Merge to master#121
Merged
Merged
Conversation
Fix workflow permission
Replace the legacy Create-React-App / React 17 / yarn / Node 16 stack with the reference stack used by app-openpgp: - Vite 8 + React 18 + pnpm 11 + Node 22 - Ledger lumen design system (@ledgerhq/lumen-ui-react + lumen-design-core, Tailwind 3 with ledgerLivePreset), following the bundled ai-rules - Vitest for the pure-logic units (charset mapping, metadata round-trip) - vite-plugin-node-polyfills for the Buffer API used by the APDU layer App rewritten with lumen (ThemeProvider/Banner/Tag/Button/...): Connect / Backup / Restore / Disconnect flow, in-app notification banners (replacing react-toastify) and an FAQ rebuilt with lumen tokens + react-markdown. Transport stays WebUSB (the Passwords app uses the generic USB interface). PasswordsManager keeps its APDU logic; disconnect() now releases the device and an onDisconnect callback surfaces physical unplugs. Icons reuse the device app glyph (glyphs/app_passwords_64px.gif): a white open-padlock for the in-page logo (on the dark canvas) and a white padlock on a black rounded tile for the favicon / PWA icons (visible on a white tab). The manifest previously pointed at a non-existent favicon.svg; fixed. Deploy workflow updated to pnpm + Node 22 + dist/; CNAME passwords.ledger.com preserved (Vite base "/"). Also refresh the stale support link in the FAQ and exclude pnpm-lock.yaml from codespell.
…f peaceiris Switch the Web UI deployment to GitHub's native Pages flow. PRs still build for validation; only pushes / manual runs deploy. The passwords.ledger.com custom domain is preserved (kept in the repo Pages settings and reinforced by dist/CNAME in the artifact).
Update webui
The POPULATE build flag seeded password1/2/3 in app_main() on every app start, with no guard, so they piled up as duplicates on each launch. init_storage() now reports whether it just freshly initialized the storage (magic not yet set); the demo passwords are created only in that case. The behaviour stays fully gated by the POPULATE compile flag.
The save dialog was opened only after the device exchange (dump_metadatas), by which time the click's transient user activation had expired, so showSaveFilePicker threw "Must be handling a user gesture". Split saveJSON into pickSaveTarget() — called first, synchronously from the click handler while the activation is still valid — and writeJSON(), called once the backup data is ready. Falls back to a Blob/anchor download when the File System Access API is unavailable or refuses.
Fix test conditions
Update CHANGELOG
Reading the card consumes the click's transient user activation, so showSaveFilePicker cannot be called from the continuation of the device exchange (it throws "Must be handling a user gesture"); opening it before the approval instead would create the chosen file on disk and leave it empty if the device is rejected. Use a two-step flow: back up first, then surface a "Save…" button that opens the native save dialog from its own click. This keeps the file-name dialog without the SecurityError and without creating an empty file on rejection; falls back to an anchor download where the File System Access API is missing.
The "Storage 4096 bytes" line showed the total metadata capacity read from GET_APP_CONFIG. It is a constant, so it adds noise to the device card.The controller still reads storage_size internally for buffer sizing;only the UI row and its React state are removed.
override_metadatas() took the destination offset as a uint8_t, but load_metadatas() passes app_state.bytes_transferred (size_t, up to MAX_METADATAS = 4096).Small backups happened to work because only the first chunk carries data;larger lists (> ~255 bytes of metadata) were corrupted.
Cover the boundary behaviour of the metadata store: - override_metadatas at offset 300 lands at 300, not at 300 % 256 == 44 (regression guard for the uint8_t-offset truncation fix), plus a write at the very end of the buffer. - write_metadata refuses new entries once full (ERR_NO_MORE_SPACE_AVAILABLE), so the 4096-byte buffer cannot overflow.
The RUN_TEST dispatch was already guarded by #ifdef TESTING, but tests.c was compiled unconditionally (APP_SOURCE_PATH globs all of src/) and dispatcher.c included tests.h unconditionally. Guard the test handler's definitions and the include with #ifdef TESTING so production builds (TESTING=0) contain no test code at all, instead of relying on linker dead-code elimination. The #include lines in tests.c stay outside the guard to avoid an empty translation unit.
Replace the device prompts "Transfer metadatas ?" / "Overwrite metadatas ?" with "Backup" / "Restore" + "password list", aligned with the WebUI buttons, and without the stray space before "?". Wallet screens keep the question mark; the Nano variant drops it. The WebUI notices, FAQ and README that quote these prompts are updated to match.
Also silence pylint's false no-member errors on the MetaScreen-generated CustomTouchScreen members (surfaced now that the file is touched).
On touch devices the passwords list is paginated and NBGL forwards a page-relative index, so password_callback() rebuilds the absolute index from the page number. Add a regression test that seeds enough passwords to span two pages, shows the first entry of page 2, and asserts the revealed value matches the value derived independently for that nickname (guarding against an off-by-page error in the recalculation). Marked skip_nano since the Nano list shows one choice per page.
UI adjustments & Fixes
The Backup/Restore approval used nbgl_useCaseConfirm, whose callback only fires on "Approve". Pressing "Refuse" silently dismissed the modal without sending any APDU response, so the host waited forever (the WebUI stayed stuck with greyed-out buttons). Switch to nbgl_useCaseChoice, which reports both outcomes: approve keeps the previous behaviour, refuse answers SWO_CONDITIONS_NOT_SATISFIED (0x6985) and returns to the home page.
Cover the refusal path: triggering a Backup/Restore and pressing "Refuse" on the device must answer 0x6985 (ActionCancelledError). Adds an APDU_REJECT navigation instruction for both the touch and Nano navigators, refusal helpers on the command client, and two xfail tests. Regenerate the Nano backup/restore approval snapshots: the screen now uses nbgl_useCaseChoice and shows a small alert glyph.
A device refusal now returns 0x6985, which surfaced as a generic "failed" error banner. Tag the mapped error with its status word and treat the cancellation status apart: show an informational notice instead of an error.
Fix reject backup restore
Contributor
Code coverage reportPer-file coverage
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #121 +/- ##
==========================================
+ Coverage 73.96% 81.88% +7.92%
==========================================
Files 7 7
Lines 361 381 +20
Branches 41 42 +1
==========================================
+ Hits 267 312 +45
+ Misses 88 53 -35
- Partials 6 16 +10
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.