Complete desktop parity, security, and platform audit #42

New Issue

hugo · 2026-08-09T19:30:18Z

hugo commented

2026-08-09 19:30:18 +00:00

Goal

Prove that the desktop app is a complete, secure, cross-platform presentation of the storage crate and matches the TUI feature surface.

Scope

Maintain and satisfy a coverage matrix mapping every base pass, pass-otp, Git, lock, configuration, and TUI milestone action to a desktop menu, control/dialog, and command-palette entry where applicable.
Test macOS native menus and standard shortcuts, plus Linux/Windows in-window menus and accelerator mappings.
Exercise keyboard-only navigation, mouse use, focus order, screen-reader labels, scaling, narrow windows, long entries, high-contrast themes, and reduced motion where applicable.
Audit plaintext lifetime, masking, logs, crash/error views, clipboard behavior, authentication expiry, dirty-document paths, and background/window lifecycle.
Verify the desktop crate does not read/mutate a password-store repository, spawn processes, parse domain formats, or duplicate storage policy.
Run the repository-required Rust checks and platform build/smoke checks documented for supported targets.

Acceptance criteria

The coverage matrix has no unexplained gaps against milestones 01 and 02.
Platform menu, shortcut, and primary workflow smoke tests pass on macOS, Linux, and Windows CI or documented equivalent runners.
Security and architecture audits find no GUI-owned storage logic, plaintext persistence, process launch, or non-HTTPS Git path.
Required formatting, check, clippy, and workspace tests pass, and remaining platform limitations are explicitly documented rather than silently stubbed.

## Goal Prove that the desktop app is a complete, secure, cross-platform presentation of the storage crate and matches the TUI feature surface. ## Scope - Maintain and satisfy a coverage matrix mapping every base pass, pass-otp, Git, lock, configuration, and TUI milestone action to a desktop menu, control/dialog, and command-palette entry where applicable. - Test macOS native menus and standard shortcuts, plus Linux/Windows in-window menus and accelerator mappings. - Exercise keyboard-only navigation, mouse use, focus order, screen-reader labels, scaling, narrow windows, long entries, high-contrast themes, and reduced motion where applicable. - Audit plaintext lifetime, masking, logs, crash/error views, clipboard behavior, authentication expiry, dirty-document paths, and background/window lifecycle. - Verify the desktop crate does not read/mutate a password-store repository, spawn processes, parse domain formats, or duplicate storage policy. - Run the repository-required Rust checks and platform build/smoke checks documented for supported targets. ## Acceptance criteria - The coverage matrix has no unexplained gaps against milestones 01 and 02. - Platform menu, shortcut, and primary workflow smoke tests pass on macOS, Linux, and Windows CI or documented equivalent runners. - Security and architecture audits find no GUI-owned storage logic, plaintext persistence, process launch, or non-HTTPS Git path. - Required formatting, check, clippy, and workspace tests pass, and remaining platform limitations are explicitly documented rather than silently stubbed.

hugo added this to the 03 - Cross-platform Iced desktop app milestone 2026-08-09 19:30:18 +00:00

hugo added the enhancement label 2026-08-09 19:30:18 +00:00

hugo referenced this issue from a commit

2026-08-10 18:38:36 +00:00

Complete desktop parity and security audit (#42)

hugo commented

2026-08-10 18:38:59 +00:00

Implemented and verified in commit 40b15a9 (Complete desktop parity and security audit (#42)).

Implementation:

Added docs/desktop-audit.md, a maintained milestone 01/02 coverage matrix for base pass, pass-otp, embedded Git, configuration/lock, navigation, window, Help, menu, direct-control, dialog, and command-palette surfaces. A desktop test requires every registered action ID to remain represented.
Added an explicit macOS/Linux/Windows platform model for shortcut labels and dispatch. Tests execute Command mappings on macOS and Control mappings on Linux/Windows from one host; the macOS native adapter now has direct accelerator assertions.
Removed the remaining hand-written command-palette shortcut label so Help, menus, palette, and toolbar consume the shared registry.
Added executable production-source auditing across every desktop module. It rejects process construction, direct repository/Git construction, OTP/QR domain parsing, filesystem writes, print/debug/log output, non-HTTPS literals, and unsafe blocks.
Added a checked narrow-window contract and documented keyboard, mouse/touch, focus order, scaling, long-content, contrast, reduced-motion, native-service smoke, plaintext lifetime, masking, clipboard, expiry, dirty-document, stale-background, and window-lifecycle evidence.

Acceptance review:

Every registered desktop action appears in the coverage matrix; terminal-shaped CLI/TUI selectors without separate desktop meaning are explicitly accounted for rather than silently omitted.
Menu, shortcut, enablement, palette, keyboard/mouse navigation, native macOS accelerators, dirty/authentication gates, encrypted primary workflows, OTP, Git HTTPS rejection, and lifecycle behavior are executable tests. Linux/Windows native picker/clipboard/secure-store smoke commands are documented as equivalent native-runner gates.
The architecture audit passes with repository and domain behavior remaining in crates/storage; no GUI process launch, plaintext persistence path, or non-HTTPS Git path was introduced.
Iced 0.14 does not expose a stable native screen-reader accessibility-tree API. That framework limitation is explicitly documented; visible operation-specific labels and deterministic keyboard focus are implemented.

Verification from the repository root:

cargo fmt --all -- --check — passed.
RUSTFLAGS="-D warnings" cargo check --workspace --all-targets — passed.
cargo clippy --workspace --all-targets -- -D warnings — passed.
cargo test --workspace — passed, including 30 desktop tests and 95 TUI tests.
Focused cargo test --package ironstorage-desktop --all-targets — 30 passed.

Implemented and verified in commit `40b15a9` (`Complete desktop parity and security audit (#42)`). Implementation: - Added `docs/desktop-audit.md`, a maintained milestone 01/02 coverage matrix for base pass, pass-otp, embedded Git, configuration/lock, navigation, window, Help, menu, direct-control, dialog, and command-palette surfaces. A desktop test requires every registered action ID to remain represented. - Added an explicit macOS/Linux/Windows platform model for shortcut labels and dispatch. Tests execute Command mappings on macOS and Control mappings on Linux/Windows from one host; the macOS native adapter now has direct accelerator assertions. - Removed the remaining hand-written command-palette shortcut label so Help, menus, palette, and toolbar consume the shared registry. - Added executable production-source auditing across every desktop module. It rejects process construction, direct repository/Git construction, OTP/QR domain parsing, filesystem writes, print/debug/log output, non-HTTPS literals, and unsafe blocks. - Added a checked narrow-window contract and documented keyboard, mouse/touch, focus order, scaling, long-content, contrast, reduced-motion, native-service smoke, plaintext lifetime, masking, clipboard, expiry, dirty-document, stale-background, and window-lifecycle evidence. Acceptance review: - Every registered desktop action appears in the coverage matrix; terminal-shaped CLI/TUI selectors without separate desktop meaning are explicitly accounted for rather than silently omitted. - Menu, shortcut, enablement, palette, keyboard/mouse navigation, native macOS accelerators, dirty/authentication gates, encrypted primary workflows, OTP, Git HTTPS rejection, and lifecycle behavior are executable tests. Linux/Windows native picker/clipboard/secure-store smoke commands are documented as equivalent native-runner gates. - The architecture audit passes with repository and domain behavior remaining in `crates/storage`; no GUI process launch, plaintext persistence path, or non-HTTPS Git path was introduced. - Iced 0.14 does not expose a stable native screen-reader accessibility-tree API. That framework limitation is explicitly documented; visible operation-specific labels and deterministic keyboard focus are implemented. Verification from the repository root: - `cargo fmt --all -- --check` — passed. - `RUSTFLAGS="-D warnings" cargo check --workspace --all-targets` — passed. - `cargo clippy --workspace --all-targets -- -D warnings` — passed. - `cargo test --workspace` — passed, including 30 desktop tests and 95 TUI tests. - Focused `cargo test --package ironstorage-desktop --all-targets` — 30 passed.

hugo closed this issue

2026-08-10 18:39:04 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#42