avoid auto-accepting pair requests from friends already paired with

Unless the request is for repo uuid we already know. This way, if A1 pairs
with friend B1, and B1 pairs with device B2, then B1 can request A1 pair
with it and no confirmation is needed. (In future, may want to try to do
that automatically, to make a more robust network.)

2 files changed, 18 insertions, 6 deletions

diff --git a/Assistant/Threads/XMPPClient.hs b/Assistant/Threads/XMPPClient.hs
index 2f4f57d9a..086494a74 100644
--- a/Assistant/Threads/XMPPClient.hs
+++ b/Assistant/Threads/XMPPClient.hs
@@ -25,6 +25,7 @@ import Assistant.Alert
 import Assistant.Pairing
 import Assistant.XMPP.Git
 import Annex.UUID
+import Logs.UUID
 
 import Network.Protocol.XMPP
 import Control.Concurrent
@@ -282,19 +283,26 @@ pull us = do
 		unlessM (null . fst <$> manualPull branch [r]) $
 			pullone rs branch
 
+{- PairReq from another client using our JID is automatically
+ - accepted. This is so pairing devices all using the same XMPP
+ - account works without confirmations.
+ -
+ - Also, autoaccept PairReq from the same JID of any repo we've
+ - already paired with, as long as the UUID in the PairReq is
+ - one we know about.
+-}
 pairMsgReceived :: UrlRenderer -> PairStage -> UUID -> JID -> JID -> Assistant ()
 pairMsgReceived urlrenderer PairReq theiruuid selfjid theirjid
 	| baseJID selfjid == baseJID theirjid = autoaccept
 	| otherwise = do
 		knownjids <- catMaybes . map (parseJID . getXMPPClientID)
 			. filter isXMPPRemote . syncRemotes <$> getDaemonStatus
-		if any (== baseJID theirjid) knownjids
+		um <- liftAnnex uuidMap
+		if any (== baseJID theirjid) knownjids && M.member theiruuid um
 			then autoaccept
 			else showalert
 
   where
-	-- PairReq from another client using our JID, or the JID of
-	-- any repo we're already paired with is automatically accepted.
 	autoaccept = do
 		selfuuid <- liftAnnex getUUID
 		sendNetMessage $
@@ -309,9 +317,9 @@ pairMsgReceived urlrenderer PairReq theiruuid selfjid theirjid
 			(T.unpack $ buddyName theirjid)
 			button
 
+{- PairAck must come from one of the buddies we are pairing with;
+ - don't pair with just anyone. -}
 pairMsgReceived _ PairAck theiruuid _selfjid theirjid =
-	{- PairAck must come from one of the buddies we are pairing with;
-	 - don't pair with just anyone. -}
 	whenM (isBuddyPairing theirjid) $ do
 		changeBuddyPairing theirjid False
 		selfuuid <- liftAnnex getUUID
diff --git a/doc/bugs/xmpp_needs_one_account_per_distinct_repository.mdwn b/doc/bugs/xmpp_needs_one_account_per_distinct_repository.mdwn
index 7d065e4a9..c917cc3d2 100644
--- a/doc/bugs/xmpp_needs_one_account_per_distinct_repository.mdwn
+++ b/doc/bugs/xmpp_needs_one_account_per_distinct_repository.mdwn
@@ -71,7 +71,7 @@ Some possible fixes:
 2. Or, only auto-accept pair requests from friends we're already paired with
    when they come from a repository whose UUID we already know. This
    enhancment to fix #1 makes it easier to build more robust networks of
-   repositories.
+   repositories. **done**
 
 Hmm, I don't think those fixes are sufficient. Suppose they're in place.
 Then when Alice shares A2 with Bob, both his repositories will ask him to
@@ -101,3 +101,7 @@ So, we need another fix:
 
   Or there could be a warning about account reuse. Doesn't seem likely to
   be effective.
+
+-----
+
+> [[done]]. I've put in the fixes around pairing with friends. --[[Joey]]