mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-10 16:33:27 +00:00
Vitor PamplonaandClaude Opus 4.8
08bd5d9b4a
Changing an app to PARANOID did not stop it signing. `sessionAllows` is consulted BEFORE `signerLedger.decide()`, so a live "allow for this session" grant short-circuits exactly the check the stricter policy would have failed. The user picks "I'm a bit paranoid", the UI updates, and the app carries on signing on the strength of a grant made under the old policy — until every applet surface closes. The trust level is a decision about how an app is treated from now on, so the policy change now drops what that app is currently holding, the same way revoking and forgetting already do. It fires on any change rather than only on tightening: loosening is the user's call too, and a stale grant surviving a deliberate re-decision is surprising in either direction. Completes the revocation work — the three paths that change what an app may do (forget, per-op revoke, trust level) now all clear its live session grants. Not automatically tested: this is a Compose click handler and `amethyst` has no Robolectric. The underlying `revokeSessionGrants` is covered by `revokingAnAppDropsItsLiveSessionSignerGrants`, which was verified to fail before its namespacing fix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>