feat(group-requests): ask a private group for money and pay a share

CrossPlatformVectors/Package.swift

@@ -18,7 +18,7 @@ let sharedCore: Package.Dependency = {
     if let sharedCoreLocalRoot {
         return .package(path: "\(sharedCoreLocalRoot)/kmp/shared-core/spm")
     }
-    return .package(url: "https://github.com/code-payments/flipcash-shared-core-spm", .upToNextMinor(from: "0.15.0"))
+    return .package(url: "https://github.com/code-payments/flipcash-shared-core-spm", .upToNextMinor(from: "0.16.0"))
 }()
 
 // Cross-platform test-vector GATE (Track-B/C safety net). Asserts the ed25519 this app signs

Flipcash/Core/Controllers/ConversationController.swift

@@ -1614,7 +1614,7 @@ final class ConversationController {
     /// bump per feed apply costs a single window re-read for the open chat.
     private static let messageWriteOperations: Set<String> = [
         "upsert-messages", "apply-chat-events", "delta-batch", "load-messages", "load-older",
-        "send-message", "send-media-message", "reset-resync", "edit-message", "delete-message",
+        "send-message", "send-media-message", "send-payment-request", "reset-resync", "edit-message", "delete-message",
         "upsert-conversation", "replace-feed", "replace-group-feed",
     ]
 
@@ -1638,11 +1638,13 @@ final class ConversationController {
     /// whoever wrote it. `currencyName` resolves a mint to its display name; nil —
     /// or the reserve, whose formatted amount already names itself — drops the
     /// "of …" suffix. `knownAuthors` names a group sender the chat's roster subset leaves out.
-    /// `viewerAmount` restates a payment in the display currency.
+    /// `viewerAmount` restates a payment in the display currency. `requestTitle` is a payment
+    /// request's title as the viewer reads it, nil while it isn't loaded or can't be opened.
     func lastMessagePreview(
         for conversation: Conversation,
         knownAuthors: KnownAuthorDirectory.Snapshot = .empty,
         viewerAmount: (ExchangedFiat) -> FiatAmount = { $0.nativeAmount },
+        requestTitle: (PaymentRequestID) -> String? = { _ in nil },
         currencyName: (PublicKey) -> String?
     ) -> String? {
         if isCounterpartTyping(in: conversation.id) {
@@ -1706,6 +1708,14 @@ final class ConversationController {
             // The server sends it; no user is the sender to name.
             return "Shared a profile"
 
+        case .widget(.paymentRequest(let id)):
+            // A title that hasn't loaded or won't open drops the "for …" rather than blanking the line.
+            let subject = requestTitle(id).map { " for \($0)" } ?? ""
+            if isFromSelf { return "You sent request\(subject)" }
+            guard let senderName else { return nil }
+            let firstName = senderName.split(separator: " ").first.map(String.init) ?? senderName
+            return "\(firstName) sent request\(subject)"
+
         case .widget(.unrecognized):
             return nil
 
@@ -2229,6 +2239,9 @@ final class ConversationController {
             _ = await deliver(clientMessageID: clientMessageID, text: text, repliedTo: pending.repliedTo, linkPreview: pending.linkPreview, to: conversationID)
         case .media(_, let caption):
             await retryMedia(clientMessageID: clientMessageID, caption: caption, repliedTo: pending.repliedTo, in: conversationID)
+        case .widget(.paymentRequest(let id)):
+            store.markPending(clientMessageID: clientMessageID, status: .sending, in: conversationID)
+            _ = await deliverPaymentRequest(id, clientMessageID: clientMessageID, to: conversationID, attempts: 1)
         case .encrypted, .cash, .deleted, .widget, .system:
             if case .failure(let error) = Result(catching: { try pending.content.asProto() }) {
                 logger.error("Cannot retry a send this client has no path to re-send", metadata: [
@@ -2295,6 +2308,70 @@ final class ConversationController {
         }
     }
 
+    /// Sends the widget for the payment request `id` into `conversationID` as a pending row, retrying a
+    /// failed send with the same request; returns whether it was delivered. A final failure leaves the
+    /// row failed in the transcript, where a tap retries it like any message.
+    @discardableResult
+    func sendPaymentRequest(_ id: PaymentRequestID, in conversationID: ConversationID, attempts: Int = 3) async -> Bool {
+        let clientMessageID = UUID()
+        let pending = ConversationMessage(
+            id: .unassigned,
+            senderID: selfUserID,
+            content: .widget(.paymentRequest(id)),
+            date: .now,
+            unreadSeq: 0,
+            status: .sending,
+            clientMessageID: clientMessageID
+        )
+        let anchor = (try? database.newestMessageID(conversationID: conversationID)).flatMap { $0 }?.value ?? 0
+        store.insertPending(pending, anchoredTo: anchor, into: conversationID)
+        receiptSettle.hold(clientMessageID.uuidString)
+        return await deliverPaymentRequest(id, clientMessageID: clientMessageID, to: conversationID, attempts: attempts)
+    }
+
+    private func deliverPaymentRequest(_ id: PaymentRequestID, clientMessageID: UUID, to conversationID: ConversationID, attempts: Int) async -> Bool {
+        let chatType = conversation(withID: conversationID)?.type
+        var lastError: Error = ErrorSendMessage.unknown
+        for attempt in 0..<attempts {
+            if attempt > 0 {
+                try? await Task.sleep(for: .seconds(attempt))
+            }
+            do {
+                var confirmed = try await messaging.sendPaymentRequestMessage(
+                    owner: owner,
+                    conversationID: conversationID,
+                    paymentRequestID: id,
+                    clientMessageID: clientMessageID
+                )
+                confirmed.clientMessageID = clientMessageID
+                if persist(operation: "send-payment-request", { try database.upsertConversationMessages([confirmed], conversationID: conversationID) }) {
+                    store.dropPending(clientMessageID: clientMessageID, confirmedAt: confirmed.id, in: conversationID)
+                } else {
+                    scheduleGapCatchUp(conversationID)
+                }
+                store.advanceLastActivity(to: confirmed.date, in: conversationID)
+                if advanceReadPointer(to: confirmed.id, in: conversationID) {
+                    confirmedOwnSendCounts[conversationID, default: 0] += 1
+                }
+                refreshFeedPreview(for: conversationID)
+                persistConversation(conversationID)
+                Analytics.sentMessage(chatType: chatType)
+                return true
+            } catch {
+                lastError = error
+                logger.warning("Failed to send payment request message", metadata: [
+                    "conversationID": "\(conversationID)",
+                    "attempt": "\(attempt)",
+                    "error": "\(error)",
+                ])
+            }
+        }
+        store.markPending(clientMessageID: clientMessageID, status: .failed, in: conversationID)
+        ErrorReporting.captureError(lastError, reason: "Failed to send payment request message")
+        Analytics.sentMessage(chatType: chatType, error: lastError)
+        return false
+    }
+
     /// Sends each staged chip as its own message, in chip order, with `caption` under the last and
     /// `repliedTo` on the first; returns whether every one was delivered.
     ///
@@ -2308,6 +2385,12 @@ final class ConversationController {
         try await messaging.photoSeal(owner: owner, conversationID: conversationID)
     }
 
+    /// The seal that opens `conversationID`'s payment-request text, nil while the chat's key is
+    /// unknown or the chat doesn't encrypt.
+    func openingSeal(for conversationID: ConversationID) async -> ChatSeal? {
+        await messaging.openingSeal(owner: owner, conversationID: conversationID)
+    }
+
     /// Decrypts `conversationID`'s end-to-end encrypted photo blobs, or nil while the chat's key is
     /// unknown or the chat doesn't encrypt.
     func mediaBlobDecrypt(for conversationID: ConversationID) async -> (@Sendable (Data, BlobID, SealedBlob) throws -> Data)? {

Flipcash/Core/Controllers/EncryptedChatClient.swift

@@ -155,6 +155,16 @@ extension EncryptedChatClient: ConversationMessaging {
         }
     }
 
+    /// Requests exist only in private groups, which always encrypt, so a chat without a seal fails.
+    func sendPaymentRequestMessage(owner: KeyPair, conversationID: ConversationID, paymentRequestID id: PaymentRequestID, clientMessageID: UUID) async throws -> ConversationMessage {
+        try await refetchingOnRefusal(conversationID) {
+            guard let seal = try await sealForSending(conversationID, owner: owner) else {
+                throw ErrorSendMessage.encryptionRequired
+            }
+            return try await client.sendPaymentRequestMessage(owner: owner, conversationID: conversationID, paymentRequestID: id, seal: seal, clientMessageID: clientMessageID)
+        }
+    }
+
     func photoSeal(owner: KeyPair, conversationID: ConversationID) async throws -> ChatSeal? {
         try await sealForSending(conversationID, owner: owner)
     }

Flipcash/Core/Controllers/FlipClient+Protocols.swift

@@ -124,6 +124,8 @@ protocol ConversationMessaging: AnyObject, Sendable {
     /// Sends the finalized `photo` as one media message, with `caption` under it; a sealed photo
     /// goes out inside `EncryptedContent`.
     func sendMediaMessage(owner: KeyPair, conversationID: ConversationID, photo: UploadedPhoto, caption: String?, repliedTo: MessageID?, clientMessageID: UUID) async throws -> ConversationMessage
+    /// Sends a widget naming the payment request `id`; it always goes out inside `EncryptedContent`.
+    func sendPaymentRequestMessage(owner: KeyPair, conversationID: ConversationID, paymentRequestID id: PaymentRequestID, clientMessageID: UUID) async throws -> ConversationMessage
     /// The seal a photo sent into `conversationID` is encrypted with, nil when it goes out in
     /// plaintext. Throws when the chat encrypts but its seal can't be built.
     func photoSeal(owner: KeyPair, conversationID: ConversationID) async throws -> ChatSeal?

Flipcash/Core/Controllers/ReactionAlertController.swift

@@ -300,6 +300,7 @@ final class ReactionAlertController {
         case .media(_, let caption): ChatQuote.snippet(forText: ChatMediaStrings.quoteSnippet(caption: caption))
         case .deleted: ChatQuote.deletedSnippet
         case .widget(.shareProfile): ChatQuote.sharedProfileSnippet
+        case .widget(.paymentRequest): ChatQuote.paymentRequestSnippet
         case .encrypted, .widget(.unrecognized), .system: ChatQuote.unavailableSnippet
         }
     }

Flipcash/Core/Navigation/AppRouter+NestedSheet.swift

@@ -27,27 +27,39 @@ private struct AppRouterNestedSheetModifier: ViewModifier {
     @Environment(\.nestedSheetDepth) private var depth
 
     func body(content: Content) -> some View {
+        let myDepth = depth + 1
+        return content
+            .background(
+                Color.clear.sheet(item: binding(at: myDepth, fullScreen: false), onDismiss: router.sheetDidFinishDismissing) { nested in
+                    NestedSheetRootView(sheet: nested)
+                        .environment(\.nestedSheetDepth, myDepth)
+                }
+            )
+            .background(
+                Color.clear.fullScreenCover(item: binding(at: myDepth, fullScreen: true), onDismiss: router.sheetDidFinishDismissing) { nested in
+                    NestedSheetRootView(sheet: nested)
+                        .environment(\.nestedSheetDepth, myDepth)
+                }
+            )
+    }
+
+    /// The presentation at `depth`, when it is the kind this host shows.
+    private func binding(at depth: Int, fullScreen: Bool) -> Binding<AppRouter.SheetPresentation?> {
         // SwiftUI also calls the setter with nil after a programmatic dismiss
         // completes; without the in-bounds guard that re-entry would pop the
         // parent sheet too.
-        let myDepth = depth + 1
-        let binding = Binding<AppRouter.SheetPresentation?>(
+        Binding(
             get: {
-                guard router.presentedSheets.indices.contains(myDepth) else { return nil }
-                return router.presentedSheets[myDepth]
+                guard router.presentedSheets.indices.contains(depth) else { return nil }
+                let sheet = router.presentedSheets[depth]
+                return sheet.coversFullScreen == fullScreen ? sheet : nil
             },
             set: { newValue in
                 guard newValue == nil else { return }
-                guard router.presentedSheets.indices.contains(myDepth) else { return }
+                guard router.presentedSheets.indices.contains(depth) else { return }
                 router.dismissSheet()
             }
         )
-        return content.background(
-            Color.clear.sheet(item: binding, onDismiss: router.sheetDidFinishDismissing) { nested in
-                NestedSheetRootView(sheet: nested)
-                    .environment(\.nestedSheetDepth, myDepth)
-            }
-        )
     }
 }
 

Flipcash/Core/Navigation/AppRouter+SheetPresentation.swift

@@ -31,6 +31,17 @@ extension AppRouter {
 
         var id: Self { self }
 
+        /// Whether this presentation covers the screen and closes only from its close button, as the
+        /// share screen does.
+        var coversFullScreen: Bool {
+            switch self {
+            case .sendAmount(.privateGroup):
+                true
+            case .give, .buy, .addMoney, .downloadApp, .sendAmount, .tips, .switchAccount:
+                false
+            }
+        }
+
         /// The stack hosted inside this sheet. Inverse of `Stack.sheet`.
         /// Used by `dismissSheet` to clear the dismissed stack's path so a
         /// re-presentation starts at root rather than restoring the stale leaf.

Flipcash/Core/Navigation/RootSheetHost.swift

@@ -83,6 +83,18 @@ struct RootSheetHostModifier: ViewModifier {
         session.transactionNotificationPrompt.pending && !router.isSheetDismissing
     }
 
+    /// The root sheet when it presents the way `fullScreen` asks for, else nil; writing nil dismisses it.
+    private func presentedRootSheet(fullScreen: Bool) -> Binding<AppRouter.SheetPresentation?> {
+        Binding(
+            get: { router.rootSheet.flatMap { $0.coversFullScreen == fullScreen ? $0 : nil } },
+            set: { newValue in
+                if newValue == nil {
+                    router.dismissSheet()
+                }
+            }
+        )
+    }
+
     func body(content: Content) -> some View {
         content
             // Resume a tip held for profile creation the moment the profile
@@ -108,14 +120,11 @@ struct RootSheetHostModifier: ViewModifier {
             // write through here. Bound to `rootSheet` (bottom of the sheet
             // stack) — nested sheets mount inside this root sheet's content
             // via `.appRouterNestedSheet`.
-            .sheet(item: Binding(
-                get: { router.rootSheet },
-                set: { newValue in
-                    if newValue == nil {
-                        router.dismissSheet()
-                    }
-                }
-            ), onDismiss: router.sheetDidFinishDismissing) { sheet in
+            .sheet(item: presentedRootSheet(fullScreen: false), onDismiss: router.sheetDidFinishDismissing) { sheet in
+                RoutedSheet(sheet: sheet)
+                    .appRouterNestedSheet()
+            }
+            .fullScreenCover(item: presentedRootSheet(fullScreen: true), onDismiss: router.sheetDidFinishDismissing) { sheet in
                 RoutedSheet(sheet: sheet)
                     .appRouterNestedSheet()
             }

Flipcash/Core/Screens/Conversation/ChatItem+Conversation.swift

@@ -108,6 +108,9 @@ extension ChatItem {
         /// defaults to no card. Takes the detected links rather than the text so the detector runs
         /// once per message, here.
         linkCard: ([DetectedLink]) -> LinkCard? = { _ in nil },
+        /// How a payment-request widget draws; resolved by the caller from the request store so
+        /// the mapper stays pure. Defaults to the loading card.
+        paymentRequest: (ConversationMessage) -> PaymentRequestCardState = { _ in .loading },
         /// Where the viewer's unread messages began at open; the divider heads the first message
         /// after it that someone else sent.
         unreadBoundary: UnreadBoundary = .none,
@@ -310,6 +313,12 @@ extension ChatItem {
                 )
             case .widget(.shareProfile(let share)):
                 content = .shareProfile(LinkCard.User(profileOf: share.username))
+            case .widget(.paymentRequest(let id)):
+                switch paymentRequest(message) {
+                case .loading:          content = .paymentRequest(ChatPaymentRequestContent(requestID: id.data, card: nil))
+                case .card(let card):   content = .paymentRequest(ChatPaymentRequestContent(requestID: id.data, card: card))
+                case .unsupported:      content = .unavailable(.updateApp)
+                }
             case .widget(.unrecognized):
                 // A widget variant this build doesn't draw; a newer one will.
                 content = .unavailable(.updateApp)
@@ -504,6 +513,14 @@ extension ChatItem {
                 kind: .text,
                 authorID: original.senderID
             )
+        case .widget(.paymentRequest):
+            return ChatQuote(
+                stableID: original.stableID,
+                authorName: authorName,
+                snippet: ChatQuote.paymentRequestSnippet,
+                kind: .text,
+                authorID: original.senderID
+            )
         case .widget(.unrecognized):
             return ChatQuote(
                 stableID: nil,