mirror of
https://github.com/kuhyx/screen-locker.git
synced 2026-11-10 20:27:13 +01:00
Krzysztof kuhy Rudnicki
79879263ba
The workout log stored ONE workout per calendar day, so a second same-day
workout was silently dropped and could never earn credit.
Multiple workouts per day:
- workout_log.json: {date: entry} -> {date: [entry, ...]}. Legacy entries are
wrapped on read (_log_io.load_workout_log) so their HMACs stay valid — no
re-signing; every write normalizes the file, migrating it progressively.
- New write chokepoint (_log_mixin.write_signed_entry) APPENDS and dedups by a
stable workout_id, returning RecordResult so callers can tell a new workout
from a duplicate. Re-verifying the same workout is a no-op.
- count_weekly_workouts is anti-gaming: each VERIFIED workout counts
individually; self-reported manual entries count at most once per day. Four
real workouts in one day satisfy the week; four manual entries count as one.
- Reward: the day's first counted workout gets the base +2h; an additional
same-day VERIFIED workout gets +1h; an additional manual gets nothing. The
old "+1h when weekly_count > 4" gate is replaced — weekly volume is the
banked bonus's job and shouldn't be paid twice.
- Fixed: the unlock screen labelled the +1h "#{weekly_count - 4}", which can
render negative under the new rule. Removed the dead runnerup_manual type.
- Flutter: the manual budget counts distinct DAYS, matching the PC.
PC->phone sync (it had never worked once):
- push_pc_manuals pushed from a side-store written at log-time, so anything
logged before that feature existed could never publish. _manual_push now
derives the crdt log directly from workout_log.json — the single source of
truth — covering manual AND verified runs. The record id is the workout's own
workout_id (derived for legacy entries to match the phone's format) and the
HLC comes from the entry's own timestamp, so a re-push is byte-identical and
the repo never churns.
- The phone reads every kind (readMergedWorkoutPayloads) and lists the PC's
workouts under "SYNCED FROM PC". The manual budget still sees manual-only, so
a verified run can't consume a self-report slot.
- Settings claimed "Connected." whenever a token STRING existed. It now
verifies against the API on open, so a revoked token reports 401 instead of
showing a green lie.
Never fail silently:
- 30 swallowed exceptions across 19 files now log WARNING with the concrete
cause AND consequence — plus the token guards in _workout_sync that returned
[] in total silence, the exact bug that hid the dead sync for weeks.
- New pre-commit hook (scripts/check_silent_failures.py) fails any except that
neither re-raises nor logs loudly. ruff's S110 only catches `except: pass`;
the real pattern here was `except: log.info(); return []`. Documented in
CLAUDE.md.
Verified on real data: the Jul 13 run (pulled from its actual TCX over ADB) now
counts alongside that day's manual squash, and all three workouts are published
to kuhyx/syncs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fv8ULVt3Q67GwCFbM7doHB
85 lines
2.7 KiB
Python
85 lines
2.7 KiB
Python
"""System clock skew detection via NTP."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import socket
|
|
import struct
|
|
import time
|
|
|
|
from screen_locker._constants import MAX_CLOCK_SKEW_SECONDS
|
|
|
|
_logger = logging.getLogger(__name__)
|
|
|
|
_NTP_EPOCH_OFFSET = 2208988800 # Seconds between 1900-01-01 and 1970-01-01
|
|
_NTP_PORT = 123
|
|
_NTP_TIMEOUT = 5
|
|
_NTP_MIN_PACKET_SIZE = 48
|
|
|
|
|
|
def _query_ntp_offset(server: str = "pool.ntp.org") -> float | None:
|
|
"""Query an NTP server and return the clock offset in seconds.
|
|
|
|
Uses a minimal SNTP (RFC 4330) client-mode request.
|
|
|
|
Returns:
|
|
Offset in seconds (positive = local clock is ahead), or None on error.
|
|
"""
|
|
# NTP v3, mode 3 (client), transmit timestamp at bytes 40-47
|
|
packet = b"\x1b" + b"\0" * 47
|
|
try:
|
|
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
|
|
sock.settimeout(_NTP_TIMEOUT)
|
|
t1 = time.time()
|
|
sock.sendto(packet, (server, _NTP_PORT))
|
|
data, _ = sock.recvfrom(1024)
|
|
t4 = time.time()
|
|
except OSError as exc:
|
|
_logger.warning(
|
|
"NTP query to %s failed: %s — the local clock CANNOT be checked for "
|
|
"tampering, so the skew check is skipped",
|
|
server,
|
|
exc,
|
|
)
|
|
return None
|
|
|
|
if len(data) < _NTP_MIN_PACKET_SIZE:
|
|
return None
|
|
|
|
# Transmit timestamp from server (bytes 40-47)
|
|
tx_seconds = struct.unpack("!I", data[40:44])[0] - _NTP_EPOCH_OFFSET
|
|
tx_fraction = struct.unpack("!I", data[44:48])[0] / (2**32)
|
|
server_time = tx_seconds + tx_fraction
|
|
|
|
# Simplified offset: server_time should be close to (t1 + t4) / 2
|
|
local_mid = (t1 + t4) / 2
|
|
return server_time - local_mid
|
|
|
|
|
|
def check_clock_skew() -> tuple[bool, str]:
|
|
"""Check if system clock is within acceptable skew of NTP time.
|
|
|
|
Returns:
|
|
Tuple of (ok, message).
|
|
ok is True if clock is within MAX_CLOCK_SKEW_SECONDS or NTP is unreachable.
|
|
When NTP is unreachable, we allow through (fail-open for network issues).
|
|
"""
|
|
offset = _query_ntp_offset()
|
|
if offset is None:
|
|
_logger.info("NTP unreachable — allowing through")
|
|
return True, "NTP check skipped (server unreachable)"
|
|
|
|
abs_offset = abs(offset)
|
|
if abs_offset > MAX_CLOCK_SKEW_SECONDS:
|
|
direction = "ahead" if offset < 0 else "behind"
|
|
_logger.warning(
|
|
"Clock skew detected: %.0f seconds %s",
|
|
abs_offset,
|
|
direction,
|
|
)
|
|
return False, (
|
|
f"System clock is {abs_offset:.0f}s {direction} of NTP time. "
|
|
f"Max allowed skew: {MAX_CLOCK_SKEW_SECONDS}s."
|
|
)
|
|
return True, f"Clock OK (offset: {offset:+.1f}s)"
|