Isolate credentials and cached state across ABS+ servers #8

Merged

backmeupplz merged 20 commits from fix/33-server-isolation into main

2026-10-05 03:48:04 +00:00

backmeupplz commented

2026-10-04 22:09:42 +00:00

(Migrated from github.com)

Summary

Transactional Android/iOS server login with immutable host/account-bound credentials and stale-request guards. Failed/cancelled login cannot replace committed state.
Isolate linked credentials, shares, favorites, session JSON, cover caches, retained media and queued work by authenticated ownership; preserve/quarantine legacy bytes.
Enforce redirect and actual playback-service boundaries; login-owned durable download retries retain current main recovery behavior.
Integrates merged navigation, accessibility, offline Home/Library/Series and retry changes.

Agentboard: https://agentboard.icefish-betta.ts.net/#33

Verification

Head: f3ed7100e2 (includes main 1013039)

Independent Astra/high final review APPROVE d1a37134-fbec-4079-a0fe-c1e6063f940a; parent acceptance review clean. All children settled.
Fresh full Android: 91 tests, zero failures/skips; Debug and Release APK builds passed.
Fresh focused iOS: parent 4/4; independent six suites 10/10; finalized xcresults Passed and exit 0.
Exact-head complete Android+iOS CI SUCCESS: https://github.com/backmeupplz/absplus/actions/runs/37258497733 (all 11 iOS selectors retained).
Main-push CI uses the same commands as PR CI; no omitted main-only checks.

Compatibility

Authenticated iOS downloads use foreground redirect-rejecting transport; background continuation is not promised. Retry intents are credential-neutral and login-owned across relaunch.
Retained media/covers partitioned by host and immutable account identity; unprovable old bytes quarantined, not deleted or implicitly migrated.
Same-account reauthentication preserves authorized ongoing playback and durable progress, but rotates general JSON/login identity and clears linked authorization.
Preserves merged progress replay, download sibling removal and book skips. Follow-on #25/#36 integrations must preserve isolation and all native suites.
Disposable fixtures only; no real credentials/personal library. No store publication, installed-device or deployed-native-version claim.

## Summary - Transactional Android/iOS server login with immutable host/account-bound credentials and stale-request guards. Failed/cancelled login cannot replace committed state. - Isolate linked credentials, shares, favorites, session JSON, cover caches, retained media and queued work by authenticated ownership; preserve/quarantine legacy bytes. - Enforce redirect and actual playback-service boundaries; login-owned durable download retries retain current main recovery behavior. - Integrates merged navigation, accessibility, offline Home/Library/Series and retry changes. Agentboard: https://agentboard.icefish-betta.ts.net/#33 ## Verification Head: f3ed7100e2aac7ae2c558265143a1e16f6b896ac (includes main 1013039) - Independent Astra/high final review APPROVE d1a37134-fbec-4079-a0fe-c1e6063f940a; parent acceptance review clean. All children settled. - Fresh full Android: 91 tests, zero failures/skips; Debug and Release APK builds passed. - Fresh focused iOS: parent 4/4; independent six suites 10/10; finalized xcresults Passed and exit 0. - Exact-head complete Android+iOS CI SUCCESS: https://github.com/backmeupplz/absplus/actions/runs/37258497733 (all 11 iOS selectors retained). - Main-push CI uses the same commands as PR CI; no omitted main-only checks. ## Compatibility - Authenticated iOS downloads use foreground redirect-rejecting transport; background continuation is not promised. Retry intents are credential-neutral and login-owned across relaunch. - Retained media/covers partitioned by host and immutable account identity; unprovable old bytes quarantined, not deleted or implicitly migrated. - Same-account reauthentication preserves authorized ongoing playback and durable progress, but rotates general JSON/login identity and clears linked authorization. - Preserves merged progress replay, download sibling removal and book skips. Follow-on #25/#36 integrations must preserve isolation and all native suites. - Disposable fixtures only; no real credentials/personal library. No store publication, installed-device or deployed-native-version claim.

backmeupplz commented

2026-10-05 01:25:55 +00:00

(Migrated from github.com)

Review verdict

REQUEST CHANGES
Head SHA: f3f54aa240
PR: https://github.com/backmeupplz/absplus/pull/8
Independent Astra review 3b510567-9386-44a0-85fa-0d5c6788c21b settled; parent independently confirms both source findings and one native integration failure. Latest main6650ef7221fa8a49a7a12839faf64cbb144f2f7a merged conflict-free and pushed, but cannot pass release gate.

P1 Android persistent artwork binding: app/src/main/java/com/borodutch/absplus/Ui.kt:38 uses item-only ImageView.tag; Main.kt:922 and1063 skip Covers.load when item matches. Download bar/mini-player survive logout/login in the same Activity without clearing drawable/tag. A loads book artwork; B on another host/account plays/downloads same item ID; A artwork remains without a B lookup, even if B denies the cover. Fix ownership-aware view binding or reset persistent drawable/tag on session replacement; add Activity-level same-ID account/host-switch regression through updateDl/updatePlayer, not only direct Covers.load tests.
P2 iOS stale general JSON after reauthentication: ios/ABSPlus/Abs.swift:122 chooses stable mediaScope for general JSON, while resetSession:367-368 ignores cleanup failures and cached:438-440 reads leftover files. Reauthenticate same host/immutable account after retaining/recreating old /api/me cache: previous progress/bookmarks can repopulate reset state via setMe. General JSON must use persisted per-login identity (Tok.id), with stable media scope retained only for allowlisted retained metadata/audio. Add leftover-cache same-account reauthentication regression; preserve same-account retained media recovery and process-restart semantics.
P1 merge-gate fixture integration: app/src/test/java/com/borodutch/absplus/LibraryRecoveryTest.kt:106-109 manually seeds acct:fixture with only a/r, lacking server/id/mediaIdentity. All nine new #31 tests fail against intentional Abs.token host validation; production login binding must not be weakened. Extend disposable HTTP fixture to authenticate through Abs.login and retain all membership/navigation assertions. Local integrated-head testDebugUnitTest assembleDebug assembleRelease --offline --no-daemon --max-workers=2 exits1: 43 tests, 9 failures (all LibraryRecoveryTest), 34 passed. Evidence /tmp/abs33-b93c-android.log and worktree app/build/test-results/testDebugUnitTest.

No fixes made in this review phase. Security findings are source-traced, not observed real credential leaks or newly executed reproductions. No real credentials or personal libraries used. Worktree worktrees/absplus-33-review-b93c is clean; HEAD is published. #34 release owner notified; preserve its prior release order and reintegrate newer main before final review. No merge, signing, store publication or installed-device claim.

## Review verdict REQUEST CHANGES Head SHA: f3f54aa2405cca6859f9b40d6145982fc7cfe52c PR: https://github.com/backmeupplz/absplus/pull/8 Independent Astra review 3b510567-9386-44a0-85fa-0d5c6788c21b settled; parent independently confirms both source findings and one native integration failure. Latest main6650ef7221fa8a49a7a12839faf64cbb144f2f7a merged conflict-free and pushed, but cannot pass release gate. 1. P1 Android persistent artwork binding: app/src/main/java/com/borodutch/absplus/Ui.kt:38 uses item-only ImageView.tag; Main.kt:922 and1063 skip Covers.load when item matches. Download bar/mini-player survive logout/login in the same Activity without clearing drawable/tag. A loads book artwork; B on another host/account plays/downloads same item ID; A artwork remains without a B lookup, even if B denies the cover. Fix ownership-aware view binding or reset persistent drawable/tag on session replacement; add Activity-level same-ID account/host-switch regression through updateDl/updatePlayer, not only direct Covers.load tests. 2. P2 iOS stale general JSON after reauthentication: ios/ABSPlus/Abs.swift:122 chooses stable mediaScope for general JSON, while resetSession:367-368 ignores cleanup failures and cached:438-440 reads leftover files. Reauthenticate same host/immutable account after retaining/recreating old /api/me cache: previous progress/bookmarks can repopulate reset state via setMe. General JSON must use persisted per-login identity (Tok.id), with stable media scope retained only for allowlisted retained metadata/audio. Add leftover-cache same-account reauthentication regression; preserve same-account retained media recovery and process-restart semantics. 3. P1 merge-gate fixture integration: app/src/test/java/com/borodutch/absplus/LibraryRecoveryTest.kt:106-109 manually seeds acct:fixture with only a/r, lacking server/id/mediaIdentity. All nine new #31 tests fail against intentional Abs.token host validation; production login binding must not be weakened. Extend disposable HTTP fixture to authenticate through Abs.login and retain all membership/navigation assertions. Local integrated-head testDebugUnitTest assembleDebug assembleRelease --offline --no-daemon --max-workers=2 exits1: 43 tests, 9 failures (all LibraryRecoveryTest), 34 passed. Evidence /tmp/abs33-b93c-android.log and worktree app/build/test-results/testDebugUnitTest. No fixes made in this review phase. Security findings are source-traced, not observed real credential leaks or newly executed reproductions. No real credentials or personal libraries used. Worktree worktrees/absplus-33-review-b93c is clean; HEAD is published. #34 release owner notified; preserve its prior release order and reintegrate newer main before final review. No merge, signing, store publication or installed-device claim.