fix(apple): make cancelling a targeted send actually cancel

Creating a targeted transfer contacts the peer and only returns once the
offer is answered or its timeouts expire — connection_timeout plus
offer_wait_timeout, so minutes against a device that never answers. The
composer disabled every control for that whole window, including Close,
leaving no way out. Worse, the core records the row before it reaches out
and leaves it in `failed` when the peer never replies, so giving up still
produced a failure notification and a history entry for a send the user
had already called off.

Cancelling now reaches the core while that create is still running. The
`created` lifecycle event carries the transfer id and is emitted before
the peer is contacted, so the id is known in time; the cancel goes out
through the interrupt lane, which exists precisely to reach a core busy
inside another call. The transfer is then deleted, and its id is filtered
out of the published list so a refresh racing the delete cannot leak it
into history or into a notification. If the id has not arrived yet, the
result carries it and the same cleanup runs on return. Picked sources are
released only once the call lands, because the import owns them until
then, and a generation counter keeps a late result from disturbing a
newer send.

Close and Cancel were also the same action under two labels. There is now
one control: the sheet's cancellation item, reading Cancel while a send is
waiting and Close otherwise, never disabled.

Two further fixes from device testing:

- Receive and Resume were gated on transfer state alone, so an approved
  outgoing transfer offered the sender a Receive button — an invitation to
  download the files it was uploading. Both pull into a local folder and
  are now receiver-only.
- Renamed the deprecated `laptopcomputerAndIphone` symbol to
  `macbookAndIphone`; the deployment targets are well past where it was
  introduced, so no availability guard is needed.

Adds a typed `targetedTransferId` accessor on CoreEventModel. This is a
narrow, deliberate exception to the wake-up-only event rule in
DESIGN-DEVICE-HISTORY.md §13: it takes the subject id and never state,
and it exists because no query can answer while the create holds the
serial lane — which is exactly when the user wants to cancel.

Known gap: direction is inferred by comparing endpoint ids, because the
binding does not expose the row's role. After an identity reset, rows
predating it match neither endpoint, so past sends read as incoming from
the device's own retired identity. Fixing that needs `role` on the core's
TargetedTransfer.
This commit is contained in:
2026-08-13 22:33:06 +02:00
parent 2d4fcd78b5
commit 6b6d5f158d
11 changed files with 383 additions and 18 deletions

View File

@@ -42,6 +42,24 @@ final class FakeCoreGateway: CoreGateway {
private(set) var resetUnrecoverableIdentityCount = 0
func setState(_ state: CoreState) { stateSubject.send(state) }
/// Publishes the `created` lifecycle event the core emits once a targeted
/// transfer row exists, then the signal that follows it the sequence that
/// lets a caller cancel a create still holding the serial lane.
func emitTargetedTransferCreated(id: String) {
var state = stateSubject.value
state.events.insert(
CoreEventModel(
id: "event-\(id)", revision: 1, timestamp: 1, scope: "endpoint", transferId: nil,
direction: nil, phase: EventPhase.targetedTransfer.rawValue,
kind: EventKind.created.rawValue,
dataJson: #"{"targeted_transfer_id":"\#(id)"}"#
),
at: 0
)
stateSubject.send(state)
emit(.targetedTransferChanged)
}
func emit(_ signal: CoreSignal) { signalsSubject.send(signal) }
func initialize(
@@ -185,10 +203,29 @@ final class FakeCoreGateway: CoreGateway {
offerResponses.append((transferId, accepted))
return offerResponseResult
}
/// Holds `createTargetedTransfer` open until `releaseTargetedCreate()`, so a
/// test can observe the model while a create is genuinely in flight the
/// state the user is stuck in when the receiving device never answers.
var holdsTargetedCreate = false
private var targetedCreateGate: CheckedContinuation<Void, Never>?
/// True once the call is parked on the gate. `isCreatingSend` flips before the
/// task body runs, so releasing on that alone can resume nothing and hang.
var isHoldingTargetedCreate: Bool { targetedCreateGate != nil }
func releaseTargetedCreate() {
let gate = targetedCreateGate
targetedCreateGate = nil
gate?.resume()
}
func createTargetedTransfer(
receiverEndpointId: String, sources: [ShareSource], transferName: String?
) async -> Result<TargetedTransferModel, Error> {
createdTargetedTransfers.append((receiverEndpointId, sources, transferName))
if holdsTargetedCreate {
await withCheckedContinuation { targetedCreateGate = $0 }
}
return createTargetedTransferResult
}
func listTargetedTransfers() async -> Result<[TargetedTransferModel], Error> {

View File

@@ -373,6 +373,27 @@ final class SavedDevicesModelTests: XCTestCase {
XCTAssertEqual(gateway.forgottenDevices, [Self.peer])
}
// MARK: - Transfer actions
func testOnlyTheReceivingSideIsOfferedReceiveAndResume() async {
gateway.savedDevices = [savedDevice()]
gateway.targetedTransfers = [
transfer(id: "in-approved", sender: Self.peer, receiver: Self.localEndpoint, state: .approved),
transfer(id: "out-approved", sender: Self.localEndpoint, receiver: Self.peer, state: .approved),
transfer(id: "in-interrupted", sender: Self.peer, receiver: Self.localEndpoint, state: .interrupted),
transfer(id: "out-interrupted", sender: Self.localEndpoint, receiver: Self.peer, state: .interrupted),
]
let model = await makeModel()
let byId = Dictionary(uniqueKeysWithValues: model.state.targetedTransfers.map { ($0.id, $0) })
XCTAssertEqual(byId["in-approved"]?.canReceive, true)
XCTAssertEqual(byId["in-interrupted"]?.canResume, true)
// The sender has nothing to pull: it is the one holding the files. Offering
// "Receive" there asked it to download its own outgoing transfer.
XCTAssertEqual(byId["out-approved"]?.canReceive, false)
XCTAssertEqual(byId["out-interrupted"]?.canResume, false)
}
// MARK: - Targeted send
private func picked(_ name: String, isDirectory: Bool = false) -> PickedShareFile {
@@ -415,6 +436,146 @@ final class SavedDevicesModelTests: XCTestCase {
XCTAssertEqual(fileSystem.discardedFiles, ["/tmp/a.txt"])
}
/// Sets up a create that never returns until released an unavailable peer,
/// where the core waits out its connection and offer timeouts. `announcesId`
/// mirrors the core emitting `created` once the row exists, which it does
/// before it ever contacts the peer.
private func stalledSend(
_ model: SavedDevicesModel,
id: String = "t-inflight",
announcesId: Bool = true
) async {
gateway.holdsTargetedCreate = true
model.beginSend(to: Self.peer)
model.onSendFilesPicked([picked("a.txt")])
model.createTargetedTransfer()
await waitUntil { self.gateway.isHoldingTargetedCreate }
if announcesId {
gateway.emitTargetedTransferCreated(id: id)
await waitUntil { !model.state.isCreatingSend || model.knowsInFlightSendTransfer }
}
XCTAssertTrue(model.state.isCreatingSend)
}
func testCancellingAnUnansweredSendReachesTheCoreWhileItIsStillRunning() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .success(transfer(id: "t-inflight"))
let model = await makeModel()
await stalledSend(model)
model.abandonSend()
// The point of cancelling: it must not wait for the create to finish. The
// cancel goes out while the core is still parked inside that very call.
await waitUntil { !self.gateway.cancelledTargetedTransfers.isEmpty }
XCTAssertEqual(gateway.cancelledTargetedTransfers, ["t-inflight"])
XCTAssertFalse(model.state.isCreatingSend)
XCTAssertNil(model.state.sendTargetPeerId)
gateway.releaseTargetedCreate()
}
func testCancelledSendIsDeletedRatherThanLeftInHistory() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .success(transfer(id: "t-inflight"))
let model = await makeModel()
await stalledSend(model)
model.abandonSend()
await waitUntil { !self.gateway.deletedTargetedTransfers.isEmpty }
// Cancelling is not "closing the sheet": the core would otherwise record a
// failed transfer, and the user would be told a send they called off failed.
XCTAssertEqual(gateway.deletedTargetedTransfers, ["t-inflight"])
gateway.releaseTargetedCreate()
}
func testCancelledSendNeverReachesHistoryEvenIfARefreshRacesTheDelete() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .success(transfer(id: "t-inflight"))
// The core reports it as failed the state an unanswered offer lands in.
gateway.targetedTransfers = [transfer(id: "t-inflight", state: .failed)]
let model = await makeModel()
await stalledSend(model)
model.abandonSend()
gateway.releaseTargetedCreate()
await waitUntil { !self.gateway.deletedTargetedTransfers.isEmpty }
// Nothing about the cancelled send may surface, or the notification
// coordinator announces a failure for work the user called off.
XCTAssertTrue(model.state.targetedTransfers.isEmpty)
}
func testCancellingReleasesTheComposerBeforeTheCreateReturns() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .success(transfer(id: "t-inflight"))
let model = await makeModel()
await stalledSend(model)
model.abandonSend()
XCTAssertFalse(model.state.isCreatingSend)
XCTAssertTrue(model.state.sendFiles.isEmpty)
// The import still owns the sources until the call lands.
XCTAssertTrue(fileSystem.discardedFiles.isEmpty)
gateway.releaseTargetedCreate()
await waitUntil { !self.fileSystem.discardedFiles.isEmpty }
XCTAssertEqual(fileSystem.discardedFiles, ["/tmp/a.txt"])
}
func testCancelledSendWithNoIdYetIsStillCleanedUpWhenTheCreateReturns() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .success(transfer(id: "t-late"))
let model = await makeModel()
// The create beat its own `created` event, so cancelling has no id to use.
await stalledSend(model, announcesId: false)
model.abandonSend()
XCTAssertTrue(gateway.cancelledTargetedTransfers.isEmpty)
gateway.releaseTargetedCreate()
// The result carries the id, so the cleanup still happens just later.
await waitUntil { !self.gateway.cancelledTargetedTransfers.isEmpty }
XCTAssertEqual(gateway.cancelledTargetedTransfers, ["t-late"])
XCTAssertEqual(gateway.deletedTargetedTransfers, ["t-late"])
}
func testCancelledSendThatNeverRegisteredHasNothingToCancel() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .failure(TestError.unimplemented)
let model = await makeModel()
await stalledSend(model, announcesId: false)
model.abandonSend()
gateway.releaseTargetedCreate()
await waitUntil { !self.fileSystem.discardedFiles.isEmpty }
XCTAssertTrue(gateway.cancelledTargetedTransfers.isEmpty)
// The composition is gone, so a failure the user walked away from is not
// resurrected as an error they have to dismiss.
XCTAssertTrue(model.state.sendFiles.isEmpty)
}
func testCancelledResultDoesNotDisturbANewerSend() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .success(transfer(id: "t-inflight"))
let model = await makeModel()
await stalledSend(model)
model.abandonSend()
// The user starts composing again while the first call is still pending.
model.beginSend(to: Self.peer)
model.onSendFilesPicked([picked("b.txt")])
gateway.releaseTargetedCreate()
await waitUntil { !self.fileSystem.discardedFiles.isEmpty }
XCTAssertEqual(model.state.sendTargetPeerId, Self.peer)
XCTAssertEqual(model.state.sendFiles.map(\.value), ["/tmp/b.txt"])
XCTAssertFalse(model.state.isCreatingSend)
}
func testSendFailureKeepsCompositionForRetry() async {
gateway.savedDevices = [savedDevice()]
gateway.createTargetedTransferResult = .failure(TestError.unimplemented)