62 lines
3.7 KiB
Markdown
62 lines
3.7 KiB
Markdown
# Android move, copy and delete
|
|
|
|
Issue [#108](https://git.rfc1437.de/hugo/IronStorage/issues/108) exposes entry and
|
|
folder mutations from row action buttons, long press, TalkBack actions, swipe and
|
|
the normal entry viewer's More menu. Swiping right selects Move; swiping left
|
|
selects Delete. The row resets and opens the action dialog. A swipe never applies
|
|
a mutation. Every action requires explicit confirmation of the Rust-provided
|
|
target, and deletion also identifies the folder's contents.
|
|
|
|
The dialog works from locked rows. Its metadata is read without decryption; its
|
|
Unlock action authenticates through the shared Rust lease before confirmation can
|
|
execute. Folder authentication uses an in-memory encryption probe for its actual
|
|
recipient policy, including empty folders. This creates no password-store entry.
|
|
|
|
Rust provides destination hierarchy depth, labels, validation, collisions and
|
|
the exact replacement targets. Unavailable destinations are disabled. Replacing
|
|
entries requires a separate checkbox, as does discarding open editors or unsaved
|
|
edits. Changing destination resets overwrite consent. Pending dialogs and their
|
|
confirmation flags are never saved across process recreation and are cancelled
|
|
by background, relock or presentation revocation.
|
|
|
|
## Transaction and revision ownership
|
|
|
|
`crates/storage` validates typed row IDs against their filesystem revisions,
|
|
then binds plans to the managed tree's ciphertext, recipient policies and object
|
|
identities. Changes anywhere in that tree conservatively require a fresh plan;
|
|
an existing target replaced after preparation cannot inherit prior overwrite
|
|
consent. The transaction engine checks the revision and authentication lease
|
|
again after any reencryption and immediately before applying changes.
|
|
|
|
The existing pass-compatible `TreeMutator` owns selective reencryption, policy
|
|
preservation, recursive deletion, rollback, empty-directory cleanup and automatic
|
|
Git commits. Unsupported auxiliary files or nested Git repositories remain
|
|
protected by its validation. Mobile reservations block overlapping repository
|
|
actions and entry/editor mutation while a transaction is applying.
|
|
|
|
Editor coordination includes encrypted checkpoints left after background or
|
|
relock. Failure retains recoverable edits while an expired lease drops plaintext.
|
|
Confirmed success removes only affected editors and checkpoints and reports their
|
|
typed identities to the Android presentation owner. It cannot resurrect a
|
|
discarded draft. Rust also returns navigation following the copied/moved object
|
|
or the nearest surviving folder after deletion; rejected transactions refresh the
|
|
current tree. Kotlin renders those results and performs no repository I/O,
|
|
recipient selection, target-path construction or commit policy.
|
|
|
|
## Validation
|
|
|
|
Upstream-compatible encrypted fixtures prove folder copy's selective reencryption,
|
|
policy/ciphertext preservation on move, recursive delete confirmation, explicit
|
|
overwrite, replacement-target rejection, a source changing during reencryption,
|
|
commit rollback, pre-apply lease revocation and checkpoint retention/discard.
|
|
NativeTreeMutationTest runs real encrypted stores through the Kotlin facade and
|
|
checks locked preparation, dirty editor consent, navigation, stale rows and
|
|
background interruption. MutationWorkflowTest checks full swipes, cancellation,
|
|
separate overwrite/discard consent and folder TalkBack/menu actions. Its optional
|
|
inspection mode supplies disposable presentation fixtures for computer use.
|
|
|
|
Emulator updates use `install -r` and preserve retained app data and enrollment.
|
|
The deterministic native tests supply OS capability callbacks; this issue changes
|
|
no real Keystore/biometric adapter. Release ABIs are arm64-v8a and armeabi-v7a.
|
|
Physical devices and x86_64 are excluded by the milestone's support scope.
|