@desklink/host 0.3.1 → 0.4.0

package/engine/src/session.rs

@@ -1,9 +1,9 @@
 //! One authorized desktop session: capture in, VP9 out, control channel in,
 //! desktop input out, and a bounded teardown.
 //!
-//! The engine trusts the consumer's local permission decision and enforces the
-//! resulting scope. It has no second identity system, no account and no notion
-//! of which application asked.
+//! The consumer's pairing is the authority for all available access. The engine
+//! has no second identity system, no account and no notion of which application
+//! asked.
 
 use crate::capture::{self, Capture};
 use crate::clipboard;
@@ -15,9 +15,7 @@ use crate::peer::{
     h264_profile_level_id, PathReport, PeerEvent, TransportOptions, VideoCodec, VideoPeer,
 };
 use crate::portal::{self, SelectedSource};
-use crate::protocol::{
-    ControlMessage, ControlReply, EncodedCodec, Permission, PointerPhase, SourceRequest,
-};
+use crate::protocol::{ControlMessage, ControlReply, EncodedCodec, PointerPhase, SourceRequest};
 use crate::x11::X11Desktop;
 use anyhow::{Context, Result};
 use std::sync::atomic::{AtomicBool, Ordering};
@@ -192,6 +190,98 @@ impl Drop for X11Capture {
     }
 }
 
+#[cfg(target_os = "linux")]
+unsafe extern "C" {
+    fn desklink_indicator_covered(
+        x: f64,
+        y: f64,
+        opacity: f64,
+        click: f64,
+        typed: f64,
+        threshold: u32,
+        reveal: f64,
+    ) -> i32;
+}
+
+/// The X11 agent cue is a real window, so root grabs contain it. Restore
+/// exactly the pixels the announced cues cover (one pixel wider for edge
+/// rounding) from the last clean frame; everything else, including what lies
+/// inside the halo, stays live.
+#[cfg(target_os = "linux")]
+struct CueMask {
+    cues: crate::indicator::Cues,
+    clean: Option<Vec<u8>>,
+}
+
+#[cfg(target_os = "linux")]
+impl CueMask {
+    fn new(cues: crate::indicator::Cues) -> Self {
+        Self { cues, clean: None }
+    }
+
+    fn snapshot(&self) -> Vec<crate::indicator::Cue> {
+        self.cues
+            .lock()
+            .map(|mut feed| feed.drain())
+            .unwrap_or_default()
+    }
+
+    /// `before` is the snapshot taken when the grab started: with the states
+    /// announced by the time it returned, it covers whatever the grab saw.
+    fn apply(
+        &mut self,
+        raw: &mut [u8],
+        width: usize,
+        height: usize,
+        mut cues: Vec<crate::indicator::Cue>,
+    ) {
+        cues.extend(self.snapshot());
+        if let Some(clean) = self.clean.as_ref().filter(|clean| clean.len() == raw.len()) {
+            for cue in cues {
+                let side = cue.size as usize + 2;
+                let mut covered = vec![false; side * side];
+                for row in 0..cue.size as usize {
+                    for col in 0..cue.size as usize {
+                        let half = cue.size as f64 / 2.0;
+                        covered[(row + 1) * side + col + 1] = unsafe {
+                            desklink_indicator_covered(
+                                (col as f64 - half) / cue.unit,
+                                (row as f64 - half) / cue.unit,
+                                cue.opacity,
+                                cue.click,
+                                cue.typed,
+                                cue.threshold,
+                                cue.reveal,
+                            )
+                        } != 0;
+                    }
+                }
+                for row in 0..side {
+                    for col in 0..side {
+                        let near =
+                            |r: usize, c: usize| r < side && c < side && covered[r * side + c];
+                        if !(near(row, col)
+                            || near(row.wrapping_sub(1), col)
+                            || near(row + 1, col)
+                            || near(row, col.wrapping_sub(1))
+                            || near(row, col + 1))
+                        {
+                            continue;
+                        }
+                        let (x, y) = (cue.x - 1 + col as i64, cue.y - 1 + row as i64);
+                        if x < 0 || y < 0 || x >= width as i64 || y >= height as i64 {
+                            continue;
+                        }
+                        let at = (y as usize * width + x as usize) * 4;
+                        raw[at..at + 4].copy_from_slice(&clean[at..at + 4]);
+                    }
+                }
+            }
+        }
+        self.clean = Some(raw.to_vec());
+    }
+}
+
 /// What a chosen capture backend gives the session.
 struct Selected {
     source: SelectedSource,
@@ -210,6 +300,7 @@ fn select_x11(
     max_fps: u32,
     metrics: Arc<Mutex<Metrics>>,
     #[cfg(target_os = "linux")] cursor_sink: Option<crate::cursor::CursorSink>,
+    #[cfg(target_os = "linux")] cues: Option<crate::indicator::Cues>,
     sink: capture::FrameSink,
     on_stop: Box<dyn Fn(String) + Send>,
 ) -> Result<Selected> {
@@ -250,6 +341,8 @@ fn select_x11(
                 let mut first = true;
                 #[cfg(target_os = "linux")]
                 let mut cursor = cursor_sink.map(crate::cursor::Reporter::new);
+                #[cfg(target_os = "linux")]
+                let mut mask = cues.map(CueMask::new);
                 while !stop.load(Ordering::SeqCst) {
                     #[cfg(target_os = "linux")]
                     if let Some(cursor) = cursor.as_mut() {
@@ -272,10 +365,19 @@ fn select_x11(
                     }
                     let started = Instant::now();
                     let grabbed = Instant::now();
+                    #[cfg(target_os = "linux")]
                     let frame = {
+                        let before = mask.as_ref().map(CueMask::snapshot);
                         let mut desktop = lock(&desktop);
-                        desktop.capture_with_pixels(max_width, max_height)
+                        desktop.capture_raw().and_then(|mut raw| {
+                            if let (Some(mask), Some(before)) = (mask.as_mut(), before) {
+                                mask.apply(&mut raw, width as usize, height as usize, before);
+                            }
+                            Ok((desktop.convert(&raw, max_width, max_height)?, raw))
+                        })
                     };
+                    #[cfg(not(target_os = "linux"))]
+                    let frame = lock(&desktop).capture_with_pixels(max_width, max_height);
                     let grab_micros = grabbed.elapsed().as_micros() as u64;
                     match frame {
                         Ok((frame, raw)) => {
@@ -593,7 +695,6 @@ pub struct OpenRequest {
     pub cursor: crate::protocol::CursorMode,
     /** Which desktop to capture; absent means the portal. */
     pub source: Option<SourceRequest>,
-    pub permissions: Vec<Permission>,
     pub max_width: usize,
     pub max_height: usize,
     pub bitrate_kbps: u32,
@@ -684,7 +785,6 @@ enum PointDesktop {
 struct Inner {
     id: String,
     generation: u64,
-    permissions: Vec<Permission>,
     source: SelectedSource,
     geometry: serde_json::Value,
     metrics: Arc<Mutex<Metrics>>,
@@ -765,12 +865,10 @@ pub fn capabilities() -> serde_json::Value {
     } else {
         "none"
     };
-    // Clipboard transfer needs Wayland; writes also need a selection server
-    // that can outlive this engine. Do not offer it when that tool is absent.
-    let clipboard = wayland_clipboard_available();
     let x11 = crate::x11::X11Desktop::connect(None)
         .map(|desktop| serde_json::json!([desktop.screen_size().0, desktop.screen_size().1]))
         .unwrap_or(serde_json::Value::Null);
+    let clipboard = wayland_clipboard_available();
     let (input, grant_state, unavailable) = match crate::input::probe() {
         Ok(()) => (serde_json::json!(true), "granted", serde_json::Value::Null),
         Err(unavailable) => (
@@ -909,19 +1007,6 @@ impl Session {
         request: OpenRequest,
         events: tokio_mpsc::UnboundedSender<Notice>,
     ) -> std::result::Result<Self, SessionError> {
-        if !request.permissions.contains(&Permission::View) {
-            return Err(SessionError::new(
-                "permission",
-                "session.open requires the view permission",
-            ));
-        }
-        #[cfg(target_os = "windows")]
-        if request.agent_indicator {
-            return Err(SessionError::new(
-                "indicator-unavailable",
-                "Windows agent indicator is not implemented in this build.",
-            ));
-        }
         if request.cursor == crate::protocol::CursorMode::Hidden {
             #[cfg(not(target_os = "linux"))]
             return Err(SessionError::new(
@@ -936,7 +1021,6 @@ impl Session {
             }
         }
         let id = opaque_id();
-        let wants_control = request.permissions.contains(&Permission::Control);
         let wants_x11 = matches!(request.source, Some(SourceRequest::X11 { .. }));
         let max_fps = request.max_fps.clamp(1, 60);
         // A source the consumer feeds needs no capture backend, no encoder and
@@ -953,23 +1037,26 @@ impl Session {
         // Which desktop decides which input path is even available: an X display
         // takes XTest, which cannot reach any other session, while a portal
         // desktop needs kernel input access.
-        if wants_control && !wants_x11 {
-            // Refuse up front rather than presenting a control surface that
-            // silently does nothing.
-            if crate::input::probe().is_err() {
-                #[cfg(target_os = "macos")]
-                let _ = crate::input::request_access();
-                if let Err(unavailable) = crate::input::probe() {
-                    return Err(SessionError::new(
-                        "input-unavailable",
-                        format!("{}; {}", unavailable.reason, unavailable.remedy),
-                    ));
-                }
-            }
+        #[cfg(target_os = "macos")]
+        if crate::input::probe().is_err() {
+            let _ = crate::input::request_access();
         }
 
         let metrics = Arc::new(Mutex::new(Metrics::default()));
         let mut indicator = None;
+        // The X11 cue starts before capture: its window is in root pixels, so
+        // the capture thread needs the announced cue states from the first grab.
+        #[cfg(target_os = "linux")]
+        if request.agent_indicator && wants_x11 {
+            let display = match &request.source {
+                Some(SourceRequest::X11 { display }) => display.clone(),
+                _ => None,
+            }
+            .or_else(|| std::env::var("DISPLAY").ok());
+            if let Some(display) = display {
+                indicator = crate::indicator::Indicator::start(&display, 0, 0).ok();
+            }
+        }
         let (frame_tx, frame_rx) = latest_frame();
         let latest = Arc::new(Mutex::new(None::<FrameSnapshot>));
         let observed = latest.clone();
@@ -1091,6 +1178,8 @@ impl Session {
                 metrics.clone(),
                 #[cfg(target_os = "linux")]
                 cursor_sink,
+                #[cfg(target_os = "linux")]
+                indicator.as_ref().map(crate::indicator::Indicator::cues),
                 sink,
                 Box::new({
                     let status = capture_status.clone();
@@ -1139,23 +1228,13 @@ impl Session {
                 let (width, height) =
                     fit(source_w, source_h, request.max_width, request.max_height);
                 #[cfg(target_os = "linux")]
-                if request.agent_indicator && wants_control {
-                    indicator = Some(
-                        crate::indicator::Indicator::start_wayland(source_w, source_h).map_err(
-                            |error| {
-                                SessionError::new("indicator-unavailable", format!("{error:#}"))
-                            },
-                        )?,
-                    );
+                if request.agent_indicator {
+                    indicator = crate::indicator::Indicator::start_wayland(source_w, source_h).ok();
                 }
                 #[cfg(target_os = "macos")]
-                if request.agent_indicator && wants_control {
-                    indicator = Some(
-                        crate::indicator::Indicator::start(source.node_id, source_w, source_h)
-                            .map_err(|error| {
-                                SessionError::new("indicator", format!("{error:#}"))
-                            })?,
-                    );
+                if request.agent_indicator {
+                    indicator =
+                        crate::indicator::Indicator::start(source.node_id, source_w, source_h).ok();
                 }
                 #[cfg(target_os = "macos")]
                 let capture = capture::start(
@@ -1230,20 +1309,6 @@ impl Session {
 
         let source_w = source.width.max(1) as usize;
         let source_h = source.height.max(1) as usize;
-        #[cfg(target_os = "linux")]
-        if request.agent_indicator && wants_control && wants_x11 {
-            let display = match &request.source {
-                Some(SourceRequest::X11 {
-                    display: Some(display),
-                }) => display.clone(),
-                _ => std::env::var("DISPLAY")
-                    .map_err(|_| SessionError::new("indicator-unavailable", "no X display"))?,
-            };
-            indicator = Some(
-                crate::indicator::Indicator::start(&display, source_w, source_h)
-                    .map_err(|error| SessionError::new("indicator", format!("{error:#}")))?,
-            );
-        }
         let (width, height) = fit(source_w, source_h, request.max_width, request.max_height);
 
         let bitrate_kbps = if request.bitrate_kbps == 0 {
@@ -1262,40 +1327,30 @@ impl Session {
 
         // Everything that can still refuse the session comes before the peer:
         // a peer created and then abandoned keeps its socket and tasks alive.
-        let input = if !wants_control {
-            None
-        } else {
-            Some(match &x11 {
-                Some(desktop) => InputTarget {
-                    applier: Applier::X11(desktop.clone()),
-                    held: HeldState::default(),
-                    explicit_modifiers: Vec::new(),
-                    chord_modifiers: Vec::new(),
-                    chord_keys: Vec::new(),
-                    wheel_rest: (0.0, 0.0),
-                },
-                None => InputTarget {
-                    applier: Applier::Uinput({
-                        #[cfg(target_os = "linux")]
-                        let devices = InputDevices::create(source_w as i32, source_h as i32);
-                        #[cfg(any(target_os = "macos", target_os = "windows"))]
-                        let devices = InputDevices::create_for_display(
-                            source_w as i32,
-                            source_h as i32,
-                            source.node_id,
-                        );
-                        devices.map_err(|error| {
-                            SessionError::new("input-unavailable", format!("{error:#}"))
-                        })?
-                    }),
-                    held: HeldState::default(),
-                    explicit_modifiers: Vec::new(),
-                    chord_modifiers: Vec::new(),
-                    chord_keys: Vec::new(),
-                    wheel_rest: (0.0, 0.0),
-                },
-            })
+        let applier = match &x11 {
+            Some(desktop) => lock(desktop)
+                .input_available()
+                .then(|| Applier::X11(desktop.clone())),
+            None => {
+                #[cfg(target_os = "linux")]
+                let devices = InputDevices::create(source_w as i32, source_h as i32);
+                #[cfg(any(target_os = "macos", target_os = "windows"))]
+                let devices = InputDevices::create_for_display(
+                    source_w as i32,
+                    source_h as i32,
+                    source.node_id,
+                );
+                devices.ok().map(Applier::Uinput)
+            }
         };
+        let input = applier.map(|applier| InputTarget {
+            applier,
+            held: HeldState::default(),
+            explicit_modifiers: Vec::new(),
+            chord_modifiers: Vec::new(),
+            chord_keys: Vec::new(),
+            wheel_rest: (0.0, 0.0),
+        });
 
         let layout = Layout::from_environment().map_err(|error| {
             SessionError::new("input", format!("no keyboard layout: {error:#}"))
@@ -1338,7 +1393,6 @@ impl Session {
         let inner = Arc::new(Inner {
             id,
             generation,
-            permissions: request.permissions,
             source,
             geometry,
             metrics,
@@ -1432,7 +1486,6 @@ impl Session {
         let inner = Arc::new(Inner {
             id,
             generation,
-            permissions: request.permissions,
             source: SelectedSource {
                 node_id: 0,
                 width: width as i32,
@@ -1532,6 +1585,10 @@ impl Session {
         self.inner.generation
     }
 
+    pub fn agent_indicator(&self) -> bool {
+        lock(&self.inner.indicator).is_some()
+    }
+
     pub fn cursor_info(&self) -> &serde_json::Value {
         &self.inner.cursor_info
     }
@@ -1554,12 +1611,6 @@ impl Session {
         if self.inner.closed.load(Ordering::SeqCst) {
             return Err(SessionError::new("session", "the session is closed"));
         }
-        if !self.inner.permissions.contains(&Permission::View) {
-            return Err(SessionError::new(
-                "permission",
-                "point requires view permission",
-            ));
-        }
         if lock(&self.inner.encoded).is_some() {
             return Err(SessionError::new(
                 "operation",
@@ -1732,12 +1783,6 @@ impl Session {
         path: &str,
         region: Option<[usize; 4]>,
     ) -> std::result::Result<serde_json::Value, SessionError> {
-        if !self.inner.permissions.contains(&Permission::View) {
-            return Err(SessionError::new(
-                "permission",
-                "view permission is required",
-            ));
-        }
         if lock(&self.inner.encoded).is_some() {
             return Err(SessionError::new(
                 "operation",
@@ -1843,20 +1888,18 @@ impl Session {
         if let Some((_, reason)) = self.inner.clipboard_refusal() {
             return Err(reason.to_owned());
         }
-        clipboard_task(move || clipboard::read_or_explain()).await
+        let inner = self.inner.clone();
+        clipboard_task(move || inner.clipboard_read_text()).await
     }
 
     pub async fn write_clipboard(&self, text: String) -> std::result::Result<(), String> {
         if let Some((_, reason)) = self.inner.clipboard_refusal() {
             return Err(reason.to_owned());
         }
-        clipboard_task(move || {
-            clipboard::write(&text)
-                .map(|()| String::new())
-                .map_err(|error| format!("{error:#}"))
-        })
-        .await
-        .map(|_written| ())
+        let inner = self.inner.clone();
+        clipboard_task(move || inner.clipboard_write_text(&text))
+            .await
+            .map(|_written| ())
     }
 
     pub fn mark_closed_reason(&self) -> Option<String> {
@@ -1945,24 +1988,40 @@ impl Inner {
         }
     }
 
-    fn has(&self, permission: Permission) -> bool {
-        self.permissions.contains(&permission)
+    fn clipboard_read_text(&self) -> std::result::Result<(String, bool), String> {
+        #[cfg(target_os = "linux")]
+        if let PointDesktop::X11(display) = &self.point_desktop {
+            return clipboard::x11_read(display).map_err(|error| format!("{error:#}"));
+        }
+        clipboard::read_or_explain()
+    }
+
+    fn clipboard_write_text(&self, text: &str) -> std::result::Result<String, String> {
+        #[cfg(target_os = "linux")]
+        if let PointDesktop::X11(display) = &self.point_desktop {
+            return clipboard::x11_write(display, text)
+                .map(|()| String::new())
+                .map_err(|error| format!("{error:#}"));
+        }
+        clipboard::write(text)
+            .map(|()| String::new())
+            .map_err(|error| format!("{error:#}"))
     }
 
     fn clipboard_refusal(&self) -> Option<(&'static str, &'static str)> {
-        if matches!(
-            self.source.source_type.as_deref(),
-            Some("x11-root") | Some("encoded")
-        ) || !wayland_clipboard_available()
-        {
+        if self.closed.load(Ordering::Relaxed) {
+            return Some(("session", "the session has ended"));
+        }
+        #[cfg(target_os = "linux")]
+        if self.source.source_type.as_deref() == Some("x11-root") {
+            return None;
+        }
+        if self.source.source_type.as_deref() == Some("encoded") || !wayland_clipboard_available() {
             return Some((
                 "clipboard-unsupported",
                 "clipboard is unavailable for this desktop source",
             ));
         }
-        if !self.has(Permission::Clipboard) {
-            return Some(("permission", "this session has no clipboard permission"));
-        }
         None
     }
 
@@ -1990,7 +2049,7 @@ impl Inner {
         Ok(())
     }
 
-    /// Admit one client action. Validation, permission and ordering checks all
+    /// Admit one client action. Validation and ordering checks all
     /// happen before any physical effect, so a refused action leaves the desktop
     /// exactly as it was.
     fn apply(self: &Arc<Self>, message: ControlMessage) {
@@ -2003,10 +2062,6 @@ impl Inner {
             self.reject(seq, "session", "the control channel is not open");
             return;
         }
-        if !self.has(Permission::Control) {
-            self.reject(seq, "permission", "this session is view-only");
-            return;
-        }
         if seq != 0 {
             let mut last = match self.last_seq.lock() {
                 Ok(last) => last,
@@ -2043,6 +2098,14 @@ impl Inner {
             self.forward(message);
             return;
         }
+        if !matches!(
+            &message,
+            ControlMessage::ClipboardRead { .. } | ControlMessage::ClipboardWrite { .. }
+        ) && lock(&self.input).is_none()
+        {
+            self.reject(seq, "input-unavailable", "no input backend");
+            return;
+        }
         let outcome = match message {
             ControlMessage::Pointer {
                 phase,
@@ -2318,10 +2381,12 @@ impl Inner {
         }
         let inner = Arc::clone(self);
         tokio::spawn(async move {
-            let (text, truncated, error) = match clipboard_task(clipboard::read_or_explain).await {
-                Ok((text, truncated)) => (text, truncated, None),
-                Err(reason) => (String::new(), false, Some(reason)),
-            };
+            let reader = inner.clone();
+            let (text, truncated, error) =
+                match clipboard_task(move || reader.clipboard_read_text()).await {
+                    Ok((text, truncated)) => (text, truncated, None),
+                    Err(reason) => (String::new(), false, Some(reason)),
+                };
             let _ = inner.reply(&ControlReply::Clipboard {
                 request: &request,
                 text,
@@ -2338,13 +2403,10 @@ impl Inner {
         }
         let inner = Arc::clone(self);
         tokio::spawn(async move {
-            let error = clipboard_task(move || {
-                clipboard::write(&text)
-                    .map(|()| String::new())
-                    .map_err(|error| format!("{error:#}"))
-            })
-            .await
-            .err();
+            let writer = inner.clone();
+            let error = clipboard_task(move || writer.clipboard_write_text(&text))
+                .await
+                .err();
             let _ = inner.reply(&ControlReply::Clipboard {
                 request: &request,
                 text: String::new(),
@@ -3216,6 +3278,60 @@ fn opaque_id() -> String {
 
 #[cfg(test)]
 mod tests {
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn x11_cue_mask_restores_only_the_cue_pixels() {
+        use crate::indicator::Cue;
+        let (w, h) = (200usize, 120usize);
+        let at = |x: usize, y: usize| (y * w + x) * 4;
+        let (cx, cy) = (20 + 55, 10 + 55);
+        // Shaped (128) and composited (1) helpers announce different thresholds.
+        for threshold in [128, 1] {
+            let cue = Cue {
+                x: 20,
+                y: 10,
+                size: 110,
+                unit: 1.0,
+                opacity: 1.0,
+                click: -1.0,
+                typed: -1.0,
+                threshold,
+                reveal: 99.0,
+            };
+            let mut mask = CueMask::new(Default::default());
+            let clean: Vec<u8> = (0..w * h * 4).map(|i| (i % 251) as u8).collect();
+            mask.apply(&mut clean.clone(), w, h, vec![]);
+            // Paint the cue's keyline and live content inside the halo.
+            let mut frame = clean.clone();
+            frame[at(cx - 24, cy)..at(cx - 24, cy) + 4].fill(255);
+            frame[at(cx - 5, cy)..at(cx - 5, cy) + 4].fill(7);
+            frame[at(190, 110)..at(190, 110) + 4].fill(9);
+            mask.apply(&mut frame, w, h, vec![cue]);
+            assert_eq!(
+                &frame[at(cx - 24, cy)..at(cx - 24, cy) + 4],
+                &clean[at(cx - 24, cy)..at(cx - 24, cy) + 4]
+            );
+            assert_eq!(
+                &frame[at(cx - 5, cy)..at(cx - 5, cy) + 4],
+                &[7; 4],
+                "the halo interior stays live"
+            );
+            assert_eq!(
+                &frame[at(190, 110)..at(190, 110) + 4],
+                &[9; 4],
+                "pixels away from the cue stay live"
+            );
+            let mut after = clean.clone();
+            after[at(cx - 24, cy)..at(cx - 24, cy) + 4].fill(3);
+            mask.apply(&mut after, w, h, vec![]);
+            assert_eq!(
+                &after[at(cx - 24, cy)..at(cx - 24, cy) + 4],
+                &[3; 4],
+                "a hidden cue masks nothing"
+            );
+        }
+    }
+
     use super::*;
 
     #[tokio::test]
@@ -3226,7 +3342,6 @@ mod tests {
         let inner = Arc::new(Inner {
             id: String::from("encoded-session"),
             generation: 1,
-            permissions: Vec::new(),
             source: SelectedSource {
                 node_id: 0,
                 width: 640,
@@ -3396,10 +3511,7 @@ mod tests {
     #[tokio::test]
     async fn a_wayland_portal_session_reports_typed_point_unsupported() {
         let (events, _) = tokio_mpsc::unbounded_channel();
-        let (mut inner, _) = test_inner(events).await;
-        Arc::get_mut(&mut inner)
-            .expect("test session has one owner")
-            .permissions = vec![Permission::View];
+        let (inner, _) = test_inner(events).await;
         let session = Session { inner };
 
         let error = session
@@ -3445,7 +3557,6 @@ mod tests {
         let (events, _) = tokio_mpsc::unbounded_channel();
         let (mut inner, _) = test_inner(events).await;
         let state = Arc::get_mut(&mut inner).unwrap();
-        state.permissions = vec![Permission::View];
         state.point_desktop = PointDesktop::Wayland;
         state.source.width = 1280;
         state.source.height = 720;
@@ -3538,7 +3649,6 @@ mod tests {
         let inner = Arc::new(Inner {
             id: String::from("test-session"),
             generation: 1,
-            permissions: vec![Permission::Control],
             source: SelectedSource {
                 node_id: 0,
                 width: 640,
@@ -3587,6 +3697,36 @@ mod tests {
         (inner, recorded)
     }
 
+    #[tokio::test]
+    async fn paired_input_without_a_backend_is_an_action_failure() {
+        let (events, _) = tokio_mpsc::unbounded_channel();
+        let (inner, recorded) = test_inner(events).await;
+        *lock(&inner.input) = None;
+        assert_eq!(
+            inner.with_input(|_| Ok(())).unwrap_err().0,
+            "input-unavailable"
+        );
+        inner.apply(ControlMessage::Pointer {
+            phase: PointerPhase::Move,
+            x: 10,
+            y: 20,
+            button: 1,
+            seq: 1,
+        });
+        assert_eq!(
+            *lock(&inner.last_seq),
+            1,
+            "paired action passes admission, never a permission refusal"
+        );
+        assert_eq!(lock(&inner.metrics).input_rejected, 1);
+        assert_eq!(lock(&inner.metrics).input_applied, 0);
+        assert!(lock(&recorded).is_empty());
+        assert!(
+            !inner.closed.load(Ordering::Relaxed),
+            "missing input does not close view access"
+        );
+    }
+
     #[tokio::test]
     async fn a_lease_that_expires_ends_the_session_and_releases_held_input() {
         let (events, mut received) = tokio_mpsc::unbounded_channel();
@@ -3845,38 +3985,24 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn x11_capture_refuses_both_clipboard_directions() {
+    async fn x11_capture_does_not_refuse_clipboard() {
         let (events, _received) = tokio_mpsc::unbounded_channel();
         let (mut inner, _recorded) = test_inner(events).await;
         let owned = Arc::get_mut(&mut inner).unwrap();
         owned.source.source_type = Some(String::from("x11-root"));
-        owned.permissions.push(Permission::Clipboard);
-        let session = Session {
-            inner: inner.clone(),
-        };
-        assert!(session
-            .read_clipboard()
-            .await
-            .unwrap_err()
-            .contains("unavailable"));
-        assert!(session
-            .write_clipboard(String::from("secret"))
-            .await
-            .unwrap_err()
-            .contains("unavailable"));
-        inner.clipboard_read(String::from("read"));
-        inner.clipboard_write(String::from("write"), String::from("secret"));
-        assert_eq!(inner.metrics.lock().unwrap().input_rejected, 2);
+        #[cfg(target_os = "linux")]
+        assert_eq!(inner.clipboard_refusal(), None);
+        Arc::get_mut(&mut inner).unwrap().source.source_type = Some(String::from("encoded"));
+        assert_eq!(
+            inner.clipboard_refusal().unwrap().0,
+            "clipboard-unsupported"
+        );
     }
 
     #[tokio::test]
     async fn a_stopped_capture_never_serves_the_last_frame() {
         let (events, _) = tokio_mpsc::unbounded_channel();
-        let (mut inner, _) = test_inner(events).await;
-        Arc::get_mut(&mut inner)
-            .unwrap()
-            .permissions
-            .push(Permission::View);
+        let (inner, _) = test_inner(events).await;
         let session = Session { inner };
         *lock(&session.inner.latest) =
             Some((1, Instant::now(), 2, 2, vec![0; 16], vec![1], vec![]));
@@ -3956,7 +4082,6 @@ mod tests {
                 width: 486,
                 height: 1080,
             }),
-            permissions: vec![Permission::View, Permission::Control],
             max_width: 3840,
             max_height: 2160,
             bitrate_kbps: 0,
@@ -4130,35 +4255,6 @@ mod tests {
         );
     }
 
-    #[tokio::test]
-    async fn opening_without_view_permission_is_refused_before_capture() {
-        let (events, _received) = tokio_mpsc::unbounded_channel();
-        let result = Session::open(
-            OpenRequest {
-                cursor: crate::protocol::CursorMode::Embedded,
-                source: None,
-                permissions: vec![Permission::Control],
-                max_width: 640,
-                max_height: 480,
-                bitrate_kbps: 0,
-                max_fps: 30,
-                ice_servers: Vec::new(),
-                restore_token: None,
-                ttl: None,
-                loopback_tcp: false,
-                agent_indicator: false,
-                local_frames: true,
-            },
-            events,
-        )
-        .await;
-        let error = match result {
-            Ok(_) => panic!("a viewless session must not open"),
-            Err(error) => error,
-        };
-        assert_eq!(error.code, "permission");
-    }
-
     #[tokio::test]
     async fn a_lost_transport_releases_input_then_ends_the_session_without_sctp_close() {
         use webrtc::peer_connection::RTCPeerConnectionState as State;