mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-25 10:45:20 +00:00
* Friend-courier store-and-forward: mutual favorites carry sealed messages to offline peers When a private message has no reachable transport, the router now seals it to the recipient's Noise static key (new one-way Noise X pattern) and hands the envelope to up to three connected mutual favorites. Couriers store the opaque ciphertext under strict quotas (20 total, 5 per depositor, 16 KiB, 24 h) and hand it over when the recipient's announce matches a rotating HMAC recipient tag; the recipient opens it and the message flows through the normal private-message pipeline, so dedup and delivery acks just work. - CourierEnvelope TLV + courierEnvelope (0x04) message type in BitFoundation - Noise X one-way pattern reusing the existing handshake machinery, domain-separated by a courier prologue; sender identity authenticated via the ss DH (no forward secrecy - documented tradeoff) - CourierStore with eviction, file persistence, and panic-wipe integration - Rotating recipient tags (HMAC over epoch day) so carried envelopes don't correlate for observers who don't already know the recipient's key - New "carried" delivery status with figure.walk glyph; header indicator while carrying mail for others - Three-node end-to-end test ferrying packets through real BLEService instances, plus codec/crypto/store/router suites (986 tests green) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix courier handoff verification and directed sends * Authenticate courier deposits by ingress peer * Gate courier handover on direct announces and isolate store test Envelopes are removed from the courier store optimistically, so releasing them on a relayed (multi-hop) announce risks losing carried mail to a speculative flood that never reaches the recipient. Handover now also requires the announce to have arrived directly (full TTL), i.e. an actual encounter with a live link; regression test builds a relayed copy of a genuinely signed announce (TTL is excluded from announce signatures). Also make CourierStore's on-disk location injectable so the persistence test round-trips through a temp directory instead of wiping the real Application Support store, and reattach BLEAnnounceHandler's doc comment to the class it describes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Use Xcode-bundled Swift in CI instead of a standalone toolchain The unpinned setup-swift action installs Swift 6.1, which refuses the SDK on runner images that have rolled to Xcode 26.5 ("this SDK is not supported by the compiler"). Jobs passed or failed depending on which image they landed on. The Xcode-bundled toolchain always matches the image's SDK, and matches local development. Cache keys now include the toolchain version so artifacts from one compiler are never restored into builds with another. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop couriered mail from blocked senders at envelope open The UI-layer block check (isPeerBlocked in the transport event coordinator) resolves a fingerprint from the live session or peer list, but a couriered message arrives precisely when its sender is absent — no session, no registry entry — so the check failed open and a blocked identity's mail was delivered anyway. Gate in openCourierEnvelope, where the sealed sender's full static key is in hand. End-to-end test ferries a full deposit→carry→handover round and verifies the envelope from a blocked sender never reaches the delegate (confirmed failing without the gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix favorites end-to-end: peer-list dedup, Nostr sync, /fav key corruption - UnifiedPeerService: dedup offline favorites against mesh peers by noise key. Phase 2 compared a 64-hex noise-key PeerID against 16-hex mesh IDs (never equal), leaving only a nickname+isConnected heuristic — a mutual favorite that was reachable-but-not-connected or renamed rendered twice, and a same-nick stranger could suppress a favorite entirely. - Nostr inbound: intercept [FAVORITED]/[UNFAVORITED] markers in the live PM handler so they update theyFavoritedUs instead of rendering as chat text; mutual favorites can now form over Nostr. Delete the dead favorite-aware PM variant and ChatNostrCoordinator.handleFavoriteNotification (unwired, parsed a stale FAVORITE:TRUE|… format no sender emits). - NostrTransport.isPeerReachable: match short form regardless of incoming ID width — toggling an offline favorite (addressed by 64-hex noise key) was silently dropped with no reachable transport. - BLEService.sendPrivateMessage: normalize recipient to the short ID like sendFilePrivate, so a 64-hex target hits the existing Noise session instead of initiating a handshake with a 32-byte wire recipient ID. - /fav, /unfav: stop writing Data(hexString: peerID.id) — the 8-byte routing ID for mesh peers — into the favorites store as a "noise key", and stop double-sending the favorite notification; delegate to toggleFavorite with a proper state check. - FavoritesPersistenceService.updatePeerFavoritedUs: keep the stored nickname when the caller passes the "Unknown" placeholder. - Bump marketing version to 1.5.4. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Route DMs to mutual favorites via Nostr when a mesh-keyed peer goes offline Field-tested on device: with a DM window opened while the peer was on mesh (conversation keyed by the short 16-hex ID), walking out of range and sending failed instantly with "peer not reachable" even though the header showed the peer as Nostr-reachable (mutual favorite, npub known). sendPrivateMessage derived the favorites key as Data(hexString: peerID.id) — for a short mesh ID that is the 8-byte routing ID, never the noise key — so the mutual-favorite/Nostr-key checks always came up empty and the send failed before reaching MessageRouter. Conversations keyed by the full 64-hex noise-key ID (opened from the offline favorite row) were unaffected, which is why later tests appeared to work. Resolve the noise key properly (peerID.noiseKey, then the unified peer row, then the favorites store by derived short ID) and add a regression test for the mesh-keyed-peer-goes-offline case. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Label Nostr DMs from favorites with their stored nickname Field-tested: a DM delivered over the Nostr fallback rendered as "anon#678e" instead of the sender's name. The inbound handler named the sender via displayNameForNostrPubkey, which only knows geohash-scoped names — even though the pipeline had already resolved the sender's noise key (the conversation is keyed by it). When the conversation key carries a noise key, prefer the favorite's stored nickname; geohash DMs (nostr_ keys) keep the anon geo name. This also stops an inbound Nostr [FAVORITED] from overwriting the stored nickname with the anon fallback, since the same name feeds updatePeerFavoritedUs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Fix courier path for offline favorites addressed by noise-key IDs Two Codex review findings, both the same ID-width confusion this PR targets, in the courier flow: - CourierDirectory.favoritesBacked resolved recipients only via getFavoriteStatus(forPeerID:), which requires a short 16-hex ID — offline favorites are addressed by the full 64-hex noise-key ID, so attemptCourierDeposit silently bailed for exactly the peers couriers exist to serve. The 64-hex ID now yields its own key directly. - openCourierEnvelope emitted the derived short mesh ID even when the sender has no live mesh identity, landing couriered mail in an unresolvable short-ID thread labeled "Unknown". Absent senders now emit the full noise-key ID so the message joins the stable favorite conversation; present senders keep the live short-ID thread. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: jack <jackjackbits@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
293 lines
12 KiB
Swift
293 lines
12 KiB
Swift
//
|
|
// PrivateChatManager.swift
|
|
// bitchat
|
|
//
|
|
// Manages private chat sessions and messages
|
|
// This is free and unencumbered software released into the public domain.
|
|
//
|
|
|
|
import BitLogger
|
|
import BitFoundation
|
|
import Combine
|
|
import Foundation
|
|
import SwiftUI
|
|
|
|
/// Manages private chat session policy (selection, read receipts,
|
|
/// consolidation). Message storage lives in the single-writer
|
|
/// `ConversationStore` (docs/CONVERSATION-STORE-DESIGN.md); the
|
|
/// `privateChats` / `unreadMessages` properties below are read-only views
|
|
/// derived from it.
|
|
@MainActor
|
|
final class PrivateChatManager: ObservableObject {
|
|
/// Read-only mirror of `ConversationStore.selectedPrivatePeerID` — the
|
|
/// store is the sole owner of conversation selection. Kept `@Published`
|
|
/// so existing observers (`objectWillChange` forwarding into
|
|
/// `ChatViewModel`) keep firing on selection changes. Mutate via
|
|
/// `startChat(with:)` / `endChat()`, which route through the store's
|
|
/// `setSelectedPrivatePeer` intent.
|
|
@Published private(set) var selectedPeer: PeerID? = nil
|
|
private var selectedPeerMirrorCancellable: AnyCancellable? = nil
|
|
|
|
private var selectedPeerFingerprint: String? = nil
|
|
var sentReadReceipts: Set<String> = [] // Made accessible for ChatViewModel
|
|
|
|
weak var meshService: Transport?
|
|
// Route acks/receipts via MessageRouter (chooses mesh or Nostr)
|
|
weak var messageRouter: MessageRouter?
|
|
// Peer service for looking up peer info during consolidation
|
|
weak var unifiedPeerService: UnifiedPeerService?
|
|
/// Single source of truth for message and selection state; injected by
|
|
/// the bootstrapper (`wireServiceGraph`).
|
|
var conversationStore: ConversationStore? {
|
|
didSet { bindSelectionMirror() }
|
|
}
|
|
|
|
init(meshService: Transport? = nil, conversationStore: ConversationStore? = nil) {
|
|
self.meshService = meshService
|
|
self.conversationStore = conversationStore
|
|
bindSelectionMirror() // didSet does not fire during init
|
|
}
|
|
|
|
/// Keeps `selectedPeer` in lock-step with the store's selection axis
|
|
/// (including store-internal handoffs such as conversation migration).
|
|
private func bindSelectionMirror() {
|
|
guard let store = conversationStore else {
|
|
selectedPeerMirrorCancellable = nil
|
|
return
|
|
}
|
|
selectedPeerMirrorCancellable = store.$selectedPrivatePeerID
|
|
.sink { [weak self] peerID in
|
|
guard let self, self.selectedPeer != peerID else { return }
|
|
self.selectedPeer = peerID
|
|
}
|
|
}
|
|
|
|
// MARK: - Derived message state (read-only compat views)
|
|
|
|
/// All private chats keyed by routing peer ID, derived from the store.
|
|
/// Mutations go through the store's intent API only.
|
|
@MainActor
|
|
var privateChats: [PeerID: [BitchatMessage]] {
|
|
conversationStore?.directMessagesByRoutingPeerID() ?? [:]
|
|
}
|
|
|
|
/// Unread chats, derived from the store's unread state.
|
|
@MainActor
|
|
var unreadMessages: Set<PeerID> {
|
|
conversationStore?.unreadDirectRoutingPeerIDs() ?? []
|
|
}
|
|
|
|
@MainActor
|
|
private func messages(for peerID: PeerID) -> [BitchatMessage] {
|
|
conversationStore?.conversationsByID[.directPeer(peerID)]?.messages ?? []
|
|
}
|
|
|
|
// MARK: - Message Consolidation
|
|
|
|
/// Consolidates messages from different peer ID representations into a single chat.
|
|
/// This ensures messages from stable Noise keys and temporary Nostr peer IDs are merged.
|
|
/// - Parameters:
|
|
/// - peerID: The target peer ID to consolidate messages into
|
|
/// - peerNickname: The peer's display name (lowercased for matching)
|
|
/// - persistedReadReceipts: The persisted read receipts set from ChatViewModel (UserDefaults-backed)
|
|
/// - Returns: True if any unread messages were found during consolidation
|
|
@MainActor
|
|
func consolidateMessages(for peerID: PeerID, peerNickname: String, persistedReadReceipts: Set<String>) -> Bool {
|
|
guard let meshService = meshService, let store = conversationStore else { return false }
|
|
var hasUnreadMessages = false
|
|
|
|
// 1. Consolidate from stable Noise key (64-char hex)
|
|
if let peer = unifiedPeerService?.getPeer(by: peerID) {
|
|
let noiseKeyHex = PeerID(hexData: peer.noisePublicKey)
|
|
let nostrMessages = messages(for: noiseKeyHex)
|
|
|
|
if noiseKeyHex != peerID, !nostrMessages.isEmpty {
|
|
for message in nostrMessages {
|
|
// Update senderPeerID for correct read receipts
|
|
let updatedMessage = BitchatMessage(
|
|
id: message.id,
|
|
sender: message.sender,
|
|
content: message.content,
|
|
timestamp: message.timestamp,
|
|
isRelay: message.isRelay,
|
|
originalSender: message.originalSender,
|
|
isPrivate: message.isPrivate,
|
|
recipientNickname: message.recipientNickname,
|
|
senderPeerID: message.senderPeerID == meshService.myPeerID ? meshService.myPeerID : peerID,
|
|
mentions: message.mentions,
|
|
deliveryStatus: message.deliveryStatus
|
|
)
|
|
// Store append dedups by message ID (skips ones the
|
|
// target chat already has).
|
|
guard store.append(updatedMessage, to: .directPeer(peerID)) else { continue }
|
|
|
|
// Check for recent unread messages (< 60s, not sent by us, not already read)
|
|
// Use persistedReadReceipts to correctly identify already-read messages after app restart
|
|
if message.senderPeerID != meshService.myPeerID {
|
|
let messageAge = Date().timeIntervalSince(message.timestamp)
|
|
if messageAge < 60 && !persistedReadReceipts.contains(message.id) {
|
|
hasUnreadMessages = true
|
|
}
|
|
}
|
|
}
|
|
|
|
if hasUnreadMessages {
|
|
store.markUnread(.directPeer(peerID))
|
|
} else {
|
|
store.markRead(.directPeer(noiseKeyHex))
|
|
}
|
|
|
|
store.removeConversation(.directPeer(noiseKeyHex))
|
|
}
|
|
}
|
|
|
|
// 2. Consolidate from temporary Nostr peer IDs (nostr_* prefixed)
|
|
let normalizedNickname = peerNickname.lowercased()
|
|
var tempPeerIDsToConsolidate: [PeerID] = []
|
|
|
|
for (storedPeerID, messages) in privateChats {
|
|
if storedPeerID.isGeoDM && storedPeerID != peerID {
|
|
let nicknamesMatch = messages.allSatisfy { $0.sender.lowercased() == normalizedNickname }
|
|
if nicknamesMatch && !messages.isEmpty {
|
|
tempPeerIDsToConsolidate.append(storedPeerID)
|
|
}
|
|
}
|
|
}
|
|
|
|
if !tempPeerIDsToConsolidate.isEmpty {
|
|
var consolidatedCount = 0
|
|
var hadUnreadTemp = false
|
|
let unreadPeerIDs = unreadMessages
|
|
|
|
for tempPeerID in tempPeerIDsToConsolidate {
|
|
if unreadPeerIDs.contains(tempPeerID) {
|
|
hadUnreadTemp = true
|
|
}
|
|
|
|
for message in messages(for: tempPeerID) {
|
|
let updatedMessage = BitchatMessage(
|
|
id: message.id,
|
|
sender: message.sender,
|
|
content: message.content,
|
|
timestamp: message.timestamp,
|
|
isRelay: message.isRelay,
|
|
originalSender: message.originalSender,
|
|
isPrivate: message.isPrivate,
|
|
recipientNickname: message.recipientNickname,
|
|
senderPeerID: peerID,
|
|
mentions: message.mentions,
|
|
deliveryStatus: message.deliveryStatus
|
|
)
|
|
if store.append(updatedMessage, to: .directPeer(peerID)) {
|
|
consolidatedCount += 1
|
|
}
|
|
}
|
|
store.removeConversation(.directPeer(tempPeerID))
|
|
}
|
|
|
|
if hadUnreadTemp {
|
|
store.markUnread(.directPeer(peerID))
|
|
hasUnreadMessages = true
|
|
SecureLogger.debug("📬 Transferred unread status from temp peer IDs to \(peerID)", category: .session)
|
|
}
|
|
|
|
if consolidatedCount > 0 {
|
|
SecureLogger.info("📥 Consolidated \(consolidatedCount) Nostr messages from temporary peer IDs to \(peerNickname)", category: .session)
|
|
}
|
|
}
|
|
|
|
return hasUnreadMessages
|
|
}
|
|
|
|
/// Syncs the read receipt tracking between manager and view model for sent messages
|
|
@MainActor
|
|
func syncReadReceiptsForSentMessages(peerID: PeerID, nickname: String, externalReceipts: inout Set<String>) {
|
|
for message in messages(for: peerID) {
|
|
if message.sender == nickname {
|
|
if let status = message.deliveryStatus {
|
|
switch status {
|
|
case .read, .delivered:
|
|
externalReceipts.insert(message.id)
|
|
sentReadReceipts.insert(message.id)
|
|
case .failed, .partiallyDelivered, .sending, .sent, .carried:
|
|
break
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Start a private chat with a peer. Selection is mutated through the
|
|
/// store's intent (the store owns it); the manager keeps its side
|
|
/// effects (fingerprint tracking, read receipts, unread clearing).
|
|
@MainActor
|
|
func startChat(with peerID: PeerID) {
|
|
// Also creates the conversation if needed and updates the derived
|
|
// `selectedConversationID`; `selectedPeer` mirrors the change.
|
|
conversationStore?.setSelectedPrivatePeer(peerID)
|
|
|
|
// Store fingerprint for persistence across reconnections
|
|
if let fingerprint = meshService?.getFingerprint(for: peerID) {
|
|
selectedPeerFingerprint = fingerprint
|
|
}
|
|
|
|
// Mark messages as read
|
|
markAsRead(from: peerID)
|
|
}
|
|
|
|
/// End the current private chat (selection returns to the active public
|
|
/// channel's conversation).
|
|
func endChat() {
|
|
conversationStore?.setSelectedPrivatePeer(nil)
|
|
selectedPeerFingerprint = nil
|
|
}
|
|
|
|
/// No-op since the `ConversationStore` cutover: the store maintains
|
|
/// chronological order and dedups by message ID on every insert, so the
|
|
/// per-append re-sort/dedup sweep this performed is no longer needed.
|
|
/// Kept only for API compatibility until step 5 removes the callers.
|
|
func sanitizeChat(for peerID: PeerID) {}
|
|
|
|
/// Mark messages from a peer as read
|
|
@MainActor
|
|
func markAsRead(from peerID: PeerID) {
|
|
conversationStore?.markRead(.directPeer(peerID))
|
|
|
|
// Send read receipts for unread messages that haven't been sent yet
|
|
for message in messages(for: peerID) {
|
|
if message.senderPeerID == peerID && !message.isRelay && !sentReadReceipts.contains(message.id) {
|
|
sendReadReceipt(for: message)
|
|
}
|
|
}
|
|
}
|
|
|
|
// MARK: - Private Methods
|
|
|
|
private func sendReadReceipt(for message: BitchatMessage) {
|
|
guard !sentReadReceipts.contains(message.id),
|
|
let senderPeerID = message.senderPeerID else {
|
|
return
|
|
}
|
|
|
|
sentReadReceipts.insert(message.id)
|
|
|
|
// Create read receipt using the simplified method
|
|
let receipt = ReadReceipt(
|
|
originalMessageID: message.id,
|
|
readerID: meshService?.myPeerID ?? PeerID(str: ""),
|
|
readerNickname: meshService?.myNickname ?? ""
|
|
)
|
|
|
|
// Route via MessageRouter to avoid handshakeRequired spam when session isn't established
|
|
if let router = messageRouter {
|
|
SecureLogger.debug("PrivateChatManager: sending READ ack for \(message.id.prefix(8))… to \(senderPeerID.id.prefix(8))… via router", category: .session)
|
|
Task { @MainActor in
|
|
router.sendReadReceipt(receipt, to: senderPeerID)
|
|
}
|
|
} else {
|
|
// Fallback: preserve previous behavior
|
|
meshService?.sendReadReceipt(receipt, to: senderPeerID)
|
|
}
|
|
}
|
|
}
|