Onboard a local clone with application-token authentication #44

New Issue

hugo · 2026-08-09T20:00:28Z

hugo commented

2026-08-09 20:00:28 +00:00

Goal

Provide first-run setup for a local password-store clone authenticated with an application token.

Scope

Present onboarding for HTTPS server URL, application token, repository identity/path, branch selection supplied by storage, and local clone/open progress.
Store the application token only through storage-owned iPhone secure-secret orchestration; ordinary configuration may keep non-secret server/application identity but never the token.
Pass all validation, HTTPS-only enforcement, remote discovery, clone/open, credential callbacks, and local app-container path decisions to crates/storage.
Support editing or replacing the configured application token later without revealing the existing token.
Present actionable states for missing configuration, invalid/expired token, inaccessible repository, unsupported remote scheme, interrupted clone, and an existing local clone.
Keep the iPhone filesystem and Git repository opaque to Swift.

Acceptance criteria

A new installation can authenticate with an application token and obtain a local clone without SSH or external helpers.
Tokens never appear in config.toml, logs, crash text, or view-ready error messages.
Failed or cancelled setup leaves a recoverable state and cannot replace a valid existing clone.
Fixtures prove that non-HTTPS remotes are rejected before transport and that all Git work occurs in Rust.

## Goal Provide first-run setup for a local password-store clone authenticated with an application token. ## Scope - Present onboarding for HTTPS server URL, application token, repository identity/path, branch selection supplied by storage, and local clone/open progress. - Store the application token only through storage-owned iPhone secure-secret orchestration; ordinary configuration may keep non-secret server/application identity but never the token. - Pass all validation, HTTPS-only enforcement, remote discovery, clone/open, credential callbacks, and local app-container path decisions to `crates/storage`. - Support editing or replacing the configured application token later without revealing the existing token. - Present actionable states for missing configuration, invalid/expired token, inaccessible repository, unsupported remote scheme, interrupted clone, and an existing local clone. - Keep the iPhone filesystem and Git repository opaque to Swift. ## Acceptance criteria - A new installation can authenticate with an application token and obtain a local clone without SSH or external helpers. - Tokens never appear in `config.toml`, logs, crash text, or view-ready error messages. - Failed or cancelled setup leaves a recoverable state and cannot replace a valid existing clone. - Fixtures prove that non-HTTPS remotes are rejected before transport and that all Git work occurs in Rust.

hugo added this to the 04 - iPhone and Apple Watch apps milestone 2026-08-09 20:00:28 +00:00

hugo added the enhancement label 2026-08-09 20:00:28 +00:00

hugo commented

2026-08-11 14:34:10 +00:00

Implemented in commit daf122a.

Implementation:

Added storage-owned first-run onboarding for credential-free HTTPS validation, stable server/repository identities, authenticated remote branch discovery, controlled clone/open, app-container path selection, progress, cancellation, typed errors, and secret-free atomic configuration.
Added pure-Rust branch discovery and selected-branch clone operations with embedded gix transport, in-memory credentials, private temporary work, atomic destination installation, and preservation of existing clones. Review also added regression coverage for a destination race and private-clone cleanup.
Added storage-owned iPhone secure-secret upsert so the application token can be replaced later without reading or revealing the prior account/token.
Added the mechanical UniFFI boundary and native UIKit onboarding/token-update screens. Swift only supplies input and renders Rust-provided branches, progress, outcomes, and errors; it does not inspect the repository or perform Git/filesystem work.

Verification:

cargo fmt --all -- --check
RUSTFLAGS=-D warnings cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
xcodegen generate
Final IronStorage iPhone 17 Pro simulator build, install, launch, and native visual review
Live Gitea branch discovery, clone/open, token replacement, and app-container relocation verified on the simulator without logging or persisting the token
Signed build installed successfully on the paired iPhone

The simulated regression transports never contact a live server; live Gitea verification was performed separately.

Implemented in commit daf122a. Implementation: - Added storage-owned first-run onboarding for credential-free HTTPS validation, stable server/repository identities, authenticated remote branch discovery, controlled clone/open, app-container path selection, progress, cancellation, typed errors, and secret-free atomic configuration. - Added pure-Rust branch discovery and selected-branch clone operations with embedded gix transport, in-memory credentials, private temporary work, atomic destination installation, and preservation of existing clones. Review also added regression coverage for a destination race and private-clone cleanup. - Added storage-owned iPhone secure-secret upsert so the application token can be replaced later without reading or revealing the prior account/token. - Added the mechanical UniFFI boundary and native UIKit onboarding/token-update screens. Swift only supplies input and renders Rust-provided branches, progress, outcomes, and errors; it does not inspect the repository or perform Git/filesystem work. Verification: - cargo fmt --all -- --check - RUSTFLAGS=-D warnings cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace - xcodegen generate - Final IronStorage iPhone 17 Pro simulator build, install, launch, and native visual review - Live Gitea branch discovery, clone/open, token replacement, and app-container relocation verified on the simulator without logging or persisting the token - Signed build installed successfully on the paired iPhone The simulated regression transports never contact a live server; live Gitea verification was performed separately.

hugo closed this issue

2026-08-11 14:34:15 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#44