feat(ui): add cons_show_warning() (issue #87)

The console had cons_show() for information and cons_show_error() for
failures, but nothing in between, so callers reporting a condition the
user should notice had to pick between hiding it and dressing it up as
an error.

cons_show_warning() prints through the new THEME_WARNING item, yellow
by default, and prefixes the text with "Warning: ". Themes that do not
set the "warning" colour fall back to that default, so the bundled
themes need no change. Logging stays with the caller, as it does for
the other console functions.

Makefile.am

@@ -236,10 +236,7 @@ omemo_sources = \
 	src/tools/aesgcm_download.h src/tools/aesgcm_download.c
 
 omemo_unittest_sources = \
-	tests/unittests/omemo/stub_omemo.c \
-	tests/unittests/omemo/test_omemo_crypto.c \
-	tests/unittests/omemo/test_omemo_crypto.h \
-	src/omemo/crypto.c
+	tests/unittests/omemo/stub_omemo.c
 
 if BUILD_PYTHON_API
 core_sources += $(python_sources)

src/common.c

@@ -455,32 +455,6 @@ str_xml_sanitize(const char* const str)
     return g_string_free(sanitized, FALSE);
 }
 
-gchar*
-redact_secrets(const char* const str)
-{
-    if (str == NULL) {
-        return NULL;
-    }
-
-    // SASL exchanges and <password> elements carry credentials — strip their content before logging
-    static gsize init = 0;
-    static GRegex* secret_regex = NULL;
-    if (g_once_init_enter(&init)) {
-        secret_regex = g_regex_new(
-            "(<(?:auth|response|challenge|success|password|digest)\\b[^>]*>)[^<]+(</(?:auth|response|challenge|success|password|digest)>)",
-            0, 0, NULL);
-        g_once_init_leave(&init, 1);
-    }
-
-    if (secret_regex == NULL) {
-        return g_strdup(str);
-    }
-
-    auto_gchar gchar* valid = g_utf8_make_valid(str, -1); // invalid UTF-8 would make the regex fail open
-    gchar* redacted = g_regex_replace(secret_regex, valid, -1, 0, "\\1[REDACTED]\\2", 0, NULL);
-    return redacted ? redacted : g_steal_pointer(&valid);
-}
-
 char*
 release_get_latest(void)
 {

src/common.h

@@ -161,7 +161,6 @@ gboolean strtoi_range(const char* str, int* saveptr, int min, int max, char** er
 gsize g_diff_to_gsize(const void* end, const void* start);
 int utf8_display_len(const char* const str);
 gchar* str_xml_sanitize(const char* const str);
-gchar* redact_secrets(const char* const str);
 
 gboolean string_matches_one_of(const char* what, const char* is, gboolean is_can_be_null, const char* first, ...) __attribute__((sentinel));
 gboolean valid_tls_policy_option(const char* is);

src/config/theme.c

@@ -87,6 +87,7 @@ theme_init(const char* const theme_name)
     g_hash_table_insert(defaults, strdup("main.help.header"), strdup("default"));
     g_hash_table_insert(defaults, strdup("main.trackbar"), strdup("default"));
     g_hash_table_insert(defaults, strdup("error"), strdup("red"));
+    g_hash_table_insert(defaults, strdup("warning"), strdup("yellow"));
     g_hash_table_insert(defaults, strdup("incoming"), strdup("yellow"));
     g_hash_table_insert(defaults, strdup("mention"), strdup("yellow"));
     g_hash_table_insert(defaults, strdup("trigger"), strdup("yellow"));
@@ -703,6 +704,9 @@ theme_attrs(theme_item_t attrs)
     case THEME_ERROR:
         _theme_prep_fgnd("error", lookup_str, &bold);
         break;
+    case THEME_WARNING:
+        _theme_prep_fgnd("warning", lookup_str, &bold);
+        break;
     case THEME_INCOMING:
         _theme_prep_fgnd("incoming", lookup_str, &bold);
         break;

src/config/theme.h

@@ -23,6 +23,7 @@ typedef enum {
     THEME_SPLASH,
     THEME_HELP_HEADER,
     THEME_ERROR,
+    THEME_WARNING,
     THEME_INCOMING,
     THEME_MENTION,
     THEME_TRIGGER,

src/database_sqlite.c

@@ -39,7 +39,6 @@
 #include <sys/statvfs.h>
 #include <sqlite3.h>
 #include <glib.h>
-#include <glib/gstdio.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -125,15 +124,6 @@ _get_db_filename(ProfAccount* account)
     return files_file_in_account_data_path(DIR_DATABASE, account->jid, "chatlog.db");
 }
 
-static int
-_quick_check_cb(void* intact, int argc, char** argv, char** column_names)
-{
-    if (argc > 0 && argv[0] && strcmp(argv[0], "ok") == 0) {
-        *(gboolean*)intact = TRUE;
-    }
-    return 0;
-}
-
 static gboolean
 _sqlite_init(ProfAccount* account)
 {
@@ -159,20 +149,6 @@ _sqlite_init(ProfAccount* account)
         return FALSE;
     }
 
-    g_chmod(filename, S_IRUSR | S_IWUSR); // history holds plaintext; journal/WAL files inherit these perms
-
-    // catch corruption before running queries or migrations against the file
-    char* check_err = NULL;
-    gboolean intact = FALSE;
-    ret = sqlite3_exec(g_chatlog_database, "PRAGMA quick_check(1);", _quick_check_cb, &intact, &check_err);
-    if (ret != SQLITE_OK || !intact) {
-        log_error("Chat history database failed integrity check (%s): %s", filename,
-                  check_err ? check_err : "quick_check did not return 'ok'");
-        sqlite3_free(check_err);
-        _db_teardown("_sqlite_init(quick_check)");
-        return FALSE;
-    }
-
     char* err_msg = NULL;
 
     int db_version = _get_db_version();
@@ -715,7 +691,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
             original_message_id = tmp ? tmp : original_message_id;
 
             if (g_strcmp0(from_jid_orig, from_jid->barejid) != 0) {
-                log_error("Mismatch in sender JIDs when trying to do LMC. Corrected message sender: %s. Original message sender: %s. Replace-ID: %s.", from_jid->barejid, from_jid_orig, message->replace_id);
+                log_error("Mismatch in sender JIDs when trying to do LMC. Corrected message sender: %s. Original message sender: %s. Replace-ID: %s. Message: %s", from_jid->barejid, from_jid_orig, message->replace_id, message->plain);
                 cons_show_error("%s sent a message correction with mismatched sender. See log for details.", from_jid->barejid);
                 sqlite3_finalize(lmc_stmt);
                 return;
@@ -738,7 +714,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
         sqlite3_stmt* stmt;
         if (_db_prepare_ctx(duplicate_check_query, &stmt, "_add_to_db(duplicate_check)")) {
             if (sqlite3_step(stmt) == SQLITE_ROW) {
-                log_error("Duplicate stanza-id found for the message. stanza_id: %s; archive_id: %s; sender: %s", message->id, message->stanzaid, from_jid->barejid);
+                log_error("Duplicate stanza-id found for the message. stanza_id: %s; archive_id: %s; sender: %s; content: %s", message->id, message->stanzaid, from_jid->barejid, message->plain);
                 cons_show_error("Got a message with duplicate (server-generated) stanza-id from %s.", from_jid->fulljid);
             }
             sqlite3_finalize(stmt);
@@ -769,7 +745,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
         return;
     }
 
-    log_debug("Writing message to DB (id: %s, stanza_id: %s, type: %s)", message->id, message->stanzaid, type); // no query text: it embeds the plaintext body
+    log_debug("Writing to DB. Query: %s", query);
 
     if (SQLITE_OK != sqlite3_exec(g_chatlog_database, query, NULL, 0, &err_msg)) {
         if (err_msg) {
@@ -781,7 +757,7 @@ _add_to_db(ProfMessage* message, const char* type, const Jid* const from_jid, co
     } else {
         int inserted_rows_count = sqlite3_changes(g_chatlog_database);
         if (inserted_rows_count < 1) {
-            log_error("SQLite did not insert message (rows: %d, id: %s)", inserted_rows_count, message->id);
+            log_error("SQLite did not insert message (rows: %d, id: %s, content: %s)", inserted_rows_count, message->id, message->plain);
         }
     }
 }

src/event/server_events.c

@@ -83,7 +83,6 @@ sv_ev_login_account_success(char* account_name, gboolean secured)
 
     if (!log_database_init(account)) {
         log_error("Failed to initialize database for account: %s", account->jid);
-        cons_show_error("Chat history storage is unavailable for this session, messages will not be saved. See the log for details.");
     }
     vcard_user_refresh();
     avatar_pep_subscribe();

src/log.c

@@ -286,8 +286,7 @@ log_stderr_handler(void)
 
         for (int i = 0; i < size; ++i) {
             if (buf[i] == '\n') {
-                auto_gchar gchar* redacted = redact_secrets(s->str); // third-party libs may echo credentials
-                log_msg(stderr_level, "stderr", redacted);
+                log_msg(stderr_level, "stderr", s->str);
                 g_string_assign(s, "");
             } else
                 g_string_append_c(s, buf[i]);
@@ -295,8 +294,7 @@ log_stderr_handler(void)
     } while (1);
 
     if (s->len > 0 && s->str[0] != '\0') {
-        auto_gchar gchar* redacted = redact_secrets(s->str);
-        log_msg(stderr_level, "stderr", redacted);
+        log_msg(stderr_level, "stderr", s->str);
         g_string_assign(s, "");
     }
 }

src/otr/otr.c

@@ -14,8 +14,6 @@
 #include <libotr/message.h>
 #include <libotr/sm.h>
 #include <glib.h>
-#include <glib/gstdio.h>
-#include <sys/stat.h>
 
 #include "log.h"
 #include "chatlog.h"
@@ -116,8 +114,6 @@ cb_write_fingerprints(void* opdata)
     if (err != GPG_ERR_NO_ERROR) {
         log_error("Failed to write fingerprints file");
         cons_show_error("Failed to write fingerprints file");
-    } else {
-        g_chmod(fpsfilename, S_IRUSR | S_IWUSR);
     }
 }
 
@@ -380,7 +376,6 @@ otr_keygen(ProfAccount* account)
         cons_show_error("Failed to generate private key");
         return;
     }
-    g_chmod(keysfilename->str, S_IRUSR | S_IWUSR);
     log_info("Private key generated");
     cons_show("");
     cons_show("Private key generation complete.");
@@ -395,7 +390,6 @@ otr_keygen(ProfAccount* account)
         cons_show_error("Failed to create fingerprints file");
         return;
     }
-    g_chmod(fpsfilename->str, S_IRUSR | S_IWUSR);
     log_info("Fingerprints file created");
 
     err = otrl_privkey_read(user_state, keysfilename->str);

src/tools/aesgcm_download.c

@@ -13,12 +13,10 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
-#include <unistd.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <curl/curl.h>
 #include <gio/gio.h>
-#include <glib/gstdio.h>
 #include <pthread.h>
 #include <assert.h>
 #include <errno.h>
@@ -64,28 +62,14 @@ aesgcm_file_get(void* userdata)
         return NULL;
     }
 
-    // Decrypt into a temporary file next to the target and rename it into
-    // place only after the GCM tag verified, so tampered or truncated
-    // content never appears at the destination path.
-    auto_gchar gchar* partname = g_strdup_printf("%s.part.XXXXXX", aesgcm_dl->filename);
-    gint outfd = g_mkstemp(partname);
-    if (outfd == -1) {
-        http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
-                                   "Downloading '%s' failed: Unable to open "
-                                   "output file at '%s' for writing (%s).",
-                                   https_url, aesgcm_dl->filename,
-                                   g_strerror(errno));
-        return NULL;
-    }
-    FILE* outfh = fdopen(outfd, "wb");
+    // Open the target file for storing the cleartext.
+    auto_FILE FILE* outfh = fopen(aesgcm_dl->filename, "wb");
     if (outfh == NULL) {
         http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
                                    "Downloading '%s' failed: Unable to open "
                                    "output file at '%s' for writing (%s).",
                                    https_url, aesgcm_dl->filename,
                                    g_strerror(errno));
-        close(outfd);
-        remove(partname);
         return NULL;
     }
 
@@ -106,8 +90,6 @@ aesgcm_file_get(void* userdata)
 
     ssize_t* p_bytes_received = http_file_get(http_dl);
     if (!p_bytes_received) {
-        fclose(outfh);
-        remove(partname);
         return NULL;
     }
     ssize_t bytes_received = *p_bytes_received;
@@ -120,8 +102,6 @@ aesgcm_file_get(void* userdata)
                                    "temporary file at '%s' for reading (%s).",
                                    aesgcm_dl->url, tmpname,
                                    g_strerror(errno));
-        fclose(outfh);
-        remove(partname);
         return NULL;
     }
 
@@ -130,32 +110,20 @@ aesgcm_file_get(void* userdata)
                                    bytes_received, fragment);
     fclose(tmpfh);
     remove(tmpname);
-    fclose(outfh);
 
-    gboolean saved = FALSE;
     if (crypt_res != GPG_ERR_NO_ERROR) {
-        remove(partname);
         http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
                                    "Downloading '%s' failed: Failed to decrypt "
                                    "file (%s).",
                                    https_url, gcry_strerror(crypt_res));
-    } else if (g_rename(partname, aesgcm_dl->filename) != 0) {
-        remove(partname);
-        http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ERROR, ENTRY_ERROR,
-                                   "Downloading '%s' failed: Unable to move "
-                                   "decrypted file to '%s' (%s).",
-                                   https_url, aesgcm_dl->filename,
-                                   g_strerror(errno));
     } else {
-        saved = TRUE;
         http_print_transfer_update(aesgcm_dl->window, aesgcm_dl->id, THEME_ONLINE, ENTRY_COMPLETED,
                                    "Downloading '%s': done\nSaved to '%s'",
                                    aesgcm_dl->url, aesgcm_dl->filename);
         win_mark_received(aesgcm_dl->window, aesgcm_dl->id);
     }
 
-    // never hand an unverified file to the external command
-    if (saved && aesgcm_dl->cmd_template != NULL) {
+    if (aesgcm_dl->cmd_template != NULL) {
         gchar** argv = format_call_external_argv(aesgcm_dl->cmd_template,
                                                  aesgcm_dl->filename,
                                                  aesgcm_dl->filename);
@@ -172,8 +140,8 @@ aesgcm_file_get(void* userdata)
         }
 
         g_strfreev(argv);
+        free(aesgcm_dl->cmd_template);
     }
-    free(aesgcm_dl->cmd_template);
 
     free(aesgcm_dl->id);
     free(aesgcm_dl->filename);

src/tools/editor.c

@@ -25,6 +25,8 @@
 #include "ui/ui.h"
 #include "xmpp/xmpp.h"
 
+extern char** environ;
+
 typedef struct EditorContext
 {
     gchar* filename;
@@ -140,6 +142,22 @@ launch_editor(gchar* initial_content, void (*callback)(gchar* content, void* dat
     GSource* sigchld_warmup = g_child_watch_source_new(getpid());
     g_source_unref(sigchld_warmup);
 
+    // Build the editor's env without LINES/COLUMNS pre-fork, so the child only
+    // reassigns environ instead of calling unsetenv() between fork and exec.
+    // The editor's (n)curses then reads the live window via ioctl(TIOCGWINSZ).
+    gsize env_len = 0;
+    while (environ[env_len]) {
+        env_len++;
+    }
+    gchar** editor_env = g_new0(gchar*, env_len + 1);
+    gsize env_kept = 0;
+    for (gsize i = 0; i < env_len; i++) {
+        if (g_str_has_prefix(environ[i], "LINES=") || g_str_has_prefix(environ[i], "COLUMNS=")) {
+            continue;
+        }
+        editor_env[env_kept++] = environ[i];
+    }
+
     pid_t pid = fork();
     if (pid == -1) {
         log_error("[Editor] Failed to fork: %s", strerror(errno));
@@ -148,12 +166,14 @@ launch_editor(gchar* initial_content, void (*callback)(gchar* content, void* dat
         ui_resize();
         cons_show_error("Failed to start editor: %s", strerror(errno));
         g_strfreev(editor_argv);
-        g_free(ctx->filename);
+        g_free(editor_env);
         g_free(ctx);
         return TRUE;
     } else if (pid == 0) {
         // Child process: Inherits TTY from parent
 
+        environ = editor_env; // live TIOCGWINSZ size, not the inherited LINES/COLUMNS
+
         // SIGTSTP=SIG_DFL lets vim's :stop / Ctrl-Z work; profanity catches
         // the STOPPED state via editor_check_stopped() and drops to the shell.
         signal(SIGINT, SIG_DFL);
@@ -170,6 +190,7 @@ launch_editor(gchar* initial_content, void (*callback)(gchar* content, void* dat
     editor_pid = pid;
     g_child_watch_add((GPid)pid, _editor_exit_cb, ctx);
     g_strfreev(editor_argv);
+    g_free(editor_env); // array only; strings are borrowed from environ
     return FALSE;
 }
 

src/ui/console.c

@@ -155,6 +155,20 @@ cons_show_error(const char* const msg, ...)
     cons_alert(NULL);
 }
 
+void
+cons_show_warning(const char* const msg, ...)
+{
+    va_list arg;
+    va_start(arg, msg);
+    GString* fmt_msg = g_string_new(NULL);
+    g_string_vprintf(fmt_msg, msg, arg);
+    win_println(wins_get_console(), THEME_WARNING, "-", "Warning: %s", fmt_msg->str);
+    g_string_free(fmt_msg, TRUE);
+    va_end(arg);
+
+    cons_alert(NULL);
+}
+
 void
 cons_show_tlscert_summary(const TLSCertificate* cert)
 {

src/ui/ui.h

@@ -252,6 +252,8 @@ G_GNUC_PRINTF(1, 2)
 void cons_debug(const char* const msg, ...);
 G_GNUC_PRINTF(1, 2)
 void cons_show_error(const char* const cmd, ...);
+G_GNUC_PRINTF(1, 2)
+void cons_show_warning(const char* const msg, ...);
 void cons_show_contacts(GSList* list);
 void cons_show_roster(GSList* list);
 void cons_show_roster_group(const char* const group, GSList* list);

src/xmpp/connection.c

@@ -749,11 +749,22 @@ connection_get_user(void)
     return connection_get_jid()->localpart;
 }
 
+// NULL 'from' means the server (RFC 6120 §8.1.2.1)
+static const char*
+_get_from_via_jid(const char* const jid)
+{
+    return jid ? jid : conn.domain;
+}
+
 void
 connection_features_received(const char* const jid)
 {
-    log_info("[CONNECTION] connection_features_received %s", jid);
-    if (g_hash_table_remove(conn.requested_features, jid) && g_hash_table_size(conn.requested_features) == 0) {
+    const char* key = _get_from_via_jid(jid);
+    if (!key) {
+        return;
+    }
+    log_info("[CONNECTION] connection_features_received %s", key);
+    if (g_hash_table_remove(conn.requested_features, key) && g_hash_table_size(conn.requested_features) == 0) {
         sv_ev_connection_features_received();
     }
 }
@@ -761,7 +772,11 @@ connection_features_received(const char* const jid)
 GHashTable*
 connection_get_features(const char* const jid)
 {
-    return g_hash_table_lookup(conn.features_by_jid, jid);
+    const char* key = _get_from_via_jid(jid);
+    if (!key || !conn.features_by_jid) {
+        return NULL;
+    }
+    return g_hash_table_lookup(conn.features_by_jid, key);
 }
 
 GList*
@@ -1104,8 +1119,7 @@ _xmpp_file_logger(void* const userdata, const xmpp_log_level_t xmpp_level, const
         break;
     }
 
-    auto_gchar gchar* redacted = redact_secrets(msg); // raw traffic contains SASL/register credentials
-    log_msg(prof_level, area, redacted);
+    log_msg(prof_level, area, msg);
 
     if ((g_strcmp0(area, "xmpp") == 0) || (g_strcmp0(area, "conn")) == 0) {
         sv_ev_xmpp_stanza(msg);

src/xmpp/iq.c

@@ -2314,6 +2314,7 @@ _disco_info_response_id_handler(xmpp_stanza_t* const stanza, void* const userdat
         log_debug("Received disco#info response from: %s", from);
     } else {
         log_debug("Received disco#info response");
+        from = connection_get_domain(); // RFC 6120 §8.1.2.1: no 'from' means the server itself
     }
 
     // handle error responses
@@ -2397,6 +2398,7 @@ _disco_info_response_id_handler_onconnect(xmpp_stanza_t* const stanza, void* con
         log_debug("Received disco#info response from: %s", from);
     } else {
         log_debug("Received disco#info response");
+        from = connection_get_domain(); // RFC 6120 §8.1.2.1: no 'from' means the server itself
     }
 
     // handle error responses

tests/functionaltests/functionaltests.c

@@ -173,6 +173,7 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(disco_info_without_name),
         PROF_FUNC_TEST(disco_items_without_name),
         PROF_FUNC_TEST(disco_info_service_unavailable),
+        PROF_FUNC_TEST(disco_info_result_no_from),
 
         /* Roster management - add/remove/rename contacts */
         PROF_FUNC_TEST(sends_new_item),
@@ -255,9 +256,6 @@ main(int argc, char* argv[])
         PROF_FUNC_TEST(message_db_history_verify),
         PROF_FUNC_TEST(message_db_history_lmc),
         PROF_FUNC_TEST(message_db_history_multi_resource),
-#ifdef HAVE_SQLITE
-        PROF_FUNC_TEST(message_db_corrupt_database_degrades_gracefully),
-#endif
 
         /* Basic message send/receive */
         PROF_FUNC_TEST(message_send),

tests/functionaltests/test_disco.c

@@ -396,6 +396,35 @@ disco_items_without_name(void **state)
     prof_timeout_reset();
 }
 
+void
+disco_info_result_no_from(void **state)
+{
+    /*
+     * Test that a disco#info result without a 'from' attribute is treated as
+     * coming from the server itself (RFC 6120 §8.1.2.1). The on-connect
+     * disco#info handler used to crash on such responses (issue #168).
+     */
+    stbbr_for_query("http://jabber.org/protocol/disco#info",
+        "<iq to='stabber@localhost/profanity' type='result'>"
+            "<query xmlns='http://jabber.org/protocol/disco#info'>"
+                "<identity category='server' type='im' name='NoFromServer'/>"
+                "<feature var='urn:xmpp:ping'/>"
+            "</query>"
+        "</iq>"
+    );
+
+    /* the on-connect disco#info gets the same from-less response */
+    prof_connect();
+
+    prof_input("/disco info");
+
+    prof_timeout(10);
+    /* client survived and attributed the response to the server */
+    assert_true(prof_output_exact("Service discovery info for localhost"));
+    assert_true(prof_output_regex("NoFromServer.*im.*server"));
+    prof_timeout_reset();
+}
+
 void
 disco_info_service_unavailable(void **state)
 {

tests/functionaltests/test_disco.h

@@ -17,3 +17,4 @@ void disco_info_multiple_identities(void **state);
 void disco_info_without_name(void **state);
 void disco_items_without_name(void **state);
 void disco_info_service_unavailable(void **state);
+void disco_info_result_no_from(void **state);

tests/functionaltests/test_history.c

@@ -536,41 +536,3 @@ message_db_history_multi_resource(void** state)
     assert_true(prof_output_regex("Buddy1/laptop"));
     assert_true(prof_output_regex("Buddy1/tablet"));
 }
-
-/*
- * Test: corrupt chatlog.db degrades gracefully (issue #146, REQ-RES-02).
- *
- * A chatlog.db with a valid SQLite magic but garbage content is planted
- * before connecting. Database init must fail cleanly: the user gets a
- * console warning, the session stays up, and the client stays responsive.
- */
-void
-message_db_corrupt_database_degrades_gracefully(void** state)
-{
-    const char* xdg_data = getenv("XDG_DATA_HOME");
-    assert_non_null(xdg_data);
-
-    GString* db_file = g_string_new(xdg_data);
-    g_string_append(db_file, "/profanity/database/stabber_at_localhost");
-    assert_int_equal(0, g_mkdir_with_parents(db_file->str, 0700));
-    g_string_append(db_file, "/chatlog.db");
-
-    /* valid 16-byte SQLite header magic followed by garbage: sqlite3_open
-     * succeeds (lazy open), the integrity gate must catch it */
-    FILE* db = fopen(db_file->str, "wb");
-    assert_non_null(db);
-    assert_int_equal(16, fwrite("SQLite format 3", 1, 16, db));
-    for (int i = 0; i < 4096; i++) {
-        fputc(0xA5, db);
-    }
-    fclose(db);
-    g_string_free(db_file, TRUE);
-
-    prof_connect();
-
-    assert_true(prof_output_exact("Chat history storage is unavailable for this session"));
-
-    /* client is still alive and responsive after the failed DB init */
-    prof_input("/autoping set 60");
-    assert_true(prof_output_exact("Autoping interval set to 60 seconds."));
-}

tests/functionaltests/test_history.h

@@ -11,4 +11,3 @@ void message_db_history_service_chars(void** state);
 void message_db_history_verify(void** state);
 void message_db_history_lmc(void** state);
 void message_db_history_multi_resource(void** state);
-void message_db_corrupt_database_degrades_gracefully(void** state);

tests/unittests/omemo/test_omemo_crypto.c

@@ -1,152 +0,0 @@
-/*
- * test_omemo_crypto.c
- *
- * Unit tests for the OMEMO AES-256-GCM file crypto (src/omemo/crypto.c).
- * The decrypt direction streams plaintext before the tag is checked, so
- * callers rely on the returned error code to discard unverified output —
- * these tests pin that contract (issue #146, REQ-CRY-06).
- */
-
-#include "config.h"
-
-#include <glib.h>
-#include <stdio.h>
-#include <string.h>
-#include "prof_cmocka.h"
-
-#ifdef HAVE_OMEMO
-
-#include "omemo/omemo.h"
-#include "omemo/crypto.h"
-
-#define TAG_LENGTH 16
-
-static const unsigned char PLAINTEXT[] = "at-rest integrity check payload: 0123456789abcdef";
-
-// gcrypt secure memory must be set up exactly once per process
-static int
-_crypto_init_once(void)
-{
-    static gboolean done = FALSE;
-    static int rc = 0;
-    if (!done) {
-        rc = omemo_crypto_init();
-        done = TRUE;
-    }
-    return rc;
-}
-
-static off_t
-_file_size(FILE* fh)
-{
-    fseeko(fh, 0, SEEK_END);
-    off_t size = ftello(fh);
-    rewind(fh);
-    return size;
-}
-
-// encrypt PLAINTEXT with a fixed key/nonce into a fresh tmpfile
-static FILE*
-_encrypted_tmpfile(unsigned char* key, unsigned char* nonce)
-{
-    memset(key, 0x42, OMEMO_AESGCM_KEY_LENGTH);
-    memset(nonce, 0x24, OMEMO_AESGCM_NONCE_LENGTH);
-
-    FILE* plain = tmpfile();
-    FILE* cipher = tmpfile();
-    assert_non_null(plain);
-    assert_non_null(cipher);
-
-    assert_int_equal(sizeof(PLAINTEXT), fwrite(PLAINTEXT, 1, sizeof(PLAINTEXT), plain));
-    rewind(plain);
-
-    assert_int_equal(GPG_ERR_NO_ERROR,
-                     aes256gcm_crypt_file(plain, cipher, (off_t)sizeof(PLAINTEXT), key, nonce, TRUE));
-    fclose(plain);
-    rewind(cipher);
-    return cipher;
-}
-
-// corrupt one byte at offset (negative counts from the end), return reopened stream
-static FILE*
-_flip_byte(FILE* cipher, long offset)
-{
-    off_t size = _file_size(cipher);
-    unsigned char* buf = g_malloc(size);
-    assert_int_equal(size, fread(buf, 1, size, cipher));
-    fclose(cipher);
-
-    long pos = offset >= 0 ? offset : (long)size + offset;
-    buf[pos] ^= 0xFF;
-
-    FILE* tampered = tmpfile();
-    assert_non_null(tampered);
-    assert_int_equal(size, fwrite(buf, 1, size, tampered));
-    rewind(tampered);
-    g_free(buf);
-    return tampered;
-}
-
-void
-aes256gcm_crypt_file__roundtrip_succeeds(void** state)
-{
-    assert_int_equal(0, _crypto_init_once());
-
-    unsigned char key[OMEMO_AESGCM_KEY_LENGTH];
-    unsigned char nonce[OMEMO_AESGCM_NONCE_LENGTH];
-    FILE* cipher = _encrypted_tmpfile(key, nonce);
-
-    off_t cipher_size = _file_size(cipher);
-    assert_int_equal((off_t)sizeof(PLAINTEXT) + TAG_LENGTH, cipher_size);
-
-    FILE* decrypted = tmpfile();
-    assert_non_null(decrypted);
-    assert_int_equal(GPG_ERR_NO_ERROR,
-                     aes256gcm_crypt_file(cipher, decrypted, cipher_size, key, nonce, FALSE));
-
-    unsigned char readback[sizeof(PLAINTEXT)];
-    rewind(decrypted);
-    assert_int_equal(sizeof(PLAINTEXT), fread(readback, 1, sizeof(readback), decrypted));
-    assert_memory_equal(PLAINTEXT, readback, sizeof(PLAINTEXT));
-
-    fclose(cipher);
-    fclose(decrypted);
-}
-
-void
-aes256gcm_crypt_file__rejects_tampered_tag(void** state)
-{
-    assert_int_equal(0, _crypto_init_once());
-
-    unsigned char key[OMEMO_AESGCM_KEY_LENGTH];
-    unsigned char nonce[OMEMO_AESGCM_NONCE_LENGTH];
-    FILE* cipher = _flip_byte(_encrypted_tmpfile(key, nonce), -1); // last tag byte
-
-    FILE* decrypted = tmpfile();
-    assert_non_null(decrypted);
-    gcry_error_t res = aes256gcm_crypt_file(cipher, decrypted, _file_size(cipher), key, nonce, FALSE);
-    assert_int_not_equal(GPG_ERR_NO_ERROR, res);
-
-    fclose(cipher);
-    fclose(decrypted);
-}
-
-void
-aes256gcm_crypt_file__rejects_tampered_ciphertext(void** state)
-{
-    assert_int_equal(0, _crypto_init_once());
-
-    unsigned char key[OMEMO_AESGCM_KEY_LENGTH];
-    unsigned char nonce[OMEMO_AESGCM_NONCE_LENGTH];
-    FILE* cipher = _flip_byte(_encrypted_tmpfile(key, nonce), 0); // first payload byte
-
-    FILE* decrypted = tmpfile();
-    assert_non_null(decrypted);
-    gcry_error_t res = aes256gcm_crypt_file(cipher, decrypted, _file_size(cipher), key, nonce, FALSE);
-    assert_int_not_equal(GPG_ERR_NO_ERROR, res);
-
-    fclose(cipher);
-    fclose(decrypted);
-}
-
-#endif

tests/unittests/omemo/test_omemo_crypto.h

@@ -1,8 +0,0 @@
-/* test_omemo_crypto.h
- *
- * Unit tests for OMEMO AES-256-GCM file crypto (issue #146, REQ-CRY-06)
- */
-
-void aes256gcm_crypt_file__roundtrip_succeeds(void** state);
-void aes256gcm_crypt_file__rejects_tampered_tag(void** state);
-void aes256gcm_crypt_file__rejects_tampered_ciphertext(void** state);

tests/unittests/test_common.c

@@ -1384,55 +1384,3 @@ str_xml_sanitize__strips_illegal_characters(void** state)
     assert_string_equal("UTF-8: üñîçøðé  and more", res5);
     g_free(res5);
 }
-
-void
-redact_secrets__masks_credentials(void** state)
-{
-    // NULL input
-    assert_null(redact_secrets(NULL));
-
-    // Plain text and non-secret XML pass through unchanged
-    gchar* res1 = redact_secrets("hello world");
-    assert_string_equal("hello world", res1);
-    g_free(res1);
-
-    gchar* res2 = redact_secrets("<message><body>secret-looking text</body></message>");
-    assert_string_equal("<message><body>secret-looking text</body></message>", res2);
-    g_free(res2);
-
-    // SASL auth payload is redacted, envelope kept
-    gchar* res3 = redact_secrets("SENT: <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>AGFsaWNlAHBhc3N3b3Jk</auth>");
-    assert_string_equal("SENT: <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>[REDACTED]</auth>", res3);
-    g_free(res3);
-
-    // SASL challenge/response round-trip
-    gchar* res4 = redact_secrets("<challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>cj1abc</challenge>");
-    assert_string_equal("<challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>[REDACTED]</challenge>", res4);
-    g_free(res4);
-
-    gchar* res5 = redact_secrets("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>Yz1iaXdz</response>");
-    assert_string_equal("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>[REDACTED]</response>", res5);
-    g_free(res5);
-
-    // Empty SASL response element has no content to redact
-    gchar* res6 = redact_secrets("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>");
-    assert_string_equal("<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>", res6);
-    g_free(res6);
-
-    // XEP-0077 registration: password redacted, username kept
-    gchar* res7 = redact_secrets("<query xmlns='jabber:iq:register'><username>alice</username><password>hunter2</password></query>");
-    assert_string_equal("<query xmlns='jabber:iq:register'><username>alice</username><password>[REDACTED]</password></query>", res7);
-    g_free(res7);
-
-    // XEP-0078 legacy auth: password-derived digest redacted
-    gchar* res8 = redact_secrets("<query xmlns='jabber:iq:auth'><username>alice</username><digest>48fc78be9ec8f86d8ce1c39ebd7a5b4c9d0e2f13</digest><resource>tui</resource></query>");
-    assert_string_equal("<query xmlns='jabber:iq:auth'><username>alice</username><digest>[REDACTED]</digest><resource>tui</resource></query>", res8);
-    g_free(res8);
-
-    // invalid UTF-8 must not make redaction fail open
-    gchar* res9 = redact_secrets("\xFF garbage <password>hunter2</password>");
-    assert_non_null(res9);
-    assert_null(strstr(res9, "hunter2"));
-    assert_non_null(strstr(res9, "[REDACTED]"));
-    g_free(res9);
-}

tests/unittests/test_common.h

@@ -64,6 +64,5 @@ void valid_tls_policy_option__is__correct_for_various_inputs(void** state);
 void get_mentions__tests__various(void** state);
 void release_is_new__tests__various(void** state);
 void str_xml_sanitize__strips_illegal_characters(void** state);
-void redact_secrets__masks_credentials(void** state);
 
 #endif

tests/unittests/ui/stub_ui.c

@@ -49,6 +49,18 @@ expect_any_cons_show_error(void)
     expect_any(cons_show_error, output);
 }
 
+void
+expect_cons_show_warning(char* expected)
+{
+    expect_string(cons_show_warning, output, expected);
+}
+
+void
+expect_any_cons_show_warning(void)
+{
+    expect_any(cons_show_warning, output);
+}
+
 void
 expect_win_println(char* message)
 {
@@ -845,6 +857,16 @@ cons_show_error(const char* const cmd, ...)
     va_end(args);
 }
 
+void
+cons_show_warning(const char* const msg, ...)
+{
+    va_list args;
+    va_start(args, msg);
+    vsnprintf(output, sizeof(output), msg, args);
+    check_expected(output);
+    va_end(args);
+}
+
 void
 cons_show_contacts(GSList* list)
 {

tests/unittests/ui/stub_ui.h

@@ -10,4 +10,6 @@ void expect_cons_show(char* expected);
 void expect_any_cons_show(void);
 void expect_cons_show_error(char* expected);
 void expect_any_cons_show_error(void);
+void expect_cons_show_warning(char* expected);
+void expect_any_cons_show_warning(void);
 void expect_win_println(char* message);

tests/unittests/unittests.c

@@ -48,7 +48,6 @@
 #include "test_ai_client.h"
 #include "test_database_export.h"
 #include "test_database_stress.h"
-#include "omemo/test_omemo_crypto.h"
 
 #define muc_unit_test(f) cmocka_unit_test_setup_teardown(f, muc_before_test, muc_after_test)
 
@@ -688,12 +687,6 @@ main(int argc, char* argv[])
         cmocka_unit_test(get_mentions__tests__various),
         cmocka_unit_test(release_is_new__tests__various),
         cmocka_unit_test(str_xml_sanitize__strips_illegal_characters),
-        cmocka_unit_test(redact_secrets__masks_credentials),
-#ifdef HAVE_OMEMO
-        cmocka_unit_test(aes256gcm_crypt_file__roundtrip_succeeds),
-        cmocka_unit_test(aes256gcm_crypt_file__rejects_tampered_tag),
-        cmocka_unit_test(aes256gcm_crypt_file__rejects_tampered_ciphertext),
-#endif
 
         cmocka_unit_test_setup_teardown(plugins_get_command_names__returns__no_commands,
                                         load_preferences,