Repository navigation
Conversation
3f4375b to
9e9c016
Compare
|
AI pre-review of the server part, prepared for Anders's review. This is agent review evidence, not an approval and not the human review. @irzhywau, please check each point; where the AI is wrong, say so and we drop it. What checks out: sign-up stays gated by the admin flag Blocker (verified by hand)
Major Minor CI note: |
9e9c016 to
1ae2549
Compare
1ae2549 to
43ecf6d
Compare
15a2759 to
023f8e5
Compare
|
@andersalm Thanks. Here's where each point of your 30 September pre-review stands, on head 1. Updates break once a release pins the network: fixed. 2. The
I'd go with (a). Also: should a Home that has already joined Community be able to leave? 3. Setup fails if the network file was never copied: fixed. 4. Unread dots are shared by everyone on the same Home: still open. 5. The free-space change doesn't belong here: done. 6. The public network-file endpoint: removed. 7. Missing tests: partly done. Next: I'll describe the contact-request capability on #86 for your approval, and run the installed Home journey on this exact commit. |
023f8e5 to
a2d3e86
Compare
a2d3e86 to
c731827
Compare
…s belong to their card Inside Home a lost conversation session only changed a status row that Home never shows, so Chat sat on 'Opening conversation' with a dark composer. The reason now shows as a lasting message with one Reconnect action. It starts a new session with Chat's Home launch token without reloading the page, so unsent drafts stay, and nothing signs in on its own; when Home no longer admits the launch, Chat says to open it again from Home. An Add contact reply arriving after the card was closed or reopened for someone else wrote into that other card. Replies now update only the opening that sent them. Closing the card with its button or Escape returns keyboard focus to the exact name that opened it: a message sender is found again by its message seq, so focus does not jump to an earlier message by the same person. When that name is gone, focus goes to the composer.
…ing keeps its place Open in Documents and elastos:// links posted to the parent frame at Chat's own origin. Home loads Chat in an opaque frame, so that origin is "null" and the request never arrived; Documents' reply, which Home relays, was also refused because it did not come from Chat's origin. Both requests now use the admitted Home path the Library picker uses (Home's top window at the ?home_origin= origin), and the reply is accepted from Home. The shared room removed the Attach button's title and aria-label, leaving an icon-only button with no accessible name. It now keeps 'Attach'. Every new message forced the view to the bottom, pulling a person reading older history away. Only a new session now opens at the newest message; later messages follow a reader already at the bottom. A person's own Community send still scrolls down, but only while Community is open, so a late response does not move them inside a direct conversation.
…8 typing When signing failed, terminal Chat still broadcast the line without a signature and printed it as sent, although every receiver drops an unsigned line. The signer now treats an HTTP refusal or an empty signature as no signature, and the line is refused before broadcast with a clear reason. The terminal read one byte at a time and pushed each byte as a char, so 'é' became 'é' in the echo and the sent text. Bytes of one UTF-8 character are now collected and pushed as that character; an invalid sequence is dropped.
The Join a Conversation form and the ?invite= / ?join= launch path posted to /invites/join, which Runtime always refuses (409, gateway_room.rs), and outside Home the form refused before posting. Chat drops that form, its launch path, its styles and the compact-rail rule that waited on it, and the smokes stop expecting it. Creating and revoking join links stays: those routes still work for an unconfigured Runtime, and browser-guest (gateway) mode is unchanged until the people who open Chat outside Home are listed on #86.
Installed setup asked the trusted source for the network file by its release name, which could serve newer bytes than the signed pin; they were refused only after the download. Setup now fetches it by the pinned CID, as the CLI and System updates do, with the 3 MiB startup-configuration bound applied from the length header. The setup test serves the network only by CID and fails on a by-name request.
Undo installs an older release through the same path as an update. A Home that joined the release Community network keeps it: a release without a pin leaves it alone, and an older pin never replaces the newer accepted chain, because Runtime never drops an accepted network. 'Undo an update' now says so, and a test updates to a release that joins the network, then undoes to an unpinned release and to an older pin and checks the network stays.
…iner key The provisioning contract required a dedicated configuration key that is never the release publisher. The production Community network instead uses the release maintainer DID: profile signatures have their own domain and the signed release pins the file's CID and signer set, so one key is safe. Production profiles are signed by the offline release custodian; the create-authority-key flow stays for disposable test and fixture networks.
Rebuilt with scripts/build-chat-room-ui.sh (now path-independent on develop, so the wasm embeds no builder paths) from the drafts, Reconnect, Profile card, attachment, Attach, scroll and invite-control changes. The asset cache version moves to chat-room-ui-20261008a so browsers load the new bundle.
|
Pushed |
…puts Preserve the owner draft, attachment, terminal and profile repairs. Keep fresh Home authority, Direct 401 recovery, exact launch intent and guarded two-Home acceptance together. Independent source review passed on UI/Home, network/Undo and harness resolutions.
Native Chat UI tests and Clippy pass before the release WASM build. Generated assets retain path-independent compiler inputs.
A poll can receive the accepted message before its held send response. Reuse canonical deduplication and preserve the newer sequence cursor. The regression covers repeated receipts after later peer traffic and preserves draft revisions.
Use the tested shared-object completion helper for attachments too. Native UI tests, Clippy and release WASM build pass; independent source review confirms the picker guards and error paths stay intact.
|
Independent development review — VERDICT: PASS. |
|
Independent adversarial review (Claude Opus via elastos-pr-review) — VERDICT: PASS. |
…urney # Conflicts: # docs/INSTALL.md
|
Today I pushed de5a986 and then ea9bee4 to feat/0.7.1-chat-people-on-invite; the second push completed at19:48:37UTC before the pause request. |
This PR connects Home’s first visit with Community and contacts. Create account is visible when registration is available, and the welcome asks for a first Recovery Kit. A signed-in person creates a Profile, enables Discovery and sends a contact request from a Community Profile card. The recipient accepts or declines in Inbox. Message selects the exact direct conversation in the current Chat window; Inbox Open launches that exact conversation.
Drafts stay with their conversation. Accepted send responses clear only the revision they sent, and uncertain direct sends retain their request identity across navigation. Session loss shows Reconnect with a clear explanation. One explicit click asks Home for fresh launch authority in the same iframe document, then restores the selected conversation and draft. Home owns sign-in. Guards keep old responses from changing renewed authority or the current selection, including Direct list, history and send 401 failures. Shared text and attachment receipts use the same deduplication and forward-only cursor rule.
The integration preserves Profile-card response and focus guards, attachments and object links through Home, the Attach accessible name, reading position, per-account direct unread indicators and notifications, and terminal signing refusal and UTF-8 input. Unused join-by-invite controls are removed; supported gateway access and link creation/revocation remain.
The signed release pins the Community configuration CID and signer set. Setup fetches that exact CID through Runtime and enforces a 3 MiB bound before reading the body. Setup and update verify the pinned configuration through their existing admission paths. Before the first start,
--isolatedrecords the choice and removes a release-supplied network file while preserving operator configuration. Undo restores the earlier release and keeps the joined network, accepted revision and later user data. The production configuration uses the approved maintainer signer and its separate profile-signature domain, with signing under the existing offline custody workflow. These changes follow Anders’s network decision.The approved contact capability remains
POST /api/apps/chat-room/contacts/requestwith only{"participant_ref":"contact:<24 hex>"}. It requires a valid Chat launch token, the sender’s own Profile and a recipient in current Discovery. Runtime signs and queues the request; the recipient owns the Inbox decision. Runtime keeps Profile and device DIDs private. Bounds remain 16 requests per sender, 128 stored records and 512 KiB, with one pending request per person/listing. Relay bounds remain 32 per recipient and 64 total; requests expire after one hour and listings after ten minutes.#86 and #139 own current acceptance and exact-candidate proof. Verification covers fresh signup, Profile/contact/Inbox paths, initial conversation selection, held responses and drafts, explicit same-document recovery, peer delivery, restart and retained history. Installed journey proof, required reviews and Sasha’s first-visit/Chat acceptance remain merge gates. The approved order is #89 closure, then #123, then #262 integration and bundle rebuild. Delivery/retry, catch-up and Community limits remain in #139/#262; signup capacity/retry acceptance remains in #260; leaving Community remains in #264.