Addresses the TOFU vulnerability where peer-claimed simplex_name was
accepted unverified. Adds:
- contacts.simplex_name_verified_at + groups.simplex_name_verified_at
(M20260606_simplex_name_verified)
- APIVerifySimplexName ChatRef command: RSLV-resolves the claimed name
and compares the resolved link to the peer's stored connection link;
on match writes verified_at and emits CEvtSimplexNameVerified;
on mismatch emits CEvtSimplexNameVerifyFailed
- CEvtSimplexNameUnverified passive warning emitted on incoming XInfo /
XGrpInfo when a name claim arrives without a current verification
- updateContactProfileWithConflict / updateGroupProfileWithConflict
clear simplex_name_verified_at whenever the peer's claim transitions
(any value change including Nothing<->Just): the prior verification
was bound to the prior claim.
UI can surface the unverified indicator next to a contact / group's
name, and prompt the user to invoke the verify command. This shifts
the security model from "TOFU + last-writer-wins" to "TOFU + on-demand
RSLV verification".
Write paths:
- updateContactProfile_' / updateGroupProfile_ now set the new
contact_profiles.simplex_name / group_profiles.simplex_name columns
from Profile.simplexName / GroupProfile.simplexName respectively.
- createContact_ INSERT writes Profile.simplexName to the new
contact_profiles column (separate from the existing simplexName arg,
which still writes contacts.simplex_name — the user's locally-known
label).
Read paths (closing Task 2's deferred sites):
- toContact splits simplex_name reads: Contact.simplexName from
contacts.simplex_name (existing); LocalProfile.simplexName from
contact_profiles.simplex_name (new column).
- toGroupInfo similarly splits: GroupInfo.simplexName from
groups.simplex_name; groupProfile.simplexName from
group_profiles.simplex_name.
- ProfileRow / rowToLocalProfile, toContactRequest, getUserContactProfiles,
toGroupProfile, getProfileById, groupMemberQuery, getGroupAndMember_,
saveRcvChatItem-related quotes — all extended to read p.simplex_name
and decode it into LocalProfile.simplexName / GroupProfile.simplexName.
Conflict handling (Decision B):
- clearConflictingContactProfileSimplexName_ / *Group* helpers do an
atomic UPDATE-with-RETURNING that NULLs simplex_name on any other
row in the same user that would collide on the partial UNIQUE index,
returning the displaced row's display_name.
- updateContactProfileWithConflict / updateGroupProfileWithConflict
bundle clear+update in one transaction.
- processContactProfileUpdate / xGrpInfo invoke the *WithConflict
variants and emit CEvtSimplexNameConflict when a displacement
happened (with the claiming and displaced display names).
Adds ChatEvent CEvtSimplexNameConflict and SimplexNameConflictEntity
(SNCEContact / SNCEGroup) with JSON instances and View.hs rendering.
Adds `simplexName :: Maybe SimplexNameInfo` to the three records and
extends every SELECT path that reconstructs them to read the new
column. Decoded via eitherToMaybe . strDecode . encodeUtf8 (the
codebase's established pattern for Maybe Text -> typed-decode fields),
extracted as decodeSimplexName helper since the chain appears in
toContact / toContact' / toGroupInfo / toConnection. INSERT paths
still write Nothing - the write-side wiring lands in the next commit
(Task 7).
* core: add custom indexed columns to groups and contacts
* directory: use database (TODO search/listing)
* triggers to maintain current member count
* update simplexmq, fix tests, use summary from GroupInfo
* fix all directory tests
* remove acceptance fields from group reg
* enable all tests
* clean up
* postgres migrations, fixes
* query plans
* use function in postgres triggers, improve sqlite query
* fix export/import
* update schema
* prevent admins from promoting groups when approving
* update listing every 5 minutes
* rfc: bot messages and buttons
* update
* update bot rfc
* core: add bot commands to chat preferences and peer type to profile
* update postgresql schema
* update query plans
* chat sessions preference
* markdown for bot commands
* schema
* core: file preference, options to create bot from CLI
* core: different command type
* ios: commands menu
* update types
* update ios
* improve command markdown
* core, ios: update types
* android, desktop: clickable commands in messages in chats with bots
* android, desktop: commands menu
* command menu button, bot icon
* ios: connect flow for bots
* android, desktop: connect flow for bots
* icon
* CLI commands to view and set commands, remove "hidden" property of command, bot api docs
* corrections
* fix inheriting profile preferences to business groups
* note on business address
* ios: export localizations
* fix test
* commands to set file preference on user/contact, tidy up layout and display of command and attachment buttons
* core: short bio/description for contact and group profiles
* use short description in commands
* fix tests
* query plans
* ios: show contact and group profile descriptions
* android, desktop: short description/bio
* ui: layout for chat info, correct copy
* comment out fields to add/edit short descriptions
* remove short description from events
* postgres schema
* core: add/send contact address and request messages, ios: use auto-reply as welcome message
* revert event type change
* fix test, type
* multiplatform: update type
* fix query
* ios: hide keyboard when sending the message
* failing test for business chat with a welcome message
* retry joining via contact address
* query plans
* do not send history to the first member (the original customer) of business chat
* correctly handle retries when joining groups, do not create a new connection on retry
* failing test for group welcome message and feature items
* do not send history item if member saw it during joining (based on welcomeSharedMsgId in join request)
* correct fields in PendingContactConnection, update plans
* prevent duplicate group description created in chat, while ensuring that it is created
* fix query
shum