, and signatures stop verifying against any peer that has not made the identical change. Both outstanding padding fixes are affected: extending coverage beyond `noiseEncrypted`/`noiseHandshake`, and closing the gap where a frame needing more than 255 bytes of padding is emitted unpadded (encoded *frames* of 241–256, 497–768 and 1009–1792 bytes ship at exact length today — the arithmetic is over the whole encoded packet that `pad` receives, not the payload alone). Two things to settle: whether Android's decoder also tolerates trailing bytes the way iOS's does (`guard offset <= buf.count`, plus an unpad retry), and whether padding changes ride this protocol revision or get their own capability-gated one. + +- **O9 — A seized device recomputes every past peer ID.** `K_rot` is a long-lived secret, so `peerID_e = HMAC(K_rot, epoch)` is computable for *any* epoch by whoever holds it. Someone who seizes a phone, or extracts the Noise static key from a backup, can therefore take historical radio captures and identify which of them were this device — retroactively defeating the unlinkability for every past epoch. Rotation protects against the passive observer, not against later key compromise. A hash ratchet (`K_{e+1} = HKDF(K_e)`, discarding `K_e`) would give forward secrecy for the ID stream, at the cost of state that must survive restarts, tolerate clock jumps, and resynchronise after a gap — none of which is free, and all of which interacts with the ±1 window. Worth deciding deliberately rather than inheriting. + +## 9. Relationship to other work + +Rotation is the largest item in the radio-layer metadata cluster but not the only one, and the others are cheaper: + +- **Drop the neighbour list** and **randomize origin TTL** — both landed separately, since neither needs agreement: see the radio-metadata PR. +- **Extend padding beyond Noise frames, and fix the length-marker gap** — only `noiseEncrypted` and `noiseHandshake` are padded, and `pad` silently declines when the required padding exceeds the single-byte marker, so frames well below their bucket ship unpadded. **Not unilateral**: padding is inside the signed bytes, so this needs both platforms. See O7. + +None of these substitute for rotation, and rotation does not substitute for them: a device with a rotating ID that still publishes its neighbour list, or that still marks its own originated packets by TTL, remains linkable. diff --git a/localPackages/BitFoundation/Sources/BitFoundation/AnnounceV2Packet.swift b/localPackages/BitFoundation/Sources/BitFoundation/AnnounceV2Packet.swift new file mode 100644 index 00000000..0bee3e6f --- /dev/null +++ b/localPackages/BitFoundation/Sources/BitFoundation/AnnounceV2Packet.swift @@ -0,0 +1,158 @@ +// +// AnnounceV2Packet.swift +// BitFoundation +// +// This is free and unencumbered software released into the public domain. +// For more information, see +// + +import Foundation + +/// Identity-free presence announcement for rotating peer IDs. +/// +/// The v1 `AnnouncementPacket` broadcasts, in cleartext, every 4–30 seconds: the +/// nickname, the 32-byte Noise static public key, the 32-byte Ed25519 signing +/// key, and up to ten neighbour IDs. That is a permanent device fingerprint plus +/// the local social graph, free to anyone in radio range. This carries none of +/// it — only an epoch, a fixed-size block of pairwise recognition tags, and +/// capability bits. +/// +/// Deliberately absent, with reasons: +/// - **Public keys**: they are the linkage. Peers learn them inside the Noise XX +/// handshake, where they are already encrypted on the wire. +/// - **Nickname**: a self-chosen, frequently reused human label. It moves into +/// the session (`AuthenticatedPeerStatePacket`). +/// - **Neighbour list**: it seeds source routing, whose documented fallback is +/// flooding. Publishing a crowd's adjacency graph is not a reasonable price +/// for routing efficiency. +/// +/// **Unsigned, on purpose and not without cost.** There is no key to verify a +/// signature against without disclosing one, so this asserts only "somebody is +/// here, and here are some tags". An attacker can therefore emit noise — bounded +/// by existing announce and connection rate limits — but cannot impersonate a +/// specific peer, because forging a recognition tag needs one of the two private +/// keys, and cannot send anything without completing a handshake. The intended +/// posture is to treat a v2 announce as *unverified presence* and not surface it +/// until a tag matches or a handshake completes. See open question O4 in +/// `docs/PEER-ID-ROTATION.md`. +/// +/// Not emitted or consumed by the shipping mesh yet. +// periphery:ignore - intentionally unreferenced by production code; nothing +// emits or consumes this type yet, and BLEService parses it only to ignore it. +// Delete this annotation when the mesh starts using it. +public struct AnnounceV2Packet: Equatable, Sendable { + /// Rotation epoch this announce was built for. Carried explicitly so a + /// receiver matches against a stated epoch instead of guessing. + public let epoch: UInt32 + /// Exactly `PeerIDRotation.tagSlots * PeerIDRotation.idLength` bytes. + public let tagBlock: Data + public let capabilities: PeerCapabilities? + /// Coarse rendezvous cell, when bridging. Same semantics as v1. + public let bridgeGeohash: String? + + public init( + epoch: UInt32, + tagBlock: Data, + capabilities: PeerCapabilities? = nil, + bridgeGeohash: String? = nil + ) { + self.epoch = epoch + self.tagBlock = tagBlock + self.capabilities = capabilities + self.bridgeGeohash = bridgeGeohash + } + + private enum TLVType: UInt8 { + case epoch = 0x01 + case tagBlock = 0x02 + case capabilities = 0x03 + case bridgeGeohash = 0x04 + } + + /// Expected tag-block width. A fixed size is load-bearing: it hides how many + /// mutual favourites a device has. + public static var tagBlockLength: Int { + PeerIDRotation.tagSlots * PeerIDRotation.idLength + } + + public func encode() -> Data? { + guard tagBlock.count == Self.tagBlockLength else { return nil } + + var data = Data() + + data.append(TLVType.epoch.rawValue) + data.append(UInt8(4)) + withUnsafeBytes(of: epoch.bigEndian) { data.append(contentsOf: $0) } + + data.append(TLVType.tagBlock.rawValue) + data.append(UInt8(tagBlock.count)) + data.append(tagBlock) + + if let capabilities { + let bytes = capabilities.encoded() + guard bytes.count <= 255 else { return nil } + data.append(TLVType.capabilities.rawValue) + data.append(UInt8(bytes.count)) + data.append(bytes) + } + + if let bridgeGeohash, !bridgeGeohash.isEmpty { + let bytes = Data(bridgeGeohash.utf8) + guard bytes.count <= 12 else { return nil } + data.append(TLVType.bridgeGeohash.rawValue) + data.append(UInt8(bytes.count)) + data.append(bytes) + } + + return data + } + + public static func decode(from data: Data) -> AnnounceV2Packet? { + var epoch: UInt32? + var tagBlock: Data? + var capabilities: PeerCapabilities? + var bridgeGeohash: String? + + var offset = data.startIndex + while offset < data.endIndex { + guard data.distance(from: offset, to: data.endIndex) >= 2 else { return nil } + let rawType = data[offset] + let length = Int(data[data.index(after: offset)]) + let valueStart = data.index(offset, offsetBy: 2) + guard data.distance(from: valueStart, to: data.endIndex) >= length else { return nil } + let value = data.subdata(in: valueStart.. +// + +import Foundation +private import CryptoKit + +/// Derivations for rotating peer IDs and pairwise recognition tags. +/// +/// See `docs/PEER-ID-ROTATION.md` for the design, the threat model, and the +/// open questions. This type is the executable half of that document: it is +/// deliberately pure (no I/O, no clock of its own, no dependency on the BLE +/// stack) so both platforms can agree on the numbers before anyone wires it +/// into a transport. +/// +/// Nothing here is used by the shipping mesh yet. +/// +/// ## Why the derivations look like this +/// +/// The rotating ID comes from **private** key material. Deriving it from the +/// public key would let anyone who has ever seen that key compute every past +/// and future ID, which is worse than not rotating because it would look like +/// protection. The same mistake is live in `CourierEnvelope.recipientTag`, +/// which is keyed on the recipient's *public* static key — and since that key +/// is broadcast in cleartext in every announce today, any observer in radio +/// range can compute a peer's courier tags for any day. +/// +/// Recognition tags come from the X25519 shared secret between two static +/// keys, so exactly two parties can compute a given tag and an observer can +/// compute none of them. +// periphery:ignore - intentionally unreferenced by production code. These are +// the reviewable primitives for a protocol change that cannot ship until both +// platforms agree on it; wiring them into the transport is the next step, not +// this one. Delete this annotation when the mesh starts using them. +public enum PeerIDRotation { + // MARK: - Parameters + + /// Seconds per rotation epoch. One hour is a starting position, not a + /// settled one: shorter is less linkable but churns sessions, routes, and + /// in-flight fragment reassembly more often. See open question O1. + public static let rotationPeriod: TimeInterval = 3600 + + /// Bytes of an ID or tag placed on the wire. Matches the existing 8-byte + /// header sender ID, so the packet layout is unchanged. + public static let idLength = 8 + + /// Fixed number of tag slots in an announce. Padding to a constant hides + /// how many mutual favourites a device has, which is itself identifying. + public static let tagSlots = 8 + + // MARK: - Context strings + // + // Distinct per use so a value derived for one purpose can never be + // substituted for another. `bitchat-announce-v1` is deliberately NOT reused: + // it belongs to the production-dead announce-signature helpers in + // NoiseEncryptionService, and confusing the two would be a real bug. + + private static let rotationInfo = Data("bitchat-peer-rotation-v1".utf8) + private static let peerIDContext = Data("bitchat-peer-id-v2".utf8) + private static let recognitionInfo = Data("bitchat-recognition-v1".utf8) + private static let bindingContext = Data("bitchat-peerid-binding-v1".utf8) + + // MARK: - Epochs + + /// Epoch number for a point in time. Wall-clock derived so two devices that + /// have never met agree on the current epoch without negotiating. + public static func epoch(at date: Date) -> UInt32 { + let seconds = max(0, date.timeIntervalSince1970) + return UInt32(truncatingIfNeeded: Int(seconds / rotationPeriod)) + } + + /// Epochs to test when matching, oldest first. + /// + /// The ±1 window absorbs clock skew and the moment either side crosses a + /// boundary, mirroring `CourierEnvelope.candidateTags`. Without it, two + /// devices a few seconds apart across a boundary would fail to recognise + /// each other for no reason a person could understand. + public static func candidateEpochs(around date: Date) -> [UInt32] { + let current = epoch(at: date) + return current == 0 ? [0, 1] : [current - 1, current, current + 1] + } + + // MARK: - Rotating peer ID + + /// Long-lived rotation secret for this device. Derived from the Noise + /// static **private** key, so it never leaves the device and no observer + /// can predict any ID it produces. + public static func rotationSecret(noiseStaticPrivateKey: Data) -> Data { + let derived = HKDF.deriveKey( + inputKeyMaterial: SymmetricKey(data: noiseStaticPrivateKey), + info: rotationInfo, + outputByteCount: 32 + ) + return derived.withUnsafeBytes { Data($0) } + } + + /// This device's peer ID for a given epoch. + public static func peerID(rotationSecret: Data, epoch: UInt32) -> Data { + var message = peerIDContext + message.append(bigEndianBytes(epoch)) + let mac = HMAC.authenticationCode( + for: message, + using: SymmetricKey(data: rotationSecret) + ) + return Data(mac).prefix(idLength) + } + + /// Convenience: the ID this device should be using at `date`. + public static func currentPeerID(noiseStaticPrivateKey: Data, at date: Date) -> Data { + peerID( + rotationSecret: rotationSecret(noiseStaticPrivateKey: noiseStaticPrivateKey), + epoch: epoch(at: date) + ) + } + + // MARK: - Pairwise recognition tags + + /// Symmetric recognition key for a pair, from their X25519 shared secret. + /// + /// Both sides compute the identical value from opposite key halves, which + /// is the whole point: recognition needs no round trip, and no third party + /// can derive it. + public static func recognitionKey(sharedSecret: Data) -> Data { + let derived = HKDF.deriveKey( + inputKeyMaterial: SymmetricKey(data: sharedSecret), + info: recognitionInfo, + outputByteCount: 32 + ) + return derived.withUnsafeBytes { Data($0) } + } + + /// The tag `sender` puts in its announce for `recipient` this epoch. + /// + /// Three inputs beyond the epoch, each load-bearing: + /// + /// - **Ordered keys make the tag directional.** An earlier draft used + /// `HMAC(K_AB, epoch)`, which is symmetric — so A and B broadcast the + /// *same* 8 bytes, and an observer who spots one value in two different + /// announces learns those two devices are mutual favourites and can link + /// their rotating IDs to each other. That hands over exactly the social + /// graph this design exists to hide. Ordering the keys gives A→B and B→A + /// distinct values; both parties can still compute both directions, + /// because both hold both public keys. + /// - **`peerID` binds the tag to the announce carrying it.** Without it the + /// tag depends only on (pair, epoch), so an attacker could lift a tag out + /// of A's announce and replay it under an ID of their choosing; the + /// recipient would match and believe that ID is A. Binding means a lifted + /// tag is only valid alongside A's own ID, which reduces the attack from + /// impersonation-as-any-ID to replaying A's presence. + /// + /// Replaying A's own announce within the epoch window remains possible — + /// unsigned announces cannot prevent it. Recognition is therefore a hint + /// only, and anything consequential must wait for a completed handshake. + /// See open question O4. + public static func recognitionTag( + recognitionKey: Data, + epoch: UInt32, + senderStaticPublicKey: Data, + recipientStaticPublicKey: Data, + peerID: Data + ) -> Data { + var message = bigEndianBytes(epoch) + message.append(fixedWidth(senderStaticPublicKey, 32)) + message.append(fixedWidth(recipientStaticPublicKey, 32)) + message.append(fixedWidth(peerID, idLength)) + let mac = HMAC.authenticationCode( + for: message, + using: SymmetricKey(data: recognitionKey) + ) + return Data(mac).prefix(idLength) + } + + // MARK: - Tag block + + /// Packs tags into the fixed-size announce block, padding with uniform + /// random bytes. + /// + /// Random padding is indistinguishable from a real tag to anyone who cannot + /// compute the real ones, so the block discloses neither how many mutual + /// favourites a device has nor which slot belongs to whom. Tags beyond + /// `tagSlots` are dropped here; choosing *which* to carry across successive + /// announces is the caller's problem (open question O2). + public static func tagBlock( + tags: [Data], + randomBytes: (Int) -> Data = Self.secureRandomBytes + ) -> Data { + var slots = tags.prefix(tagSlots).map { $0.prefix(idLength) } + // Order must carry no information, so shuffle rather than appending + // real tags at the front. + slots.shuffle() + var block = Data() + for slot in slots { + block.append(slot) + if slot.count < idLength { + block.append(Data(repeating: 0, count: idLength - slot.count)) + } + } + let padding = (tagSlots - slots.count) * idLength + if padding > 0 { + block.append(randomBytes(padding)) + } + return block + } + + /// Splits a received block back into candidate tags. + /// + /// Returns nil for a block that is not exactly `tagSlots * idLength`, so a + /// malformed announce is rejected rather than partially interpreted. + public static func tags(fromBlock block: Data) -> [Data]? { + guard block.count == tagSlots * idLength else { return nil } + return stride(from: 0, to: block.count, by: idLength).map { + block.subdata(in: (block.startIndex + $0)..<(block.startIndex + $0 + idLength)) + } + } + + /// Whether any slot in `block` holds the tag we expect a specific peer to + /// have put there, for an announce carrying `peerID`. + /// + /// `senderStaticPublicKey` is the peer we hope sent this (so we compute the + /// direction they would use) and `recipientStaticPublicKey` is our own. + /// Passing them the other way round tests the opposite direction and will + /// not match, which is the point of making tags directional. + /// + /// Comparison is constant-time per candidate, and every slot is examined + /// even after a match, so neither the presence of a match nor its slot + /// index is observable through timing. + public static func blockMatches( + _ block: Data, + recognitionKey: Data, + senderStaticPublicKey: Data, + recipientStaticPublicKey: Data, + peerID: Data, + at date: Date + ) -> Bool { + guard let slots = tags(fromBlock: block) else { return false } + let expected = candidateEpochs(around: date).map { + recognitionTag( + recognitionKey: recognitionKey, + epoch: $0, + senderStaticPublicKey: senderStaticPublicKey, + recipientStaticPublicKey: recipientStaticPublicKey, + peerID: peerID + ) + } + var matched = false + for slot in slots { + for candidate in expected where constantTimeEquals(slot, candidate) { + matched = true + } + } + return matched + } + + // MARK: - Identity binding + + /// Canonical bytes proving a rotating ID belongs to a static key. + /// + /// Signed with the Ed25519 identity key and exchanged **inside** a + /// completed Noise session, this replaces the derivation check that today + /// makes peer IDs unforgeable (`peerID == SHA-256(staticKey)[0..8]`, checked + /// in the announce preflight and again at handshake completion). Once IDs + /// are independent of the key, those checks fail for every peer, so a + /// replacement has to exist before rotation can ship. + /// + /// Fixed-width fields throughout: no length prefixes are needed and no two + /// distinct inputs can produce the same bytes. + public static func bindingMessage( + epoch: UInt32, + peerID: Data, + noiseStaticPublicKey: Data + ) -> Data { + var out = bindingContext + out.append(bigEndianBytes(epoch)) + out.append(fixedWidth(peerID, idLength)) + out.append(fixedWidth(noiseStaticPublicKey, 32)) + return out + } + + // MARK: - Helpers + + /// Padding must be indistinguishable from a real tag, so it comes from the + /// system CSPRNG via key generation rather than a general-purpose RNG. + public static func secureRandomBytes(_ count: Int) -> Data { + guard count > 0 else { return Data() } + let key = SymmetricKey(size: SymmetricKeySize(bitCount: count * 8)) + return key.withUnsafeBytes { Data($0) } + } + + private static func bigEndianBytes(_ value: UInt32) -> Data { + withUnsafeBytes(of: value.bigEndian) { Data($0) } + } + + private static func fixedWidth(_ data: Data, _ width: Int) -> Data { + var out = data.prefix(width) + if out.count < width { + out.append(Data(repeating: 0, count: width - out.count)) + } + return Data(out) + } + + /// Length-independent comparison, so a match cannot be found byte by byte + /// through timing. + private static func constantTimeEquals(_ lhs: Data, _ rhs: Data) -> Bool { + guard lhs.count == rhs.count else { return false } + var difference: UInt8 = 0 + for (left, right) in zip(lhs, rhs) { + difference |= left ^ right + } + return difference == 0 + } +} diff --git a/localPackages/BitFoundation/Tests/BitFoundationTests/AnnounceV2PacketTests.swift b/localPackages/BitFoundation/Tests/BitFoundationTests/AnnounceV2PacketTests.swift new file mode 100644 index 00000000..e7653463 --- /dev/null +++ b/localPackages/BitFoundation/Tests/BitFoundationTests/AnnounceV2PacketTests.swift @@ -0,0 +1,159 @@ +import Foundation +import Testing +@testable import BitFoundation + +/// Wire-format tests for the identity-free announce. These are the second half +/// of the cross-platform contract: Android must encode and decode byte-identical +/// packets, so anything asserted here is a promise, not an implementation detail. +struct AnnounceV2PacketTests { + private var block: Data { + Data(repeating: 0xAB, count: AnnounceV2Packet.tagBlockLength) + } + + @Test func typeValueIsStable() { + // Changing this breaks every deployed decoder. + // + // Deliberately NOT 0x05, which merely looks free: it has been recycled + // twice already (announce, then bulkTransferResponse, then fragmentStart + // until #446), so an old peer could still map it to a fragment header + // and misparse presence as a partial message. Values above + // voiceFrame = 0x29 have only ever been allocated forward; 0x2A/0x2B + // belong to the courier spray-ack work. + #expect(MessageType.announceV2.rawValue == 0x2C) + #expect(MessageType(rawValue: 0x2C) == .announceV2) + #expect(MessageType.announceV2.description == "announceV2") + } + + @Test func tagBlockIsSixtyFourBytes() { + #expect(AnnounceV2Packet.tagBlockLength == 64) + } + + @Test func roundTripsWithEveryField() throws { + let packet = AnnounceV2Packet( + epoch: 495_555, + tagBlock: block, + capabilities: [.bridge, .prekeys], + bridgeGeohash: "u4pruy" + ) + let encoded = try #require(packet.encode()) + let decoded = try #require(AnnounceV2Packet.decode(from: encoded)) + #expect(decoded == packet) + } + + @Test func roundTripsWithOnlyRequiredFields() throws { + let packet = AnnounceV2Packet(epoch: 0, tagBlock: block) + let encoded = try #require(packet.encode()) + let decoded = try #require(AnnounceV2Packet.decode(from: encoded)) + #expect(decoded == packet) + #expect(decoded.capabilities == nil) + #expect(decoded.bridgeGeohash == nil) + } + + @Test func epochIsBigEndianOnTheWire() throws { + let encoded = try #require(AnnounceV2Packet(epoch: 0x0102_0304, tagBlock: block).encode()) + // TLV 0x01, length 4, then the epoch most-significant byte first. + #expect(Array(encoded.prefix(6)) == [0x01, 0x04, 0x01, 0x02, 0x03, 0x04]) + } + + /// The whole point of the format: none of the identifying v1 fields appear. + @Test func encodingCarriesNoIdentity() throws { + let noiseKey = Data(repeating: 0x11, count: 32) + let signingKey = Data(repeating: 0x22, count: 32) + let nickname = Data("alice".utf8) + + let encoded = try #require( + AnnounceV2Packet( + epoch: 100, + tagBlock: block, + capabilities: [.bridge], + bridgeGeohash: "u4pruy" + ).encode() + ) + + #expect(!encoded.contains(noiseKey)) + #expect(!encoded.contains(signingKey)) + #expect(encoded.range(of: nickname) == nil) + } + + @Test func encodingIsSmallerThanAV1Announce() throws { + let v2 = try #require( + AnnounceV2Packet(epoch: 100, tagBlock: block, capabilities: [.bridge]).encode() + ) + // v1 with a 10-byte nickname and a full neighbour list, before its + // 64-byte signature: nickname 12 + noise 34 + signing 34 + neighbours 82 + // + capabilities 3. + let v1PayloadEstimate = 12 + 34 + 34 + 82 + 3 + #expect(v2.count < v1PayloadEstimate) + } + + // MARK: - Rejection + + @Test func encodeRejectsAWrongWidthTagBlock() { + // A short block would disclose the favourite count, so it must never go + // on the wire. + #expect(AnnounceV2Packet(epoch: 1, tagBlock: Data(repeating: 0, count: 63)).encode() == nil) + #expect(AnnounceV2Packet(epoch: 1, tagBlock: Data(repeating: 0, count: 65)).encode() == nil) + #expect(AnnounceV2Packet(epoch: 1, tagBlock: Data()).encode() == nil) + } + + @Test func encodeRejectsAnOversizedGeohash() { + #expect(AnnounceV2Packet( + epoch: 1, + tagBlock: block, + bridgeGeohash: String(repeating: "u", count: 13) + ).encode() == nil) + } + + @Test func decodeRequiresEpochAndTagBlock() throws { + // Capabilities alone is not a valid announce. + var onlyCapabilities = Data([0x03, 0x01]) + onlyCapabilities.append(PeerCapabilities([.bridge]).encoded()) + #expect(AnnounceV2Packet.decode(from: onlyCapabilities) == nil) + + // Epoch without a tag block is not either. + let onlyEpoch = Data([0x01, 0x04, 0x00, 0x00, 0x00, 0x64]) + #expect(AnnounceV2Packet.decode(from: onlyEpoch) == nil) + } + + @Test func decodeRejectsTruncatedAndMalformedInput() { + #expect(AnnounceV2Packet.decode(from: Data()) == nil) + // Declares 4 bytes, supplies 2. + #expect(AnnounceV2Packet.decode(from: Data([0x01, 0x04, 0x00, 0x00])) == nil) + // Dangling type byte with no length. + #expect(AnnounceV2Packet.decode(from: Data([0x01])) == nil) + // Wrong epoch width. + #expect(AnnounceV2Packet.decode(from: Data([0x01, 0x02, 0x00, 0x64])) == nil) + } + + @Test func decodeRejectsAWrongWidthTagBlock() { + var data = Data([0x01, 0x04, 0x00, 0x00, 0x00, 0x64]) + data.append(0x02) + data.append(UInt8(63)) + data.append(Data(repeating: 0xAB, count: 63)) + #expect(AnnounceV2Packet.decode(from: data) == nil) + } + + @Test func decodeRejectsNonCanonicalCapabilities() throws { + // Same capability set, non-minimal encoding: it must not be accepted, or + // one set could travel as several distinct byte strings. + var data = Data([0x01, 0x04, 0x00, 0x00, 0x00, 0x64]) + data.append(0x02) + data.append(UInt8(AnnounceV2Packet.tagBlockLength)) + data.append(block) + data.append(0x03) + data.append(UInt8(3)) + data.append(Data([0x80, 0x00, 0x00])) // trailing zero bytes are non-minimal + #expect(AnnounceV2Packet.decode(from: data) == nil) + } + + @Test func unknownTLVsAreSkippedForForwardCompatibility() throws { + var data = try #require(AnnounceV2Packet(epoch: 100, tagBlock: block).encode()) + data.append(0x7F) // a type this build has never heard of + data.append(UInt8(3)) + data.append(Data([0x01, 0x02, 0x03])) + + let decoded = try #require(AnnounceV2Packet.decode(from: data)) + #expect(decoded.epoch == 100) + #expect(decoded.tagBlock == block) + } +} diff --git a/localPackages/BitFoundation/Tests/BitFoundationTests/PeerIDRotationTests.swift b/localPackages/BitFoundation/Tests/BitFoundationTests/PeerIDRotationTests.swift new file mode 100644 index 00000000..434d08f3 --- /dev/null +++ b/localPackages/BitFoundation/Tests/BitFoundationTests/PeerIDRotationTests.swift @@ -0,0 +1,408 @@ +import Foundation +import Testing +import CryptoKit +@testable import BitFoundation + +/// Executable test vectors for peer ID rotation. +/// +/// These are the numbers the Android implementation must reproduce. Two rules +/// for keeping them useful: +/// +/// 1. **Reproduce them from `docs/PEER-ID-ROTATION.md`, not from this code.** +/// Deriving the expected values by reading the other platform's +/// implementation proves only that both share a bug. +/// 2. **If a derivation changes, the hex here changes too, deliberately.** A +/// vector that gets "fixed" to match new behavior has stopped being a vector. +/// +/// The three `VECTOR:` values below were cross-checked against an independent +/// HKDF/HMAC implementation written from the specification alone (Python +/// `hmac`/`hashlib`, empty salt, extract-then-expand) and matched byte for byte. +/// So the spec text is sufficient to reproduce them without reading this code — +/// which is the property Android needs. +struct PeerIDRotationTests { + // A fixed, obviously-fake private key so the vectors are stable. + private let staticPrivateA = Data((0..<32).map { UInt8($0 + 1) }) // 01..20 + private let staticPrivateB = Data((0..<32).map { UInt8(0xA0 &+ $0) }) // a0..bf + + private func hex(_ data: Data) -> String { + data.map { String(format: "%02x", $0) }.joined() + } + + // MARK: - Epochs + + @Test func epochIsWallClockDivision() { + #expect(PeerIDRotation.rotationPeriod == 3600) + #expect(PeerIDRotation.epoch(at: Date(timeIntervalSince1970: 0)) == 0) + #expect(PeerIDRotation.epoch(at: Date(timeIntervalSince1970: 3599)) == 0) + #expect(PeerIDRotation.epoch(at: Date(timeIntervalSince1970: 3600)) == 1) + // 2026-07-26T00:00:00Z + #expect(PeerIDRotation.epoch(at: Date(timeIntervalSince1970: 1_784_000_000)) == 495_555) + } + + @Test func candidateEpochsCoverTheBoundaryBothWays() { + // Two devices seconds apart across a boundary must still recognise each + // other, so the window spans the neighbouring epochs. + let date = Date(timeIntervalSince1970: 3600 * 100) + #expect(PeerIDRotation.candidateEpochs(around: date) == [99, 100, 101]) + } + + @Test func candidateEpochsDoNotUnderflowAtTheOrigin() { + // UInt32 underflow here would produce 4294967295 and break matching. + #expect(PeerIDRotation.candidateEpochs(around: Date(timeIntervalSince1970: 0)) == [0, 1]) + } + + // MARK: - Rotating peer ID + + @Test func rotationSecretIsStableForAKey() { + let first = PeerIDRotation.rotationSecret(noiseStaticPrivateKey: staticPrivateA) + let second = PeerIDRotation.rotationSecret(noiseStaticPrivateKey: staticPrivateA) + #expect(first == second) + #expect(first.count == 32) + // VECTOR: HKDF-SHA256(ikm: 01..20, salt: empty, info: "bitchat-peer-rotation-v1", 32) + #expect(hex(first) == "fb82dfec0c0a2a4677beca44e2f72c80e7c5de773dd5fce6ee47af83d3c25f09") + } + + @Test func peerIDIsEightBytesAndEpochDependent() { + let secret = PeerIDRotation.rotationSecret(noiseStaticPrivateKey: staticPrivateA) + let a = PeerIDRotation.peerID(rotationSecret: secret, epoch: 100) + let b = PeerIDRotation.peerID(rotationSecret: secret, epoch: 101) + + #expect(a.count == PeerIDRotation.idLength) + #expect(b.count == PeerIDRotation.idLength) + // VECTOR: HMAC-SHA256(rotationSecret, "bitchat-peer-id-v2" || uint32be(100))[0..8] + #expect(hex(a) == "f7c08c528506a374") + // The whole point: consecutive epochs are unrelated to an observer. + #expect(a != b) + // Deterministic within an epoch, so a restart keeps the same ID. + #expect(a == PeerIDRotation.peerID(rotationSecret: secret, epoch: 100)) + } + + @Test func peerIDDiffersBetweenDevices() { + let secretA = PeerIDRotation.rotationSecret(noiseStaticPrivateKey: staticPrivateA) + let secretB = PeerIDRotation.rotationSecret(noiseStaticPrivateKey: staticPrivateB) + #expect(PeerIDRotation.peerID(rotationSecret: secretA, epoch: 100) + != PeerIDRotation.peerID(rotationSecret: secretB, epoch: 100)) + } + + @Test func currentPeerIDMatchesTheExplicitEpochForm() { + let date = Date(timeIntervalSince1970: 3600 * 100 + 17) + let viaConvenience = PeerIDRotation.currentPeerID( + noiseStaticPrivateKey: staticPrivateA, + at: date + ) + let viaParts = PeerIDRotation.peerID( + rotationSecret: PeerIDRotation.rotationSecret(noiseStaticPrivateKey: staticPrivateA), + epoch: 100 + ) + #expect(viaConvenience == viaParts) + } + + // MARK: - Recognition tags + + private var pubA: Data { Data(repeating: 0x0A, count: 32) } + private var pubB: Data { Data(repeating: 0x0B, count: 32) } + private var idA: Data { Data(repeating: 0xA1, count: 8) } + + /// The property that makes handshake-free recognition possible: both sides + /// reach the same tag from opposite halves of the key pair. + @Test func bothSidesDeriveTheSameRecognitionTag() throws { + let privA = try Curve25519.KeyAgreement.PrivateKey(rawRepresentation: staticPrivateA) + let privB = try Curve25519.KeyAgreement.PrivateKey(rawRepresentation: staticPrivateB) + + let sharedFromA = try privA.sharedSecretFromKeyAgreement(with: privB.publicKey) + let sharedFromB = try privB.sharedSecretFromKeyAgreement(with: privA.publicKey) + let rawA = sharedFromA.withUnsafeBytes { Data($0) } + let rawB = sharedFromB.withUnsafeBytes { Data($0) } + #expect(rawA == rawB) + + let keyA = PeerIDRotation.recognitionKey(sharedSecret: rawA) + let keyB = PeerIDRotation.recognitionKey(sharedSecret: rawB) + #expect(keyA == keyB) + + // A emits its A->B tag; B computes the same value to look for it. + let emitted = PeerIDRotation.recognitionTag( + recognitionKey: keyA, epoch: 100, + senderStaticPublicKey: privA.publicKey.rawRepresentation, + recipientStaticPublicKey: privB.publicKey.rawRepresentation, + peerID: idA + ) + let expected = PeerIDRotation.recognitionTag( + recognitionKey: keyB, epoch: 100, + senderStaticPublicKey: privA.publicKey.rawRepresentation, + recipientStaticPublicKey: privB.publicKey.rawRepresentation, + peerID: idA + ) + #expect(emitted == expected) + #expect(emitted.count == PeerIDRotation.idLength) + } + + /// Regression, Codex #1487 P1: a symmetric tag means A and B broadcast the + /// identical 8 bytes, so an observer who sees one value in two announces + /// learns those two are mutual favourites and can link their rotating IDs. + /// Tags must therefore differ by direction. + @Test func recognitionTagsAreDirectional() { + let key = PeerIDRotation.recognitionKey(sharedSecret: Data(repeating: 0x42, count: 32)) + let aToB = PeerIDRotation.recognitionTag( + recognitionKey: key, epoch: 100, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, peerID: idA + ) + let bToA = PeerIDRotation.recognitionTag( + recognitionKey: key, epoch: 100, + senderStaticPublicKey: pubB, recipientStaticPublicKey: pubA, peerID: idA + ) + #expect(aToB != bToA) + } + + /// Regression, Codex #1487 P1: without the peer ID in the MAC, a tag lifted + /// from someone's announce could be replayed under an attacker-chosen ID and + /// the recipient would accept that ID as the favourite. + @Test func recognitionTagIsBoundToTheAnnouncedPeerID() { + let key = PeerIDRotation.recognitionKey(sharedSecret: Data(repeating: 0x42, count: 32)) + let real = PeerIDRotation.recognitionTag( + recognitionKey: key, epoch: 100, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, peerID: idA + ) + let underAttackerID = PeerIDRotation.recognitionTag( + recognitionKey: key, epoch: 100, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, + peerID: Data(repeating: 0xFF, count: 8) + ) + #expect(real != underAttackerID) + + // And the lifted tag must not verify against the attacker's ID. + let block = PeerIDRotation.tagBlock(tags: [real]) + #expect(!PeerIDRotation.blockMatches( + block, recognitionKey: key, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, + peerID: Data(repeating: 0xFF, count: 8), + at: Date(timeIntervalSince1970: 3600 * 100) + )) + } + + @Test func recognitionTagRotatesWithTheEpoch() { + let key = PeerIDRotation.recognitionKey(sharedSecret: Data(repeating: 0x42, count: 32)) + let now = PeerIDRotation.recognitionTag( + recognitionKey: key, epoch: 100, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, peerID: idA + ) + let next = PeerIDRotation.recognitionTag( + recognitionKey: key, epoch: 101, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, peerID: idA + ) + #expect(now != next) + // VECTOR: HMAC-SHA256(HKDF(ikm: 0x42*32, info: "bitchat-recognition-v1"), + // uint32be(100) || 0x0A*32 || 0x0B*32 || 0xA1*8)[0..8] + #expect(hex(now) == "4568f61d61d6cbfb") + } + + @Test func aThirdPartyCannotDeriveAPairsTag() { + // An observer holding a *different* shared secret gets a different tag, + // which is what stops it from tracking the pair. + let pair = PeerIDRotation.recognitionKey(sharedSecret: Data(repeating: 0x01, count: 32)) + let other = PeerIDRotation.recognitionKey(sharedSecret: Data(repeating: 0x02, count: 32)) + #expect(PeerIDRotation.recognitionTag( + recognitionKey: pair, epoch: 7, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, peerID: idA + ) != PeerIDRotation.recognitionTag( + recognitionKey: other, epoch: 7, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, peerID: idA + )) + } + + // MARK: - Tag block + + @Test func tagBlockIsAlwaysFullWidth() { + let expected = PeerIDRotation.tagSlots * PeerIDRotation.idLength + for count in 0...PeerIDRotation.tagSlots { + let tags = (0.. (key: Data, tag: Data, date: Date) { + let date = Date(timeIntervalSince1970: 3600 * 100) + let key = PeerIDRotation.recognitionKey(sharedSecret: Data(repeating: 0x77, count: 32)) + let tag = PeerIDRotation.recognitionTag( + recognitionKey: key, + epoch: PeerIDRotation.epoch(at: date), + senderStaticPublicKey: pubA, + recipientStaticPublicKey: pubB, + peerID: idA + ) + return (key, tag, date) + } + + @Test func blockMatchesRecogniseAPeerAnywhereInTheBlock() { + let (key, tag, date) = matchFixture() + // Slot order must not matter, so assert across many shuffles. + for _ in 0..<20 { + let block = PeerIDRotation.tagBlock(tags: [tag]) + #expect(PeerIDRotation.blockMatches( + block, recognitionKey: key, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, + peerID: idA, at: date + )) + } + } + + /// Testing the wrong direction must fail, or the directional fix would be + /// cosmetic. + @Test func blockDoesNotMatchTheOppositeDirection() { + let (key, tag, date) = matchFixture() + let block = PeerIDRotation.tagBlock(tags: [tag]) + #expect(!PeerIDRotation.blockMatches( + block, recognitionKey: key, + senderStaticPublicKey: pubB, recipientStaticPublicKey: pubA, + peerID: idA, at: date + )) + } + + @Test func blockMatchesToleratesTheEpochBoundary() { + let date = Date(timeIntervalSince1970: 3600 * 100) + let key = PeerIDRotation.recognitionKey(sharedSecret: Data(repeating: 0x11, count: 32)) + + func tag(epoch: UInt32) -> Data { + PeerIDRotation.recognitionTag( + recognitionKey: key, epoch: epoch, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, peerID: idA + ) + } + func matches(_ candidate: Data) -> Bool { + PeerIDRotation.blockMatches( + PeerIDRotation.tagBlock(tags: [candidate]), recognitionKey: key, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, + peerID: idA, at: date + ) + } + + // A peer whose clock has already ticked over still matches. + #expect(matches(tag(epoch: 101))) + // Two epochs out is outside the window and must not. + #expect(!matches(tag(epoch: 98))) + } + + @Test func randomBlockDoesNotMatch() { + let (key, _, date) = matchFixture() + #expect(!PeerIDRotation.blockMatches( + PeerIDRotation.tagBlock(tags: []), recognitionKey: key, + senderStaticPublicKey: pubA, recipientStaticPublicKey: pubB, + peerID: idA, at: date + )) + } + + // MARK: - Identity binding + + @Test func bindingMessageIsFixedWidthAndContextSeparated() { + let message = PeerIDRotation.bindingMessage( + epoch: 100, + peerID: Data(repeating: 0xAB, count: 8), + noiseStaticPublicKey: Data(repeating: 0xCD, count: 32) + ) + let context = Data("bitchat-peerid-binding-v1".utf8) + #expect(message.count == context.count + 4 + 8 + 32) + #expect(message.starts(with: context)) + // Must not collide with the production-dead announce-signature helpers, + // which use "bitchat-announce-v1". + #expect(!message.starts(with: Data("bitchat-announce-v1".utf8))) + } + + @Test func bindingMessagePadsShortInputsRatherThanShifting() { + // Fixed-width fields mean a short ID cannot shift the key into the ID's + // position and produce a message that verifies for the wrong pairing. + let short = PeerIDRotation.bindingMessage( + epoch: 1, + peerID: Data([0x01]), + noiseStaticPublicKey: Data([0x02]) + ) + let padded = PeerIDRotation.bindingMessage( + epoch: 1, + peerID: Data([0x01]) + Data(repeating: 0, count: 7), + noiseStaticPublicKey: Data([0x02]) + Data(repeating: 0, count: 31) + ) + #expect(short == padded) + } + + @Test func bindingMessageChangesWithEveryField() { + let base = PeerIDRotation.bindingMessage( + epoch: 1, + peerID: Data(repeating: 0x01, count: 8), + noiseStaticPublicKey: Data(repeating: 0x02, count: 32) + ) + #expect(base != PeerIDRotation.bindingMessage( + epoch: 2, + peerID: Data(repeating: 0x01, count: 8), + noiseStaticPublicKey: Data(repeating: 0x02, count: 32) + )) + #expect(base != PeerIDRotation.bindingMessage( + epoch: 1, + peerID: Data(repeating: 0x03, count: 8), + noiseStaticPublicKey: Data(repeating: 0x02, count: 32) + )) + #expect(base != PeerIDRotation.bindingMessage( + epoch: 1, + peerID: Data(repeating: 0x01, count: 8), + noiseStaticPublicKey: Data(repeating: 0x04, count: 32) + )) + } + + @Test func bindingMessageVerifiesUnderTheIdentityKey() throws { + let signing = Curve25519.Signing.PrivateKey() + let message = PeerIDRotation.bindingMessage( + epoch: 100, + peerID: Data(repeating: 0xAB, count: 8), + noiseStaticPublicKey: Data(repeating: 0xCD, count: 32) + ) + let signature = try signing.signature(for: message) + #expect(signing.publicKey.isValidSignature(signature, for: message)) + + // A different epoch must not verify: replaying a binding into a later + // epoch is exactly what this prevents. + let other = PeerIDRotation.bindingMessage( + epoch: 101, + peerID: Data(repeating: 0xAB, count: 8), + noiseStaticPublicKey: Data(repeating: 0xCD, count: 32) + ) + #expect(!signing.publicKey.isValidSignature(signature, for: other)) + } +}