fix compositor edge cases, process handing and other cool improvements

compositor/src/handlers/activation.rs

@@ -1,4 +1,9 @@
-use std::time::Duration;
+use std::collections::VecDeque;
+use std::time::{Duration, Instant};
+
+use smithay::input::Seat;
+use smithay::reexports::wayland_server::{Resource, backend::ClientId};
+use smithay::utils::Serial;
 
 use smithay::reexports::wayland_server::protocol::wl_surface::WlSurface;
 use smithay::utils::SERIAL_COUNTER;
@@ -9,6 +14,50 @@ use smithay::wayland::xdg_activation::{
 use crate::Ferese;
 
 const TOKEN_MAX_AGE: Duration = Duration::from_secs(10);
+const MAX_INTERACTIONS: usize = 64;
+
+pub(crate) struct InputHistory<C = ClientId> {
+    events: VecDeque<(Serial, C, Instant)>,
+}
+
+impl<C> Default for InputHistory<C> {
+    fn default() -> Self {
+        Self {
+            events: VecDeque::new(),
+        }
+    }
+}
+
+impl<C: PartialEq> InputHistory<C> {
+    fn record(&mut self, serial: Serial, client: C, time: Instant) {
+        while self.events.len() >= MAX_INTERACTIONS {
+            self.events.pop_front();
+        }
+
+        self.events.push_back((serial, client, time));
+    }
+
+    fn validate(&self, serial: Serial, client: &C, now: Instant) -> Option<Instant> {
+        self.events.iter().rev().find_map(|(event, owner, time)| {
+            (*event == serial && owner == client && now.saturating_duration_since(*time) <= TOKEN_MAX_AGE)
+                .then_some(*time)
+        })
+    }
+}
+
+struct ApprovedInteraction(Instant);
+
+impl Ferese {
+    pub(crate) fn record_activation_input(&mut self, serial: Serial, surface: Option<WlSurface>) {
+        if self.session_lock.active() || self.input_capture.active() {
+            return;
+        }
+
+        if let Some(client) = surface.and_then(|surface| surface.client()) {
+            self.activation_inputs.record(serial, client.id(), Instant::now());
+        }
+    }
+}
 
 impl XdgActivationHandler for Ferese {
     fn activation_state(&mut self) -> &mut XdgActivationState {
@@ -16,15 +65,46 @@ impl XdgActivationHandler for Ferese {
     }
 
     fn token_created(&mut self, _token: XdgActivationToken, data: XdgActivationTokenData) -> bool {
-        data.serial.is_some() && data.timestamp.elapsed() <= TOKEN_MAX_AGE
+        if self.session_lock.active() || self.input_capture.active() {
+            return false;
+        }
+
+        let Some((serial, seat)) = &data.serial else {
+            return false;
+        };
+        let Some(client) = &data.client_id else {
+            return false;
+        };
+        if Seat::<Self>::from_resource(seat).as_ref() != Some(&self.seat)
+            || seat.client().is_none_or(|owner| owner.id() != *client)
+            || data
+                .surface
+                .as_ref()
+                .is_some_and(|surface| surface.client().is_none_or(|owner| owner.id() != *client))
+        {
+            return false;
+        }
+
+        let Some(time) = self.activation_inputs.validate(*serial, client, Instant::now()) else {
+            return false;
+        };
+        data.user_data.insert_if_missing(|| ApprovedInteraction(time));
+        true
     }
 
     fn request_activation(&mut self, token: XdgActivationToken, data: XdgActivationTokenData, surface: WlSurface) {
+        self.xdg_activation_state.remove_token(&token);
         if self.session_lock.active() || self.input_capture.captures(1) {
             return;
         }
-        let valid = data.serial.is_some() && data.timestamp.elapsed() <= TOKEN_MAX_AGE;
-        self.xdg_activation_state.remove_token(&token);
+
+        // The recipient may be a different client: launcher-to-app token handoff.
+        // Retain the original interaction time rather than renewing it at commit.
+        let valid = data.timestamp.elapsed() <= TOKEN_MAX_AGE
+            && data
+                .user_data
+                .get::<ApprovedInteraction>()
+                .is_some_and(|proof| proof.0.elapsed() <= TOKEN_MAX_AGE);
         if !valid {
             tracing::debug!("ignored stale or non-interactive activation request");
             return;
@@ -60,3 +140,163 @@ impl XdgActivationHandler for Ferese {
         });
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn token_creation_validates_real_seat_owner_and_input_age() {
+        use smithay::reexports::calloop::EventLoop;
+        use smithay::reexports::wayland_server::protocol::wl_seat::WlSeat;
+        use std::io::{Read, Write};
+        use std::os::unix::net::UnixStream;
+        use std::sync::Arc;
+
+        if !crate::startup_tests::private_runtime(
+            "handlers::activation::tests::token_creation_validates_real_seat_owner_and_input_age",
+        ) {
+            return;
+        }
+
+        let mut events = EventLoop::try_new().unwrap();
+        let mut state = crate::startup_tests::state(&mut events);
+        let (server, mut wire) = UnixStream::pair().unwrap();
+        let launcher = state
+            .display_handle
+            .insert_client(server, Arc::new(crate::state::ClientState::default()))
+            .unwrap();
+        let send = |wire: &mut UnixStream, object: u32, opcode: u32, args: &[u32]| {
+            let bytes: Vec<_> = [object, ((args.len() as u32 + 2) * 4) << 16 | opcode]
+                .into_iter()
+                .chain(args.iter().copied())
+                .flat_map(u32::to_ne_bytes)
+                .collect();
+            wire.write_all(&bytes).unwrap();
+        };
+        send(&mut wire, 1, 1, &[2]); // wl_display.get_registry
+        events.dispatch(Duration::from_millis(1), &mut state).unwrap();
+        state.display_handle.flush_clients().unwrap();
+        wire.set_nonblocking(true).unwrap();
+        let mut globals = Vec::new();
+        let _ = wire.read_to_end(&mut globals);
+        wire.set_nonblocking(false).unwrap();
+        let mut offset = 0;
+        let mut seat_name = None;
+        while offset < globals.len() {
+            let header = u32::from_ne_bytes(globals[offset + 4..offset + 8].try_into().unwrap());
+            if u32::from_ne_bytes(globals[offset..offset + 4].try_into().unwrap()) == 2 && header & 0xffff == 0 {
+                let length = u32::from_ne_bytes(globals[offset + 12..offset + 16].try_into().unwrap()) as usize;
+                if &globals[offset + 16..offset + 16 + length] == b"wl_seat\0" {
+                    seat_name = Some(u32::from_ne_bytes(globals[offset + 8..offset + 12].try_into().unwrap()));
+                }
+            }
+
+            offset += (header >> 16) as usize;
+        }
+
+        let mut args = vec![seat_name.expect("seat global"), 8];
+        args.extend(
+            b"wl_seat\0"
+                .chunks_exact(4)
+                .map(|word| u32::from_ne_bytes(word.try_into().unwrap())),
+        );
+        args.extend([7, 3]);
+        send(&mut wire, 2, 0, &args);
+        events.dispatch(Duration::from_millis(1), &mut state).unwrap();
+        let seat: WlSeat = state
+            .seat
+            .client_seats(&launcher)
+            .into_iter()
+            .next()
+            .expect("bound seat");
+        let (token, _) = state.xdg_activation_state.create_external_token(None);
+        let token = token.clone();
+        let serial = SERIAL_COUNTER.next_serial();
+        let data = || XdgActivationTokenData {
+            client_id: Some(launcher.id()),
+            serial: Some((serial, seat.clone())),
+            ..Default::default()
+        };
+        assert!(
+            !state.token_created(token.clone(), data()),
+            "fabricated serial accepted"
+        );
+        state.activation_inputs.record(
+            serial,
+            launcher.id(),
+            Instant::now() - TOKEN_MAX_AGE - Duration::from_millis(1),
+        );
+        assert!(
+            !state.token_created(token.clone(), data()),
+            "fresh token renewed stale input"
+        );
+        state.activation_inputs.record(serial, launcher.id(), Instant::now());
+        let approved = data();
+        assert!(state.token_created(token.clone(), approved.clone()));
+        assert!(approved.user_data.get::<ApprovedInteraction>().is_some());
+
+        let (server, mut recipient_wire) = UnixStream::pair().unwrap();
+        let recipient = state
+            .display_handle
+            .insert_client(server, Arc::new(crate::state::ClientState::default()))
+            .unwrap();
+        let mut stolen = data();
+        stolen.client_id = Some(recipient.id());
+        assert!(
+            !state.token_created(token.clone(), stolen),
+            "other client claimed launcher's seat/input"
+        );
+        // The proof is attached to the token, not the recipient identity. This
+        // is what lets a validated launcher hand it to a different application.
+        assert_ne!(approved.client_id, Some(recipient.id()));
+        assert!(approved.user_data.get::<ApprovedInteraction>().unwrap().0.elapsed() < TOKEN_MAX_AGE);
+
+        // Exercise the production handler with a real recipient toplevel.
+        // Creating the window needs no GPU or client buffer.
+        use smithay::reexports::wayland_protocols::xdg::shell::server::xdg_wm_base::XdgWmBase;
+        use smithay::reexports::wayland_server::protocol::wl_compositor::WlCompositor;
+        use smithay::wayland::shell::xdg::XdgWmBaseUserData;
+        let compositor = recipient
+            .create_resource::<WlCompositor, (), Ferese>(&state.display_handle, 6, ())
+            .unwrap();
+        let shell = recipient
+            .create_resource::<XdgWmBase, XdgWmBaseUserData, Ferese>(&state.display_handle, 6, Default::default())
+            .unwrap();
+        send(&mut recipient_wire, compositor.id().protocol_id(), 0, &[2]);
+        send(&mut recipient_wire, shell.id().protocol_id(), 2, &[3, 2]);
+        send(&mut recipient_wire, 3, 1, &[4]);
+        events.dispatch(Duration::from_millis(1), &mut state).unwrap();
+        let target = state
+            .space
+            .elements()
+            .find_map(|window| {
+                let surface = window.toplevel()?.wl_surface();
+                surface
+                    .client()
+                    .is_some_and(|client| client.id() == recipient.id())
+                    .then(|| surface.clone())
+            })
+            .expect("recipient's toplevel");
+        state.request_activation(token, approved, target.clone());
+        assert_eq!(state.seat.get_keyboard().unwrap().current_focus(), Some(target));
+    }
+
+    #[test]
+    fn validates_owner_serial_and_original_interaction_age() {
+        let now = Instant::now();
+        let mut history = InputHistory::default();
+        let serial = Serial::from(12);
+        history.record(serial, "launcher", now);
+        assert_eq!(history.validate(serial, &"launcher", now), Some(now));
+        assert_eq!(history.validate(Serial::from(13), &"launcher", now), None);
+        assert_eq!(history.validate(serial, &"other-client", now), None);
+        assert_eq!(
+            history.validate(serial, &"launcher", now + TOKEN_MAX_AGE + Duration::from_millis(1)),
+            None
+        );
+        // An approved token retains the interaction time across client handoff.
+        let approved = ApprovedInteraction(history.validate(serial, &"launcher", now).unwrap());
+        assert_eq!(approved.0, now);
+    }
+}