proton-drive-linux/crates/pdfs-gui/src/app/pages/login.rs

use crate::*;
use pdfs_core::proton_sdk::api::{HumanVerification, HumanVerificationCredential};

pub(crate) struct LoginState {
    // Login page.
    pub(crate) email: adw::EntryRow,
    pub(crate) password: adw::PasswordEntryRow,
    pub(crate) login_button: gtk4::Button,
    /// Spins inside the Sign in button while a sign-in is running.
    pub(crate) login_spinner: Spinner,
    pub(crate) login_status: gtk4::Label,
    /// Shown over the form while a saved sign-in exists but the keyring would
    /// not hand it over; see [`keyring_unreadable`].
    pub(crate) keyring_banner: adw::Banner,
}

/// Where the login page's account links go.
const SIGNUP_URL: &str = "https://account.proton.me/drive/signup";
const RESET_PASSWORD_URL: &str = "https://account.proton.me/reset-password";

/// The login page: an email row, password row, a primary "Sign in" button, a
/// status label and links to create an account or reset the password, centred
/// in a clamp. The 2FA code is prompted lazily in a dialog (see [`prompt_2fa`])
/// only when the account actually requires it.
pub(crate) fn build_login_page() -> (gtk4::Widget, LoginState) {
    let group = adw::PreferencesGroup::builder()
        .title(gettext("Sign in to Proton"))
        .description(gettext("Use your Proton account to connect Drive."))
        .build();

    let email = adw::EntryRow::builder()
        .title(gettext("Email or username"))
        .build();
    let password = adw::PasswordEntryRow::builder()
        .title(gettext("Password"))
        .build();
    group.add(&email);
    group.add(&password);

    let login_spinner = spinner();
    login_spinner.set_visible(false);
    let button_content = gtk4::Box::new(gtk4::Orientation::Horizontal, 8);
    button_content.append(&login_spinner);
    button_content.append(&gtk4::Label::new(Some(&gettext("Sign in"))));
    let login_button = gtk4::Button::builder()
        .child(&button_content)
        .halign(gtk4::Align::Center)
        .build();
    login_button.add_css_class("suggested-action");
    login_button.add_css_class("pill");

    let login_status = gtk4::Label::builder()
        .wrap(true)
        .justify(gtk4::Justification::Center)
        .build();
    login_status.add_css_class("dim-label");

    let header = gtk4::Box::new(gtk4::Orientation::Vertical, 4);
    let logo = gtk4::Image::from_icon_name(APP_ID);
    logo.set_pixel_size(96);
    let title = gtk4::Label::new(Some("Proton Drive"));
    title.add_css_class("brand-title");
    header.append(&logo);
    header.append(&title);
    header.set_margin_bottom(12);

    let inner = gtk4::Box::new(gtk4::Orientation::Vertical, 16);
    inner.set_margin_top(32);
    inner.set_margin_bottom(32);
    inner.set_margin_start(12);
    inner.set_margin_end(12);
    inner.append(&header);
    inner.append(&group);
    inner.append(&login_button);
    inner.append(&login_status);
    let links = gtk4::Box::new(gtk4::Orientation::Horizontal, 0);
    links.set_halign(gtk4::Align::Center);
    links.append(&gtk4::LinkButton::with_label(
        SIGNUP_URL,
        &gettext("Create account"),
    ));
    links.append(&gtk4::LinkButton::with_label(
        RESET_PASSWORD_URL,
        &gettext("Forgot password?"),
    ));
    inner.append(&links);

    let clamp = adw::Clamp::builder()
        .maximum_size(420)
        .child(&inner)
        .build();
    let scroll = gtk4::ScrolledWindow::builder().child(&clamp).build();
    let keyring_banner = adw::Banner::builder()
        .title(gettext(
            "Couldn't read your saved sign-in. Unlock the system keyring, then try again.",
        ))
        .button_label(gettext("Retry"))
        .build();

    (
        scroll.upcast(),
        LoginState {
            email,
            password,
            login_button,
            login_spinner,
            login_status,
            keyring_banner,
        },
    )
}

/// The stored session, `None` when there is none, or the keyring's error when
/// it could not be read. A locked or absent keyring is not a sign-out: the
/// session is still saved, and signing in again would only replace it.
pub(crate) fn read_session() -> pdfs_core::Result<Option<auth::StoredSession>> {
    match auth::load() {
        Ok(session) => Ok(Some(session)),
        Err(pdfs_core::Error::NotLoggedIn) => Ok(None),
        Err(e) => Err(e),
    }
}

/// How long to wait before each automatic retry of an unreadable keyring. A
/// keyring daemon started with the session is usually up within seconds.
const KEYRING_RETRIES: [u32; 4] = [2, 5, 10, 30];

/// The keyring refused to hand over the saved session. Keep the login page up,
/// but say why, and pick the session up as soon as the keyring answers: on its
/// own a few times, and whenever the user presses Retry.
pub(crate) fn keyring_unreadable(ui: &Rc<Ui>, error: &pdfs_core::Error) {
    tracing::warn!("cannot read the saved session: {error}");
    let banner = &ui.login.keyring_banner;
    if banner.is_revealed() {
        return;
    }
    banner.set_revealed(true);
    let ui_retry = ui.clone();
    let handler = banner.connect_button_clicked(move |_| retry_session(&ui_retry));
    // Disconnected once the banner goes, so a later failure wires it afresh.
    let handler = RefCell::new(Some(handler));
    banner.connect_revealed_notify(move |banner| {
        if !banner.is_revealed()
            && let Some(handler) = handler.borrow_mut().take()
        {
            banner.disconnect(handler);
        }
    });
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        for seconds in KEYRING_RETRIES {
            glib::timeout_future_seconds(seconds).await;
            if !ui.login.keyring_banner.is_revealed() {
                return;
            }
            retry_session(&ui);
        }
    });
}

/// Read the saved session again after [`keyring_unreadable`]. Found: show the
/// signed-in window. Gone: the plain login page. Still unreadable: keep waiting.
fn retry_session(ui: &Rc<Ui>) {
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        let Ok(result) = gio::spawn_blocking(read_session).await else {
            return;
        };
        match result {
            Ok(session) => {
                ui.login.keyring_banner.set_revealed(false);
                if session.is_some() && ui.session.borrow().is_none() {
                    *ui.session.borrow_mut() = session;
                    refresh(&ui);
                }
            }
            Err(e) => tracing::debug!("the keyring still cannot be read: {e}"),
        }
    });
}

/// Connect the sign-in button: read the fields, run [`auth::login`] on a worker
/// thread, and report the outcome back on the main loop.
pub(crate) fn wire_login(ui: &Rc<Ui>) {
    // Pressing Enter in either field submits the form, so signing in never needs
    // a reach for the mouse. Both fields route to the same button.
    let btn = ui.login.login_button.clone();
    ui.login
        .email
        .connect_entry_activated(move |_| btn.emit_clicked());
    let btn = ui.login.login_button.clone();
    ui.login
        .password
        .connect_entry_activated(move |_| btn.emit_clicked());

    let ui = ui.clone();
    let button = ui.login.login_button.clone();
    button.connect_clicked(move |_| {
        let username = ui.login.email.text().to_string();
        let password = ui.login.password.text().to_string();
        if username.is_empty() || password.is_empty() {
            ui.login
                .login_status
                .set_text(&gettext("Enter your email and password."));
            return;
        }

        set_signing_in(&ui, true);
        ui.login.login_status.set_text(&gettext("Signing in…"));
        let LoginChannels {
            result: rx,
            totp: totp_req_rx,
            hv: hv_req_rx,
            mailbox: mailbox_req_rx,
        } = spawn_login(username, password);

        // Surface the 2FA dialog only if the SDK actually asks for a code (i.e.
        // the account has 2FA enabled). The worker blocks until the dialog feeds
        // back a code (or is cancelled, dropping the sender).
        //
        // Loops rather than awaiting once: a login gated behind a CAPTCHA is
        // restarted after verification, so a 2FA account is asked for a second,
        // unexpired code on the retry.
        let ui_2fa = ui.clone();
        glib::spawn_future_local(async move {
            while let Ok(code_tx) = totp_req_rx.recv().await {
                prompt_2fa(&ui_2fa, code_tx);
            }
        });

        // Same shape for human verification: only fires when the API gates the
        // sign-in, and the worker is blocked on the credential until it does.
        let ui_hv = ui.clone();
        glib::spawn_future_local(async move {
            if let Ok((hv, credential_tx)) = hv_req_rx.recv().await {
                ui_hv
                    .login
                    .login_status
                    .set_text(&gettext("Complete the verification to continue…"));
                // Anything but a credential drops the sender, which the worker
                // reads as a cancelled sign-in.
                match verify_human(hv.verification_url()).await {
                    Verification::Solved(token) => {
                        let _ = credential_tx.send(HumanVerificationCredential::captcha(token));
                    }
                    Verification::Cancelled => {}
                    // The web view could not start, most likely its sandbox
                    // (B195): the user's browser can show the page instead.
                    Verification::Failed => verify_in_browser(&ui_hv, &hv, credential_tx),
                }
            }
        });

        // And for the mailbox password, which only a two-password account has.
        // The worker asks again after a wrong answer, so this loops too.
        let ui_mailbox = ui.clone();
        glib::spawn_future_local(async move {
            while let Ok((attempt, answer_tx)) = mailbox_req_rx.recv().await {
                ask_mailbox(&ui_mailbox, attempt > 0, move |answer| {
                    // A cancelled dialog drops the sender, which the worker
                    // reads as a cancelled login.
                    if let Some(answer) = answer {
                        let _ = answer_tx.send(answer);
                    }
                });
            }
        });

        let ui = ui.clone();
        glib::spawn_future_local(async move {
            let result = rx
                .recv()
                .await
                .unwrap_or_else(|_| Err(gettext("login cancelled")));
            set_signing_in(&ui, false);
            match result {
                Ok(()) => {
                    ui.login.login_status.set_text("");
                    ui.login.password.set_text("");
                    // Cache the new identity so `refresh` never hits the keyring.
                    // Read on a worker: a keyring that has to be unlocked first
                    // answers only once the user has, and the window must not
                    // freeze until then.
                    match gio::spawn_blocking(read_session).await {
                        Ok(Ok(session)) => *ui.session.borrow_mut() = session,
                        Ok(Err(e)) => keyring_unreadable(&ui, &e),
                        Err(_) => {}
                    }
                    // Enable+start the mount service now that we have a session.
                    let _ = gio::spawn_blocking(service::enable_start).await;
                    refresh(&ui);
                }
                Err(e) => ui.login.login_status.set_text(&e),
            }
        });
    });
}

/// Lock the form and spin the button while a sign-in runs.
fn set_signing_in(ui: &Rc<Ui>, running: bool) {
    ui.login.login_button.set_sensitive(!running);
    ui.login.email.set_sensitive(!running);
    ui.login.password.set_sensitive(!running);
    ui.login.login_spinner.set_visible(running);
}

/// What to tell the person when sign-in fails. Proton's own API messages are
/// written for people ("Incorrect login credentials…"), so they pass through;
/// everything else is mapped from its kind rather than shown as a debug string.
pub(crate) fn login_error_message(error: &pdfs_core::Error) -> String {
    use pdfs_core::proton_sdk::ProtonError;
    match error {
        pdfs_core::Error::Proton(ProtonError::Api(api)) if api.http_status == 429 => {
            gettext("Too many sign-in attempts. Wait a few minutes and try again.")
        }
        // Proton's text for this one asks the user to update an app that is
        // already current.
        pdfs_core::Error::Proton(e) if pdfs_core::error::sign_in_blocked(e) => gettext(
            "Proton is temporarily refusing sign-in from this device. Your app version is not the problem. Wait several hours, up to a day, without trying again, then sign in.",
        ),
        pdfs_core::Error::Proton(ProtonError::Api(api)) if !api.message.is_empty() => {
            api.message.clone()
        }
        pdfs_core::Error::Proton(ProtonError::Transport(_)) => {
            gettext("Couldn't reach Proton. Check your internet connection and try again.")
        }
        pdfs_core::Error::Keyring(_) => gettext(
            "Signed in, but the session couldn't be saved to the system keyring. Make sure a keyring (GNOME Keyring or KWallet) is running and unlocked.",
        ),
        pdfs_core::Error::Other(message) if message.contains("two-factor") => {
            gettext("Sign-in cancelled: no two-factor code was entered.")
        }
        pdfs_core::Error::Other(message) if message.contains("mailbox") => {
            gettext("Sign-in cancelled: no mailbox password was entered.")
        }
        pdfs_core::Error::WrongMailboxPassword => {
            gettext("That mailbox password didn't unlock your account.")
        }
        pdfs_core::Error::Other(message) if message.contains("verification") => gettext(
            "Sign-in cancelled: the verification wasn't completed. Sign in again to get a new one.",
        ),
        other => {
            let error = other.to_string();
            // Translators: {error} is an error message, usually in English.
            gettext_f("Sign-in failed: {error}", &[("error", &error)])
        }
    }
}

/// What the login worker asks the UI for, and how it reports back.
pub(crate) struct LoginChannels {
    /// The final outcome, once.
    pub(crate) result: async_channel::Receiver<Result<(), String>>,
    /// Fires only if the account needs a 2FA code; carries the sender for it.
    pub(crate) totp: async_channel::Receiver<std::sync::mpsc::Sender<String>>,
    /// Fires only if the sign-in is gated: the challenge, and the sender for the
    /// credential the user earns by solving it.
    pub(crate) hv: async_channel::Receiver<(
        HumanVerification,
        std::sync::mpsc::Sender<HumanVerificationCredential>,
    )>,
    /// Fires only for a two-password account: how many answers were already
    /// wrong, and the sender for the password and the "remember" choice.
    pub(crate) mailbox: async_channel::Receiver<(u32, std::sync::mpsc::Sender<(String, bool)>)>,
}

/// Run the async SRP + optional 2FA login on a dedicated current-thread Tokio
/// runtime. The returned [`LoginChannels`] carry the final result and the lazy
/// prompts. Each login closure blocks the worker on a sender the UI answers, so
/// a code is requested lazily and can't expire before the password proof.
pub(crate) fn spawn_login(username: String, password: String) -> LoginChannels {
    let (tx, rx) = async_channel::bounded(1);
    // Two, not one: a CAPTCHA-gated login restarts, so a 2FA account is asked
    // for a code on each attempt and a single slot would deadlock the worker.
    let (totp_req_tx, totp_req_rx) = async_channel::bounded(2);
    let (hv_req_tx, hv_req_rx) = async_channel::bounded(1);
    let (mailbox_req_tx, mailbox_req_rx) = async_channel::bounded(1);
    std::thread::spawn(move || {
        let rt = match tokio::runtime::Builder::new_current_thread()
            .enable_all()
            .build()
        {
            Ok(rt) => rt,
            Err(e) => {
                let _ = tx.send_blocking(Err(e.to_string()));
                return;
            }
        };
        let result = rt.block_on(async move {
            auth::login_interactive(
                &username,
                &password,
                || {
                    // 2FA required: hand a one-shot sender to the UI and block
                    // until the dialog supplies the code. A dropped sender
                    // (cancelled dialog) surfaces as a cancelled login.
                    let (code_tx, code_rx) = std::sync::mpsc::channel::<String>();
                    totp_req_tx
                        .send_blocking(code_tx)
                        .map_err(|_| pdfs_core::Error::Other("two-factor prompt closed".into()))?;
                    code_rx
                        .recv()
                        .map_err(|_| pdfs_core::Error::Other("two-factor entry cancelled".into()))
                },
                |attempt| {
                    let (answer_tx, answer_rx) = std::sync::mpsc::channel::<(String, bool)>();
                    mailbox_req_tx
                        .send_blocking((attempt, answer_tx))
                        .map_err(|_| pdfs_core::Error::Other("mailbox prompt closed".into()))?;
                    let (password, remember) = answer_rx
                        .recv()
                        .map_err(|_| pdfs_core::Error::Other("mailbox entry cancelled".into()))?;
                    Ok(auth::Mailbox {
                        password: password.into(),
                        remember,
                    })
                },
                |hv| {
                    // Gated: hand the UI the challenge, block on the credential
                    // the user earns by solving it.
                    let (credential_tx, credential_rx) =
                        std::sync::mpsc::channel::<HumanVerificationCredential>();
                    hv_req_tx.send_blocking((hv, credential_tx)).map_err(|_| {
                        pdfs_core::Error::Other("verification prompt closed".into())
                    })?;
                    credential_rx
                        .recv()
                        .map_err(|_| pdfs_core::Error::Other("verification cancelled".into()))
                },
            )
            .await
            .map_err(|e| login_error_message(&e))
        });
        let _ = tx.send_blocking(result);
    });
    LoginChannels {
        result: rx,
        totp: totp_req_rx,
        hv: hv_req_rx,
        mailbox: mailbox_req_rx,
    }
}

/// Ask for the mailbox password of a two-password account.
///
/// `done` gets the password and the "keep unlocked" choice, or `None` when the
/// dialog was cancelled. `retry` says the last answer was wrong. The choice
/// defaults to off: storing the mailbox unlock in the keyring trades away what
/// a separate mailbox password is for, so it is something to opt into.
pub(crate) fn ask_mailbox(
    ui: &Rc<Ui>,
    retry: bool,
    done: impl FnOnce(Option<(String, bool)>) + 'static,
) {
    let body = if retry {
        gettext("That mailbox password didn't unlock your account. Try again.")
    } else {
        gettext("This account has a separate mailbox password. Enter it to unlock your files.")
    };
    let dialog = adw::AlertDialog::builder()
        .heading(gettext("Mailbox Password"))
        .body(body)
        .build();

    let group = adw::PreferencesGroup::new();
    let entry = adw::PasswordEntryRow::builder()
        .title(gettext("Mailbox password"))
        .activates_default(true)
        .build();
    let remember = adw::SwitchRow::builder()
        .title(gettext("Keep unlocked on this computer"))
        .subtitle(gettext(
            "Stores the unlock in the system keyring, so Proton Drive opens without asking after every login. Otherwise you enter the password once per session.",
        ))
        .build();
    group.add(&entry);
    group.add(&remember);
    dialog.set_extra_child(Some(&group));

    dialog.add_response("cancel", &gettext("Cancel"));
    dialog.add_response("unlock", &gettext("Unlock"));
    dialog.set_response_appearance("unlock", adw::ResponseAppearance::Suggested);
    dialog.set_default_response(Some("unlock"));
    dialog.set_close_response("cancel");

    let done = RefCell::new(Some(done));
    dialog.connect_response(None, move |_, resp| {
        let Some(done) = done.borrow_mut().take() else {
            return;
        };
        let password = entry.text().to_string();
        if resp == "unlock" && !password.is_empty() {
            done(Some((password, remember.is_active())));
        } else {
            done(None);
        }
    });

    let parent = ui_window(ui).map(|w| w.upcast::<gtk4::Window>());
    dialog.present(parent.as_ref());
}

/// If the signed-in account is locked, ask for its mailbox password — once per
/// run; after a cancel, a toast keeps an Unlock button within reach.
///
/// The key state is a keyring and kernel-keyring read, so it runs on a worker.
pub(crate) fn offer_unlock(ui: &Rc<Ui>) {
    if ui.unlock_offered.get() {
        return;
    }
    let ui = ui.clone();
    glib::spawn_future_local(async move {
        let state = gio::spawn_blocking(|| auth::key_state().ok()).await;
        if matches!(state, Ok(Some(auth::KeyState::Locked))) && !ui.unlock_offered.replace(true) {
            prompt_unlock(&ui, false);
        }
    });
}

enum UnlockOutcome {
    Unlocked,
    Wrong,
    Failed(String),
}

/// Ask for the mailbox password and unlock the account with it.
fn prompt_unlock(ui: &Rc<Ui>, retry: bool) {
    let ui_done = ui.clone();
    ask_mailbox(ui, retry, move |answer| {
        let Some((password, remember)) = answer else {
            toast_action(
                &ui_done,
                &gettext("Proton Drive is locked. Enter your mailbox password to unlock it."),
                &gettext("Unlock"),
                |ui| prompt_unlock(ui, false),
            );
            return;
        };
        glib::spawn_future_local(async move {
            // Verifying talks to Proton and the restart talks to systemd, so
            // both run on a worker, never on the main loop.
            let outcome = gio::spawn_blocking(move || {
                let rt = match tokio::runtime::Builder::new_current_thread()
                    .enable_all()
                    .build()
                {
                    Ok(rt) => rt,
                    Err(e) => return UnlockOutcome::Failed(e.to_string()),
                };
                match rt.block_on(auth::unlock(&password, remember)) {
                    Ok(()) => {
                        service::restart();
                        UnlockOutcome::Unlocked
                    }
                    Err(pdfs_core::Error::WrongMailboxPassword) => UnlockOutcome::Wrong,
                    Err(e) => UnlockOutcome::Failed(login_error_message(&e)),
                }
            })
            .await;
            match outcome {
                Ok(UnlockOutcome::Unlocked) => {
                    toast(&ui_done, &gettext("Unlocked."));
                    refresh(&ui_done);
                }
                Ok(UnlockOutcome::Wrong) => prompt_unlock(&ui_done, true),
                Ok(UnlockOutcome::Failed(message)) => {
                    toast_error(&ui_done, &gettext("Couldn't unlock"), &message)
                }
                Err(_) => {}
            }
        });
    });
}

/// Show the lazy two-factor dialog and feed the entered code back to the waiting
/// login worker via `code_tx`. Cancelling (or closing) drops the sender, which
/// the worker reads as a cancelled login.
pub(crate) fn prompt_2fa(ui: &Rc<Ui>, code_tx: std::sync::mpsc::Sender<String>) {
    let dialog = adw::AlertDialog::builder()
        .heading(gettext("Two-Factor Authentication"))
        .body(gettext(
            "Enter the code from your authenticator app, or one of your recovery codes.",
        ))
        .build();

    let group = adw::PreferencesGroup::new();
    let entry = adw::EntryRow::builder()
        .title(gettext("Authentication code"))
        .activates_default(true)
        .build();
    group.add(&entry);
    dialog.set_extra_child(Some(&group));

    dialog.add_response("cancel", &gettext("Cancel"));
    dialog.add_response("confirm", &gettext("Confirm"));
    dialog.set_response_appearance("confirm", adw::ResponseAppearance::Suggested);
    dialog.set_default_response(Some("confirm"));
    dialog.set_close_response("cancel");

    let code_tx = RefCell::new(Some(code_tx));
    dialog.connect_response(None, move |_, resp| {
        // On cancel/close we take + drop `tx` without sending, so the worker's
        // recv errors out and the login is reported as cancelled.
        if let Some(tx) = code_tx.borrow_mut().take()
            && resp == "confirm"
        {
            let _ = tx.send(entry.text().trim().to_string());
        }
    });

    let parent = ui.login.login_button.root().and_downcast::<gtk4::Window>();
    dialog.present(parent.as_ref());
}

/// Let the user solve the challenge in their own browser, for when the
/// verification window could not come up. The page cannot hand its token back
/// to us, so the user says when they are done, and the retry carries the
/// challenge token, which the solved page made good (see
/// [`auth::browser_verified`]).
fn verify_in_browser(
    ui: &Rc<Ui>,
    hv: &HumanVerification,
    credential_tx: std::sync::mpsc::Sender<HumanVerificationCredential>,
) {
    let dialog = adw::AlertDialog::builder()
        .heading(gettext("Verify in Your Browser"))
        .body(gettext(
            "The verification page can't be shown in the app on this system. Open it in your browser, complete it there, then come back and choose Continue.",
        ))
        .build();

    let url = auth::browser_verification_url(hv);
    let open = gtk4::Button::builder()
        .label(gettext("Open Verification Page"))
        .halign(gtk4::Align::Center)
        .build();
    open.add_css_class("pill");
    dialog.set_extra_child(Some(&open));

    dialog.add_response("cancel", &gettext("Cancel"));
    dialog.add_response("continue", &gettext("Continue"));
    dialog.set_response_appearance("continue", adw::ResponseAppearance::Suggested);
    // Continuing before the page was even opened would only fail the retry.
    dialog.set_response_enabled("continue", false);
    dialog.set_default_response(Some("continue"));
    dialog.set_close_response("cancel");

    let dialog_weak = dialog.downgrade();
    open.connect_clicked(move |_| {
        open_uri(&url);
        if let Some(dialog) = dialog_weak.upgrade() {
            dialog.set_response_enabled("continue", true);
        }
    });

    let credential = auth::browser_verified(hv);
    let credential_tx = RefCell::new(Some(credential_tx));
    dialog.connect_response(None, move |_, resp| {
        // On cancel/close we take + drop `tx` without sending, so the worker's
        // recv errors out and the login is reported as cancelled.
        if let Some(tx) = credential_tx.borrow_mut().take()
            && resp == "continue"
        {
            let _ = tx.send(credential.clone());
        }
    });

    let parent = ui.login.login_button.root().and_downcast::<gtk4::Window>();
    dialog.present(parent.as_ref());
}

/// Sign out, after a confirmation: disable+stop the mount service (so the
/// daemon isn't left running without credentials), forget the stored session,
/// and drop back to the login page.
pub(crate) fn sign_out(ui: &Rc<Ui>) {
    let Some(window) = ui_window(ui) else { return };
    let ui = ui.clone();
    confirm_destructive(
        &window,
        &gettext("Sign Out?"),
        &gettext(
            "Proton Drive will disconnect and stop syncing until you sign in again. Files already on this computer stay where they are.",
        ),
        &gettext("Sign Out"),
        move || {
            // systemctl and the keyring both block, so run them on a worker.
            let ui = ui.clone();
            glib::spawn_future_local(async move {
                let result = gio::spawn_blocking(|| {
                    service::disable_stop();
                    auth::logout().map(|_| ()).map_err(|e| e.to_string())
                })
                .await;
                if let Ok(Err(e)) = result {
                    tracing::error!("logout failed: {e}");
                }
                *ui.session.borrow_mut() = None;
                refresh(&ui);
            });
        },
    );
}

#[cfg(test)]
mod tests {
    use super::login_error_message;

    #[test]
    fn a_cancelled_prompt_says_which_step_was_skipped() {
        let totp = pdfs_core::Error::Other("two-factor entry cancelled".into());
        assert!(login_error_message(&totp).contains("two-factor code"));
        let hv = pdfs_core::Error::Other("verification cancelled".into());
        assert!(login_error_message(&hv).contains("verification wasn't completed"));
    }

    #[test]
    fn a_cancelled_mailbox_prompt_is_reported_as_such() {
        let error = pdfs_core::Error::Other("mailbox entry cancelled".into());
        assert!(login_error_message(&error).contains("no mailbox password"));
    }

    #[test]
    fn a_blocked_sign_in_does_not_ask_for_an_update() {
        use pdfs_core::proton_sdk::api::ResponseCode;
        use pdfs_core::proton_sdk::{ProtonApiError, ProtonError};
        let error = pdfs_core::Error::Proton(ProtonError::Api(ProtonApiError {
            code: ResponseCode::Blocked,
            http_status: 422,
            message: "This version of the app is no longer supported, please update to continue using the app".into(),
            details: None,
        }));
        let message = login_error_message(&error);
        assert!(message.contains("temporarily refusing"), "{message}");
        assert!(!message.contains("update"), "{message}");
    }

    #[test]
    fn an_unmapped_error_keeps_its_text() {
        let error = pdfs_core::Error::Other("something odd".into());
        assert_eq!(login_error_message(&error), "Sign-in failed: something odd");
    }
}