dtourolle
f12aece07e
`RemoteBackend` existed from the first release and bought nothing it was
designed for. Seven files in `dr-ui` constructed a `NextcloudBackend`
directly, an account *was* a server URL beside a DAV user id, the local
cache directory was named after a hostname, and the launch screen knew
that signing in meant a browser handshake. The trait was real; the seam
was documentation.
A trait over operations is only a quarter of it. Pluggable storage needs
four things, and this adds the other three:
- **Capabilities** — already there, and the reason the engine can drive
two backends at the speed each actually runs at.
- **Configuration** — `dr_sync::Account`: where a library lives, in
whatever form its connector addresses, with no server in it. Loads
every existing config unchanged (`backend` defaults to `nextcloud`,
`endpoint` is stored under its historical `server` key), and
`Account::namespace()` reproduces the old catalog directory byte for
byte, because changing it would abandon a catalog, its thumbnail
shards, and the sidecars holding unsynced offline work.
- **Registration** — `BackendProvider` and `BackendRegistry`.
`ui/dr-ui/src/remote.rs` is now the only file above `dr-sync` that
names a connector.
`Connection` (an account plus an optional `Secret`) replaces the
credentials-and-user-id pair that was threaded through fifteen
signatures in an order that could be swapped. `Secret`'s inner string is
reachable only through `expose()` and its `Debug` prints `Secret(***)`,
so the indirect leak — a `{:?}` on anything holding one — no longer
compiles into a leak.
Nextcloud is unchanged and keeps every peculiarity: propagating ETags,
chunked upload v2, `oc:fileid`, the `oc:permissions` probe on a refused
PUT, the 423 retry classification, Login Flow v2. Those are what the
capability model exists to serve, not something to hide.
`dr-sync-folder` is the second connector: a local disk, a network mount,
an external drive, or a folder a Nextcloud client already syncs. No
account, no credential — the route that works where no secrets daemon
does. It declares `LocalEtags` rather than claiming propagation a POSIX
directory cannot provide, which costs nothing because 50k `stat` calls
are not 50k PROPFINDs. Identity is a path hash, not an inode: an inode
survives a rename but differs between devices and is reused after a
delete, so two machines would disagree about which photograph a
thumbnail belonged to. Re-deriving a thumbnail is a cost; showing the
wrong one is a bug.
docs/storage.md is the contract — the traits, the four steps to add a
backend, and what each connector declares. ARCH §8.0 and §8.4a, and
FR-NC-13, say why.
35 lines
1.3 KiB
TOML
35 lines
1.3 KiB
TOML
[package]
|
|
name = "darkroom-android"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
|
|
# A cdylib, not a bin: Android loads the app as a shared library and calls
|
|
# `android_main` through android-activity's glue. Nothing execs a binary, so
|
|
# there is no `main` to provide.
|
|
[lib]
|
|
name = "darkroom"
|
|
crate-type = ["cdylib"]
|
|
|
|
[dependencies]
|
|
# No backend feature to select: dr-ui picks its Slint backend from the target,
|
|
# so building for aarch64-linux-android gets android-activity automatically.
|
|
dr-ui.workspace = true
|
|
# For `account::set_data_dir`: only the platform entry point knows where Android
|
|
# lets this app keep files, and it must be set before any store is opened.
|
|
dr-sync.workspace = true
|
|
# Directly, not just through dr-ui: `android_main` takes an `AndroidApp` and
|
|
# calls `slint::android::init`, both of which come from this crate. The backend
|
|
# feature comes from dr-ui's target-specific dependency.
|
|
slint.workspace = true
|
|
log.workspace = true
|
|
android_logger = "0.15"
|
|
|
|
[features]
|
|
# Mirrors darkroom-desktop: the CPU readback path is gone since S1 landed
|
|
# zero-copy. It mattered more here than on desktop — the same wrong path with
|
|
# far less memory bandwidth to absorb it (ARCH §6.1) — but it is untested on a
|
|
# device, since S1 was verified on desktop only.
|
|
default = []
|