@oxy.so/services 11.10.0 → 11.12.0

package/src/ui/appAssertion/AppAssertionContext.tsx

@@ -0,0 +1,109 @@
+/**
+ * `useAppAssertion()` (ADR 0045): this app's Oxy-signed assertion of which app
+ * it is, for the signed-in session.
+ *
+ * `OxyProvider` mounts {@link AppAssertionProvider} itself and the manager
+ * obtains and refreshes the assertion on its own; an app never handles the
+ * proof. Something that calls a service which needs to know the app (Alia's
+ * SDK, for an agent confined to its application) attaches
+ * `await getAppAssertionHeaders()` to the request.
+ */
+
+import type { OxyServices } from '@oxy.so/core';
+import {
+  createContext,
+  type ReactNode,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useSyncExternalStore,
+} from 'react';
+import type { StorageInterface } from '../utils/storageHelpers';
+import { appIntegrityPlatform } from './appIntegrityPlatform';
+import { AppAssertionManager, type AppAssertionSnapshot } from './appAssertionManager';
+import type { AppIntegrityPlatform } from './appIntegrityTypes';
+
+const AppAssertionContext = createContext<AppAssertionManager | null>(null);
+
+export interface AppAssertionProviderProps {
+  readonly children: ReactNode;
+  readonly oxyServices: OxyServices;
+  readonly clientId: string | null;
+  /** The signed-in person, once the session can call Oxy; `null` otherwise. */
+  readonly userId: string | null;
+  readonly sessionId: string | null;
+  readonly storage: StorageInterface | null;
+  readonly storageKeyPrefix: string;
+  /** Replaces the build's own platform, in tests. */
+  readonly integrity?: AppIntegrityPlatform;
+}
+
+export function AppAssertionProvider({
+  children,
+  oxyServices,
+  clientId,
+  userId,
+  sessionId,
+  storage,
+  storageKeyPrefix,
+  integrity = appIntegrityPlatform,
+}: AppAssertionProviderProps) {
+  // Read only when an iOS install needs its App Attest key id, never in render.
+  const storageRef = useRef<StorageInterface | null>(storage);
+  useEffect(() => {
+    storageRef.current = storage;
+  }, [storage]);
+
+  const manager = useMemo(
+    () =>
+      new AppAssertionManager({
+        oxyServices,
+        clientId,
+        integrity,
+        storage: () => storageRef.current,
+        storageKeyPrefix,
+      }),
+    [oxyServices, clientId, integrity, storageKeyPrefix],
+  );
+
+  useEffect(() => {
+    manager.setSession(userId && sessionId ? { userId, sessionId } : null);
+  }, [manager, userId, sessionId]);
+
+  useEffect(() => () => manager.dispose(), [manager]);
+
+  return <AppAssertionContext.Provider value={manager}>{children}</AppAssertionContext.Provider>;
+}
+
+export interface UseAppAssertionResult extends AppAssertionSnapshot {
+  /** A current assertion, obtained now when there is none or it is about to expire; `null` when there can be none. */
+  readonly getAppAssertion: () => Promise<string | null>;
+  /** `{ 'X-Oxy-App-Assertion': <assertion> }`, or `{}` when there is none. */
+  readonly getAppAssertionHeaders: () => Promise<Record<string, string>>;
+}
+
+export class AppAssertionProviderMissingError extends Error {
+  readonly code = 'oxy_provider_missing';
+
+  constructor() {
+    super('useAppAssertion() was called outside <OxyProvider>.');
+    this.name = 'AppAssertionProviderMissingError';
+  }
+}
+
+/** This app's assertion of which app it is, kept current for the signed-in session. */
+export function useAppAssertion(): UseAppAssertionResult {
+  const manager = useContext(AppAssertionContext);
+  if (!manager) throw new AppAssertionProviderMissingError();
+  const snapshot = useSyncExternalStore(
+    manager.subscribe,
+    manager.getSnapshot,
+    manager.getSnapshot,
+  );
+  return {
+    ...snapshot,
+    getAppAssertion: manager.getAppAssertion,
+    getAppAssertionHeaders: manager.getAppAssertionHeaders,
+  };
+}

package/src/ui/appAssertion/appAssertionManager.ts

@@ -0,0 +1,363 @@
+/**
+ * The app's assertion of which app it is (ADR 0045), obtained and refreshed for
+ * the signed-in session without any app code.
+ *
+ * One manager per `OxyProvider`. For the active session it resolves the app's
+ * application id from its registered `clientId`, proves the app by platform —
+ * the browser's `Origin` on the web, Play Integrity on Android, App Attest on
+ * iOS — trades the proof for an Oxy-signed `OXY-APP+JWT`, and refreshes it a
+ * minute before it expires. A session change drops the assertion at once: an
+ * assertion names exactly one person and one session.
+ *
+ * Outcomes are values, never thrown: `ready`, `unsupported` (this build cannot
+ * prove itself: no `clientId`, no native module, App Attest unavailable) or
+ * `unavailable` (Oxy refused or could not be reached). A refusal that will not
+ * change for this session (an unregistered origin or platform) is not retried
+ * until the session changes; anything else is retried with a backoff.
+ */
+
+import type { AppAssertionPlatform, AppAssertionResponse } from '@oxy.so/contracts';
+import { OXY_APP_ASSERTION_HEADER } from '@oxy.so/contracts/client';
+import type { OxyServices } from '@oxy.so/core';
+import type { StorageInterface } from '../utils/storageHelpers';
+import type { AppIntegrityModule, AppIntegrityPlatform } from './appIntegrityTypes';
+
+export type AppAssertionStatus = 'idle' | 'pending' | 'ready' | 'unavailable' | 'unsupported';
+
+export interface AppAssertionSnapshot {
+  readonly status: AppAssertionStatus;
+  /** The `OXY-APP+JWT`, to send as `X-Oxy-App-Assertion`. */
+  readonly assertion: string | null;
+  readonly applicationId: string | null;
+  readonly platform: AppAssertionPlatform | null;
+  /** Epoch milliseconds. */
+  readonly expiresAt: number | null;
+  /** Why there is none: an `APP_ASSERTION_ERROR_CODES` value, or an SDK reason. */
+  readonly error: string | null;
+}
+
+export interface AppAssertionSession {
+  readonly userId: string;
+  readonly sessionId: string;
+}
+
+export interface AppAssertionManagerOptions {
+  readonly oxyServices: Pick<OxyServices, 'apps'>;
+  readonly clientId: string | null;
+  readonly integrity: AppIntegrityPlatform;
+  /** Where an iOS install keeps its App Attest key id. */
+  readonly storage: () => StorageInterface | null;
+  readonly storageKeyPrefix: string;
+  readonly now?: () => number;
+  readonly setTimer?: (run: () => void, ms: number) => unknown;
+  readonly clearTimer?: (timer: unknown) => void;
+}
+
+/** Refresh this long before expiry. */
+const REFRESH_BEFORE_MS = 60_000;
+/** `getAppAssertion()` fetches anew when less than this is left. */
+const MIN_REMAINING_MS = 30_000;
+const RETRY_FIRST_MS = 30_000;
+const RETRY_MAX_MS = 15 * 60_000;
+
+/** Refusals that will not change for this session. */
+const PERMANENT_REFUSALS = new Set([
+  'application_unavailable',
+  'session_other_application',
+  'platform_not_registered',
+  'origin_not_registered',
+  'integrity_unconfigured',
+]);
+
+const IDLE: AppAssertionSnapshot = {
+  status: 'idle',
+  assertion: null,
+  applicationId: null,
+  platform: null,
+  expiresAt: null,
+  error: null,
+};
+
+class Unsupported extends Error {
+  constructor(readonly reason: string) {
+    super(reason);
+  }
+}
+
+function errorCode(error: unknown): string {
+  if (error instanceof Unsupported) return error.reason;
+  const code = (error as { code?: unknown } | null)?.code;
+  return typeof code === 'string' && code.length > 0 ? code : 'request_failed';
+}
+
+export class AppAssertionManager {
+  private snapshot: AppAssertionSnapshot = IDLE;
+  private readonly listeners = new Set<() => void>();
+  private session: AppAssertionSession | null = null;
+  /** Bumped on every session change; a result for an older generation is dropped. */
+  private generation = 0;
+  private inflight: Promise<string | null> | null = null;
+  private timer: unknown = null;
+  private retryMs = RETRY_FIRST_MS;
+  private retryAt = 0;
+  private applicationId: { clientId: string; id: Promise<string> } | null = null;
+  private preparedProject: string | null = null;
+  private readonly now: () => number;
+  private readonly setTimer: (run: () => void, ms: number) => unknown;
+  private readonly clearTimer: (timer: unknown) => void;
+
+  constructor(private readonly options: AppAssertionManagerOptions) {
+    this.now = options.now ?? Date.now;
+    this.setTimer = options.setTimer ?? ((run, ms) => setTimeout(run, ms));
+    this.clearTimer =
+      options.clearTimer ?? ((timer) => clearTimeout(timer as ReturnType<typeof setTimeout>));
+  }
+
+  readonly subscribe = (listener: () => void): (() => void) => {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  };
+
+  readonly getSnapshot = (): AppAssertionSnapshot => this.snapshot;
+
+  /**
+   * A current assertion for the active session, obtaining one when there is
+   * none or it is about to expire; `null` when this app cannot have one now.
+   */
+  readonly getAppAssertion = async (): Promise<string | null> => {
+    const current = this.snapshot;
+    if (
+      current.status === 'ready' &&
+      current.assertion &&
+      current.expiresAt !== null &&
+      current.expiresAt - this.now() > MIN_REMAINING_MS
+    ) {
+      return current.assertion;
+    }
+    if (!this.session || current.status === 'unsupported') return null;
+    if (current.status === 'unavailable' && this.now() < this.retryAt) return null;
+    return this.refresh();
+  };
+
+  /**
+   * `{ 'X-Oxy-App-Assertion': <assertion> }` for a request to a service that
+   * needs to know the app (Alia), or `{}` when there is none.
+   */
+  readonly getAppAssertionHeaders = async (): Promise<Record<string, string>> => {
+    const assertion = await this.getAppAssertion();
+    return assertion ? { [OXY_APP_ASSERTION_HEADER]: assertion } : {};
+  };
+
+  /** Follow the active session; `null` when signed out or not yet able to call Oxy. */
+  setSession(session: AppAssertionSession | null): void {
+    const same =
+      session?.userId === this.session?.userId && session?.sessionId === this.session?.sessionId;
+    if (same) return;
+    this.session = session;
+    this.generation += 1;
+    this.inflight = null;
+    this.retryMs = RETRY_FIRST_MS;
+    this.retryAt = 0;
+    this.cancelTimer();
+    this.publish(IDLE);
+    if (session) void this.refresh();
+  }
+
+  /** Stop all work. A later `setSession` starts again. */
+  dispose(): void {
+    this.session = null;
+    this.generation += 1;
+    this.inflight = null;
+    this.cancelTimer();
+  }
+
+  private refresh(): Promise<string | null> {
+    if (this.inflight) return this.inflight;
+    const generation = this.generation;
+    const run = this.obtain()
+      .then((answer) => {
+        if (generation !== this.generation) return null;
+        const expiresAt = Date.parse(answer.expiresAt);
+        this.retryMs = RETRY_FIRST_MS;
+        this.publish({
+          status: 'ready',
+          assertion: answer.assertion,
+          applicationId: answer.applicationId,
+          platform: answer.platform,
+          expiresAt,
+          error: null,
+        });
+        this.schedule(Math.max(expiresAt - this.now() - REFRESH_BEFORE_MS, MIN_REMAINING_MS));
+        return answer.assertion;
+      })
+      .catch((error: unknown) => {
+        if (generation !== this.generation) return null;
+        const code = errorCode(error);
+        const unsupported = error instanceof Unsupported;
+        const current = this.snapshot;
+        if (
+          !unsupported &&
+          !PERMANENT_REFUSALS.has(code) &&
+          current.status === 'ready' &&
+          current.expiresAt !== null &&
+          current.expiresAt - this.now() > MIN_REMAINING_MS
+        ) {
+          // The assertion in hand is still good: keep it, and try again soon.
+          this.schedule(
+            Math.min(RETRY_FIRST_MS, current.expiresAt - this.now() - MIN_REMAINING_MS),
+          );
+          return current.assertion;
+        }
+        this.publish({
+          ...IDLE,
+          status: unsupported ? 'unsupported' : 'unavailable',
+          platform: this.options.integrity.platform,
+          error: code,
+        });
+        if (!unsupported) {
+          if (PERMANENT_REFUSALS.has(code)) {
+            this.retryAt = Number.POSITIVE_INFINITY;
+          } else {
+            this.retryAt = this.now() + this.retryMs;
+            this.schedule(this.retryMs);
+            this.retryMs = Math.min(this.retryMs * 2, RETRY_MAX_MS);
+          }
+        }
+        return null;
+      })
+      .finally(() => {
+        if (this.inflight === run) this.inflight = null;
+      });
+    this.inflight = run;
+    if (this.snapshot.status !== 'ready') this.publish({ ...this.snapshot, status: 'pending' });
+    return run;
+  }
+
+  private async obtain(): Promise<AppAssertionResponse> {
+    const applicationId = await this.resolveApplicationId();
+    const { platform } = this.options.integrity;
+    const assertions = this.options.oxyServices.apps.assertions;
+    if (platform === 'web') return assertions.create({ applicationId, platform: 'web' });
+
+    const integrity = await this.options.integrity.loadIntegrity();
+    if (!integrity) throw new Unsupported('integrity_module_unavailable');
+    if (platform === 'android') return this.proveAndroid(applicationId, integrity);
+    if (!integrity.isSupported) throw new Unsupported('app_attest_unsupported');
+    return this.proveIos(applicationId, integrity);
+  }
+
+  private resolveApplicationId(): Promise<string> {
+    const clientId = this.options.clientId;
+    if (!clientId) return Promise.reject(new Unsupported('client_id_missing'));
+    if (this.applicationId?.clientId !== clientId) {
+      const id = this.options.oxyServices.apps.getPublic(clientId).then((app) => app.id);
+      id.catch(() => {
+        if (this.applicationId?.id === id) this.applicationId = null;
+      });
+      this.applicationId = { clientId, id };
+    }
+    return this.applicationId.id;
+  }
+
+  private async proveAndroid(
+    applicationId: string,
+    integrity: AppIntegrityModule,
+  ): Promise<AppAssertionResponse> {
+    const assertions = this.options.oxyServices.apps.assertions;
+    const challenge = await assertions.challenge({ applicationId, platform: 'android' });
+    if (!challenge.cloudProjectNumber) throw new Unsupported('integrity_unconfigured');
+    try {
+      if (this.preparedProject !== challenge.cloudProjectNumber) {
+        await integrity.prepareIntegrityTokenProviderAsync(challenge.cloudProjectNumber);
+        this.preparedProject = challenge.cloudProjectNumber;
+      }
+      const integrityToken = await integrity.requestIntegrityCheckAsync(challenge.requestHash);
+      return await assertions.create({
+        applicationId,
+        platform: 'android',
+        proof: { challenge: challenge.challenge, integrityToken },
+      });
+    } catch (error) {
+      // A provider Google invalidated is prepared again on the next attempt.
+      this.preparedProject = null;
+      throw error;
+    }
+  }
+
+  private async proveIos(
+    applicationId: string,
+    integrity: AppIntegrityModule,
+  ): Promise<AppAssertionResponse> {
+    const keyName = `${this.options.storageKeyPrefix}_app_attest_key_${applicationId}`;
+    const storage = this.options.storage();
+    const assertOnce = async (keyId: string) => {
+      const assertions = this.options.oxyServices.apps.assertions;
+      const challenge = await assertions.challenge({
+        applicationId,
+        platform: 'ios',
+        purpose: 'assertion',
+      });
+      const assertion = await integrity.generateAssertionAsync(keyId, challenge.requestHash);
+      return assertions.create({
+        applicationId,
+        platform: 'ios',
+        proof: { challenge: challenge.challenge, keyId, assertion },
+      });
+    };
+
+    const stored = await storage?.getItem(keyName).catch(() => null);
+    if (stored) {
+      try {
+        return await assertOnce(stored);
+      } catch (error) {
+        // Oxy no longer knows the key (swept, or never registered): attest a new one.
+        if (errorCode(error) !== 'attest_key_unknown') throw error;
+        await storage?.removeItem(keyName).catch(() => undefined);
+      }
+    }
+    const keyId = await this.attestKey(applicationId, integrity);
+    await storage?.setItem(keyName, keyId).catch(() => undefined);
+    return assertOnce(keyId);
+  }
+
+  private async attestKey(applicationId: string, integrity: AppIntegrityModule): Promise<string> {
+    const assertions = this.options.oxyServices.apps.assertions;
+    const keyId = await integrity.generateKeyAsync();
+    const challenge = await assertions.challenge({
+      applicationId,
+      platform: 'ios',
+      purpose: 'attest_key',
+    });
+    const attestation = await integrity.attestKeyAsync(keyId, challenge.requestHash);
+    await assertions.registerAttestKey({
+      applicationId,
+      keyId,
+      challenge: challenge.challenge,
+      attestation,
+    });
+    return keyId;
+  }
+
+  private schedule(ms: number): void {
+    this.cancelTimer();
+    const generation = this.generation;
+    this.timer = this.setTimer(() => {
+      this.timer = null;
+      if (generation === this.generation && this.session) void this.refresh();
+    }, ms);
+  }
+
+  private cancelTimer(): void {
+    if (this.timer !== null) {
+      this.clearTimer(this.timer);
+      this.timer = null;
+    }
+  }
+
+  private publish(next: AppAssertionSnapshot): void {
+    this.snapshot = next;
+    for (const listener of this.listeners) listener();
+  }
+}

package/src/ui/appAssertion/appIntegrityPlatform.native.ts

@@ -0,0 +1,27 @@
+/**
+ * iOS and Android: the app proves itself with App Attest or Play Integrity
+ * through `@expo/app-integrity` (ADR 0045).
+ *
+ * The module is loaded lazily, and its `import()` is a direct statement of a
+ * `try` block — the shape Metro marks OPTIONAL — so an app bundle that lacks
+ * the package, or a binary built before it was added (an over-the-air update
+ * of the JavaScript alone), still boots: `requireNativeModule` throws inside
+ * the import, and the app simply has no assertion.
+ */
+import { Platform } from 'react-native';
+import type { AppIntegrityModule, AppIntegrityPlatform } from './appIntegrityTypes';
+
+async function loadIntegrity(): Promise<AppIntegrityModule | null> {
+  try {
+    const integrity = await import('@expo/app-integrity');
+    return integrity;
+  } catch {
+    return null;
+  }
+}
+
+export const appIntegrityPlatform: AppIntegrityPlatform = {
+  platform: Platform.OS === 'ios' ? 'ios' : Platform.OS === 'android' ? 'android' : 'web',
+  loadIntegrity:
+    Platform.OS === 'ios' || Platform.OS === 'android' ? loadIntegrity : async () => null,
+};

package/src/ui/appAssertion/appIntegrityPlatform.ts

@@ -0,0 +1,12 @@
+/**
+ * Web: the app proves itself with the browser's `Origin`, which Oxy reads from
+ * the request itself (ADR 0045). Nothing to load.
+ *
+ * Native builds resolve `appIntegrityPlatform.native.ts` instead.
+ */
+import type { AppIntegrityPlatform } from './appIntegrityTypes';
+
+export const appIntegrityPlatform: AppIntegrityPlatform = {
+  platform: 'web',
+  loadIntegrity: async () => null,
+};

package/src/ui/appAssertion/appIntegrityTypes.ts

@@ -0,0 +1,23 @@
+import type { AppAssertionPlatform } from '@oxy.so/contracts';
+
+/**
+ * The part of `@expo/app-integrity` the SDK uses: App Attest on iOS, the Play
+ * Integrity standard request on Android. Declared here rather than imported so
+ * the web build never names the native package.
+ */
+export interface AppIntegrityModule {
+  /** Whether this iOS device offers App Attest. `true` on Android. */
+  readonly isSupported: boolean;
+  generateKeyAsync(): Promise<string>;
+  attestKeyAsync(keyId: string, challenge: string): Promise<string>;
+  generateAssertionAsync(keyId: string, challenge: string): Promise<string>;
+  prepareIntegrityTokenProviderAsync(cloudProjectNumber: string): Promise<void>;
+  requestIntegrityCheckAsync(requestHash: string): Promise<string>;
+}
+
+/** How this build proves which app it is. */
+export interface AppIntegrityPlatform {
+  readonly platform: AppAssertionPlatform;
+  /** The native integrity module, or `null` where there is none (web, or a binary without it). */
+  loadIntegrity(): Promise<AppIntegrityModule | null>;
+}

package/src/ui/components/fileManagement/FileAppAccessSection.tsx

@@ -0,0 +1,111 @@
+import type React from 'react';
+import { useCallback, useState } from 'react';
+import { ActivityIndicator, View } from 'react-native';
+import { Avatar } from '@oxy.so/bloom/avatar';
+import { Button } from '@oxy.so/bloom/button';
+import { SettingsListGroup, SettingsListItem } from '@oxy.so/bloom/settings-list';
+import { surfaces } from '@oxy.so/bloom/surfaces';
+import { useTheme } from '@oxy.so/bloom/theme';
+import { toast } from '@oxy.so/bloom/toast';
+import { Text } from '@oxy.so/bloom/typography';
+import type { FileApplicationAccess } from '@oxy.so/core';
+import { useI18n } from '../../hooks/useI18n';
+import { useFileAppAccess } from '../../hooks/queries/useFileQueries';
+import { useRevokeFileAppAccess } from '../../hooks/mutations/useAccountMutations';
+
+const APP_ICON_SIZE = 32;
+
+interface FileAppAccessSectionProps {
+  fileId: string;
+}
+
+/**
+ * "Apps with access" (ADR 0043 stage 4c): the applications that can open this
+ * file on their own — one that stored it for the person (`upload`), one the
+ * person attached it to (`link`) — each with a Revoke action behind a
+ * confirmation. Revoking stops the application reading the file and every
+ * playback it started; the row leaves the list at once and comes back if the
+ * revoke fails. Shown only on the owner's own file.
+ */
+export const FileAppAccessSection: React.FC<FileAppAccessSectionProps> = ({ fileId }) => {
+  const { t } = useI18n();
+  const { colors } = useTheme();
+  const { data: apps, isLoading, isError } = useFileAppAccess(fileId);
+  const revoke = useRevokeFileAppAccess();
+  const [revokingId, setRevokingId] = useState<string | null>(null);
+
+  const confirmRevoke = useCallback(
+    async (app: FileApplicationAccess) => {
+      const confirmed = await surfaces.confirm({
+        title: t('fileManagement.appAccess.confirm.title', { name: app.name }),
+        description: t('fileManagement.appAccess.confirm.message', { name: app.name }),
+        confirmLabel: t('fileManagement.appAccess.revoke'),
+        cancelLabel: t('common.cancel'),
+        destructive: true,
+      });
+      if (!confirmed) return;
+      setRevokingId(app.applicationId);
+      try {
+        await revoke.mutateAsync({ fileId, applicationId: app.applicationId });
+        toast.success(t('fileManagement.appAccess.toasts.revoked', { name: app.name }));
+      } catch {
+        toast.error(t('fileManagement.appAccess.toasts.revokeFailed', { name: app.name }));
+      } finally {
+        setRevokingId(null);
+      }
+    },
+    [fileId, revoke, t],
+  );
+
+  const viaText = (app: FileApplicationAccess): string =>
+    app.via.map((via) => t(`fileManagement.appAccess.via.${via}`)).join(' · ');
+
+  return (
+    <View className="w-full mb-space-24">
+      <Text className="text-text text-[16px] font-semibold mb-space-4">
+        {t('fileManagement.appAccess.title')}
+      </Text>
+      <Text className="text-text-secondary text-[14px] mb-space-12">
+        {t('fileManagement.appAccess.description')}
+      </Text>
+      {isLoading ? (
+        <ActivityIndicator color={colors.primary} />
+      ) : isError ? (
+        <Text className="text-text-secondary text-[14px]">
+          {t('fileManagement.appAccess.loadError')}
+        </Text>
+      ) : !apps || apps.length === 0 ? (
+        <Text className="text-text-secondary text-[14px]">
+          {t('fileManagement.appAccess.empty')}
+        </Text>
+      ) : (
+        <SettingsListGroup>
+          {apps.map((app) => (
+            <SettingsListItem
+              key={app.applicationId}
+              icon={<Avatar source={app.icon} name={app.name} size={APP_ICON_SIZE} />}
+              title={app.name}
+              description={viaText(app)}
+              showChevron={false}
+              rightElement={
+                <Button
+                  appearance="subtle"
+                  tone="danger"
+                  size="sm"
+                  loading={revokingId === app.applicationId}
+                  disabled={revokingId !== null}
+                  accessibilityLabel={t('fileManagement.appAccess.a11y.revoke', { name: app.name })}
+                  onPress={() => {
+                    void confirmRevoke(app);
+                  }}
+                >
+                  {t('fileManagement.appAccess.revoke')}
+                </Button>
+              }
+            />
+          ))}
+        </SettingsListGroup>
+      )}
+    </View>
+  );
+};

package/src/ui/components/fileManagement/FileDetailsModal.tsx

@@ -9,6 +9,7 @@ import { surfaces, type SurfaceControls } from '@oxy.so/bloom/surfaces';
 import type { FileMetadata } from '@oxy.so/core';
 import { useI18n } from '../../hooks/useI18n';
 import { formatFileSize, getFileIcon } from '../../utils/fileManagement';
+import { FileAppAccessSection } from './FileAppAccessSection';
 
 interface FileDetailsModalProps {
   /** The presenting surface's controls (from `surfaces.present`). */
@@ -21,7 +22,8 @@ interface FileDetailsModalProps {
 
 /**
  * File-detail panel — a rich presented surface (NOT a yes/no confirm): a file's
- * icon + metadata plus download / delete / cancel actions. Each action first
+ * icon + metadata, for the owner the applications that can open it ("Apps with
+ * access", ADR 0043 stage 4c), plus download / delete / cancel actions. Each action first
  * dismisses this surface, then runs its handler, so a follow-up delete confirm
  * stacks cleanly above whatever remains. Presented via {@link presentFileDetails}.
  */
@@ -83,6 +85,8 @@ export const FileDetailsModal: React.FC<FileDetailsModalProps> = ({
             </View>
           )}
         </View>
+
+        {isOwner ? <FileAppAccessSection fileId={file.id} /> : null}
       </Card>
 
       <View style={{ gap: 8 }}>