Show every unlocked TUI value and a live clipboard cleanup countdown #67

New Issue

hugo · 2026-08-10T15:56:54Z

hugo commented

2026-08-10 15:56:54 +00:00

Goal

Make the terminal UI immediately useful after authentication: every field value, including passwords and other sensitive values, is visible on unlocked entries; selection and status chrome remain high-contrast; and clipboard cleanup has a truthful live countdown.

Observed behavior

The native TUI still renders the password as •••••••• after the entry has been authenticated and opened, even though other values such as URL, autotype_enabled, and icon are visible. Requiring another reveal step defeats the primary use case of opening an entry to read its password. The selected entry and parts of the status chrome also still combine faint foreground colors with a light selection background. After y copies a field, the status reports the configured 45-second cleanup delay once, but it does not count down, so the user cannot tell when the clipboard will actually be cleared. These failures are reproduced in the attached report screenshot against commit 7c64be3.

Required behavior

Once the authentication lease has granted access and an entry is open, render the real value of every storage-provided field in the TUI without an additional reveal action. This includes passwords, OTP URIs, notes, unknown fields, repeated fields, empty values, Unicode, and long or wrapped values.
Apply the same rule to every unlocked TUI entry-value surface: a value must not silently return to bullets merely because focus changes. Locking, authentication expiry, terminal ownership loss, or closing the entry must remove the decrypted document and all rendered values immediately.
Keep all parsing and entry structure in crates/storage; the TUI consumes the typed EntryDocument and must not reparse labels or infer field policy from display strings. Storage sensitivity metadata may still govern explicit output operations, but it must not mask an already authenticated TUI entry view.
Replace every remaining low-contrast selected or active style used by the entry tree, viewer/editor rows, search results, and status chrome with an explicit high-contrast foreground/background pair. Nested spans must not override the selected style. Preserve a clearly distinguishable reverse-video or equivalent monochrome fallback.
Track an active clipboard presentation in TUI state. Immediately after copy, show the configured cleanup deadline and update the visible remaining seconds on every tick until cleanup completes. The displayed countdown and the actual NativeClipboardManager cleanup lifecycle must use the same presentation instance/deadline.
When cleanup restores or clears the clipboard, remove the countdown and report the real disposition. A second copy resets the countdown for the new value; manual lock, authentication expiry, terminal ownership loss, and shutdown cancel or complete cleanup through the existing secret-safe clipboard lifecycle without leaving stale countdown state.

Safety and boundaries

This is an authenticated presentation change, not permission to retain plaintext while locked or after the lease expires.
Do not weaken secure-storage authentication, lease revocation, clipboard replacement checks, cancellation, or cleanup failure reporting.
Do not launch pass, gpg, git, shells, or helper processes.
Keep application code free of unsafe Rust and preserve the crates/storage ownership boundary.

Tests and verification

Drive a real encrypted compatibility entry through the production activation, authentication, document-load, and render path. Assert that password and every other field value are present while unlocked without a reveal action, remain visible across field focus changes, and disappear after lock and authentication expiry.
Cover empty, Unicode, repeated, unknown, OTP, and wrapped values without lossy display or TUI-owned parsing.
Assert every cell/span of selected sidebar, viewer/editor, search, and status content uses the intended contrasting style in color mode and remains distinguishable in monochrome mode.
Add deterministic clipboard lifecycle tests that prove the visible countdown decreases, reaches cleanup in sync with the configured timeout, resets on a second copy, disappears on completion, and cannot survive lock/expiry/cancellation.
Run cargo fmt --all -- --check, RUSTFLAGS="-D warnings" cargo check --workspace --all-targets, cargo clippy --workspace --all-targets -- -D warnings, and cargo test --workspace.

Acceptance criteria

Opening an entry after authentication shows its password and every other field value immediately; no bullet placeholders or reveal step remain on an unlocked entry.
No decrypted value remains visible or retained after lock, expiry, terminal loss, or entry close.
Selected and active TUI content is plainly readable in color, limited-color, and monochrome terminals.
Clipboard feedback counts down once per second from the configured timeout and clears exactly when the real clipboard presentation completes or is cancelled.
All behavior is covered through production state/render paths, uses pure Rust, and preserves storage-owned parsing and secret-safe clipboard cleanup.

## Goal Make the terminal UI immediately useful after authentication: every field value, including passwords and other sensitive values, is visible on unlocked entries; selection and status chrome remain high-contrast; and clipboard cleanup has a truthful live countdown. ## Observed behavior The native TUI still renders the password as `••••••••` after the entry has been authenticated and opened, even though other values such as URL, `autotype_enabled`, and `icon` are visible. Requiring another reveal step defeats the primary use case of opening an entry to read its password. The selected entry and parts of the status chrome also still combine faint foreground colors with a light selection background. After `y` copies a field, the status reports the configured 45-second cleanup delay once, but it does not count down, so the user cannot tell when the clipboard will actually be cleared. These failures are reproduced in the attached report screenshot against commit `7c64be3`. ## Required behavior - Once the authentication lease has granted access and an entry is open, render the real value of every storage-provided field in the TUI without an additional reveal action. This includes passwords, OTP URIs, notes, unknown fields, repeated fields, empty values, Unicode, and long or wrapped values. - Apply the same rule to every unlocked TUI entry-value surface: a value must not silently return to bullets merely because focus changes. Locking, authentication expiry, terminal ownership loss, or closing the entry must remove the decrypted document and all rendered values immediately. - Keep all parsing and entry structure in `crates/storage`; the TUI consumes the typed `EntryDocument` and must not reparse labels or infer field policy from display strings. Storage sensitivity metadata may still govern explicit output operations, but it must not mask an already authenticated TUI entry view. - Replace every remaining low-contrast selected or active style used by the entry tree, viewer/editor rows, search results, and status chrome with an explicit high-contrast foreground/background pair. Nested spans must not override the selected style. Preserve a clearly distinguishable reverse-video or equivalent monochrome fallback. - Track an active clipboard presentation in TUI state. Immediately after copy, show the configured cleanup deadline and update the visible remaining seconds on every tick until cleanup completes. The displayed countdown and the actual `NativeClipboardManager` cleanup lifecycle must use the same presentation instance/deadline. - When cleanup restores or clears the clipboard, remove the countdown and report the real disposition. A second copy resets the countdown for the new value; manual lock, authentication expiry, terminal ownership loss, and shutdown cancel or complete cleanup through the existing secret-safe clipboard lifecycle without leaving stale countdown state. ## Safety and boundaries - This is an authenticated presentation change, not permission to retain plaintext while locked or after the lease expires. - Do not weaken secure-storage authentication, lease revocation, clipboard replacement checks, cancellation, or cleanup failure reporting. - Do not launch `pass`, `gpg`, `git`, shells, or helper processes. - Keep application code free of `unsafe` Rust and preserve the `crates/storage` ownership boundary. ## Tests and verification - Drive a real encrypted compatibility entry through the production activation, authentication, document-load, and render path. Assert that password and every other field value are present while unlocked without a reveal action, remain visible across field focus changes, and disappear after lock and authentication expiry. - Cover empty, Unicode, repeated, unknown, OTP, and wrapped values without lossy display or TUI-owned parsing. - Assert every cell/span of selected sidebar, viewer/editor, search, and status content uses the intended contrasting style in color mode and remains distinguishable in monochrome mode. - Add deterministic clipboard lifecycle tests that prove the visible countdown decreases, reaches cleanup in sync with the configured timeout, resets on a second copy, disappears on completion, and cannot survive lock/expiry/cancellation. - Run `cargo fmt --all -- --check`, `RUSTFLAGS="-D warnings" cargo check --workspace --all-targets`, `cargo clippy --workspace --all-targets -- -D warnings`, and `cargo test --workspace`. ## Acceptance criteria - Opening an entry after authentication shows its password and every other field value immediately; no bullet placeholders or reveal step remain on an unlocked entry. - No decrypted value remains visible or retained after lock, expiry, terminal loss, or entry close. - Selected and active TUI content is plainly readable in color, limited-color, and monochrome terminals. - Clipboard feedback counts down once per second from the configured timeout and clears exactly when the real clipboard presentation completes or is cancelled. - All behavior is covered through production state/render paths, uses pure Rust, and preserves storage-owned parsing and secret-safe clipboard cleanup.

hugo added this to the 03 - Cross-platform Iced desktop app milestone 2026-08-10 15:56:54 +00:00

hugo added the bug label 2026-08-10 15:56:54 +00:00

hugo commented

2026-08-10 16:33:51 +00:00

Implemented and verified in commit 75d4ead.

What changed:

Unlocked entries now render every stored field value directly, including passwords, OTP URIs, notes, unknown/repeated fields, empty values, Unicode, and wrapped values. Values are removed when the entry closes, authentication expires, the store locks, terminal ownership is lost, or the app shuts down.
Selected and active tree, viewer, editor, search, and status surfaces now use bold black-on-white styling; monochrome terminals receive reverse-video selection.
Clipboard copies now expose the worker's actual cleanup deadline as a live seconds countdown. Re-copy resets the deadline, stale worker results cannot overwrite current state, and lock/expiry/terminal-loss/shutdown cancel and complete cleanup safely.
Regression coverage exercises a real temporary OpenPGP-encrypted entry plus visibility, Unicode, expiry, contrast, exact countdown, replacement-copy serialization, and cleanup lifecycle paths.

Review:

The TUI presents Rust-provided typed fields without introducing storage rules or subprocesses.
No plaintext is added to debug output.
The live issue acceptance criteria were checked against the final diff.

Verification:

cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

All gates passed.

Implemented and verified in commit 75d4ead. What changed: - Unlocked entries now render every stored field value directly, including passwords, OTP URIs, notes, unknown/repeated fields, empty values, Unicode, and wrapped values. Values are removed when the entry closes, authentication expires, the store locks, terminal ownership is lost, or the app shuts down. - Selected and active tree, viewer, editor, search, and status surfaces now use bold black-on-white styling; monochrome terminals receive reverse-video selection. - Clipboard copies now expose the worker's actual cleanup deadline as a live seconds countdown. Re-copy resets the deadline, stale worker results cannot overwrite current state, and lock/expiry/terminal-loss/shutdown cancel and complete cleanup safely. - Regression coverage exercises a real temporary OpenPGP-encrypted entry plus visibility, Unicode, expiry, contrast, exact countdown, replacement-copy serialization, and cleanup lifecycle paths. Review: - The TUI presents Rust-provided typed fields without introducing storage rules or subprocesses. - No plaintext is added to debug output. - The live issue acceptance criteria were checked against the final diff. Verification: - cargo fmt --all -- --check - RUSTFLAGS="-D warnings" cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace All gates passed.

hugo closed this issue

2026-08-10 16:34:23 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#67