DragonX/ObsidianDragon
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

feat(chat): service-level sensitive gating + local sensitive marks

Browse Source 
Wires the sensitive-conversation plumbing into ChatService + Settings:
- Settings gains a persisted local sensitive set (isChatSensitive /
  setChatSensitive / sensitiveChatConversations), mirroring the blocked set, for
  INSTANT effect the moment the user marks a conversation (before the on-chain
  signal is harvested back).
- ChatService::isConversationSensitive() OR-combines that local mark with the
  on-chain reduction, and setPersistence() wires it as the DB's per-row key
  selector (sensitive rows -> vault key).
- ingest() withholds a sensitive conversation's messages while the vault key is
  absent (fail-closed: not shown, not persisted); they re-import + persist under
  the vault key once it is unlocked and a scan runs. loadFromDatabase() already
  withholds via the DB's two-key try.
Service-tested end to end against a real ChatDatabase (ingest + reload).

Phase B, step 4 (service gating). App vault lifecycle + UI next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
DanS
2026-10-23 17:42:31 -05:00
co-authored by Claude Opus 4.8
parent 6b9bda3ee4
commit fe3d2aa935
5 changed files with 124 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/chat/chat_service.cpp
+14
View File
@@ -88,6 +88,10 @@ int ChatService::ingest(const std::vector<HushChatTransactionMetadata>& metadata
// in the same conversation has a different txid and flows through normally.
if (blocked_pred_ && blocked_pred_(message.conversation_id)) continue;
if (conversationHiddenOnChain(message.conversation_id)) continue; // hidden by an on-chain delete
// Withhold a sensitive conversation's messages while its local vault key is absent (locked vault or
// a fresh seed import). Fail-closed: if we can't store it under the vault key we don't surface it.
// They re-import and persist under the vault key once it is unlocked and a scan runs.
if (isConversationSensitive(message.conversation_id) && !(db_ && db_->hasSensitiveKey())) continue;
if (db_ && db_->isTombstoned(message)) continue;
if (meta.type == HushChatHeaderType::ContactRequest) {
@@ -200,6 +204,16 @@ bool ChatService::conversationSensitiveOnChain(const std::string& conversationId
auto it = sensitive_control_.find(conversationId);
return it != sensitive_control_.end() && it->second.op == "sensitive";
}
bool ChatService::isConversationSensitive(const std::string& conversationId) const {
if (conversationSensitiveOnChain(conversationId)) return true;
return local_sensitive_pred_ && local_sensitive_pred_(conversationId);
}
void ChatService::setPersistence(ChatDatabase* db) {
db_ = db;
// The DB picks the per-row key by this predicate: a sensitive conversation's rows are stored under the
// local vault key. Combines the on-chain reduction with the local (instant) mark.
if (db_) db_->setSensitivePredicate([this](const std::string& cid) { return isConversationSensitive(cid); });
}
std::vector<std::pair<std::string, std::string>> ChatService::onChainSensitiveConversations() const {
std::vector<std::pair<std::string, std::string>> out;
for (const auto& entry : sensitive_control_) {
src/chat/chat_service.h
+13 -1
View File
@@ -53,7 +53,8 @@ public:
// Attach a persistent backing store (Phase 2). Not owned. Pass nullptr to detach. New messages
// from ingest() are written through; loadFromDatabase() rehydrates the in-memory store from it.
void setPersistence(ChatDatabase* db) { db_ = db; }
// Also wires the DB's per-conversation sensitivity predicate to isConversationSensitive().
void setPersistence(ChatDatabase* db);
// Load previously-persisted messages (already decrypted at ingest, re-encrypted at rest under
// the seed-derived key) into the in-memory store. No-op without an unlocked database.
void loadFromDatabase();
@@ -89,6 +90,16 @@ public:
// Conversations whose latest on-chain control op is "sensitive", each paired with its control label.
std::vector<std::pair<std::string, std::string>> onChainSensitiveConversations() const;
// A local "sensitive" predicate (typically Settings::isChatSensitive) giving INSTANT effect the moment
// the user marks a conversation, before the on-chain signal is harvested back. OR-combined with the
// on-chain reduction by isConversationSensitive().
void setLocalSensitivePredicate(std::function<bool(const std::string&)> pred) {
local_sensitive_pred_ = std::move(pred);
}
// True if this conversation is sensitive (locally marked OR on-chain). Its rows are stored under the
// local vault key; while that key is absent its messages are withheld from the store on ingest/load.
bool isConversationSensitive(const std::string& conversationId) const;
// --- Outgoing (compose) ---
// My chat public key (hex), or "" without an identity — goes in an outgoing header's "p".
std::string identityPublicKeyHex() const;
@@ -131,6 +142,7 @@ private:
ChatStore store_;
ChatDatabase* db_ = nullptr; // optional; not owned
std::function<bool(const std::string&)> blocked_pred_; // true => cid is blocked (drop its messages)
std::function<bool(const std::string&)> local_sensitive_pred_; // true => cid locally marked sensitive
// Reduced on-chain control state, cid -> latest signal. Not persisted (re-derived from chain).
struct ControlState {
src/config/settings.cpp
+15
View File
@@ -180,6 +180,14 @@ bool Settings::load(const std::string& path)
(c.contains("name") && c["name"].is_string())
? c["name"].get<std::string>() : std::string()});
}
if (j.contains("sensitive_chat_convs") && j["sensitive_chat_convs"].is_array()) {
sensitive_chat_convs_.clear();
for (const auto& c : j["sensitive_chat_convs"])
if (c.is_object() && c.contains("cid") && c["cid"].is_string())
sensitive_chat_convs_.push_back({c["cid"].get<std::string>(),
(c.contains("name") && c["name"].is_string())
? c["name"].get<std::string>() : std::string()});
}
// Chat-tab customization (re-clamped through the setters so hand-edited JSON stays in range).
loadScalar(j, "chat_emoji_color", chat_emoji_color_);
loadScalar(j, "chat_poll_rate_sec", chat_poll_rate_sec_); setChatPollRateSec(chat_poll_rate_sec_);
@@ -544,6 +552,13 @@ bool Settings::save(const std::string& path)
o["name"] = b.name;
j["blocked_chat_convs"].push_back(o);
}
j["sensitive_chat_convs"] = json::array();
for (const auto& s : sensitive_chat_convs_) {
json o;
o["cid"] = s.cid;
o["name"] = s.name;
j["sensitive_chat_convs"].push_back(o);
}
j["chat_emoji_color"] = chat_emoji_color_;
j["chat_poll_rate_sec"] = chat_poll_rate_sec_;
j["chat_bubble_style"] = chat_bubble_style_;
src/config/settings.h
+21
View File
@@ -182,6 +182,26 @@ public:
}
const std::vector<BlockedChatConv>& blockedChatConversations() const { return blocked_chat_convs_; }
// Sensitive chat conversations (by cid): their local rows are stored under the local chat vault key
// (not the seed key) and are withheld without it. Kept locally for INSTANT effect the moment the user
// marks one; the mark is also signaled on-chain so other devices / a fresh seed import gate it too.
// The last-known peer name labels the sensitive-conversations list.
struct SensitiveChatConv { std::string cid; std::string name; };
bool isChatSensitive(const std::string& cid) const {
for (const auto& s : sensitive_chat_convs_) if (s.cid == cid) return true;
return false;
}
void setChatSensitive(const std::string& cid, const std::string& name, bool sensitive) {
const bool already = isChatSensitive(cid);
if (sensitive && !already) sensitive_chat_convs_.push_back({cid, name});
else if (!sensitive && already)
sensitive_chat_convs_.erase(
std::remove_if(sensitive_chat_convs_.begin(), sensitive_chat_convs_.end(),
[&](const SensitiveChatConv& s) { return s.cid == cid; }),
sensitive_chat_convs_.end());
}
const std::vector<SensitiveChatConv>& sensitiveChatConversations() const { return sensitive_chat_convs_; }
// ── Chat-tab customization (chat settings modal + Settings → Chat & Contacts) ──────
bool getChatEmojiColor() const { return chat_emoji_color_; }
void setChatEmojiColor(bool v) { chat_emoji_color_ = v; }
@@ -694,6 +714,7 @@ private:
std::vector<std::string> muted_chat_cids_; // muted chat conversations by cid (Q10)
std::vector<std::string> hidden_chat_cids_; // hidden chat conversations by cid
std::vector<BlockedChatConv> blocked_chat_convs_; // blocked chat conversations (cid + last-known name)
std::vector<SensitiveChatConv> sensitive_chat_convs_; // sensitive chat conversations (cid + last-known name)
// Chat-tab customization (chat settings modal + Settings → Chat & Contacts).
bool chat_emoji_color_ = true; // true = color (needs FreeType; falls back to mono if absent), false = monochrome
float chat_poll_rate_sec_ = 2.5f; // 0-conf chat fast-scan cadence (full node)
tests/test_phase4.cpp
+61
View File
@@ -15382,6 +15382,66 @@ void testChatSensitiveDatabase()
scrub(dbPath);
}
// Service-level sensitive gating: a sensitive conversation's messages are withheld on ingest and on
// reload while the DB vault key is absent, and flow + persist once it is present.
void testHushChatSensitiveService()
{
using namespace dragonx::chat;
namespace fs = std::filesystem;
const std::string dbPath = (fs::temp_directory_path() / "drgx_chat_senssvc_test.sqlite").string();
auto scrub = [](const std::string& p) { fs::remove(p); fs::remove(p + "-wal"); fs::remove(p + "-shm"); };
scrub(dbPath);
ChatKeyPair me, peer;
ChatIdentityResult rm = deriveChatIdentityFromSecret("senssvc-me", me, true);
ChatIdentityResult rp = deriveChatIdentityFromSecret("senssvc-peer", peer, true);
EXPECT_TRUE(rm.status == ChatIdentityStatus::Ready && rp.status == ChatIdentityStatus::Ready);
ChatDatabase db(dbPath);
EXPECT_TRUE(db.unlockWithSecret("seed-xyz"));
ChatService svc; svc.setIdentity(me); svc.setPersistence(&db);
svc.setLocalSensitivePredicate([](const std::string& cid) { return cid == "sens"; });
EXPECT_TRUE(svc.isConversationSensitive("sens"));
EXPECT_TRUE(!svc.isConversationSensitive("normal"));
auto feedPeerMsg = [&](const std::string& cid, const std::string& txid, const std::string& body) {
OutgoingChatMemos m;
EXPECT_TRUE(buildOutgoingMessage(peer, rp.public_key_hex, "zs-peer", rm.public_key_hex, "zs-me",
cid, body, m) == ChatComposeStatus::Ok);
HushChatTransactionInput tx; tx.txid = txid;
tx.outputs.push_back({0, m.headerMemo}); tx.outputs.push_back({1, m.payloadMemo});
auto ex = extractHushChatTransactionMetadata(tx, true);
const std::int64_t t = static_cast<std::int64_t>(std::time(nullptr));
return svc.ingest(ex.metadata, {{txid, t}}, t);
};
// Vault locked: a sensitive message is withheld (fail-closed); a normal one flows.
EXPECT_EQ(feedPeerMsg("normal", "n1", "hi"), 1);
EXPECT_EQ(feedPeerMsg("sens", "s1", "secret"), 0);
EXPECT_EQ((int)svc.store().conversation("sens").size(), 0);
EXPECT_EQ((int)svc.store().conversation("normal").size(), 1);
// Unlock the vault (provide a key): the sensitive message now flows and persists.
std::array<unsigned char, 32> vkey; vkey.fill(0x33);
db.setSensitiveKey(vkey);
EXPECT_EQ(feedPeerMsg("sens", "s1", "secret"), 1);
EXPECT_EQ((int)svc.store().conversation("sens").size(), 1);
// Reload from the DB with the vault LOCKED: sensitive withheld, normal loads.
db.lockSensitive();
svc.store().clear();
svc.loadFromDatabase();
EXPECT_EQ((int)svc.store().conversation("sens").size(), 0);
EXPECT_EQ((int)svc.store().conversation("normal").size(), 1);
// Reload with the vault key present: the sensitive thread reappears.
db.setSensitiveKey(vkey);
svc.store().clear();
svc.loadFromDatabase();
EXPECT_EQ((int)svc.store().conversation("sens").size(), 1);
scrub(dbPath);
}
void testHushChatDatabase()
{
using namespace dragonx::chat;
@@ -20238,6 +20298,7 @@ int main()
testHushChatService();
testHushChatDatabase();
testChatSensitiveDatabase();
testHushChatSensitiveService();
testHushChatDeleteConversation();
testChatStoreTxidIndex();
testChatStoreLatestAndMove();