Scope authenticated delivery cleanup

2026-07-26 12:05:20 +00:00 · 2026-07-25 23:00:28 +02:00
parent 8998660139
commit c12b341d8a
12 changed files with 684 additions and 73 deletions
@@ -357,6 +357,78 @@ struct ChatViewModelDeliveryStatusTests {
        #expect(transport.sentPrivateMessages.count == 2)
    }

+    @Test @MainActor
+    func authenticatedNoiseAckClearsOnlyIntendedPeersPrivateMediaRetry() async throws {
+        let (viewModel, transport) = makeTestableViewModel()
+        let intendedPeer = PeerID(str: "0102030405060708")
+        let otherPeer = PeerID(str: "1112131415161718")
+        let fileName = "voice_0011223344556677.m4a"
+        let content = Data("voice".utf8)
+
+        transport.privateMediaPolicies[intendedPeer] = .encrypted
+        transport.privateMediaReceiptSessionGenerations[intendedPeer] = UUID()
+        viewModel.selectedPrivateChatPeer = intendedPeer
+        let coordinator = ChatMediaTransferCoordinator(
+            context: viewModel,
+            prepareVoiceNotePacket: { _ in
+                BitchatFilePacket(
+                    fileName: fileName,
+                    fileSize: UInt64(content.count),
+                    mimeType: "audio/mp4",
+                    content: content
+                )
+            },
+            transferIDFactory: { "\($0)-receipt-ack" }
+        )
+        viewModel.mediaTransferCoordinator = coordinator
+
+        let directory = FileManager.default.temporaryDirectory
+            .appendingPathComponent(
+                "scoped-media-ack-\(UUID().uuidString)",
+                isDirectory: true
+            )
+        try FileManager.default.createDirectory(
+            at: directory,
+            withIntermediateDirectories: true
+        )
+        let sourceURL = directory.appendingPathComponent(fileName)
+        try content.write(to: sourceURL)
+        defer { try? FileManager.default.removeItem(at: directory) }
+
+        coordinator.sendVoiceNote(at: sourceURL)
+        #expect(await TestHelpers.waitUntil(
+            {
+                transport.sentPrivateFiles.count == 1
+                    && coordinator.retainedReconnectRetryCount == 1
+            },
+            timeout: TestConstants.longTimeout
+        ))
+        let messageID = try #require(
+            viewModel.privateChats[intendedPeer]?.first?.id
+        )
+        let transferID = try #require(
+            transport.sentPrivateFiles.first?.transferID
+        )
+
+        #expect(!viewModel.deliveryCoordinator
+            .updateAcknowledgedMessageDeliveryStatus(
+                messageID,
+                status: .delivered(to: "Other", at: Date()),
+                from: [otherPeer]
+            ))
+        #expect(coordinator.retainedReconnectRetryCount == 1)
+        #expect(transport.cancelledTransfers.isEmpty)
+
+        #expect(viewModel.deliveryCoordinator
+            .updateAcknowledgedMessageDeliveryStatus(
+                messageID,
+                status: .delivered(to: "Intended", at: Date()),
+                from: [intendedPeer]
+            ))
+        #expect(coordinator.retainedReconnectRetryCount == 0)
+        #expect(transport.cancelledTransfers == [transferID])
+    }
+
    @Test @MainActor
    func cleanupOldReadReceipts_removesReceiptIDsWithoutMessages() async {
        let (viewModel, transport) = makeTestableViewModel()
@@ -643,6 +715,19 @@ private final class MockChatDeliveryContext: ChatDeliveryContext {
        store.setDeliveryStatus(status, forMessageID: messageID)
    }

+    @discardableResult
+    func setDeliveryStatus(
+        _ status: DeliveryStatus,
+        forMessageID messageID: String,
+        inDirectPeerAliases peerIDs: Set<PeerID>
+    ) -> Bool {
+        store.setDeliveryStatus(
+            status,
+            forMessageID: messageID,
+            inDirectPeerAliases: peerIDs
+        )
+    }
+
    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
        store.deliveryStatus(forMessageID: messageID)
    }
@@ -769,6 +854,94 @@ struct ChatDeliveryCoordinatorContextTests {
        #expect(context.peerBoundDeliveredMessages[0].peerIDs == [peerID])
    }

+    @Test @MainActor
+    func authenticatedReceiptWithCollidingIDUpdatesOnlyAuthenticatedAliases() async {
+        let context = MockChatDeliveryContext()
+        let coordinator = ChatDeliveryCoordinator(context: context)
+        let ephemeralPeerID = PeerID(str: "0102030405060708")
+        let stablePeerID = PeerID(hexData: Data(repeating: 0x08, count: 32))
+        let otherPeerID = PeerID(str: "1112131415161718")
+        let messageID = "authenticated-receipt-collision"
+        let mirroredMessage = makePrivateMessage(id: messageID, status: .sent)
+
+        context.store.append(mirroredMessage, to: .directPeer(ephemeralPeerID))
+        context.store.append(mirroredMessage, to: .directPeer(stablePeerID))
+        context.store.append(
+            makePrivateMessage(id: messageID, status: .sent),
+            to: .directPeer(otherPeerID)
+        )
+        context.store.append(makePublicMessage(id: messageID, status: .sent), to: .mesh)
+
+        let aliases: Set<PeerID> = [ephemeralPeerID, stablePeerID]
+        let didUpdate = coordinator.updateAcknowledgedMessageDeliveryStatus(
+            messageID,
+            status: .delivered(to: "Peer", at: Date()),
+            from: aliases
+        )
+
+        #expect(didUpdate)
+        #expect(isDelivered(
+            context.store.conversation(for: .directPeer(ephemeralPeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isDelivered(
+            context.store.conversation(for: .directPeer(stablePeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isSent(
+            context.store.conversation(for: .directPeer(otherPeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isSent(
+            context.store.conversation(for: .mesh)
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(context.peerBoundDeliveredMessages.count == 1)
+        #expect(context.peerBoundDeliveredMessages[0].messageID == messageID)
+        #expect(context.peerBoundDeliveredMessages[0].peerIDs == aliases)
+        #expect(context.notifyUIChangedCount == 1)
+    }
+
+    @Test @MainActor
+    func authenticatedReceiptRemainsScopedAfterPeerAliasMigration() async {
+        let context = MockChatDeliveryContext()
+        let coordinator = ChatDeliveryCoordinator(context: context)
+        let ephemeralPeerID = PeerID(str: "2122232425262728")
+        let stablePeerID = PeerID(hexData: Data(repeating: 0x28, count: 32))
+        let otherPeerID = PeerID(str: "3132333435363738")
+        let messageID = "authenticated-receipt-after-migration"
+
+        context.store.append(
+            makePrivateMessage(id: messageID, status: .sent),
+            to: .directPeer(ephemeralPeerID)
+        )
+        context.store.append(
+            makePrivateMessage(id: messageID, status: .sent),
+            to: .directPeer(otherPeerID)
+        )
+        context.store.migrateConversation(
+            from: .directPeer(ephemeralPeerID),
+            to: .directPeer(stablePeerID)
+        )
+
+        let didUpdate = coordinator.updateAcknowledgedMessageDeliveryStatus(
+            messageID,
+            status: .read(by: "Peer", at: Date()),
+            from: [ephemeralPeerID, stablePeerID]
+        )
+
+        #expect(didUpdate)
+        #expect(context.store.conversationsByID[.directPeer(ephemeralPeerID)] == nil)
+        #expect(isRead(
+            context.store.conversation(for: .directPeer(stablePeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+        #expect(isSent(
+            context.store.conversation(for: .directPeer(otherPeerID))
+                .message(withID: messageID)?.deliveryStatus
+        ))
+    }
+
    @Test @MainActor
    func receiptFromWrongPeerDoesNotUpdateOrTerminalizeOutgoingMessage() async {
        let context = MockChatDeliveryContext()
@@ -755,6 +755,71 @@ struct ConversationStoreTests {
        #expect(statusChangedIDs.isEmpty)
    }

+    @Test("peer-scoped receipt updates only authenticated direct aliases")
+    @MainActor
+    func peerScopedReceiptUpdatesOnlyAuthenticatedDirectAliases() {
+        let store = ConversationStore()
+        let ephemeralPeer = PeerID(str: "0102030405060708")
+        let stablePeer = PeerID(hexData: Data(repeating: 0x08, count: 32))
+        let otherPeer = PeerID(str: "1112131415161718")
+        let ephemeral = ConversationID.directPeer(ephemeralPeer)
+        let stable = ConversationID.directPeer(stablePeer)
+        let other = ConversationID.directPeer(otherPeer)
+        let messageID = "scoped-receipt"
+        let mirrored = makeMessage(
+            id: messageID,
+            timestamp: 1,
+            isPrivate: true,
+            deliveryStatus: .sent
+        )
+        store.upsertByID(mirrored, in: ephemeral)
+        store.upsertByID(mirrored, in: stable)
+        store.upsertByID(
+            makeMessage(
+                id: messageID,
+                timestamp: 1,
+                isPrivate: true,
+                deliveryStatus: .sent
+            ),
+            in: other
+        )
+        store.upsertByID(
+            makeMessage(id: messageID, timestamp: 1, deliveryStatus: .sent),
+            in: .mesh
+        )
+
+        var cancellables = Set<AnyCancellable>()
+        var publishedIDs: [ConversationID] = []
+        for id in [ephemeral, stable, other, .mesh] {
+            store.conversation(for: id).objectWillChange
+                .sink { publishedIDs.append(id) }
+                .store(in: &cancellables)
+        }
+        var statusChangedIDs: [ConversationID] = []
+        store.changes
+            .sink { change in
+                if case .statusChanged(let id, messageID, _) = change,
+                   messageID == "scoped-receipt" {
+                    statusChangedIDs.append(id)
+                }
+            }
+            .store(in: &cancellables)
+
+        let delivered = DeliveryStatus.delivered(to: "bob", at: Date())
+        #expect(store.setDeliveryStatus(
+            delivered,
+            forMessageID: messageID,
+            inDirectPeerAliases: [ephemeralPeer, stablePeer]
+        ))
+
+        #expect(Set(publishedIDs) == Set([ephemeral, stable]))
+        #expect(Set(statusChangedIDs) == Set([ephemeral, stable]))
+        #expect(store.conversation(for: ephemeral).message(withID: messageID)?.deliveryStatus == delivered)
+        #expect(store.conversation(for: stable).message(withID: messageID)?.deliveryStatus == delivered)
+        #expect(store.conversation(for: other).message(withID: messageID)?.deliveryStatus == .sent)
+        #expect(store.conversation(for: .mesh).message(withID: messageID)?.deliveryStatus == .sent)
+    }
+
    // MARK: - Invariant audit (field observability)

    /// A store exercised through every intent family: public + geohash +
@@ -65,6 +65,7 @@ final class MockTransport: Transport, PrivateMediaDeletionPersisting {
    var peerFingerprints: [PeerID: String] = [:]
    var peerNoiseStates: [PeerID: LazyHandshakeState] = [:]
    var privateMediaPolicies: [PeerID: PrivateMediaSendPolicy] = [:]
+    var privateMediaReceiptSessionGenerations: [PeerID: UUID] = [:]
    var persistDeletedPrivateMediaResult = true
    var deferDeletedPrivateMediaPersistence = false
    private var pendingDeletedPrivateMediaCompletions: [
@@ -223,6 +224,12 @@ final class MockTransport: Transport, PrivateMediaDeletionPersisting {
        privateMediaPolicies[peerID] ?? .encrypted
    }

+    func authenticatedPrivateMediaReceiptSessionGeneration(
+        to peerID: PeerID
+    ) -> UUID? {
+        privateMediaReceiptSessionGenerations[peerID]
+    }
+
    func resolvePrivateMediaSendPolicy(
        to peerID: PeerID,
        completion: @escaping @MainActor (PrivateMediaSendPolicy) -> Void
@@ -700,6 +700,19 @@ private final class PerfDeliveryContext: ChatDeliveryContext {
        store.setDeliveryStatus(status, forMessageID: messageID)
    }

+    @discardableResult
+    func setDeliveryStatus(
+        _ status: DeliveryStatus,
+        forMessageID messageID: String,
+        inDirectPeerAliases peerIDs: Set<PeerID>
+    ) -> Bool {
+        store.setDeliveryStatus(
+            status,
+            forMessageID: messageID,
+            inDirectPeerAliases: peerIDs
+        )
+    }
+
    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
        store.deliveryStatus(forMessageID: messageID)
    }
@@ -203,6 +203,134 @@ struct BridgeCourierServiceTests {
        #expect(confirmed.sealRequests.isEmpty)
    }

+    @Test func sameMessageIDIsScopedByRecipientAcrossRejectedActiveAndPersistedState() {
+        let fileURL = FileManager.default.temporaryDirectory
+            .appendingPathComponent("bridge-dedup-\(UUID().uuidString).json")
+        defer { try? FileManager.default.removeItem(at: fileURL) }
+        let rejectedKey = Fixture.randomKey()
+        let firstKey = Fixture.randomKey()
+        let secondKey = Fixture.randomKey()
+        let thirdKey = Fixture.randomKey()
+        let messageID = "recipient-scoped-collision"
+
+        let fixture = Fixture(dedupStore: BridgeDropDedupStore(fileURL: fileURL))
+        fixture.sealResult = makeEnvelope(
+            recipientKey: rejectedKey,
+            ciphertext: Data(
+                repeating: 7,
+                count: BridgeCourierService.Limits.maxDropEnvelopeBytes + 1
+            )
+        )
+        var rejectedResults: [Bool] = []
+        fixture.service.depositDrop(
+            content: "rejected",
+            messageID: messageID,
+            recipientNoiseKey: rejectedKey
+        ) { rejectedResults.append($0) }
+        #expect(rejectedResults == [false])
+
+        fixture.sealResult = makeEnvelope(recipientKey: firstKey)
+        fixture.automaticPublishResult = nil
+        var firstResults: [Bool] = []
+        var secondResults: [Bool] = []
+        var duplicateFirstResults: [Bool] = []
+        fixture.service.depositDrop(
+            content: "first",
+            messageID: messageID,
+            recipientNoiseKey: firstKey
+        ) { firstResults.append($0) }
+        fixture.service.depositDrop(
+            content: "second",
+            messageID: messageID,
+            recipientNoiseKey: secondKey
+        ) { secondResults.append($0) }
+        fixture.service.depositDrop(
+            content: "first duplicate",
+            messageID: messageID,
+            recipientNoiseKey: firstKey
+        ) { duplicateFirstResults.append($0) }
+
+        #expect(fixture.publishedEvents.count == 2)
+        #expect(fixture.pendingPublishCompletions.count == 2)
+        #expect(duplicateFirstResults == [false])
+        #expect(firstResults.isEmpty)
+        #expect(secondResults.isEmpty)
+
+        fixture.resolveNextPublish(true)
+        fixture.resolveNextPublish(true)
+        #expect(firstResults == [true])
+        #expect(secondResults == [true])
+        fixture.service.flushDedupSnapshot()
+
+        let relaunched = Fixture(
+            dedupStore: BridgeDropDedupStore(fileURL: fileURL)
+        )
+        relaunched.sealResult = makeEnvelope(recipientKey: thirdKey)
+        var relaunchResults: [Bool] = []
+        relaunched.service.depositDrop(
+            content: "first",
+            messageID: messageID,
+            recipientNoiseKey: firstKey
+        ) { relaunchResults.append($0) }
+        relaunched.service.depositDrop(
+            content: "second",
+            messageID: messageID,
+            recipientNoiseKey: secondKey
+        ) { relaunchResults.append($0) }
+        relaunched.service.depositDrop(
+            content: "third",
+            messageID: messageID,
+            recipientNoiseKey: thirdKey
+        ) { relaunchResults.append($0) }
+
+        #expect(relaunchResults == [false, false, true])
+        #expect(relaunched.sealRequests.count == 1)
+        #expect(relaunched.sealRequests.first?.key == thirdKey)
+        #expect(relaunched.publishedEvents.count == 1)
+    }
+
+    @Test func legacyPublishedMessageIDIsWildcardUntilItsOriginalExpiry() {
+        let fileURL = FileManager.default.temporaryDirectory
+            .appendingPathComponent("bridge-dedup-\(UUID().uuidString).json")
+        defer { try? FileManager.default.removeItem(at: fileURL) }
+        var date = Date()
+        let messageID = "legacy-wildcard"
+        let recipientKey = Fixture.randomKey()
+        let store = BridgeDropDedupStore(fileURL: fileURL)
+        store.save(BridgeDropDedupStore.Snapshot(
+            publishedDropKeys: [messageID: date],
+            seenDropEventIDs: [:]
+        ))
+
+        let fixture = Fixture(
+            now: { date },
+            dedupStore: BridgeDropDedupStore(fileURL: fileURL)
+        )
+        fixture.sealResult = makeEnvelope(recipientKey: recipientKey)
+        var results: [Bool] = []
+        fixture.service.depositDrop(
+            content: "legacy",
+            messageID: messageID,
+            recipientNoiseKey: recipientKey
+        ) { results.append($0) }
+        #expect(results == [false])
+        #expect(fixture.sealRequests.isEmpty)
+
+        date = date.addingTimeInterval(CourierEnvelope.maxLifetimeSeconds + 1)
+        fixture.service.depositDrop(
+            content: "after expiry",
+            messageID: messageID,
+            recipientNoiseKey: recipientKey
+        ) { results.append($0) }
+        #expect(results == [false, true])
+        #expect(fixture.publishedEvents.count == 1)
+        fixture.service.flushDedupSnapshot()
+
+        let snapshot = BridgeDropDedupStore(fileURL: fileURL).load()
+        #expect(snapshot.publishedDropKeys[messageID] == nil)
+        #expect(snapshot.publishedDropKeys.count == 1)
+    }
+
    @Test func panicWipeInvalidatesInFlightPublishCompletion() throws {
        let fileURL = FileManager.default.temporaryDirectory
            .appendingPathComponent("bridge-dedup-\(UUID().uuidString).json")
@@ -297,8 +425,10 @@ struct BridgeCourierServiceTests {
        #expect(firstResults == [false])

        // The evicted first drop is deposit-able again (slot released).
+        let sealCountBeforeRetry = fixture.sealRequests.count
        fixture.service.depositDrop(content: "0-retry", messageID: firstID, recipientNoiseKey: key)
-        #expect(fixture.service.pendingDrops.last?.dedupKey == firstID)
+        #expect(fixture.sealRequests.count == sealCountBeforeRetry + 1)
+        #expect(fixture.service.pendingDrops.count == BridgeCourierService.Limits.maxPendingDrops)
    }

    @Test func oversizeDropConsumesSlotInsteadOfChurning() {
@@ -188,6 +188,58 @@ struct MessageRouterTests {
        router.markDelivered("normal-handshake")
    }

+    @Test @MainActor
+    func authenticationRetry_scopesCollidingMessageIDsByPeer() async {
+        let securePeer = PeerID(str: "0000000000000025")
+        let pendingPeer = PeerID(str: "0000000000000026")
+        let transport = MockTransport()
+        transport.connectedPeers = [securePeer, pendingPeer]
+        transport.securePeers = [securePeer]
+
+        let router = MessageRouter(transports: [transport])
+        let promotedID = "collision-promoted"
+        let clearedID = "collision-cleared"
+
+        // Pending B then secure A: an ID-global marker falsely promotes B.
+        router.sendPrivate(
+            "pending promoted",
+            to: pendingPeer,
+            recipientNickname: "Pending",
+            messageID: promotedID
+        )
+        router.sendPrivate(
+            "secure promoted",
+            to: securePeer,
+            recipientNickname: "Secure",
+            messageID: promotedID
+        )
+
+        // Secure A then pending B: an ID-global removal falsely clears A.
+        router.sendPrivate(
+            "secure cleared",
+            to: securePeer,
+            recipientNickname: "Secure",
+            messageID: clearedID
+        )
+        router.sendPrivate(
+            "pending cleared",
+            to: pendingPeer,
+            recipientNickname: "Pending",
+            messageID: clearedID
+        )
+
+        transport.resetRecordings()
+        transport.securePeers = [securePeer, pendingPeer]
+
+        router.retrySecurePrivateMessagesAfterAuthentication(for: [pendingPeer])
+        #expect(transport.sentPrivateMessages.isEmpty)
+
+        router.retrySecurePrivateMessagesAfterAuthentication(for: [securePeer])
+        #expect(transport.sentPrivateMessages.count == 2)
+        #expect(Set(transport.sentPrivateMessages.map(\.messageID)) == [promotedID, clearedID])
+        #expect(transport.sentPrivateMessages.allSatisfy { $0.peerID == securePeer })
+    }
+
    @Test @MainActor
    func authenticationRetry_doesNotDuplicateMessageRequeuedByBLEForHandshake() async {
        let peerID = PeerID(str: "0000000000000021")
@@ -713,6 +765,52 @@ struct MessageRouterTests {
        #expect(carried == ["bridge-ack"])
    }

+    @Test @MainActor
+    func bridgeDepositsScopeCollidingMessageIDsByRecipient() async {
+        let firstRecipient = PeerID(str: "00000000000000b1")
+        let secondRecipient = PeerID(str: "00000000000000b2")
+        let firstKey = Data(repeating: 0xB1, count: 32)
+        let secondKey = Data(repeating: 0xB2, count: 32)
+        let recipientKeys = [
+            firstRecipient: firstKey,
+            secondRecipient: secondKey
+        ]
+        let router = MessageRouter(
+            transports: [MockTransport()],
+            courierDirectory: CourierDirectory(
+                noiseKey: { recipientKeys[$0] },
+                isTrustedCourier: { _ in false }
+            )
+        )
+        var requestedKeys: [Data] = []
+        var completions: [@MainActor (Bool) -> Void] = []
+        router.bridgeCourierDeposit = { _, _, recipientKey, completion in
+            requestedKeys.append(recipientKey)
+            completions.append(completion)
+        }
+        var carriedPeers: [PeerID] = []
+        router.onMessageCarried = { _, peerID in carriedPeers.append(peerID) }
+
+        router.sendPrivate(
+            "First",
+            to: firstRecipient,
+            recipientNickname: "First",
+            messageID: "bridge-collision"
+        )
+        router.sendPrivate(
+            "Second",
+            to: secondRecipient,
+            recipientNickname: "Second",
+            messageID: "bridge-collision"
+        )
+
+        #expect(completions.count == 2)
+        #expect(Set(requestedKeys) == [firstKey, secondKey])
+
+        completions.forEach { $0(true) }
+        #expect(Set(carriedPeers) == [firstRecipient, secondRecipient])
+    }
+
    // MARK: - Outbox persistence

    @Test @MainActor
@@ -829,7 +927,10 @@ struct MessageRouterTests {
        transport.reachablePeers.formUnion([acknowledgedPeer, otherPeer])
        let router = MessageRouter(transports: [transport], outboxStore: restoredStore)

-        #expect(!router.markDelivered("shared-locked-id", for: [acknowledgedPeer]))
+        router.markDelivered(
+            "shared-locked-id",
+            from: [acknowledgedPeer]
+        )
        protectedDataUnavailable = false
        restoredStore.retryDeferredLoad()
        await Task.yield()