RelaySettingsStore.kt

1package com.peachpasswords.sync23import android.content.Context4import dagger.hilt.android.qualifiers.ApplicationContext5import javax.inject.Inject6import javax.inject.Singleton78/**9 * Sync is exactly three named choices (docs/sync-lan-retirement.md, mirroring10 * the browser's `sync-settings.ts`):11 *12 *  - [PUBLIC]  — Peach's relay. The default, zero setup.13 *  - [PRIVATE] — a self-hosted peach-relay this mesh points at.14 *  - [OFF]     — no sync; the vault moves by Codex/CSV export instead.15 *16 * LAN peer-to-peer sync is retired, not deprecated: there is no fourth mode and17 * no "local network only" opt-out.18 */19enum class SyncMode {20    PUBLIC,21    PRIVATE,22    OFF,23    ;2425    fun wire(): String = when (this) {26        PUBLIC -> "public"27        PRIVATE -> "private"28        OFF -> "off"29    }3031    companion object {32        fun parse(raw: String?): SyncMode? = when (raw) {33            "public" -> PUBLIC34            "private" -> PRIVATE35            "off" -> OFF36            else -> null37        }38    }39}4041/**42 * The relay to dial, or why there is none. Single gate for every sync and43 * pairing entry point, so a new caller cannot forget one of the two ways sync44 * can be unusable — and so a URL only ever reaches the wire out of [Dial].45 */46sealed interface RelayDecision {47    @JvmInline48    value class Dial(val relayUrl: String) : RelayDecision49    data class Refuse(val reason: SyncOutcomeReason) : RelayDecision50}5152/**53 * [SyncMode.PRIVATE] chosen but no relay entered yet. The stored URL still54 * reads as the public default in that state, so syncing would quietly put this55 * phone on Peach's relay under a "Private relay" label — the exact trap the56 * retired `lanOnly` flag set. Every entry point fails closed on it instead.57 */58fun isPrivateRelayUnconfigured(mode: SyncMode, storedRelayUrl: String): Boolean =59    mode == SyncMode.PRIVATE && storedRelayUrl == Rendezvous.DEFAULT_RELAY_URL6061/**62 * A custom URL implies [SyncMode.PRIVATE]; Peach's own relay stays63 * [SyncMode.PUBLIC]. Adoption hands the source's relay over the same path, so64 * labelling that "private" would strand every device that joined over the65 * public relay in the unconfigured state below.66 */67fun modeForRelayUrl(normalizedRelayUrl: String): SyncMode =68    if (normalizedRelayUrl == Rendezvous.DEFAULT_RELAY_URL) SyncMode.PUBLIC else SyncMode.PRIVATE6970/**71 * The private relay as the user should see it: blank when none is set. Never72 * Peach's own URL wearing a private label — an empty field is the honest73 * representation of "not configured".74 */75fun privateRelayUrlOf(storedRelayUrl: String): String =76    storedRelayUrl.takeIf { it != Rendezvous.DEFAULT_RELAY_URL }.orEmpty()7778fun relayInForce(mode: SyncMode, storedRelayUrl: String): RelayDecision = when {79    mode == SyncMode.OFF -> RelayDecision.Refuse(SyncOutcomeReason.SYNC_DISABLED)80    isPrivateRelayUnconfigured(mode, storedRelayUrl) ->81        RelayDecision.Refuse(SyncOutcomeReason.PRIVATE_RELAY_UNSET)82    mode == SyncMode.PUBLIC -> RelayDecision.Dial(Rendezvous.DEFAULT_RELAY_URL)83    else -> RelayDecision.Dial(storedRelayUrl)84}8586/**87 * This handset's sync configuration. Plain SharedPreferences rather than the88 * encrypted store: none of it is a secret, and it must not travel to other89 * devices the way a vault setting would.90 */91@Singleton92class RelaySettingsStore @Inject constructor(93    @ApplicationContext context: Context,94    private val devices: PairedDeviceStore,95) {96    private val prefs = context.getSharedPreferences(PREFS_FILE, Context.MODE_PRIVATE)9798    fun syncMode(): SyncMode {99        SyncMode.parse(prefs.getString(KEY_MODE, null))?.let { return it }100        // Migration. Someone who set lanOnly chose "no relay involved", and LAN101        // is now gone, so the honest landing spot is OFF rather than silently102        // enrolling them in a relay they opted out of. Everyone else lands on103        // public/private by whether they had configured a custom URL.104        return when {105            prefs.getBoolean(LEGACY_KEY_LAN_ONLY, false) -> SyncMode.OFF106            storedRelayUrl() != Rendezvous.DEFAULT_RELAY_URL -> SyncMode.PRIVATE107            else -> SyncMode.PUBLIC108        }109    }110111    /**112     * The relay is mesh state: every paired device must agree on it or a peer113     * keeps dialling one we no longer use, and reconcile prefers the pair's own114     * URL over this setting. So the mode change reaches the mesh before it is115     * stored — the browser's `setSyncMode` orders it the same way.116     */117    fun setSyncMode(mode: SyncMode) {118        devices.propagateRelaySetting(mode, storedRelayUrl())119        prefs.edit().putString(KEY_MODE, mode.wire()).apply()120    }121122    /** The relay to dial, or the reason there is none. */123    fun relayInForce(): RelayDecision = relayInForce(syncMode(), storedRelayUrl())124125    /** Blank while no private relay is set. See [privateRelayUrlOf]. */126    fun privateRelayUrl(): String = privateRelayUrlOf(storedRelayUrl())127128    /**129     * Point this mesh at a relay by URL. A custom URL implies130     * [SyncMode.PRIVATE] — offering one and not switching to it would be a131     * trap. Peach's own relay stays [SyncMode.PUBLIC]: adoption hands the132     * source's relay over this same path, so calling that "private" would133     * mislabel every device that joined over the public relay and strand it in134     * the unconfigured-private state above.135     */136    fun setRelayUrl(input: String): String {137        val normalized = Rendezvous.normalizeRelayUrl(input)138        devices.propagateRelaySetting(modeForRelayUrl(normalized), normalized)139        prefs.edit()140            .putString(KEY_URL, normalized)141            .putString(KEY_MODE, modeForRelayUrl(normalized).wire())142            .apply()143        return normalized144    }145146    private fun storedRelayUrl(): String = prefs.getString(KEY_URL, null)147        ?.let { runCatching { Rendezvous.normalizeRelayUrl(it) }.getOrNull() }148        ?: Rendezvous.DEFAULT_RELAY_URL149150    companion object {151        const val PREFS_FILE = "peach_relay_settings"152        const val KEY_URL = "relay_url"153        const val KEY_MODE = "sync_mode"154        /** Retired `lanOnly` flag, read once for migration and never written. */155        const val LEGACY_KEY_LAN_ONLY = "lan_only"156157        fun readRelayUrl(context: Context): String =158            context.getSharedPreferences(PREFS_FILE, Context.MODE_PRIVATE)159                .getString(KEY_URL, null)160                ?.let { runCatching { Rendezvous.normalizeRelayUrl(it) }.getOrNull() }161                ?: Rendezvous.DEFAULT_RELAY_URL162    }163}