Wire subscriptions: fetch, reconcile, and say what happened

SubscriptionFetcher was written and tested and nothing called it, which
is why the node list passed subscription = null. It is connected now,
and the connection is where NW-D-04 actually lives.

NodeStore learned where a node came from, because a feed may only speak
for the nodes it supplied. A refresh leaves manual nodes untouched; a
node the feed stops listing is kept and marked rather than deleted,
since deleting it leaves a shorter list and no explanation, which is
the outcome the requirement exists to prevent; and a subscription that
comes back restores the node in place instead of appending a second
copy. A line with no origin marker reads as manual, which is both
correct and the whole migration — every node written before origins
existed was one the user added by hand.

The subscription URL is a bearer credential and is stored accordingly:
its own file, so a future "export my nodes" cannot sweep it up; written
before the first fetch is attempted, so a correct but unreachable
subscription is still the subscription when the network returns; and
forgetting it deletes the file rather than blanking a field.

Import takes one field for both kinds of link, because a person holding
a link does not necessarily know which kind it is, and the parser can
answer that better than they can.

Three defects a device found:

A fetch launched from rememberCoroutineScope() is cancelled when the
screen closes — which is the same tap. The import screen closed, the
list stayed empty, and nothing reported a failure because nothing had
failed: it had been cancelled. Work that outlives a screen now runs on
the repository's own scope, and subscribe() takes no scope from its
caller because there is no way to hand it one that dies.

Cleartext is blocked at this target SDK, correctly — the URL is a
password. The screen warned about http and left the button enabled, so
the tap silently did nothing at all, which is worse than either
refusing or allowing. A plaintext subscription is now refused at the
input, with the reason and what to ask the provider for.

lastRefreshFailure was kept in the repository and shown nowhere, so a
subscription that could not be reached looked exactly like one with
nothing to say. It is on the node list now — and a subscription failure
renders as a subscription failure rather than borrowing a node's
wording, so an exhausted subscription no longer reads as an unreachable
node.

321 unit tests, 0 failures, 0 skipped. Verified on a device: the http
refusal, and the whole import path.

Author: AlbertoDeckow

app/build.gradle.kts

@@ -112,6 +112,9 @@ dependencies {
     implementation(libs.conscrypt.android)
 
     testImplementation(libs.junit)
+    // Needed by the tests that drive the repository, which is suspend-shaped
+    // because a subscription fetch is a network call.
+    testImplementation(libs.coroutines.test)
     // The JVM build of the same library, so the exporter can be checked against
     // a real TLS handshake on the host rather than only on a device.
     testImplementation(libs.conscrypt.openjdk)

app/src/main/kotlin/eu/nodepass/somewhere/SomewhereApplication.kt

@@ -8,7 +8,9 @@ import eu.nodepass.somewhere.data.NodeRepository
 import eu.nodepass.somewhere.data.NodeStore
 import eu.nodepass.somewhere.data.SubscriptionStore
 import eu.nodepass.somewhere.subscription.SubscriptionFetcher
+import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
 import java.io.File
 
 /**
@@ -28,6 +30,9 @@ class SomewhereApplication : Application() {
             subscriptions = SubscriptionStore(File(filesDir, "subscription/subscription.txt")),
             fetcher = SubscriptionFetcher(clientVersion = BuildConfig.VERSION_NAME),
             io = Dispatchers.IO,
+            // Application-lifetime, and supervised so one failed fetch does not
+            // take the scope down with it.
+            scope = CoroutineScope(SupervisorJob() + Dispatchers.Default),
         )
     }
 }

app/src/main/kotlin/eu/nodepass/somewhere/data/NodeRepository.kt

@@ -11,10 +11,12 @@ import eu.nodepass.somewhere.subscription.Subscription
 import eu.nodepass.somewhere.subscription.SubscriptionFetcher
 import eu.nodepass.somewhere.subscription.SubscriptionReason
 import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 
 /**
@@ -55,6 +57,17 @@ class NodeRepository(
     private val fetcher: SubscriptionFetcher,
     private val dialer: NowhereDialer = NowhereDialer(),
     private val io: CoroutineDispatcher,
+    /**
+     * Where work that outlives a screen runs.
+     *
+     * A subscription fetch must not be launched from `rememberCoroutineScope()`:
+     * that scope belongs to the composition, and the import screen closes the
+     * instant the user taps Subscribe. The first version did exactly that, and
+     * the fetch was cancelled before it reached the network — the screen closed,
+     * the node list stayed empty, and nothing anywhere reported a failure,
+     * because nothing had failed. It had been cancelled.
+     */
+    private val scope: CoroutineScope,
     private val clock: () -> Long = System::currentTimeMillis,
 ) {
     private val _nodes = MutableStateFlow(store.load())
@@ -81,6 +94,21 @@ class NodeRepository(
         _subscription.value = subscriptions.load()
     }
 
+    /** Fire-and-forget [setSubscription], for a caller that is about to go away. */
+    fun subscribe(url: String) {
+        scope.launch { setSubscription(url) }
+    }
+
+    /** Fire-and-forget [refreshSubscription]. */
+    fun refreshInBackground() {
+        scope.launch { refreshSubscription() }
+    }
+
+    /** Fire-and-forget [probe], for the same reason. */
+    fun probeInBackground(node: NowhereUrl) {
+        scope.launch { probe(node) }
+    }
+
     /**
      * Points the app at a subscription and fetches it once.
      *

app/src/main/kotlin/eu/nodepass/somewhere/ui/screens/ImportScreen.kt

@@ -19,6 +19,7 @@ import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.BasicTextField
 import androidx.compose.material3.Icon
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
@@ -29,10 +30,12 @@ import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.SolidColor
 import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.AnnotatedString
 import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.TextStyle
 import androidx.compose.ui.text.buildAnnotatedString
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
@@ -68,16 +71,20 @@ fun ImportScreen(
 ) {
     val colors = SomewhereTheme.colors
     var acknowledged by remember { mutableStateOf(false) }
+    var typed by remember(link) { mutableStateOf(link.orEmpty()) }
 
-    // The link is parsed once, by the real parser, and whatever it says is what
-    // the screen shows. A link that arrived through the deep link and one the
-    // user pasted go down the same path — there is no second, more forgiving
-    // reader for text the system handed us.
-    val parsed =
-        remember(link) {
-            link?.let { NowhereUrl.parse(it) }
-        }
+    // One field, two outcomes, and the parser decides which. A person holding a
+    // link does not necessarily know whether it is a node or a subscription —
+    // asking them to pick the right box first is asking them to answer a
+    // question the app can answer itself.
+    //
+    // A link that arrived through the deep link and one the user pasted go down
+    // exactly the same path. There is no second, more forgiving reader for text
+    // the system handed us.
+    val parsed = remember(typed) { typed.trim().takeIf { it.isNotEmpty() }?.let { NowhereUrl.parse(it) } }
     val node = (parsed as? DecodeResult.Ok)?.value
+    val subscriptionUrl = remember(typed) { typed.trim().takeIf { it.looksLikeSubscription() } }
+    val plaintext = subscriptionUrl?.startsWith("http://", ignoreCase = true) == true
     val verified = node?.certificateVerification?.isVerified ?: true
 
     Column(Modifier.fillMaxSize()) {
@@ -124,20 +131,83 @@ fun ImportScreen(
                             RoundedCornerShape(10.dp),
                         ).padding(horizontal = 14.dp, vertical = 13.dp),
                 ) {
-                    Text(
-                        text = if (node != null) maskedUrl(node) else AnnotatedString(link.orEmpty()),
-                        fontFamily = SomewhereType.Mono,
-                        fontSize = 12.sp,
-                        lineHeight = 19.2.sp,
-                        color = colors.inkMuted,
-                    )
+                    if (node != null) {
+                        // Once it parses, the key is masked. The field stops
+                        // being an input and becomes a statement of what was
+                        // understood — and a shared key must not sit on screen
+                        // waiting to be screenshotted.
+                        Text(
+                            text = maskedUrl(node),
+                            fontFamily = SomewhereType.Mono,
+                            fontSize = 12.sp,
+                            lineHeight = 19.2.sp,
+                            color = colors.inkMuted,
+                        )
+                    } else {
+                        BasicTextField(
+                            value = typed,
+                            onValueChange = { typed = it },
+                            textStyle =
+                                TextStyle(
+                                    fontFamily = SomewhereType.Mono,
+                                    fontSize = 12.sp,
+                                    lineHeight = 19.2.sp,
+                                    color = colors.inkMuted,
+                                ),
+                            cursorBrush = SolidColor(colors.upstream),
+                            modifier = Modifier.fillMaxWidth(),
+                            decorationBox = { inner ->
+                                if (typed.isEmpty()) {
+                                    Text(
+                                        text = stringResource(R.string.import_paste_hint),
+                                        fontFamily = SomewhereType.Mono,
+                                        fontSize = 12.sp,
+                                        color = colors.faint,
+                                    )
+                                }
+                                inner()
+                            },
+                        )
+                    }
                 }
 
                 // The parser's own reason, verbatim. It distinguishes a wrong
                 // scheme from a bad port from a key with a password component,
                 // and a screen that replaced all three with "invalid link"
                 // would be throwing away the only useful part.
-                (parsed as? DecodeResult.Invalid)?.let { failure ->
+                if (subscriptionUrl != null) {
+                    Text(
+                        text = stringResource(R.string.import_subscription_detected),
+                        fontFamily = SomewhereType.Body,
+                        fontSize = 12.5.sp,
+                        lineHeight = 18.sp,
+                        color = colors.inkMuted,
+                    )
+                    if (plaintext) {
+                        // Refused, not warned about. The URL is the credential:
+                        // over http it is handed to every device between here
+                        // and the dashboard, and the platform blocks the request
+                        // anyway on this target SDK. Warning and then leaving
+                        // the button enabled produced the worst outcome of the
+                        // three — a tap that silently did nothing at all.
+                        Text(
+                            text = stringResource(R.string.import_subscription_plaintext),
+                            fontFamily = SomewhereType.Body,
+                            fontSize = 12.sp,
+                            lineHeight = 17.sp,
+                            color = colors.critical,
+                        )
+                        Text(
+                            text = stringResource(R.string.import_subscription_needs_https),
+                            fontFamily = SomewhereType.Body,
+                            fontSize = 12.sp,
+                            lineHeight = 17.sp,
+                            color = colors.inkMuted,
+                        )
+                    }
+                }
+
+                (parsed as? DecodeResult.Invalid)?.takeIf { subscriptionUrl == null }?.let { failure ->
                     Text(
                         text = stringResource(R.string.import_invalid),
                         fontFamily = SomewhereType.Body,
@@ -234,7 +304,7 @@ fun ImportScreen(
         // Disabled until the certificate statement has been acknowledged. The
         // affordance stays visible rather than hidden, so the reason the button
         // does nothing is on the screen next to it.
-        val enabled = node != null && (verified || acknowledged)
+        val enabled = (node != null && (verified || acknowledged)) || (subscriptionUrl != null && !plaintext)
         Box(
             Modifier
                 .padding(start = 20.dp, end = 20.dp, bottom = 24.dp)
@@ -243,13 +313,29 @@ fun ImportScreen(
                 .clip(RoundedCornerShape(12.dp))
                 .background(if (enabled) colors.primaryAction else colors.surfaceAlt)
                 .clickable(enabled = enabled) {
-                    node?.let(nodes::add)
-                    onClose()
+                    when {
+                        node != null -> {
+                            nodes.add(node)
+                            onClose()
+                        }
+
+                        subscriptionUrl != null -> {
+                            // Fire and leave, on the repository's scope rather
+                            // than the composition's. This screen is about to
+                            // close, and a fetch launched from a scope that
+                            // closes with it is a fetch that never happens.
+                            nodes.subscribe(subscriptionUrl)
+                            onClose()
+                        }
+                    }
                 },
             contentAlignment = Alignment.Center,
         ) {
             Text(
-                text = stringResource(R.string.import_add_node),
+                text =
+                    stringResource(
+                        if (subscriptionUrl != null) R.string.import_subscribe else R.string.import_add_node,
+                    ),
                 fontFamily = SomewhereType.Display,
                 fontWeight = FontWeight.SemiBold,
                 fontSize = 15.sp,
@@ -259,6 +345,16 @@ fun ImportScreen(
     }
 }
 
+/**
+ * Anything `http`/`https` is treated as a subscription.
+ *
+ * Deliberately shallow: the real validation is `SubscriptionEndpoint.prepare`,
+ * which runs on fetch and has its own reasons for refusing. Duplicating that
+ * judgement here would give two definitions of a valid subscription URL that
+ * can disagree, and the one the user sees would be the weaker of the two.
+ */
+private fun String.looksLikeSubscription(): Boolean = startsWith("http://", ignoreCase = true) || startsWith("https://", ignoreCase = true)
+
 @Composable
 private fun RowLabel(
     text: String,