fix(cbio): resolve the live lane's vendor material from an injected source by shroominic · Pull Request #192 · shroominic/OpenGlucose

shroominic · 2026-09-18T05:21:14Z

Closes #191.

The defect

The live lane resolved its vendor material from compiled defaults:
CbioCompiledAuthMaterialProvider for the link credential and the defaulted
cbioVendorStreamKey for every mask and unmask. fix/cbio-credential-redaction
(#166) removes both, so the lane stopped compiling against the redacted API.

This branch adopts that API. It is two commits:

0d3f763 - fix(cbio): require injected vendor material instead of compiled constants #166 verbatim, cherry-picked from 7fa477c on
fix/cbio-credential-redaction.
9e2105a - the adoption itself.

The cherry-pick is included so the branch compiles and passes on its own. Once
#166 lands, this PR's diff reduces to the second commit; both pieces are
byte-identical to the branch that is already open.

RED

Both runs are on 0d3f763 - the lane tip with #166 applied and nothing else.

cd packages/cgm_cbio && flutter test

lib/src/cbio_glucose_session.dart:341:34: Error: Required named parameter 'key' must be provided.
        buildMaskedCbioGlucoseQuery(0),
lib/src/cbio_glucose_session.dart:671:38: Error: Required named parameter 'key' must be provided.
      final plaintext = unmaskCbioFrame(masked);
test/cbio_glucose_session_test.dart:161:38: Error: Required named parameter 'key' must be provided.
00:00 +0 -8: Some tests failed.

cd openhealth && flutter analyze

error • The named parameter 'key' is required, but there's no corresponding argument
  • integration_test/cbio_live_capture_test.dart:63:21 • missing_required_argument
1 issue found.

Seven key: errors in the session, eleven in its tests, and one in the capture
harness.

GREEN

Same two commands on this branch: +81 ~2: All tests passed! and
No issues found!.

The fix

CbioGlucoseSession takes a CbioCredentialSource (default
CbioDefineCredentialSource) and resolves it once per session, before the
transport is touched. An unconfigured build fails closed with
cbio.auth.material, a configuration status text, zero connects, zero
writes, and no subscription - the fail-open compiled default is gone.
One _streamKey getter feeds every maskCbioFrame, unmaskCbioFrame, and
masked builder; the authentication frame additionally takes the resolved
material. No call site can reach a mask without the key.
CbioSensorDriver exposes its source and a canAuthenticate predicate.
The app's platform registry registers the GS1 driver only when
cbioCredentials.isConfigured, so a plain build does not offer a sensor it
can only fail to read. The capture harness reads the material from the
environment or --dart-define and reports vendor-material-missing before
touching the radio, exactly as fix(cbio): require injected vendor material instead of compiled constants #166's authenticated harness does.

Decisions to review

The registry gate. isConfigured exists on the redaction branch for this
call site, but it changes the default build: registeredDriverIds is
{aidex} instead of {aidex, cbio} when no material is supplied. The
alternative is to keep registering the driver and let the session fail at
connect with the new configuration text. I chose the gate because a listed
sensor that can never be read is a dead end; say the word and I will invert
it.
Resolution point. The material is read before connect, not inside
_authenticate. That is what makes "no link is opened" true for the
fail-closed case, and it is one read per session either way.
_fail gained an optional statusText so the configuration failure does
not render as "Connection failed". The failure code and every other caller
are unchanged.

Tests added

resolves the material once per session - a counting source asserts one
read() across a double initialize().
fails closed before the radio when the build carries none - asserts the
transport was never asked to connect, no write was sent, and the snapshot
carries cbio.auth.material.
a driver reports whether its build can authenticate at all and
a driver without material fails closed before any write on the driver.
Every existing session and driver test now supplies synthetic material
(CGMTESTKEY000000 / CGMTESTMATERIAL1) through a
CbioStaticCredentialSource, so no test depends on a compiled constant.
og_demo_flag_test asserts the registry contents per configuration instead of
a hard-coded {aidex, cbio}.

Verification

cd packages/cgm_cbio && flutter test - exit 0, +81 ~2: All tests passed!
(17db5b4: +75; fix(cbio): require injected vendor material instead of compiled constants #166 adds its own crypto tests, this branch adds four)
cd openhealth && flutter test - exit 0, +480: All tests passed!
(17db5b4: +480)
flutter analyze - No issues found! in both, plus
flutter analyze integration_test in openhealth
dart format on every line this branch adds - no change. The two test files
and three app files keep exactly the pre-existing drift hunks they had at
17db5b4; the formatter lanes own those.
No vendor bytes are added anywhere: fixtures are CGMTEST… strings and the
material is read from the environment at run time.

…ants The vendor GS1 stream key, link credential, and authentication prompt were plaintext constants in packages/cgm_cbio/lib/src/cbio_crypto.dart. The repository is public, the file is on the 0.4.0 release aggregate, and the Secret Scan job is red on the same lane for a fixture derived from it. Remove the constants and make the material an explicit input: * cbio_credentials.dart adds CbioCredentials (validated, immutable, redacting toString), CbioCredentialSource, CbioMapCredentialSource, CbioDefineCredentialSource, and the fail-closed CbioCredentialUnavailable. * cbioRc4Keystream, maskCbioFrame, unmaskCbioFrame, and every builder in cbio_vendor_frames.dart now take the key and material as required arguments, so a caller that has not resolved material cannot compile a call. * the device harness reads the material from the process environment or --dart-define and aborts with vendor-material-missing before touching radio. * tests use clearly synthetic fixtures; the real-material checks skip unless the values are injected. * .gitleaks.toml adds a rule for this exact class of literal and a narrow allowlist for synthetic fixtures only. Refs #164 (cherry picked from commit 7fa477c)

…ource The live session still called the pre-redaction crypto API: `maskCbioFrame`, `unmaskCbioFrame`, and every masked builder defaulted to compiled constants, and the session read its link credential from `CbioCompiledAuthMaterialProvider`. Those defaults are gone, so the lane has to resolve the material explicitly. - `CbioGlucoseSession` takes a `CbioCredentialSource` and resolves it once per session, before the transport is touched. An unconfigured build fails closed with `cbio.auth.material` and a configuration status text instead of opening a link it could never authenticate or unmask. - Every mask, unmask, and masked builder receives the resolved key explicitly, and the authentication frame receives the resolved material. - `CbioSensorDriver` exposes its source and a `canAuthenticate` predicate. - The app's platform registry registers the GS1 driver only when the build supplied the material, so a plain build does not offer a sensor it cannot read. The capture harness reads the material from the environment or `--dart-define` and reports `vendor-material-missing` when it is absent. Tests: cgm_cbio 81 passed (2 skipped), openhealth 480 passed; `flutter analyze` clean in both, including `openhealth/integration_test`.

Absorbs feature/cbio-gs1-app-live at 05785b0, which carries the redacted credential API (#166 verbatim as a7c21bc) and the live lane's adoption of an injected CbioCredentialSource (PR #192, issue #191). Conflict resolution: - packages/cgm_cbio/README.md: union. The aggregate's FF31 reply-decode paragraph (#132) and the lane's new injected-material section are both kept; neither lineage had the other. - packages/cgm_cbio/test/cbio_crypto_test.dart: take the lane's version. It supersedes the masked-vector fixture from #148 by removing the published vectors entirely and testing the mask with synthetic material.

…andidate Reverts the merge of fix/cbio-archive-unit-claim (#168). #168 removes CbioRawGlucoseRecord.derivedMilligramsPerDecilitre and .derivedMillimolesPerLitre and leaves only an explicitly unitless rawCurrentScaled. The app-live surface still fills CgmReading.valueMgdl from the removed mg/dL accessor, so the merge leaves six analyzer errors in cgm_cbio and, fixing them, would change the number the live surface renders. That is a unit-reference decision on the product surface, not a mechanical merge, and it is the owner's to make. The lane needs an adoption change (as #192 was for #166) before this can land. Recorded as excluded in the PR body.

shroominic added 2 commits September 18, 2026 12:09

This was referenced Sep 18, 2026

The live GS1 lane still compiles its vendor key, so it cannot compile against the redaction branch #191

Open

feat(cbio): stream GS1 history and live readings into the app #142

Closed

shroominic merged commit 05785b0 into feature/cbio-gs1-app-live Sep 18, 2026
5 of 10 checks passed

Navigation Menu

Repository navigation

fix(cbio): resolve the live lane's vendor material from an injected source - #192

fix(cbio): resolve the live lane's vendor material from an injected source#192
shroominic merged 2 commits into
feature/cbio-gs1-app-livefrom
fix/cbio-credential-source-adoption

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

The defect

RED

GREEN

The fix

Decisions to review

Tests added

Verification

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant