[Feature] Online storage as an extension: off by default, so the interface starts quiet

brenno commented

2026-07-22 16:13:43 +00:00

Owner

OciDeck has grown into a tool that shows a first-time user a great deal at once. The Uitbreidingen tab already answers that for one cluster: the Informatieveiligheid module is off by default and its features simply are not there until you switch it on. This issue proposes a second module on the same pattern — Online opslag — covering the WebDAV, S3 and Git connection kinds.

Two reasons, and the second one matters more.

The first is quiet. Today "Verbinding toevoegen" offers WebDAV, S3 and Git beside the local folder before the user has made a single slide (lib/widgets/dialogs/parts/settings_dialog_storage.dart:435). Behind those three kinds sit roughly 2,300 lines of settings and provider code, four browser dialogs, a certificate-trust dialog, a proxy-fallback dialog, and — for git — a whole review/merge/tag vocabulary that means nothing to someone writing a talk.

The second is honesty about maturity. docs/design/VERIFICATION.md is the list of what has never met a real server, and five of its ten points are remote storage: GitHub and GitLab against the real service (1), the live Basic-auth handshake per forge (3), the storage path against a real Forgejo (4), a genuine concurrent edit (5), and several libraries and storage kinds side by side (8). These are good features to have. They are not features to have on by default, because a path that has only ever seen its own tests should be chosen deliberately rather than stumbled into. A module card is the honest place to say that out loud — the description can name the maturity instead of hiding it.

Precedent to copy, not to reuse. lib/state/info_safety_provider.dart is explicit that it is not a module framework: the prefs key and the reveal check are hardcoded to that one module, and "a second module needs a real registry (module id, parameterised keys, per-module reveal)". This issue is that second module, so the registry comes first. One constraint carries over unchanged: secModuleEnabled keeps its legacy name on disk. Renaming it would silently switch the security module off for everyone who had it on — a behaviour change disguised as tidying, and one nobody reports because it looks like the module was simply never enabled.

What moves behind the toggle

The WebDAV, S3 and Git entries in "Verbinding toevoegen", and their forms — settings_dialog_webdav*.dart, settings_dialog_s3*.dart, settings_dialog_git*.dart.
"Openen uit…" and "Opslaan naar…" in the menu and on the welcome screen. Both are already conditional on having a remote connection (app_shell_menu.dart:114, welcome_screen.dart:154), so with no remote connections possible they fall away on their own.
The entire git block: sync, deck-wide search, repository images, history, versions, release for review, merge draft, tag a version (app_shell_menu.dart:34).
The browser and trust dialogs: s3_browser_dialog, webdav_browser_dialog, git_browser_dialog, git_search_dialog, certificate_trust_dialog, proxy_fallback_dialog.

What stays

Local folders, open and save, export, package import and export, URL import. Someone with a laptop and no server loses nothing at all.

Three rules the module must keep

Omit, do not grey out. Same line as the security module: an item that always ends in the same snackbar is noise, not a menu item.
Reveal when the content is already there. A deck opened from git, WebDAV or S3 must keep showing its origin even with the module off — the same trick the MIAUW fields use (presentation_info_dialog.dart:411). A deck must never silently degrade to "a local file" because a toggle was flipped.
Never strand unsent work. The git outbox holds saves that exist only on this machine (status_bar.dart:360). Its status item, and the route to flush the queue, must survive the module going off. Otherwise switching off a setting quietly abandons work that the user believes is safe.

What it costs

The registry, one card in Uitbreidingen, the reveal gates listed above, l10n in 30 languages for every new string, and the documentation gates this repository already enforces — docs/USER_GUIDE.md, docs/SOURCE_MAP.md, and the docs-reader registration where relevant.

Settled: all three kinds, S3 included. S3 is not among the paths named as under-tested, so it rides along on the first argument rather than the second — but hiding WebDAV and Git while leaving S3 in place would keep the tab cluttered and split the concept in two. The module is online opslag, so it is every remote kind, and the card's description should lean on the quiet argument for S3 and on the maturity argument for WebDAV and Git.

Judgement call to make first

What happens to someone who already has a remote connection configured? The module has to start on for them — a one-time migration that reads the existing connection list — or an upgrade hides a setup that was working yesterday. Default-off applies to new installs, not to a working configuration.

Related: #648. The existing Informatieveiligheid module leaks three surfaces that stay visible with the module off. Worth fixing whether or not this issue is built, and worth doing first: it is cheap, it needs no registry, and the per-section reveal predicate it introduces is the same one this module needs to hide storage settings.

OciDeck has grown into a tool that shows a first-time user a great deal at once. The `Uitbreidingen` tab already answers that for one cluster: the Informatieveiligheid module is off by default and its features simply are not there until you switch it on. This issue proposes a second module on the same pattern — **Online opslag** — covering the WebDAV, S3 and Git connection kinds. **Two reasons, and the second one matters more.** The first is quiet. Today "Verbinding toevoegen" offers WebDAV, S3 and Git beside the local folder before the user has made a single slide (`lib/widgets/dialogs/parts/settings_dialog_storage.dart:435`). Behind those three kinds sit roughly 2,300 lines of settings and provider code, four browser dialogs, a certificate-trust dialog, a proxy-fallback dialog, and — for git — a whole review/merge/tag vocabulary that means nothing to someone writing a talk. The second is honesty about maturity. `docs/design/VERIFICATION.md` is the list of what has never met a real server, and five of its ten points are remote storage: GitHub and GitLab against the real service (1), the live Basic-auth handshake per forge (3), the storage path against a real Forgejo (4), a genuine concurrent edit (5), and several libraries and storage kinds side by side (8). These are good features to have. They are not features to have *on by default*, because a path that has only ever seen its own tests should be chosen deliberately rather than stumbled into. A module card is the honest place to say that out loud — the description can name the maturity instead of hiding it. **Precedent to copy, not to reuse.** `lib/state/info_safety_provider.dart` is explicit that it is not a module framework: the prefs key and the reveal check are hardcoded to that one module, and "a second module needs a real registry (module id, parameterised keys, per-module reveal)". This issue is that second module, so the registry comes first. One constraint carries over unchanged: `secModuleEnabled` keeps its legacy name on disk. Renaming it would silently switch the security module off for everyone who had it on — a behaviour change disguised as tidying, and one nobody reports because it looks like the module was simply never enabled. **What moves behind the toggle** - The WebDAV, S3 and Git entries in "Verbinding toevoegen", and their forms — `settings_dialog_webdav*.dart`, `settings_dialog_s3*.dart`, `settings_dialog_git*.dart`. - "Openen uit…" and "Opslaan naar…" in the menu and on the welcome screen. Both are already conditional on having a remote connection (`app_shell_menu.dart:114`, `welcome_screen.dart:154`), so with no remote connections possible they fall away on their own. - The entire git block: sync, deck-wide search, repository images, history, versions, release for review, merge draft, tag a version (`app_shell_menu.dart:34`). - The browser and trust dialogs: `s3_browser_dialog`, `webdav_browser_dialog`, `git_browser_dialog`, `git_search_dialog`, `certificate_trust_dialog`, `proxy_fallback_dialog`. **What stays** Local folders, open and save, export, package import and export, URL import. Someone with a laptop and no server loses nothing at all. **Three rules the module must keep** 1. **Omit, do not grey out.** Same line as the security module: an item that always ends in the same snackbar is noise, not a menu item. 2. **Reveal when the content is already there.** A deck opened from git, WebDAV or S3 must keep showing its origin even with the module off — the same trick the MIAUW fields use (`presentation_info_dialog.dart:411`). A deck must never silently degrade to "a local file" because a toggle was flipped. 3. **Never strand unsent work.** The git outbox holds saves that exist only on this machine (`status_bar.dart:360`). Its status item, and the route to flush the queue, must survive the module going off. Otherwise switching off a setting quietly abandons work that the user believes is safe. **What it costs** The registry, one card in Uitbreidingen, the reveal gates listed above, l10n in 30 languages for every new string, and the documentation gates this repository already enforces — `docs/USER_GUIDE.md`, `docs/SOURCE_MAP.md`, and the docs-reader registration where relevant. **Settled: all three kinds, S3 included.** S3 is not among the paths named as under-tested, so it rides along on the first argument rather than the second — but hiding WebDAV and Git while leaving S3 in place would keep the tab cluttered and split the concept in two. The module is *online opslag*, so it is every remote kind, and the card's description should lean on the quiet argument for S3 and on the maturity argument for WebDAV and Git. **Judgement call to make first** **What happens to someone who already has a remote connection configured?** The module has to start **on** for them — a one-time migration that reads the existing connection list — or an upgrade hides a setup that was working yesterday. Default-off applies to new installs, not to a working configuration. **Related: #648.** The existing Informatieveiligheid module leaks three surfaces that stay visible with the module off. Worth fixing whether or not this issue is built, and worth doing first: it is cheap, it needs no registry, and the per-section reveal predicate it introduces is the same one this module needs to hide storage settings.

brenno added the

enhancement

triage

labels

2026-07-22 16:13:43 +00:00

brenno referenced this issue

2026-07-22 16:36:10 +00:00

[Bug] The Informatieveiligheid module leaks: three surfaces stay visible with the module off #648

brenno added

accepted

and removed

triage

labels

2026-07-23 15:05:00 +00:00

brenno commented

2026-07-23 15:05:00 +00:00

Author

Owner

Gewogen: bouwen — het label staat op accepted. De stand is sinds het schrijven van dit issue verschoven, en gunstig:

#648 is gesloten: het per-sectie-reveal-predicaat dat dit issue 'worth doing first' noemde bestaat (SettingsSection.navItems met infoSafetyRevealed/hasChecklists), inclusief de tonen-zodra-er-inhoud-is-regel en de testdekking (module_surface_leak_test.dart).
#731 (in de maak) maakt AI-assistentie de tweede modulekaart, zónder register — bewust, omdat beide modules hun eigen bestaande state dragen; dat besluit staat genoteerd in de doc-kop van info_safety_provider.dart. Online opslag wordt de dérde module, en dan is het register geen uitstelbare vraag meer: drie hardgecodeerde reveal-paden is het punt waarop het patroon kopieerschuld wordt.

Bouwvolgorde die daaruit volgt: (a) het moduleregister (module-id, geparametriseerde sleutels, per-module reveal; secModuleEnabled behoudt zijn legacy-naam op schijf — hernoemen zet de module stil uit voor iedereen die hem aan had), met migratie van de twee bestaande kaarten; (b) de Online-opslag-module zelf met de drie regels uit het issue (weglaten i.p.v. grijs, tonen zodra inhoud er is, de outbox overleeft het uitzetten); (c) de eenmalige migratie: wie al een remote-verbinding heeft geconfigureerd start met de module áán.

De beslisvraag die het issue benoemt is daarmee beantwoord zoals het issue zelf al voorstelt. Kosten blijven fors (register + poorten over ~2.300 regels oppervlak + l10n + docs + tests), dus dit is een eigen ronde, na het lopende werk aan #541/#741.

Gewogen: **bouwen** — het label staat op accepted. De stand is sinds het schrijven van dit issue verschoven, en gunstig: 1. **#648 is gesloten**: het per-sectie-reveal-predicaat dat dit issue 'worth doing first' noemde bestaat (SettingsSection.navItems met infoSafetyRevealed/hasChecklists), inclusief de tonen-zodra-er-inhoud-is-regel en de testdekking (module_surface_leak_test.dart). 2. **#731 (in de maak) maakt AI-assistentie de tweede modulekaart**, zónder register — bewust, omdat beide modules hun eigen bestaande state dragen; dat besluit staat genoteerd in de doc-kop van info_safety_provider.dart. Online opslag wordt de dérde module, en dan is het register geen uitstelbare vraag meer: drie hardgecodeerde reveal-paden is het punt waarop het patroon kopieerschuld wordt. Bouwvolgorde die daaruit volgt: (a) het moduleregister (module-id, geparametriseerde sleutels, per-module reveal; secModuleEnabled behoudt zijn legacy-naam op schijf — hernoemen zet de module stil uit voor iedereen die hem aan had), met migratie van de twee bestaande kaarten; (b) de Online-opslag-module zelf met de drie regels uit het issue (weglaten i.p.v. grijs, tonen zodra inhoud er is, de outbox overleeft het uitzetten); (c) de eenmalige migratie: wie al een remote-verbinding heeft geconfigureerd start met de module áán. De beslisvraag die het issue benoemt is daarmee beantwoord zoals het issue zelf al voorstelt. Kosten blijven fors (register + poorten over ~2.300 regels oppervlak + l10n + docs + tests), dus dit is een eigen ronde, na het lopende werk aan #541/#741.

brenno added the

in-progress

label

2026-07-23 16:18:37 +00:00

brenno commented

2026-07-23 16:18:38 +00:00

Author

Owner

Opgepakt. Tak: feat/online-opslag-module-570. Volgorde zoals in de weging: (a) een registerlicht — één opsomming van de drie modules met elk hun eigen bestaande state (module-id + reveal per module; geen sleutelparametrisering, secModuleEnabled houdt zijn schijfnaam) — (b) de modulekaart Online opslag met de eerlijke rijpheidsomschrijving, (c) de poorten (verbindingssoorten, git-menublok; weglaten, niet grijs), (d) tonen-zodra-inhoud (bestaande remote-verbinding of geopend remote-deck), (e) de eenmalige migratie: wie al een remote-verbinding heeft start met de module aan, (f) de outbox overleeft uitzetten. Verwachte reikwijdte: state/ (nieuw registerlicht + settings), settings_dialog_modules/storage/sections, app_shell_menu, welcome_screen, status_bar, l10n, docs, tests.

brenno referenced this issue from a commit

2026-07-23 16:47:06 +00:00

feat(opslag): Online opslag als module op Uitbreidingen — standaard uit, register erbij (#570)

brenno referenced this issue from a pull request that will close it,

2026-07-23 16:47:28 +00:00

feat(opslag): Online opslag als module op Uitbreidingen — standaard uit (#570) #764

brenno closed this issue

2026-07-23 16:47:40 +00:00

brenno referenced this issue from a commit

2026-07-23 16:47:41 +00:00

Merge pull request 'feat(opslag): Online opslag als module op Uitbreidingen — standaard uit (#570)' (#764) from feat/online-opslag-module-570 into main

brenno commented

2026-07-23 16:51:21 +00:00

Author

Owner

Af, op main: 204cfcc (PR #764), en 'make check' is dáár groen gedraaid. De drie regels uit het issue staan er alle drie op test: weglaten-niet-grijs (de soortenlijst onder 'Verbinding toevoegen' is de énige poort — al het andere oppervlak kijkt naar bestáánde verbindingen en valt onder tonen-zodra-inhoud), bestaand én wachtend werk blijft bij uitzetten bereikbaar, en een werkende configuratie start áán — als afgeleide standaard in plaats van een migratieschrijf, omdat prefs en verbindingen asynchroon laden. Het register dat info_safety_provider beloofde is er, bewust licht: één opsomming met poorten per module, elke module houdt zijn eigen state; de kaartenlijst komt er letterlijk uit. De bewaker keurde de rijpheidsformulering tegen VERIFICATION.md en liet twee dingen herstellen vóór de merge: het kantelpunt van de afgeleide standaard is nu gedocumenteerd én getest, en op web is de kaart uitgeschakeld met de reden ernaast. Vier strings × 31 talen, elf nieuwe tests, docs bij. Dicht.

Af, op main: 204cfcc (PR #764), en 'make check' is dáár groen gedraaid. De drie regels uit het issue staan er alle drie op test: weglaten-niet-grijs (de soortenlijst onder 'Verbinding toevoegen' is de énige poort — al het andere oppervlak kijkt naar bestáánde verbindingen en valt onder tonen-zodra-inhoud), bestaand én wachtend werk blijft bij uitzetten bereikbaar, en een werkende configuratie start áán — als afgeleide standaard in plaats van een migratieschrijf, omdat prefs en verbindingen asynchroon laden. Het register dat info_safety_provider beloofde is er, bewust licht: één opsomming met poorten per module, elke module houdt zijn eigen state; de kaartenlijst komt er letterlijk uit. De bewaker keurde de rijpheidsformulering tegen VERIFICATION.md en liet twee dingen herstellen vóór de merge: het kantelpunt van de afgeleide standaard is nu gedocumenteerd én getest, en op web is de kaart uitgeschakeld met de reden ernaast. Vier strings × 31 talen, elf nieuwe tests, docs bij. Dicht.

Rows
Columns

[Feature] Online storage as an extension: off by default, so the interface starts quiet #570