cdricms/vnidrop
1
1
Fork 0
mirror of https://github.com/sudosylabs/vnidrop.git synced 2026-08-14 14:19:57 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(apple): saved devices and targeted transfers UI

Browse Source 
Adds the native SwiftUI Saved Devices experience on top of the production
saved-device core, as a top-level destination in the iOS tab bar and the
macOS sidebar.

Core seam:
- App-facing saved-device domain models mirroring core/SavedDeviceModels.kt,
  with lifecycle helpers (canReceive/canResume/canCancel/canDelete) so views
  never hand-roll state checks.
- 21 gateway methods through CoreGateway/CoreRepository with UniFFI mapping.
  cancelTargetedTransfer, forgetSavedDevice and blockDevice run off the serial
  lane: each must reach the core while a targeted receive is blocking it.
- Payload-free pairingChanged/targetedTransferChanged signals, dispatched
  before the numeric-transferId guard since saved-device events identify
  their subject by peer endpoint or a string transfer id.

Experience:
- Screen lists saved devices and outstanding consent requests only; the
  global targeted-transfer history stays out, reachable per device.
- Details as a sheet with detents on compact layouts and a native inspector
  on macOS, owning Send, label, forget/block and that device's transfers.
- Label editing is transactional: the draft and editor survive a failed
  write, conflicting actions are refused while saving, and the editor closes
  only after the core confirms.
- Pairing and targeted-offer consent hosted at the app root, answerable from
  any tab and suppressed while a transfer approval is up. Dismissing a
  pairing prompt suppresses locally without consuming the single-use
  eligibility; dismissing an offer declines it, since an unanswered offer
  holds a slot in the core's bounded per-sender queue.
- Targeted send reuses the invitation composer's affordances with file,
  folder, rename, replace and cleanup parity. Picker copies are released on
  replace/remove/clear/cancel and after a successful create, but kept after a
  failure so retry does not require re-picking.
- Notifications for pairing requests and offers (withdrawn once answered) and
  for terminal targeted transfers. Wording follows direction: on the sending
  device the peer finished receiving, not us.

Localization:
- Widens 52 saved-device keys from kmp-only to both platforms.
- Five keys carried a literal %1$s with no declared args, which Compose
  renders positionally but the Apple generator emits as a plain constant,
  leaking the placeholder into the UI. They now use named args; Compose
  output is byte-identical.
- Adds targeted_offer_title/body. Reusing the invitation approval copy stated
  the roles backwards, announcing the sender as the receiver.

Also surfaces core startup failures: the startup overlay is drawn above the
snackbar host, so a failed initialize() was indistinguishable from an app
that never finished loading. AppModel now keeps the reason, logs it, and the
overlay shows it with a retry, plus the technical detail in DEBUG builds.

Send and receive between two devices is verified only partially; a missing
endpoint-identity credential currently blocks startup on the test device.
This commit is contained in:
Cédric
2026-08-13 19:42:37 +02:00
parent bece2af179
commit 8bb1442338
33 changed files with 3837 additions and 247 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
apple/VniDrop/Core/CoreGateway.swift
View File

@@ -47,4 +47,51 @@ protocol CoreGateway: AnyObject {
func receiverRequests(transferId: UInt64) async -> Result<[ReceiverRequestModel], Error>
func respondReceiverRequest(requestId: String, accepted: Bool, reason: String?) async -> Result<Void, Error>
func refresh() async -> Result<Void, Error>
// MARK: - Saved devices
func listPairingEligibilities() async -> Result<[PairingEligibilityModel], Error>
func declinePairingEligibility(peerEndpointId: String) async -> Result<Void, Error>
/// Asks a peer to pair. Returns false when no valid eligibility exists, which
/// the core rejects silently so a stranger cannot provoke a prompt.
func requestSavedDevicePairing(peerEndpointId: String) async -> Result<Bool, Error>
func respondToDevicePairing(peerEndpointId: String, accepted: Bool) async -> Result<Bool, Error>
func listDeviceRelationships() async -> Result<[DeviceRelationshipModel], Error>
func listSavedDevices() async -> Result<[SavedDeviceModel], Error>
/// Sets or clears (`nil`) the user-owned local label.
func setSavedDeviceLabel(peerEndpointId: String, label: String?) async -> Result<Void, Error>
func forgetSavedDevice(peerEndpointId: String) async -> Result<Void, Error>
func blockDevice(peerEndpointId: String) async -> Result<Void, Error>
/// Removes only the deny rule. Grants, relationships, and cancelled transfers
/// are not restored — re-saving needs another qualifying transfer and consent.
func unblockDevice(peerEndpointId: String) async -> Result<Void, Error>
func listBlockedDevices() async -> Result<[String], Error>
// MARK: - Targeted transfers
func listPendingTargetedOffers() async -> Result<[PendingTargetedOfferModel], Error>
func respondToTargetedOffer(
transferId: String,
accepted: Bool
) async -> Result<TargetedOfferResponseModel, Error>
func createTargetedTransfer(
receiverEndpointId: String,
sources: [ShareSource],
transferName: String?
) async -> Result<TargetedTransferModel, Error>
func listTargetedTransfers() async -> Result<[TargetedTransferModel], Error>
/// Pulls an approved transfer into a security-scoped destination, holding
/// access for the duration of the stream (mirrors the invitation receive path).
func receiveTargetedTransfer(
transferId: String,
outputDirectoryUrl: String
) async -> Result<Void, Error>
/// Resumes an interrupted transfer. The same immutable transfer continues from
/// its verified progress and is not re-approved.
func resumeTargetedTransfer(
id: String,
outputDirectoryUrl: String
) async -> Result<Void, Error>
func cancelTargetedTransfer(id: String) async -> Result<Void, Error>
func deleteTargetedTransfer(id: String) async -> Result<Void, Error>
}

13
apple/VniDrop/Core/CoreModels.swift
View File

@@ -47,6 +47,12 @@ enum EventPhase: String, Equatable, Sendable {
case network
case handshake
case error
/// Saved-device consent lifecycle (eligibility, relationships, grants).
case pairing
/// Targeted-transfer offer and lifecycle. Its events identify the transfer by
/// a string `targeted_transfer_id`, not the numeric `transferId` used by
/// invitation shares.
case targetedTransfer = "targeted_transfer"
}
/// Kind of a core progress event (the `kind` wire field).
@@ -174,6 +180,13 @@ enum CoreSignal: Equatable, Sendable {
case receiverHistoryChanged(transferId: UInt64)
/// Transfer status/history changed enough to re-read the durable snapshot.
case transfersChanged(transferId: UInt64)
/// Pairing / saved-device state changed; refresh eligibility, relationships,
/// and the saved list. Carries no payload: core events are wake-ups, not
/// authoritative state, so consumers re-query rather than apply a delta.
case pairingChanged
/// Targeted-transfer offer or lifecycle changed; refresh pending offers and
/// transfers. Payload-free for the same reason as `pairingChanged`.
case targetedTransferChanged
}
// MARK: - Transfer helpers (ported from AppUiModels.kt)

241
apple/VniDrop/Core/CoreRepository.swift
View File

@@ -293,6 +293,140 @@ final class CoreRepository: ObservableObject, CoreGateway {
if let snapshot { self.applySnapshot(snapshot) }
}
}
// MARK: - Saved devices
func listPairingEligibilities() async -> Result<[PairingEligibilityModel], Error> {
await runCore { try self.requireCore().listPairingEligibilities().map { $0.toModel() } }
}
func declinePairingEligibility(peerEndpointId: String) async -> Result<Void, Error> {
await runCore { try self.requireCore().declinePairingEligibility(peerEndpointId: peerEndpointId) }
}
func requestSavedDevicePairing(peerEndpointId: String) async -> Result<Bool, Error> {
await runCore { try self.requireCore().requestSavedDevicePairing(peerEndpointId: peerEndpointId) }
}
func respondToDevicePairing(peerEndpointId: String, accepted: Bool) async -> Result<Bool, Error> {
await runCore {
try self.requireCore().respondToDevicePairing(peerEndpointId: peerEndpointId, accepted: accepted)
}
}
func listDeviceRelationships() async -> Result<[DeviceRelationshipModel], Error> {
await runCore { try self.requireCore().listDeviceRelationships().map { $0.toModel() } }
}
func listSavedDevices() async -> Result<[SavedDeviceModel], Error> {
await runCore { try self.requireCore().listSavedDevices().map { $0.toModel() } }
}
func setSavedDeviceLabel(peerEndpointId: String, label: String?) async -> Result<Void, Error> {
await runCore { try self.requireCore().setSavedDeviceLabel(peerEndpointId: peerEndpointId, label: label) }
}
func forgetSavedDevice(peerEndpointId: String) async -> Result<Void, Error> {
// Forget cancels the peer's active/resumable targeted transfers, so it can
// run while one is streaming on the serial lane — same reasoning as `cancel`.
await runInterrupt { try self.requireCore().forgetSavedDevice(peerEndpointId: peerEndpointId) }
}
func blockDevice(peerEndpointId: String) async -> Result<Void, Error> {
// Block is immediate and identity-wide, cancelling traffic in flight.
await runInterrupt { try self.requireCore().blockDevice(peerEndpointId: peerEndpointId) }
}
func unblockDevice(peerEndpointId: String) async -> Result<Void, Error> {
await runCore { try self.requireCore().unblockDevice(peerEndpointId: peerEndpointId) }
}
func listBlockedDevices() async -> Result<[String], Error> {
await runCore { try self.requireCore().listBlockedDevices() }
}
// MARK: - Targeted transfers
func listPendingTargetedOffers() async -> Result<[PendingTargetedOfferModel], Error> {
// `listPendingTargetedOffers` is itself non-throwing, but `requireCore` is.
await runCore { try self.requireCore().listPendingTargetedOffers().map { $0.toModel() } }
}
func respondToTargetedOffer(
transferId: String,
accepted: Bool
) async -> Result<TargetedOfferResponseModel, Error> {
await runCore {
try self.requireCore()
.respondToTargetedOffer(transferId: transferId, accepted: accepted)
.toModel()
}
}
func createTargetedTransfer(
receiverEndpointId: String,
sources: [ShareSource],
transferName: String?
) async -> Result<TargetedTransferModel, Error> {
guard !isNetworkTransitionInProgress else {
return .failure(CoreNetworkLifecycleError.transitionInProgress)
}
guard !sources.isEmpty else {
return .failure(InvitationError.shareEmpty)
}
return await runCore {
try self.requireCore().createTargetedTransfer(
receiverEndpointId: receiverEndpointId,
sources: sources,
transferName: transferName
).toModel()
}
}
func listTargetedTransfers() async -> Result<[TargetedTransferModel], Error> {
await runCore { try self.requireCore().listTargetedTransfers().map { $0.toModel() } }
}
func receiveTargetedTransfer(
transferId: String,
outputDirectoryUrl: String
) async -> Result<Void, Error> {
guard !isNetworkTransitionInProgress else {
return .failure(CoreNetworkLifecycleError.transitionInProgress)
}
return await runCore {
try withSecurityScopedAccess(pathOrUrl: outputDirectoryUrl) {
try self.requireCore().receiveTargetedTransfer(
transferId: transferId,
outputDir: outputDirectoryUrl
)
}
}
}
func resumeTargetedTransfer(
id: String,
outputDirectoryUrl: String
) async -> Result<Void, Error> {
guard !isNetworkTransitionInProgress else {
return .failure(CoreNetworkLifecycleError.transitionInProgress)
}
return await runCore {
try withSecurityScopedAccess(pathOrUrl: outputDirectoryUrl) {
try self.requireCore().resumeTargetedTransfer(id: id, outputDir: outputDirectoryUrl)
}
}
}
func cancelTargetedTransfer(id: String) async -> Result<Void, Error> {
// Off the serial lane: an in-flight targeted receive is blocking it, and the
// cancel must reach the core to unblock that receive (see `cancel`).
await runInterrupt { try self.requireCore().cancelTargetedTransfer(id: id) }
}
func deleteTargetedTransfer(id: String) async -> Result<Void, Error> {
await runCore { try self.requireCore().deleteTargetedTransfer(id: id) }
}
// MARK: - Event sink handling (ported from CoreRepository.sink)
private func handle(event: CoreEvent) {
@@ -302,6 +436,21 @@ final class CoreRepository: ObservableObject, CoreGateway {
if events.count > Self.maxEvents { events = Array(events.prefix(Self.maxEvents)) }
state.events = events
// Saved-device events identify their subject by peer endpoint or a string
// `targeted_transfer_id`, so they carry no numeric `transferId` and must be
// dispatched before the guard below. Both are payload-free wake-ups: the
// consumer re-reads durable state rather than trusting the event.
switch model.eventPhase {
case .pairing:
signalsSubject.send(.pairingChanged)
return
case .targetedTransfer:
signalsSubject.send(.targetedTransferChanged)
return
default:
break
}
guard let transferId = model.transferId else { return }
switch model.phase {
case "approval", "access": signalsSubject.send(.approvalChanged(transferId: transferId))
@@ -497,6 +646,98 @@ private extension TransferMetadata {
}
}
// MARK: - Saved-device mapping (ported from CoreRepository.kt)
private extension SavedDevice {
func toModel() -> SavedDeviceModel {
SavedDeviceModel(
endpointId: endpointId, localLabel: localLabel, remoteDisplayName: remoteDisplayName,
createdAt: createdAt, lastAuthenticatedAt: lastAuthenticatedAt
)
}
}
private extension DeviceRelationshipState {
func toModel() -> DeviceRelationshipStateModel {
switch self {
case .pendingOutgoing: return .pendingOutgoing
case .pendingIncoming: return .pendingIncoming
case .saved: return .saved
case .revoked: return .revoked
case .blocked: return .blocked
}
}
}
private extension DeviceRelationship {
func toModel() -> DeviceRelationshipModel {
DeviceRelationshipModel(
remoteEndpointId: remoteEndpointId, state: state.toModel(), generation: generation,
minimumProtocolVersion: minimumProtocolVersion, createdAt: createdAt, updatedAt: updatedAt
)
}
}
private extension PairingEligibilitySummary {
func toModel() -> PairingEligibilityModel {
PairingEligibilityModel(
peerEndpointId: peerEndpointId, remoteDisplayName: remoteDisplayName, sessionId: sessionId,
protocolVersion: protocolVersion, createdAt: createdAt, expiresAt: expiresAt
)
}
}
private extension PendingTargetedOffer {
func toModel() -> PendingTargetedOfferModel {
PendingTargetedOfferModel(
transferId: transferId, senderEndpointId: senderEndpointId,
receiverEndpointId: receiverEndpointId, manifestId: manifestId, contentHash: contentHash,
transferName: transferName, fileCount: fileCount, totalSize: totalSize,
protocolVersion: protocolVersion, receivedAt: receivedAt
)
}
}
private extension TargetedTransferState {
func toModel() -> TargetedTransferStateModel {
switch self {
case .preparing: return .preparing
case .offering: return .offering
case .awaitingApproval: return .awaitingApproval
case .approved: return .approved
case .connecting: return .connecting
case .transferring: return .transferring
case .interrupted: return .interrupted
case .completed: return .completed
case .declined: return .declined
case .cancelled: return .cancelled
case .failed: return .failed
case .deleted: return .deleted
}
}
}
private extension TargetedTransfer {
func toModel() -> TargetedTransferModel {
TargetedTransferModel(
id: id, senderEndpointId: senderEndpointId, receiverEndpointId: receiverEndpointId,
manifestId: manifestId, transferName: transferName, fileCount: fileCount,
totalSize: totalSize, verifiedBytes: verifiedBytes, state: state.toModel(),
createdAt: createdAt, updatedAt: updatedAt
)
}
}
private extension TargetedOfferResponse {
func toModel() -> TargetedOfferResponseModel {
switch self {
case .approved(let transferId): return .approved(transferId: transferId)
case .declined: return .declined
case .alreadySettled(let transferId): return .alreadySettled(transferId: transferId)
}
}
}
private extension ReceiverRequest {
func toModel() -> ReceiverRequestModel {
ReceiverRequestModel(

9
apple/VniDrop/Core/FileSystemService.swift
View File

@@ -43,6 +43,15 @@ protocol FileSystemService {
senderName: String,
destination: ShareDestination
) async -> Result<Share, Error>
/// Sends a picked selection straight to one saved device. Separate from
/// `sharePickedFiles` because a targeted transfer is its own domain with its
/// own result type — it is not an access mode on an invitation share.
func sendPickedFilesToSavedDevice(
repository: CoreGateway,
files: [PickedShareFile],
transferName: String,
receiverEndpointId: String
) async -> Result<TargetedTransferModel, Error>
}
extension FileSystemService {

182
apple/VniDrop/Core/SavedDeviceModels.swift Normal file
View File

@@ -0,0 +1,182 @@
import Foundation
/// App-facing saved-device domain models, ported from `core/SavedDeviceModels.kt`.
/// The repository maps the generated UniFFI records into these so the UI never
/// depends on the binding surface directly.
///
/// A saved device is a remote VniDrop *app-installation identity*, not a person,
/// account, or piece of hardware. Display names and platform hints are untrusted
/// peer-supplied hints and must never be used to merge or match identities.
struct SavedDeviceModel: Equatable, Identifiable, Sendable {
/// The remote iroh endpoint identity. Stable, cryptographic, and the only
/// safe way to identify a peer.
let endpointId: String
/// User-owned local label. Takes precedence over `remoteDisplayName`.
let localLabel: String?
/// Untrusted display-name hint supplied by the peer.
let remoteDisplayName: String?
let createdAt: Int64
let lastAuthenticatedAt: Int64?
var id: String { endpointId }
/// The name to show, or nil when neither side supplied one. Callers fall back
/// to `L10n.SavedDevices.unnamed` (see `SavedDeviceTransferHistory.kt`).
var displayNameOrNil: String? {
if let localLabel, !localLabel.trimmed.isEmpty { return localLabel }
if let remoteDisplayName, !remoteDisplayName.trimmed.isEmpty { return remoteDisplayName }
return nil
}
}
/// Durable consent lifecycle for one remote app-installation identity. A
/// relationship is usable only in `saved`; the pending states are bounded
/// operations that cannot initiate a transfer.
enum DeviceRelationshipStateModel: Equatable, Sendable {
case pendingOutgoing
case pendingIncoming
case saved
case revoked
case blocked
}
struct DeviceRelationshipModel: Equatable, Identifiable, Sendable {
let remoteEndpointId: String
let state: DeviceRelationshipStateModel
let generation: UInt64
let minimumProtocolVersion: UInt16
let createdAt: Int64
let updatedAt: Int64
var id: String { remoteEndpointId }
}
/// Single-use permission to *ask* to pair, created by a fully completed
/// authenticated transfer and expiring 24 hours later. Consumed by pairing,
/// declining, expiry, forget, block, or reset.
struct PairingEligibilityModel: Equatable, Identifiable, Sendable {
let peerEndpointId: String
/// Untrusted display-name hint from the qualifying transfer. Usually the only
/// name available for a peer that is not saved yet.
let remoteDisplayName: String?
let sessionId: String
let protocolVersion: UInt16
let createdAt: Int64
let expiresAt: Int64
var id: String { peerEndpointId }
}
/// A pre-approval targeted offer awaiting a local approve/decline. Lives only in
/// the core's bounded live-session queue — a restart, timeout, disconnect, or
/// sender cancellation removes it, so it is never durable UI state.
struct PendingTargetedOfferModel: Equatable, Identifiable, Sendable {
let transferId: String
let senderEndpointId: String
let receiverEndpointId: String
let manifestId: String
let contentHash: String
/// Peer-supplied and untrusted; render it as text, never as a path.
let transferName: String
let fileCount: UInt64
let totalSize: UInt64
let protocolVersion: UInt16
let receivedAt: Int64
var id: String { transferId }
}
/// Durable targeted-transfer lifecycle. Rust validates every transition; the UI
/// only invokes typed operations and renders the snapshot it gets back.
enum TargetedTransferStateModel: Equatable, Sendable {
case preparing
case offering
case awaitingApproval
case approved
case connecting
case transferring
case interrupted
case completed
case declined
case cancelled
case failed
case deleted
}
struct TargetedTransferModel: Equatable, Identifiable, Sendable {
let id: String
let senderEndpointId: String
let receiverEndpointId: String
let manifestId: String
/// Peer-supplied and untrusted; render it as text, never as a path.
let transferName: String
let fileCount: UInt64
let totalSize: UInt64
/// Bytes verified so far; survives interruption for resume.
let verifiedBytes: UInt64
let state: TargetedTransferStateModel
let createdAt: Int64
let updatedAt: Int64
}
/// Outcome of responding to a targeted offer. `alreadySettled` is the idempotent
/// replay path — the core returns the existing result rather than creating a
/// duplicate approval.
enum TargetedOfferResponseModel: Equatable, Sendable {
case approved(transferId: String)
case declined
case alreadySettled(transferId: String)
}
// MARK: - Lifecycle helpers
extension TargetedTransferStateModel {
/// States where bytes may still move, so progress is meaningful.
var isActive: Bool {
switch self {
case .connecting, .transferring: return true
default: return false
}
}
/// No further transition is possible without creating a new transfer.
var isTerminal: Bool {
switch self {
case .completed, .declined, .cancelled, .failed, .deleted: return true
default: return false
}
}
/// Cancellation withdraws the offer before approval and stops authorization
/// plus active streaming after it. Terminal transfers have nothing to stop.
var canCancel: Bool { !isTerminal }
/// An interrupted transfer keeps its verified progress and resumes the same
/// immutable transfer without asking for approval again.
var canResume: Bool { self == .interrupted }
/// The receiver pulls content once the sender's authorization is in place.
var canReceive: Bool { self == .approved }
/// Deletion makes authorization unusable and removes resumable state. Offered
/// on anything already terminal except an entry that is itself deleted.
var canDelete: Bool { isTerminal && self != .deleted }
}
extension TargetedTransferModel {
/// Fraction of verified payload in `0...1`, or nil when the total is unknown
/// or the state carries no meaningful progress.
var progressFraction: Double? {
guard totalSize > 0, state.isActive || state == .interrupted else { return nil }
return min(1, Double(verifiedBytes) / Double(totalSize))
}
}
extension PairingEligibilityModel {
func isExpired(now: Int64) -> Bool { now >= expiresAt }
}
private extension String {
var trimmed: String { trimmingCharacters(in: .whitespacesAndNewlines) }
}