phone reads vaultStatus from the scanned invitation and switches roles: 'empty' → grantAdoption (send the vault to the empty browser), 'populated' or missing → existing receiver flow unchanged. Defaults to 'populated' for older invitations so historical sync is unaffected. (v2.7.12)

@@ -16,8 +16,8 @@1616         applicationId "com.peachpasswords"1717         minSdk 261818         targetSdk 3519-        versionCode 24013820-        versionName "2.7.11"19+        versionCode 24013920+        versionName "2.7.12"2121 2222         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"2323         vectorDrawables {

@@ -8,30 +8,49 @@88 private const val PAIRING_INVITATION_PREFIX = "peach-pair-v1:"99 private val PairingTokenPattern = Regex("^[A-Za-z0-9_-]{22}$")1010 11+/**12+ * Which side of the vault transfer the issuing device is on:13+ *   POPULATED — issuer has the vault; the scanner receives it (historical default).14+ *   EMPTY     — issuer has no vault; the scanner (phone) is the source and sends it.15+ *16+ * Older invitations from before this field existed parse as POPULATED, so a17+ * scanner that doesn't know about `vaultStatus` still does the right thing:18+ * it receives the vault from the source.19+ */20+enum class VaultStatus { EMPTY, POPULATED }21+1122 data class PairingInvitation(1223     val relayUrl: String,1324     val token: String,25+    val vaultStatus: VaultStatus = VaultStatus.POPULATED,1426 )1527 1628 @Serializable1729 private data class PairingInvitationWire(1830     val relay: String,1931     val token: String,32+    val vault: String? = null,2033 )2134 2235 /**2336  * QR/manual first-pair payload. Only reachability is present before Noise:24- * a credential-free wss relay and a fresh 128-bit token. Never add identity or25- * vault fields here.37+ * a credential-free wss relay and a fresh 128-bit token. [vaultStatus] tells38+ * the scanner which side of the transfer it is on; older invitations omit it39+ * and parse as POPULATED. Never add identity or vault fields here.2640  */2741 fun createPairingInvitation(2842     relayUrl: String,2943     token: String = Rendezvous.newPairingToken(),44+    vaultStatus: VaultStatus = VaultStatus.POPULATED,3045 ): String {3146     require(PairingTokenPattern.matches(token)) {3247         "pairing invitation token must be 128-bit base64url"3348     }34-    val wire = PairingInvitationWire(Rendezvous.normalizeRelayUrl(relayUrl), token)49+    val wire = PairingInvitationWire(50+        relay = Rendezvous.normalizeRelayUrl(relayUrl),51+        token = token,52+        vault = wireVaultStatus(vaultStatus),53+    )3554     val encoded = Base64.getUrlEncoder().withoutPadding()3655         .encodeToString(Json.encodeToString(wire).toByteArray(Charsets.UTF_8))3756     return PAIRING_INVITATION_PREFIX + encoded@@ -51,8 +70,22 @@5170         PairingInvitation(5271             relayUrl = Rendezvous.normalizeRelayUrl(wire.relay),5372             token = wire.token,73+            vaultStatus = parseVaultStatus(wire.vault),5474         )5575     }.getOrNull()5676 }5777 58-fun PairingInvitation.roomUrl(): String = Rendezvous.buildUrl(relayUrl, token)78+private fun wireVaultStatus(status: VaultStatus): String = when (status) {79+    VaultStatus.EMPTY -> "empty"80+    VaultStatus.POPULATED -> "populated"81+}82+83+private fun parseVaultStatus(raw: String?): VaultStatus = when (raw) {84+    "empty" -> VaultStatus.EMPTY85+    "populated" -> VaultStatus.POPULATED86+    // Missing or unknown defaults to POPULATED so historical invitations keep87+    // working byte-for-byte: the scanner receives the vault from the source.88+    else -> VaultStatus.POPULATED89+}90+91+fun PairingInvitation.roomUrl(): String = Rendezvous.buildUrl(relayUrl, token)\ No newline at end of file

@@ -13,6 +13,11 @@1313  */1414 @Singleton1515 class RelayAdoptionReceiver @Inject constructor() {16+    /**17+     * Phone as receiver: scan a [VaultStatus.POPULATED] invitation, dial the18+     * relay room, complete Noise, and receive the source's root key. This is19+     * the historical pairing direction and stays byte-for-byte unchanged.20+     */1621     suspend fun adopt(1722         encodedInvitation: String,1823         deps: AdoptionReceiverDeps,@@ -21,6 +26,9 @@2126     ): PairedDevice {2227         val invitation = parsePairingInvitation(encodedInvitation)2328             ?: throw IllegalArgumentException("invalid_pairing_invitation")29+        require(invitation.vaultStatus == VaultStatus.POPULATED) {30+            "receiver adopt() expects a populated invitation; got ${invitation.vaultStatus}"31+        }2432         val socket = OkHttpRelaySocket.connect(invitation.roomUrl())2533         return adoptFromRelaySocket(2634             socket = socket,@@ -30,6 +38,34 @@3038             windowMs = windowMs,3139         )3240     }41+42+    /**43+     * Phone as source: scan a [VaultStatus.EMPTY] invitation from an empty44+     * device, dial the relay room, complete Noise, and hand our root key over.45+     * Symmetric to [adopt]: the initiator runs Noise NK, but the payload46+     * direction flips — the phone sends the grant, the empty device receives47+     * it.48+     */49+    suspend fun grantFromInvitation(50+        encodedInvitation: String,51+        sourceDeps: AdoptionSourceDeps,52+        confirm: suspend (sas: String, request: AdoptionFrame.Request) -> Boolean,53+        windowMs: Long = PAIRING_WINDOW_MS,54+    ): PairedDevice {55+        val invitation = parsePairingInvitation(encodedInvitation)56+            ?: throw IllegalArgumentException("invalid_pairing_invitation")57+        require(invitation.vaultStatus == VaultStatus.EMPTY) {58+            "grantFromInvitation() expects an empty invitation; got ${invitation.vaultStatus}"59+        }60+        val socket = OkHttpRelaySocket.connect(invitation.roomUrl())61+        return grantFromRelaySocket(62+            socket = socket,63+            invitation = invitation,64+            sourceDeps = sourceDeps,65+            confirm = confirm,66+            windowMs = windowMs,67+        )68+    }3369 }3470 3571 /**@@ -70,6 +106,40 @@70106 }71107 72108 /**109+ * Source-initiator counterpart to [adoptFromRelaySocket]: phone dials the110+ * relay room, runs Noise as initiator, and hands the root key over to the111+ * empty responder. The final source action is an encrypted ADOPT_COMPLETE,112+ * so a graceful close is required to land it.113+ */114+internal suspend fun grantFromRelaySocket(115+    socket: RelayBinarySocket,116+    invitation: PairingInvitation,117+    sourceDeps: AdoptionSourceDeps,118+    confirm: suspend (sas: String, request: AdoptionFrame.Request) -> Boolean,119+    windowMs: Long = PAIRING_WINDOW_MS,120+): PairedDevice {121+    var completed = false122+    return try {123+        val granted = withTimeout(windowMs) {124+            runRelayAdoptionInitiatorSourceSession(125+                socket = socket,126+                invitation = invitation,127+                sourceDeps = sourceDeps,128+                confirm = confirm,129+            ) ?: throw IllegalStateException("adoption_rejected")130+        }131+        completed = true132+        granted133+    } finally {134+        if (completed) {135+            socket.closeAfterQueuedFrames()136+        } else {137+            socket.close()138+        }139+    }140+}141+142+/**73143  * Pure live-session seam used by both production and the real Noise interop74144  * test. The source must already occupy the relay room before this starts.75145  */@@ -152,3 +222,73 @@152222         noise.close()153223     }154224 }225+226+/**227+ * Phone-initiator source session for the "empty browser" invitation path.228+ * The phone dials the relay room and waits for the empty responder to send229+ * ADOPT_REQUEST, then hands over its root key through [grantAdoption]. The230+ * SAS gate is the single commit signal — same model as the existing source231+ * session — and onConsent is pre-cleared because the user already opted in232+ * by scanning the QR.233+ */234+internal suspend fun runRelayAdoptionInitiatorSourceSession(235+    socket: RelayBinarySocket,236+    invitation: PairingInvitation,237+    sourceDeps: AdoptionSourceDeps,238+    confirm: suspend (sas: String, request: AdoptionFrame.Request) -> Boolean,239+): PairedDevice? {240+    socket.send(241+        JSONObject()242+            .put("type", "PEACH_HELLO")243+            .put("token", invitation.token)244+            .toString()245+            .toByteArray(Charsets.UTF_8),246+    )247+248+    val ack = JSONObject(String(socket.receive(), Charsets.UTF_8))249+    require(ack.optString("type") == "PEACH_HELLO_ACK") {250+        "expected PEACH_HELLO_ACK"251+    }252+    val responderStatic = hexToPubkey(ack.optString("ephemeralPublicKeyHex"))253+    val noise = try {254+        noiseNKInitiator(255+            responderStatic,256+            socket::send,257+            socket::receive,258+        )259+    } finally {260+        responderStatic.fill(0)261+    }262+    try {263+        val channel = object : PairingTransport {264+            override suspend fun send(msg: ByteArray) = socket.send(noise.encrypt(msg))265+            override suspend fun receive(): ByteArray = noise.decrypt(socket.receive())266+            override suspend fun close() = socket.close()267+        }268+        val request = receiveFrame(channel)269+        if (!isAdoptRequest(request)) return null270+        request as AdoptionFrame.Request271+        if (!confirm(SASDerivation.derive(noise.handshakeHash), request)) return null272+273+        val pairState = AdoptionPairState(274+            rendezvousSecretHex = Rendezvous.bytesToHex(275+                Rendezvous.deriveSecret(noise.handshakeHash),276+            ),277+            relayUrl = invitation.relayUrl,278+        )279+        val boundDeps = object : AdoptionSourceDeps {280+            override val sourceIdentity = sourceDeps.sourceIdentity281+            override val pairState = pairState282+            override suspend fun rootKeyHex(): String = sourceDeps.rootKeyHex()283+            override suspend fun vaultId(): String = sourceDeps.vaultId()284+            override suspend fun license(): String? = sourceDeps.license()285+            override suspend fun onConsent(request: AdoptionFrame.Request): Boolean = true286+            override suspend fun upsertPairedDevice(device: PairedDevice) {287+                sourceDeps.upsertPairedDevice(device)288+            }289+        }290+        return grantAdoption(channel, request, boundDeps)291+    } finally {292+        noise.close()293+    }294+}\ No newline at end of file

@@ -211,6 +211,9 @@211211                     Body(212212                         "Only continue if this code is identical on the device sharing the vault.",213213                     )214+                    current.peerName?.let { name ->215+                        Body("Joining device: $name")216+                    }214217                     Spacer(Modifier.height(PeachSpacing.lg))215218                     Text(216219                         current.sas,@@ -221,7 +224,11 @@221224                     )222225                     Spacer(Modifier.height(PeachSpacing.lg))223226                     PillButton(224-                        if (vm.joining) "They match — join vault" else "They match — adopt vault",227+                        when {228+                            current.isSource -> "They match — send vault"229+                            vm.joining -> "They match — join vault"230+                            else -> "They match — adopt vault"231+                        },225232                         LocalPeachAccent.current,226233                         filled = true,227234                     ) { vm.confirmSas(true) }

@@ -5,6 +5,7 @@55 import androidx.lifecycle.viewModelScope66 import com.peachpasswords.license.LicenseRepository77 import com.peachpasswords.sync.AdoptionReceiverDeps8+import com.peachpasswords.sync.AdoptionSourceDeps89 import com.peachpasswords.sync.BackgroundSyncPreference910 import com.peachpasswords.sync.DeviceType1011 import com.peachpasswords.sync.AdoptionFrame@@ -14,9 +15,13 @@1415 import com.peachpasswords.sync.PeachSyncService1516 import com.peachpasswords.sync.RelayAdoptionReceiver1617 import com.peachpasswords.sync.RelaySettingsStore18+import com.peachpasswords.sync.RelayDecision19+import com.peachpasswords.sync.VaultStatus1720 import com.peachpasswords.sync.buildLocalIdentity1821 import com.peachpasswords.sync.computeVaultId22+import com.peachpasswords.sync.deriveLocalSyncKeypair1923 import com.peachpasswords.sync.getDeviceName24+import com.peachpasswords.sync.getOrCreateDeviceId2025 import com.peachpasswords.sync.hexToPubkey2126 import com.peachpasswords.sync.parsePairingInvitation2227 import com.peachpasswords.ui.security.scorePassword@@ -45,7 +50,16 @@4550     data object Disclosure : AdoptVaultUiState4651     data object Pair : AdoptVaultUiState4752     data object Connecting : AdoptVaultUiState48-    data class ConfirmSas(val sas: String) : AdoptVaultUiState53+    /**54+     * Source-initiator flow exposes [isSource] so the screen can phrase the55+     * confirmation as "send vault" instead of "adopt/join vault". The SAS is56+     * identical to the receiver flow; only the payload direction differs.57+     */58+    data class ConfirmSas(59+        val sas: String,60+        val isSource: Boolean = false,61+        val peerName: String? = null,62+    ) : AdoptVaultUiState4963     data object Adopting : AdoptVaultUiState5064     data class Complete(val sourceName: String) : AdoptVaultUiState5165     data class Failed(val reason: String) : AdoptVaultUiState@@ -96,11 +110,19 @@96110 97111     fun adopt(invitation: String) {98112         if (_state.value !is AdoptVaultUiState.Pair) return99-        if (parsePairingInvitation(invitation) == null) {113+        val parsed = parsePairingInvitation(invitation)114+        if (parsed == null) {100115             _state.value = AdoptVaultUiState.Failed("invalid_pairing_invitation")101116             clearPassword()102117             return103118         }119+        when (parsed.vaultStatus) {120+            VaultStatus.POPULATED -> startReceiverFlow(invitation)121+            VaultStatus.EMPTY -> startSourceFlow(invitation)122+        }123+    }124+125+    private fun startReceiverFlow(invitation: String) {104126         _state.value = AdoptVaultUiState.Connecting105127         protocolError = null106128         adoptionJob = viewModelScope.launch {@@ -111,7 +133,10 @@111133                     confirm = { sas ->112134                         val pending = CompletableDeferred<Boolean>()113135                         confirmation = pending114-                        _state.value = AdoptVaultUiState.ConfirmSas(sas)136+                        _state.value = AdoptVaultUiState.ConfirmSas(137+                            sas = sas,138+                            isSource = false,139+                        )115140                         pending.await()116141                     },117142                 )@@ -137,6 +162,70 @@137162         }138163     }139164 165+    /**166+     * Source-initiator flow: the scanning invitation came from a vault-less167+     * device, so the phone dials the relay, completes Noise, and sends the168+     * root key over. Uses the same UI states as the receiver flow so the169+     * surface area stays the same; only [AdoptVaultUiState.ConfirmSas.isSource]170+     * distinguishes the role for the confirmation copy.171+     */172+    private fun startSourceFlow(invitation: String) {173+        val master = vault.syncMasterKey()174+        if (master == null) {175+            _state.value = AdoptVaultUiState.Failed("vault_locked")176+            clearPassword()177+            return178+        }179+        when (val decision = relaySettings.relayInForce()) {180+            is RelayDecision.Refuse -> {181+                VaultCrypto.zero(master)182+                _state.value = AdoptVaultUiState.Failed(decision.reason.wire())183+                clearPassword()184+                return185+            }186+            is RelayDecision.Dial -> Unit187+        }188+        _state.value = AdoptVaultUiState.Connecting189+        protocolError = null190+191+        val keys = deriveLocalSyncKeypair(master, getOrCreateDeviceId(appContext))192+        val identity = buildLocalIdentity(appContext, master)193+        VaultCrypto.zero(master)194+        adoptionJob = viewModelScope.launch {195+            try {196+                val paired = receiver.grantFromInvitation(197+                    encodedInvitation = invitation,198+                    sourceDeps = sourceDeps(identity),199+                    confirm = { sas, request ->200+                        val pending = CompletableDeferred<Boolean>()201+                        confirmation = pending202+                        _state.value = AdoptVaultUiState.ConfirmSas(203+                            sas = sas,204+                            isSource = true,205+                            peerName = request.deviceName.ifBlank { "New device" },206+                        )207+                        pending.await()208+                    },209+                )210+                paired.relayUrl?.let(relaySettings::setRelayUrl)211+                _state.value = AdoptVaultUiState.Complete(212+                    paired.deviceName?.takeIf(String::isNotBlank) ?: "Your other device",213+                )214+            } catch (error: CancellationException) {215+                throw error216+            } catch (error: Throwable) {217+                _state.value = AdoptVaultUiState.Failed(218+                    protocolError ?: error.message ?: "adoption_failed",219+                )220+            } finally {221+                VaultCrypto.zero(keys.secretKey)222+                VaultCrypto.zero(keys.publicKey)223+                confirmation = null224+                clearPassword()225+            }226+        }227+    }228+140229     fun confirmSas(matches: Boolean) {141230         val pending = confirmation ?: return142231         confirmation = null@@ -231,6 +320,34 @@231320             }232321         }233322 323+    private fun sourceDeps(identity: LocalDeviceIdentity): AdoptionSourceDeps =324+        object : AdoptionSourceDeps {325+            override val sourceIdentity: LocalDeviceIdentity = identity326+327+            override suspend fun rootKeyHex(): String {328+                val root = vault.syncMasterKey()329+                    ?: throw IllegalStateException("vault_locked")330+                return try {331+                    root.joinToString("") { "%02x".format(it) }332+                } finally {333+                    VaultCrypto.zero(root)334+                }335+            }336+337+            override suspend fun vaultId(): String =338+                vault.syncVaultId() ?: throw IllegalStateException("vault_locked")339+340+            override suspend fun license(): String? =341+                license.getLicenseKey()?.takeIf(license::validateLicense)342+343+            override suspend fun onConsent(request: AdoptionFrame.Request): Boolean = true344+345+            override suspend fun upsertPairedDevice(device: PairedDevice) {346+                devices.clearRevocation(device.deviceId)347+                devices.upsert(device)348+            }349+        }350+234351     fun setBackgroundSync(enabled: Boolean) {235352         backgroundSync.setEnabled(enabled)236353         if (enabled) PeachSyncService.start(appContext) else PeachSyncService.stop(appContext)@@ -262,4 +379,4 @@262379         throw IllegalStateException("JOIN_POPULATED_VAULT_BLOCKED")263380     }264381     return localVaultId265-}382+}\ No newline at end of file

@@ -1,6 +1,7 @@11 package com.peachpasswords.sync22 33 import org.junit.Assert.assertEquals4+import org.junit.Assert.assertNotNull45 import org.junit.Assert.assertNull56 import org.junit.Test67 @@ -8,14 +9,54 @@89     private val token = "AAECAwQFBgcICQoLDA0ODw"910     private val relay = "wss://relay.peachpasswords.com"1011     private val kat =11-        "peach-pair-v1:eyJyZWxheSI6IndzczovL3JlbGF5LnBlYWNocGFzc3dvcmRzLmNvbSIsInRva2VuIjoiQUFFQ0F3UUZCZ2NJQ1FvTERBME9EdyJ9"12+        "peach-pair-v1:eyJyZWxheSI6IndzczovL3JlbGF5LnBlYWNocGFzc3dvcmRzLmNvbSIsInRva2VuIjoiQUFFQ0F3UUZCZ2NJQ1FvTERBME9EdyIsInZhdWx0IjoicG9wdWxhdGVkIn0"13+    private val emptyKat =14+        "peach-pair-v1:eyJyZWxheSI6IndzczovL3JlbGF5LnBlYWNocGFzc3dvcmRzLmNvbSIsInRva2VuIjoiQUFFQ0F3UUZCZ2NJQ1FvTERBME9EdyIsInZhdWx0IjoiZW1wdHkifQ"1215 13-    @Test fun `matches browser invitation KAT`() {16+    @Test fun `matches browser invitation KAT with default populated vault`() {1417         assertEquals(kat, createPairingInvitation("$relay/", token))15-        assertEquals(PairingInvitation(relay, token), parsePairingInvitation(kat))16-        assertEquals("$relay/r/$token", parsePairingInvitation(kat)!!.roomUrl())18+        val parsed = parsePairingInvitation(kat)19+        assertEquals(PairingInvitation(relay, token, VaultStatus.POPULATED), parsed)20+        assertEquals("$relay/r/$token", parsed!!.roomUrl())1721     }1822 23+    @Test fun `empty invitation round-trips as source role`() {24+        assertEquals(emptyKat, createPairingInvitation(relay, token, VaultStatus.EMPTY))25+        val parsed = parsePairingInvitation(emptyKat)26+        assertEquals(PairingInvitation(relay, token, VaultStatus.EMPTY), parsed)27+    }28+29+    @Test fun `explicit populated invitation round-trips as receiver role`() {30+        val invitation = createPairingInvitation(relay, token, VaultStatus.POPULATED)31+        val parsed = parsePairingInvitation(invitation)32+        assertEquals(VaultStatus.POPULATED, parsed?.vaultStatus)33+    }34+35+    @Test fun `missing vault field defaults to populated for historical compatibility`() {36+        val older = raw("""{"relay":"$relay","token":"$token"}""")37+        val parsed = parsePairingInvitation(older)38+        assertEquals(VaultStatus.POPULATED, parsed?.vaultStatus)39+        assertEquals(PairingInvitation(relay, token), parsed)40+    }41+42+    @Test fun `unknown vault value defaults to populated`() {43+        val weird = raw("""{"relay":"$relay","token":"$token","vault":"maybe"}""")44+        val parsed = parsePairingInvitation(weird)45+        assertEquals(VaultStatus.POPULATED, parsed?.vaultStatus)46+    }47+48+    @Test fun `vaultStatus on the parsed invitation drives the adoption flow`() {49+        val empty = parsePairingInvitation(emptyKat)50+        val populated = parsePairingInvitation(kat)51+        val legacy = parsePairingInvitation(raw("""{"relay":"$relay","token":"$token"}"""))52+        assertNotNull(empty)53+        assertNotNull(populated)54+        assertNotNull(legacy)55+        assertEquals(VaultStatus.EMPTY, empty!!.vaultStatus)56+        assertEquals(VaultStatus.POPULATED, populated!!.vaultStatus)57+        assertEquals(VaultStatus.POPULATED, legacy!!.vaultStatus)58+    }59+1960     @Test fun `rejects malformed insecure and short-token invitations`() {2061         assertNull(parsePairingInvitation("not-an-invitation"))2162         assertNull(parsePairingInvitation("peach-pair-v1:%%%"))@@ -26,4 +67,4 @@2667     private fun raw(json: String): String =2768         "peach-pair-v1:" + java.util.Base64.getUrlEncoder().withoutPadding()2869             .encodeToString(json.toByteArray())29-}70+}\ No newline at end of file