fix: make Drive sync recovery cross-platform

Author: joanroig

docs/guides/google-drive-sync.md

@@ -33,6 +33,20 @@ for recovery.
     Keep an exported backup file somewhere safe. A Drive copy cannot be
     decrypted without its passphrase.
 
+## If you forget the passphrase
+
+There is no recovery key or encryption backdoor. If the Drive file is your
+only remaining copy, it cannot be decrypted without the old passphrase.
+
+If Admincraft still has the server profiles on this device, open
+**Settings → Data & Sync → Forgot passphrase?** and choose **Replace Drive
+copy**. Confirm a new passphrase and Admincraft will encrypt the local profiles
+again, overwrite the inaccessible Drive file, and resume sync. This does not
+recover anything that existed only in the old Drive file.
+
+Choose **Disconnect Drive** instead if you want to stop sync without replacing
+the remote file. The profiles on this device are kept.
+
 ## Web app notes
 
 Drive sync works in the web app, but sign-in is tied to the exact site origin.
@@ -42,6 +56,18 @@ and third-party sign-in are allowed for the Admincraft site.
 Profiles in the browser still depend on site storage. Drive sync or an
 encrypted backup protects them if browser data is cleared.
 
+### Profiles created with a self-signed certificate
+
+Drive preserves a certificate configured on Android or desktop, but a browser
+cannot use that certificate for pinning. When such a profile is downloaded,
+Admincraft keeps it unchanged for native devices, stops the browser from
+attempting an incompatible connection, and explains the required change.
+
+Use **Public address, trusted certificate** with a hostname and certificate the
+browser already trusts. If the browser reaches the same Minecraft server
+through a different address, keep the self-signed profile for native apps and
+add a second browser-compatible server profile. Admincraft will sync both.
+
 ## Troubleshooting
 
 | What Admincraft shows | What to do |
@@ -52,6 +78,7 @@ encrypted backup protects them if browser data is cleared.
 | **No Admincraft configuration exists** | Choose **Upload this device** on the device that has the profiles first. |
 | **Sign-in was cancelled** | Try again and finish the Google account prompt. |
 | **Could not decrypt** | Check that the passphrase exactly matches the one used for the Drive copy. |
+| **Passphrase forgotten** | Use **Forgot passphrase?** to replace Drive from a device that still has the profiles, or disconnect while keeping its local profiles. A Drive-only copy cannot be recovered. |
 
 If you maintain the build, the
 [developer OAuth setup](../development/google-drive-oauth.md) explains origins,

docs/guides/web-app.md

@@ -28,7 +28,17 @@ The private tailnet address still works in the Windows and Android builds, which
 
 ## Self-signed certificates
 
-Web pages cannot install or pin a certificate for a WebSocket connection. The **Self-signed certificate** option is therefore hidden in the web app.
+Web pages cannot install or pin a certificate for a WebSocket connection. The
+**Self-signed certificate** option is therefore not offered for new web
+profiles. A synced native profile still shows its real mode, disabled, so the
+web app does not silently reinterpret it as a public certificate.
+
+If Drive sync brings in a profile that was configured with a self-signed
+certificate on Android or desktop, Admincraft preserves it but does not try to
+connect with it in the browser. Switch that profile to **Public certificate**
+only when the same hostname presents a certificate the browser already trusts.
+If the browser needs another hostname or port, add a separate browser profile
+and keep the native self-signed profile unchanged.
 
 If the browser or operating system already trusts the endpoint certificate, use **Public certificate**. Otherwise use the Windows or Android build, or place the WebSocket behind a publicly trusted TLS endpoint.
 

lib/controllers/connection_controller.dart

@@ -3,6 +3,7 @@ import 'dart:async';
 import 'package:admincraft/models/connection_status.dart';
 import 'package:admincraft/models/model.dart';
 import 'package:admincraft/services/connection_failure.dart';
+import 'package:admincraft/services/connection_platform_capabilities.dart';
 import 'package:admincraft/services/connection_service.dart';
 import 'package:admincraft/services/retry_policy.dart';
 import 'package:admincraft/utils/toast_utils.dart';
@@ -18,6 +19,7 @@ class ConnectionController with ChangeNotifier, WidgetsBindingObserver {
   static const int maxRetries = 3;
 
   final ConnectionService connectionService;
+  final ConnectionPlatformCapabilities capabilities;
   ConnectionStatus get status => connectionService.status;
 
   int _retries = 0;
@@ -32,8 +34,10 @@ class ConnectionController with ChangeNotifier, WidgetsBindingObserver {
   /// only flashing a toast that may be missed.
   ConnectionFailure? lastFailure;
 
-  ConnectionController({ConnectionService? connectionService})
-    : connectionService = connectionService ?? ConnectionService() {
+  ConnectionController({
+    ConnectionService? connectionService,
+    this.capabilities = currentConnectionPlatformCapabilities,
+  }) : connectionService = connectionService ?? ConnectionService() {
     this.connectionService.onConnectionLost = _handleConnectionLost;
     WidgetsBinding.instance.addObserver(this);
   }
@@ -54,6 +58,14 @@ class ConnectionController with ChangeNotifier, WidgetsBindingObserver {
       return;
     }
 
+    final platformFailure = compatibilityFailure(model);
+    if (platformFailure != null) {
+      _keepConnected = false;
+      lastFailure = platformFailure;
+      notifyListeners();
+      return;
+    }
+
     if (status == ConnectionStatus.connected) {
       ToastUtils.showToastError('Already connected.');
       return;
@@ -84,6 +96,9 @@ class ConnectionController with ChangeNotifier, WidgetsBindingObserver {
     }
   }
 
+  ConnectionFailure? compatibilityFailure(Model model) =>
+      capabilities.failureFor(model.connectionSecurity, model.minecraftEdition);
+
   /// Reports the failure, and schedules another attempt when [decideRetry]
   /// says one is worth making.
   void _reportAndMaybeRetry(Model model, ConnectionFailure failure) {

lib/controllers/google_drive_sync_controller.dart

@@ -198,6 +198,16 @@ class GoogleDriveSyncController with ChangeNotifier {
     });
   }
 
+  /// Replaces an inaccessible Drive copy with the profiles on this device.
+  ///
+  /// Encryption intentionally has no recovery key. This is therefore a reset,
+  /// not a way to decrypt the previous copy: the caller must warn the user
+  /// before overwriting it.
+  Future<void> replaceDriveCopyWithNewPassphrase(
+    Model model,
+    String passphrase,
+  ) => enableWithUpload(model, passphrase);
+
   Future<void> enableWithDownload(Model model, String passphrase) async {
     await _run(() async {
       final api = await _api(interactive: true);

lib/services/connection_platform_capabilities.dart

@@ -0,0 +1,64 @@
+import 'package:admincraft/models/connection_security.dart';
+import 'package:admincraft/models/minecraft_edition.dart';
+import 'package:admincraft/services/connection_failure.dart';
+import 'package:admincraft/services/rcon_client.dart' as rcon;
+import 'package:admincraft/services/websocket_connector.dart' as websocket;
+
+/// Connection features the current platform can implement.
+///
+/// Profiles are synced unchanged between devices, but the transports are not
+/// interchangeable: browsers cannot pin a certificate or open a raw RCON
+/// socket. Keeping this decision outside the profile prevents a web download
+/// from silently rewriting a configuration that still works on Android.
+class ConnectionPlatformCapabilities {
+  final bool supportsCustomCertificates;
+  final bool supportsDirectRcon;
+
+  const ConnectionPlatformCapabilities({
+    required this.supportsCustomCertificates,
+    required this.supportsDirectRcon,
+  });
+
+  bool supports(ConnectionSecurity security, MinecraftEdition edition) {
+    if (security.requiresCertificate) return supportsCustomCertificates;
+    if (security.isDirectRcon) {
+      return supportsDirectRcon && edition == MinecraftEdition.java;
+    }
+    return true;
+  }
+
+  String? unsupportedMessage(
+    ConnectionSecurity security,
+    MinecraftEdition edition,
+  ) {
+    if (supports(security, edition)) return null;
+    if (security.requiresCertificate) {
+      return 'Web browsers cannot use the self-signed certificate stored in '
+          'this synced profile. Keep this profile for Android or desktop, or '
+          'switch to Public certificate with a hostname the browser trusts. '
+          'If the browser uses a different address, add a separate server '
+          'profile for it.';
+    }
+    if (security.isDirectRcon) {
+      return 'Web browsers cannot open a Direct RCON connection. Keep this '
+          'profile for a native app, or add a browser profile that connects '
+          'through the Admincraft WebSocket bridge.';
+    }
+    return 'This connection type is not available on this platform.';
+  }
+
+  ConnectionFailure? failureFor(
+    ConnectionSecurity security,
+    MinecraftEdition edition,
+  ) {
+    final message = unsupportedMessage(security, edition);
+    return message == null
+        ? null
+        : ConnectionFailure(ConnectionFailureKind.unsupported, message);
+  }
+}
+
+const currentConnectionPlatformCapabilities = ConnectionPlatformCapabilities(
+  supportsCustomCertificates: websocket.supportsCustomCertificate,
+  supportsDirectRcon: rcon.supportsDirectRcon,
+);

lib/views/data_sync_view.dart

@@ -13,6 +13,8 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:provider/provider.dart';
 
+enum _PassphraseRecoveryAction { replaceDriveCopy, disconnect }
+
 class DataSyncView extends StatefulWidget {
   final Future<void> Function() onServersChanged;
 
@@ -111,7 +113,8 @@ class _DataSyncViewState extends State<DataSyncView> {
       final servers = await ConfigTransfer.import(blob, passphrase);
       if (servers.isEmpty) {
         throw const ConfigTransferException(
-            'This backup does not contain any servers.');
+          'This backup does not contain any servers.',
+        );
       }
       if (!mounted) return;
       final confirmed = await DialogUtils.confirmAction(
@@ -182,6 +185,66 @@ class _DataSyncViewState extends State<DataSyncView> {
     );
   }
 
+  Future<void> _recoverDrivePassphrase() async {
+    final action = await showDialog<_PassphraseRecoveryAction>(
+      context: context,
+      builder: (dialogContext) => AlertDialog(
+        icon: const Icon(Icons.key_off_outlined),
+        title: const Text('Forgot the sync passphrase?'),
+        content: const Text(
+          'The existing encrypted Drive copy cannot be decrypted without its '
+          'old passphrase.\n\nIf this device still has the server profiles you '
+          'want, you can replace the Drive copy and protect it with a new '
+          'passphrase. Otherwise, disconnect Drive and keep the profiles on '
+          'this device.\n\nIf Drive is your only remaining copy, it cannot be '
+          'recovered.',
+        ),
+        actions: [
+          TextButton(
+            onPressed: () => Navigator.pop(dialogContext),
+            child: const Text('Cancel'),
+          ),
+          TextButton(
+            onPressed: () => Navigator.pop(
+              dialogContext,
+              _PassphraseRecoveryAction.disconnect,
+            ),
+            child: const Text('Disconnect Drive'),
+          ),
+          FilledButton(
+            onPressed: () => Navigator.pop(
+              dialogContext,
+              _PassphraseRecoveryAction.replaceDriveCopy,
+            ),
+            child: const Text('Replace Drive copy'),
+          ),
+        ],
+      ),
+    );
+    if (action == null || !mounted) return;
+
+    if (action == _PassphraseRecoveryAction.disconnect) {
+      await _drive.disconnect();
+      ToastUtils.showToastSuccess(
+        'Google Drive disconnected. Local server profiles were kept.',
+      );
+      return;
+    }
+
+    final passphrase = await DialogUtils.promptForPassphrase(
+      context,
+      title: 'Set a new sync passphrase',
+      message:
+          'The profiles currently on this device will replace the inaccessible Drive copy.',
+      confirm: true,
+    );
+    if (passphrase == null || !mounted) return;
+    await _driveAction(
+      () => _drive.replaceDriveCopyWithNewPassphrase(_model, passphrase),
+      'Google Drive was replaced and protected with the new passphrase.',
+    );
+  }
+
   Future<void> _driveAction(
     Future<void> Function() action,
     String success,
@@ -241,10 +304,10 @@ class _DataSyncViewState extends State<DataSyncView> {
     final subtitle = !drive.configured
         ? 'This build has no Google OAuth client IDs. Add them at build time to enable Drive.'
         : !drive.signedIn
-            ? 'Sign in to keep the same encrypted server profiles on every device.'
-            : drive.automaticSyncEnabled
-                ? '${account == null ? 'Connected to Google Drive' : 'Connected as $account'} · ${_lastSyncLabel(drive.lastSyncAt)}'
-                : '${account ?? 'Google account connected'} · Choose which copy to use first.';
+        ? 'Sign in to keep the same encrypted server profiles on every device.'
+        : drive.automaticSyncEnabled
+        ? '${account == null ? 'Connected to Google Drive' : 'Connected as $account'} · ${_lastSyncLabel(drive.lastSyncAt)}'
+        : '${account ?? 'Google account connected'} · Choose which copy to use first.';
 
     final actions = <Widget>[];
     if (drive.configured && !drive.signedIn) {
@@ -271,6 +334,11 @@ class _DataSyncViewState extends State<DataSyncView> {
           icon: const Icon(Icons.cloud_download_outlined),
           label: const Text('Use Drive copy'),
         ),
+        TextButton.icon(
+          onPressed: drive.busy ? null : _recoverDrivePassphrase,
+          icon: const Icon(Icons.key_off_outlined),
+          label: const Text('Forgot passphrase?'),
+        ),
         TextButton(
           onPressed: drive.busy ? null : drive.disconnect,
           child: const Text('Sign out'),
@@ -282,9 +350,9 @@ class _DataSyncViewState extends State<DataSyncView> {
           onPressed: drive.busy
               ? null
               : () => _driveAction(
-                    () => drive.syncNow(_model),
-                    'Google Drive is up to date.',
-                  ),
+                  () => drive.syncNow(_model),
+                  'Google Drive is up to date.',
+                ),
           icon: const Icon(Icons.sync),
           label: const Text('Sync now'),
         ),
@@ -298,6 +366,11 @@ class _DataSyncViewState extends State<DataSyncView> {
           icon: const Icon(Icons.cloud_download_outlined),
           label: const Text('Download'),
         ),
+        TextButton.icon(
+          onPressed: drive.busy ? null : _recoverDrivePassphrase,
+          icon: const Icon(Icons.key_off_outlined),
+          label: const Text('Forgot passphrase?'),
+        ),
         TextButton(
           onPressed: drive.busy ? null : drive.disconnect,
           child: const Text('Disconnect'),
@@ -316,8 +389,8 @@ class _DataSyncViewState extends State<DataSyncView> {
                 final status = !drive.configured
                     ? const Chip(label: Text('Setup required'))
                     : drive.automaticSyncEnabled
-                        ? const Chip(label: Text('Automatic'))
-                        : null;
+                    ? const Chip(label: Text('Automatic'))
+                    : null;
                 final icon = Icon(
                   Icons.cloud_sync_outlined,
                   size: 30,
@@ -408,8 +481,10 @@ class _DataSyncViewState extends State<DataSyncView> {
                     child: Column(
                       crossAxisAlignment: CrossAxisAlignment.start,
                       children: [
-                        Text('Data & Sync',
-                            style: Theme.of(context).textTheme.headlineMedium),
+                        Text(
+                          'Data & Sync',
+                          style: Theme.of(context).textTheme.headlineMedium,
+                        ),
                         const SizedBox(height: 4),
                         Text(
                           'Move or protect every saved server profile.',
@@ -440,8 +515,9 @@ class _DataSyncViewState extends State<DataSyncView> {
                           'Copy an encrypted configuration and paste it on another device.',
                       actions: [
                         FilledButton.icon(
-                          onPressed:
-                              busy ? null : () => _export(toClipboard: true),
+                          onPressed: busy
+                              ? null
+                              : () => _export(toClipboard: true),
                           icon: const Icon(Icons.copy),
                           label: const Text('Copy config'),
                         ),
@@ -459,8 +535,9 @@ class _DataSyncViewState extends State<DataSyncView> {
                           'Keep a portable encrypted backup for offline transfer or recovery.',
                       actions: [
                         FilledButton.icon(
-                          onPressed:
-                              busy ? null : () => _export(toClipboard: false),
+                          onPressed: busy
+                              ? null
+                              : () => _export(toClipboard: false),
                           icon: const Icon(Icons.save_alt),
                           label: const Text('Export file'),
                         ),
@@ -501,7 +578,7 @@ class _DataSyncViewState extends State<DataSyncView> {
                   leading: Icon(Icons.lock_outline),
                   title: Text('Your passphrase is never stored in the backup'),
                   subtitle: Text(
-                    'Anyone importing it must know the passphrase you chose during export.',
+                    'There is no recovery key. Keep the passphrase or an accessible copy of your server profiles.',
                   ),
                 ),
               ),