gitpane 1.0.0__py3-none-any.whl

gitpane/controller/account_controller.py

@@ -0,0 +1,677 @@
+"""Manage the accounts GitPane uses to sign in to remote Git servers."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from shiboken6 import isValid
+
+from gitpane.account.account_choice import check_url_by_origin
+from gitpane.account.authentication import EMPTY_CHECK_URL_TEXT, GENERIC_PROVIDER, store_was_refused, transfer_account
+from gitpane.account.credential_manager import INSTALL_WINDOW_PROBLEM_SET, CredentialManagerProblem, credential_manager_check_again_text, credential_manager_setting_text, ignore_line
+from gitpane.account.keyring_state import UNKNOWN_KEYRING_READING, keyring_stops_sign_in
+from gitpane.config import AUTHENTICATION_PREFERENCE_KEY
+from gitpane.history.file_history import WindowCapability
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.tool.git_executable import terminal_git_filename
+from gitpane.transport.refusal_notice import account_notice_text
+from gitpane.ui.setting.account_page import removal_failure_text, removal_result_text
+from gitpane.ui.setting.add_account_dialog import EMPTY_BITBUCKET_EMAIL_TEXT, EMPTY_PASSWORD_TEXT, EMPTY_SERVER_TEXT, EMPTY_SERVICE_NAME_TEXT, EMPTY_TOKEN_TEXT, EMPTY_USERNAME_TEXT, SELF_HOSTED_BROWSER_TEXT, AddAccountDialog, sign_in_result_text
+from gitpane.ui.setting.credential_manager_dialog import CredentialManagerDialog
+from gitpane.ui.setting.ssh_widget import SshPromptDialog
+from gitpane.ui.widget.result_label import ResultTone
+from gitpane.ui.window_control.dialog_modality import open_window_modal
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from PySide6.QtWidgets import QWidget
+
+    from gitpane.account.authentication import AccountSelection, AuthenticationService, AuthOutcome, SecretLookup
+    from gitpane.account.credential_manager import CredentialManagerDetection
+    from gitpane.account.keyring_state import KeyringReading
+    from gitpane.account.ssh_prompt import SshQuestion
+    from gitpane.controller.operation_policy import OperationPolicy
+    from gitpane.controller.session_registry import SessionRegistry
+    from gitpane.controller.setting_controller import SettingController
+    from gitpane.history.repository import GitRepository
+    from gitpane.history.repository_value import RepositoryContext
+    from gitpane.operation.diagnostic import DiagnosticLog
+    from gitpane.transport.refusal_notice import AccountNotice
+    from gitpane.transport.remote import RemoteService
+    from gitpane.transport.remote_config import RemoteSnapshot
+    from gitpane.ui.setting.account_page import AccountPage
+    from gitpane.ui.setting.setting_dialog import SettingDialog
+    from gitpane.worktree.worktree_service import WorktreeService
+
+# The --log lines of the keyring reads made for a sign-in: the state's value and the name of the program that holds the
+# Secret Service, never a collection name or a secret.
+KEYRING_STATE_LOG_TEMPLATE = "Keyring before sign-in: {state}, held by {program}"
+KEYRING_STATE_AFTER_REFUSAL_LOG_TEMPLATE = "Keyring after a refused store: {state}, held by {program}"
+UNREADABLE_PROGRAM_LOG_TEXT = "an unreadable program"
+
+class AccountController:
+    """The accounts page of Settings, its sign-in windows, the SSH questions of running operations and the window explaining how to install the credential manager."""
+
+    def __init__(self, *, session_registry_controller: SessionRegistry, operation_policy_controller: OperationPolicy, setting_controller: SettingController, repository: GitRepository, worktree_service: WorktreeService, remote: RemoteService,
+                 authentication: AuthenticationService, diagnostic_log: DiagnosticLog | None, read_keyring: Callable[[], KeyringReading]) -> None:
+        """Receive the services and the lower controllers the accounts go through; the wiring builds it after the Settings controller, whose opening and preference changes reach it through the wiring.
+
+        ``read_keyring`` reads, without changing anything, the state of the keyring the credential manager stores
+        secrets in and the program that holds it; it may wait on the session bus, so it is only called on a worker thread.
+        """
+        self.session_registry_controller = session_registry_controller
+        self.operation_policy_controller = operation_policy_controller
+        self.setting_controller = setting_controller
+        self.repository = repository
+        self.worktree_service = worktree_service
+        self.remote = remote
+        self.authentication = authentication
+        self.diagnostic_log = diagnostic_log
+        self.read_keyring = read_keyring
+        # The only window explaining how to install the credential manager; a refusal while it is open adds only its red line.
+        self.credential_manager_dialog: CredentialManagerDialog | None = None
+        # The sign-in form whose refusal the open install window explains, kept while that window is open: once Check
+        # again finds a usable credential manager, the form no longer says signing in is impossible.
+        self.credential_manager_refusal_form: AddAccountDialog | None = None
+        self.ssh_dialog_by_id: dict[str, SshPromptDialog] = {}
+
+    def bind_setting_account_page(self, dialog: SettingDialog, account_page: AccountPage, session_id: str | None, context: RepositoryContext | None) -> None:
+        """Connect the accounts page of a Settings window being built, then fill it: accounts, their stored secrets, the remotes and the credential manager.
+
+        ``session_id`` is the window that asked for Settings, None from the welcome window; ``context`` is the repository
+        Settings opened for, None without one, and then no remote is read.
+        """
+        account_page.add_account_requested.connect(lambda: self.show_add_account(session_id))
+        account_page.reconnect_requested.connect(lambda: self.show_reconnect(session_id))
+        account_page.remove_account_requested.connect(lambda namespace: self.remove_account(session_id, namespace))
+        account_page.save_global_requested.connect(self.save_global_accounts)
+        account_page.save_repository_requested.connect(self.save_repository_accounts)
+        if self.refresh_account_page():
+            self.lookup_account_secrets(dialog)
+        if context is not None:
+            self.read_account_remotes(dialog)
+        self.check_credential_manager_for_setting(dialog)
+
+    def offer_account_after_refusal(self, session_id: str | None, notice: AccountNotice) -> None:
+        """Open Settings on Accounts with an orange notice naming what Git refused, so the user can add or reconnect the account.
+
+        The failed operation is never started again: the user runs it again once the account works. An already open
+        Settings window is brought back as it is, keeping every unsaved draft; a window that may not manage settings
+        opens nothing.
+        """
+        dialog = self.setting_controller.show_setting(session_id, section="accounts")
+        if dialog is None:
+            return
+        dialog.account_page.show_account_notice(account_notice_text(notice), notice.address)
+
+    def offer_credential_manager_install(self, detection: CredentialManagerDetection, parent: QWidget | None) -> bool:
+        """Open the window explaining how to install the credential manager, for a refusal that stopped an operation the user asked for.
+
+        Returns True when an install window is open after the call, whether it was just opened or already open; a second
+        refusal never opens a second window. An open install window is offered again only while it can take clicks: once
+        a modal window it does not belong to opened after it, such as Settings, Qt blocks it, so it is closed and a new
+        one opens over ``parent``. A console blocks it the same way, so it is replaced too, when the console is modal for
+        the whole application, as on macOS, or modal for the install window's own repository window; only a console over
+        another repository window on Windows and Linux leaves it taking clicks, so it stays. Does nothing for an
+        unsupported system, which has nothing to install, nor while GitPane is closing. No operation is started again:
+        the user runs it again once the credential manager is installed.
+        """
+        if detection.problem not in INSTALL_WINDOW_PROBLEM_SET:
+            return False
+        if self.session_registry_controller.shutdown_requested:
+            return False
+        existing = self.credential_manager_dialog
+        if existing is not None and isValid(existing):
+            if not existing.blocked_by_modal:
+                return True
+            # Its finished signal forgets it, and only if it is still the window kept here, so the new one stays kept.
+            existing.close()
+        dialog = CredentialManagerDialog(self.authentication.credential_manager.install_lines(detection), detection, parent)
+        self.credential_manager_dialog = dialog
+        dialog.finished.connect(lambda _result, dialog=dialog: self._forget_credential_manager_dialog(dialog))
+        dialog.check_again_requested.connect(lambda dialog=dialog: self._check_credential_manager_again(dialog))
+        dialog.show()
+        return True
+
+    def _check_credential_manager_again(self, dialog: CredentialManagerDialog) -> None:
+        """Search again for the credential manager of the Git the operations will use, once the user says it is installed.
+
+        The window closes when a usable credential manager is found, and the sign-in form whose refusal it explained, if
+        still open, takes that refusal and its install lines away; otherwise the window says what changed and its install
+        text becomes the one of the refusal found, and the form keeps its refusal. No operation is started again: the
+        user runs the refused one again. The search runs off the window's thread.
+        """
+        dialog.set_checking(True)
+
+        def found(detection: CredentialManagerDetection | None, error: Exception | None) -> None:
+            """Report the answer in the install window, only while it is still the open one."""
+            # An open Settings window shows what this search found too, even once the install window is gone.
+            self._show_credential_manager_setting(detection, error)
+            if self.credential_manager_dialog is not dialog or not isValid(dialog):
+                return
+            dialog.set_checking(False)
+            if error is not None:
+                dialog.show_check_result(str(error))
+                return
+            if detection.problem == CredentialManagerProblem.NONE:
+                form = self.credential_manager_refusal_form
+                if form is not None and isValid(form) and not form.closed:
+                    form.clear_credential_manager_refusal()
+                dialog.accept()
+                return
+            platform = self.authentication.credential_manager.platform
+            text = credential_manager_check_again_text(dialog.detection, detection, platform)
+            # The text is rewritten for every refusal found, so the short answer of a later Check again always refers
+            # to what the window shows.
+            dialog.show_detection(self.authentication.credential_manager.install_lines(detection), detection)
+            dialog.show_check_result(text)
+
+        self.authentication.locate_credential_manager(terminal_git_filename(self.repository.git_filename), found)
+
+    def check_credential_manager_for_setting(self, dialog: SettingDialog) -> None:
+        """Search in the background for the credential manager shown in the Accounts page of a Settings window that just opened.
+
+        A success already kept for this Git is shown at once; the search started next confirms it without starting
+        --version again. The answer only reaches the Settings window that asked while it is still the open one, and
+        never opens the install window.
+        """
+        git_filename = terminal_git_filename(self.repository.git_filename)
+        # Workaround: the kept success is read without the search's lock, because a running search may hold that lock
+        # up to the probe time limit of each candidate and the window's thread must never wait for it. Reading one dict
+        # entry is atomic, and the search started just below confirms or replaces what is shown.
+        kept = self.authentication.credential_manager.detection_by_git_filename.get(git_filename)
+        if kept is not None:
+            dialog.account_page.show_credential_manager(credential_manager_setting_text(kept, self.authentication.credential_manager.platform), False)
+        else:
+            dialog.account_page.show_credential_manager_checking()
+
+        def found(detection: CredentialManagerDetection | None, error: Exception | None) -> None:
+            """Show the answer only while the Settings window that asked is still the open one."""
+            if self.session_registry_controller.setting_dialog is not dialog or not isValid(dialog):
+                return
+            self._show_credential_manager_setting(detection, error)
+
+        self.authentication.locate_credential_manager(git_filename, found)
+
+    def _show_credential_manager_setting(self, detection: CredentialManagerDetection | None, error: Exception | None) -> None:
+        """Write in the credential manager line of the open Settings window what a search found; does nothing while Settings is closed."""
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None or not isValid(dialog):
+            return
+        if error is not None:
+            dialog.account_page.show_credential_manager(str(error), True)
+            return
+        text = credential_manager_setting_text(detection, self.authentication.credential_manager.platform)
+        dialog.account_page.show_credential_manager(text, detection.problem != CredentialManagerProblem.NONE)
+
+    def _forget_credential_manager_dialog(self, dialog: CredentialManagerDialog) -> None:
+        """Forget the install window once it closes, with the sign-in form it explained, unless a newer one already replaced it, so the next refusal can open one again."""
+        if self.credential_manager_dialog is dialog:
+            self.credential_manager_dialog = None
+            self.credential_manager_refusal_form = None
+
+    def show_ssh_question(self, question: SshQuestion) -> None:
+        """Open a private credential question owned by the captured running operation."""
+        dialog = SshPromptDialog(question)
+        self.ssh_dialog_by_id[question.operation_id] = dialog
+        dialog.finished.connect(lambda: self.ssh_dialog_by_id.pop(question.operation_id, None))
+        open_window_modal(dialog)
+
+    def close_ssh_question(self, operation_id: str) -> None:
+        """Discard a question when its socket closes or its operation is cancelled."""
+        dialog = self.ssh_dialog_by_id.pop(operation_id, None)
+        if dialog is not None and isValid(dialog):
+            dialog.reject()
+            dialog.deleteLater()
+
+    def show_add_account(self, session_id: str | None) -> None:
+        """Open the sign-in window that adds a new account to Connected accounts."""
+        self._open_account_sign_in(session_id, None)
+
+    def show_reconnect(self, session_id: str | None) -> None:
+        """Open the sign-in window that renews the account selected in Connected accounts."""
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None:
+            return
+        namespace = dialog.account_page.selected_namespace()
+        if namespace is None:
+            return
+        catalogue = self.authentication.catalogue()
+        for selection in catalogue.accounts:
+            if selection.namespace == namespace:
+                self._open_account_sign_in(session_id, selection, catalogue.service_name_by_origin.get(selection.origin, ""))
+                return
+
+    def _open_account_sign_in(self, session_id: str | None, reconnect: AccountSelection | None, service_name: str = "") -> None:
+        """Show one sign-in window at a time for Settings; the window that asked must be allowed to manage settings.
+
+        ``service_name`` is the name of the renewed account's address, shown in the Reconnect window. The remotes already
+        read for This repository give the window a repository URL per address, so a username + password on the address
+        of one of them is tested there without asking; remotes read later reach the open window as they arrive.
+        """
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None or session_id is not None and not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        page = dialog.account_page
+        if page.sign_in_dialog is not None and isValid(page.sign_in_dialog):
+            page.sign_in_dialog.showNormal()
+            page.sign_in_dialog.raise_()
+            page.sign_in_dialog.activateWindow()
+            return
+        add_dialog = AddAccountDialog(dialog, reconnect=reconnect, service_name=service_name, service_name_by_origin=self.service_name_by_origin(),
+                                      known_check_url_by_origin=check_url_by_origin(page.remote_entries or ()), browser_timeout_ms=self.authentication.browser_timeout_ms)
+        page.sign_in_dialog = add_dialog
+
+        def owner_is_current() -> bool:
+            """Publish only while the Settings window that opened the sign-in is still the open one."""
+            return self.session_registry_controller.setting_dialog is dialog
+
+        def on_success(outcome: AuthOutcome) -> None:
+            """Show the refreshed list and the result in the Settings window that asked."""
+            self._account_signed_in(dialog, outcome, reconnect is not None)
+
+        def finished() -> None:
+            """Forget the closed window so the next Add account or Reconnect opens a fresh one.
+
+            Nothing is raised here: a browser sign-in ends while the browser is in front, and raising a window asks macOS
+            to bring GitPane forward. Settings stays above the other GitPane windows because it is modal.
+            """
+            if isValid(page) and page.sign_in_dialog is add_dialog:
+                page.sign_in_dialog = None
+            add_dialog.deleteLater()
+
+        add_dialog.sign_in_requested.connect(lambda token_mode: self.start_account_sign_in(add_dialog, token_mode, owner_is_current, on_success))
+        add_dialog.cancel_requested.connect(lambda: self.cancel_account_sign_in(add_dialog))
+        add_dialog.finished.connect(finished)
+        # Modal over Settings: a form left non-modal would take the level of the modal Settings on macOS and stay above
+        # the browser while GitPane waits for a browser sign-in.
+        open_window_modal(add_dialog)
+
+    def start_account_sign_in(self, add_dialog: AddAccountDialog, token_mode: bool, owner_is_current: Callable[[], bool], on_success: Callable[[AuthOutcome], None]) -> None:
+        """Capture the window's authority and generation before the private sign-in exchange starts.
+
+        ``token_mode`` is true when a secret was typed, false for browser sign-in. On GitHub, gitlab.com and Bitbucket
+        Cloud a typed secret is a personal access token whose identity the service's API checks; on any other server it
+        is the password or token of a generic account, saved only once Git lists the repository typed in the window with
+        them; a failed test is also written to the --log file, without any secret. Which browser sign-in
+        fits the address is only the window's answer. Reconnect renews exactly the selected account. Any window that
+        owns an Add account or Reconnect window can use this: ``owner_is_current`` tells whether the window that opened
+        it still accepts results, and ``on_success`` shows the result there. No repository is reserved, because the
+        account list belongs to no repository.
+
+        Before any exchange, the keyring is read off the window's thread: when the GNOME keyring's default collection is
+        not published on the session bus, the credential manager could not store the account, so nothing is sent and the
+        window says why. The typed secret is kept only until that read answers.
+        """
+        if add_dialog.operation_id:
+            return
+        reconnect = add_dialog.reconnect
+        refusal = self._account_form_refusal(add_dialog, token_mode)
+        if refusal:
+            add_dialog.clear_password()
+            add_dialog.show_refusal(refusal)
+            return
+        # The password or token is the one value taken exactly as typed, blanks included: a space may be part of a secret.
+        secret = add_dialog.password_edit.text() if token_mode else ""
+        check_url = add_dialog.check_url()
+        api_email = add_dialog.bitbucket_email() if add_dialog.asks_bitbucket_email() else ""
+        username = add_dialog.username()
+        service_name = add_dialog.service_name()
+        server_url = add_dialog.server_url()
+        cloud_provider = add_dialog.cloud_provider()
+        browser_provider = add_dialog.browser_provider()
+        generation = add_dialog.generation
+        add_dialog.refused_outcome = None
+        add_dialog.set_running(True, token=token_mode)
+
+        def is_current() -> bool:
+            """Authorize nonsecret publication only while the captured sign-in window still owns it."""
+            return owner_is_current() and isValid(add_dialog) and not add_dialog.closed and add_dialog.generation == generation
+
+        def complete(outcome: AuthOutcome) -> None:
+            """Close the window after a full success; otherwise keep it open with the failed step and its cause.
+
+            When the secure store refused to save, the keyring is read again first: a collection still locked, not
+            published, or no default collection at all explains the refusal and is said with it. The refusal is kept on
+            the window during that read, so Cancel there shows it rather than a cancelled try.
+            """
+            if not is_current():
+                return
+            add_dialog.operation_id = ""
+            if outcome.status == OperationStatus.SUCCESS and outcome.selection is not None:
+                add_dialog.set_running(False)
+                on_success(outcome)
+                add_dialog.accept()
+                return
+            if not store_was_refused(outcome):
+                self._report_sign_in_failure(add_dialog, outcome, UNKNOWN_KEYRING_READING)
+                return
+
+            def keyring_read_after_refusal(reading: KeyringReading) -> None:
+                """Show the refused store with what the keyring read again says, unless the window no longer accepts results."""
+                if not is_current():
+                    return
+                add_dialog.refused_outcome = None
+                self._log_keyring_reading(KEYRING_STATE_AFTER_REFUSAL_LOG_TEMPLATE, reading)
+                self._report_sign_in_failure(add_dialog, outcome, reading)
+
+            add_dialog.refused_outcome = outcome
+            add_dialog.read_keyring_state(self.read_keyring, keyring_read_after_refusal, log_line=self._log_line())
+
+        def start_exchange() -> None:
+            """Start the exchange the window asked for: renew the selected account, or sign in with a token, a password or the browser."""
+            if reconnect is not None:
+                add_dialog.operation_id = self.authentication.approve(reconnect, secret, complete, api_email=api_email, is_current=is_current, check_url=check_url,
+                                                                      git_filename=self.repository.git_filename)
+                return
+            if token_mode and cloud_provider is not None:
+                add_dialog.operation_id = self.authentication.sign_in(cloud_provider, server_url, complete, token=secret, api_email=api_email, service_name=service_name,
+                                                                      git_filename=self.repository.git_filename, is_current=is_current)
+                return
+            if token_mode:
+                add_dialog.operation_id = self.authentication.sign_in(GENERIC_PROVIDER, server_url, complete, token=secret, username=username, service_name=service_name,
+                                                                      git_filename=self.repository.git_filename, is_current=is_current, check_url=check_url)
+                return
+            add_dialog.operation_id = self.authentication.sign_in(browser_provider, server_url, complete, service_name=service_name, git_filename=self.repository.git_filename,
+                                                                  is_current=is_current)
+
+        def keyring_answered(reading: KeyringReading) -> None:
+            """Stop before anything is sent when the keyring cannot store the account; any other reading lets the exchange start as before.
+
+            Only the answer already seen with the GNOME keyring stops it: its default collection not published, in the
+            very first session of a new system or user. The same answer from KDE Wallet, KeePassXC, any other program or
+            a program that could not be read lets the exchange go, so the credential manager's own output says what
+            happened. A locked collection does not stop it: the keyring asks for its password when the credential
+            manager stores the account. A keyring with no default collection does not stop it either: the credential
+            manager's library asks the desktop to create one when it stores the account, and the user decides. A state
+            that could not be read says nothing and stops nothing.
+            """
+            if not is_current():
+                return
+            self._log_keyring_reading(KEYRING_STATE_LOG_TEMPLATE, reading)
+            if keyring_stops_sign_in(reading):
+                add_dialog.show_keyring_refusal(reading)
+                return
+            start_exchange()
+
+        add_dialog.read_keyring_state(self.read_keyring, keyring_answered, log_line=self._log_line())
+
+    def _account_form_refusal(self, add_dialog: AddAccountDialog, token_mode: bool) -> str:
+        """Say what the sign-in form still misses before anything starts, or return an empty text when it can start.
+
+        Fields are checked in the order the form shows them. A new account needs a service name, whatever the way it
+        signs in. A Reconnect only needs the new secret: its server, service name and username are fixed, and a
+        Bitbucket account already has its e-mail saved. A username + password account, new or reconnected, also needs a
+        repository of its server to be tested on.
+        """
+        adding = add_dialog.reconnect is None
+        if adding and not add_dialog.server_url():
+            return EMPTY_SERVER_TEXT
+        if adding and not add_dialog.service_name():
+            return EMPTY_SERVICE_NAME_TEXT
+        if not token_mode:
+            if adding and add_dialog.browser_provider() is None:
+                return SELF_HOSTED_BROWSER_TEXT
+            return ""
+        if adding and add_dialog.asks_username() and not add_dialog.username():
+            return EMPTY_USERNAME_TEXT
+        if add_dialog.asks_check_url() and not add_dialog.check_url():
+            return EMPTY_CHECK_URL_TEXT.format(address=add_dialog.address())
+        # A secret made only of spaces is still a secret, so it is checked exactly as typed.
+        if not add_dialog.password_edit.text():
+            return EMPTY_TOKEN_TEXT if add_dialog.asks_token() else EMPTY_PASSWORD_TEXT
+        if adding and add_dialog.asks_bitbucket_email() and not add_dialog.bitbucket_email():
+            return EMPTY_BITBUCKET_EMAIL_TEXT
+        return ""
+
+    def service_name_by_origin(self) -> dict[str, str]:
+        """Read the names already given to service addresses, for the sign-in window to propose; an unreadable list proposes none."""
+        try:
+            return self.authentication.catalogue().service_name_by_origin
+        except (OSError, ValueError, TypeError, KeyError):
+            return {}
+
+    def _report_sign_in_failure(self, add_dialog: AddAccountDialog, outcome: AuthOutcome, keyring_reading: KeyringReading) -> None:
+        """Keep the sign-in window open with the failed step, the keyring sentence when the keyring explains it, and the cause.
+
+        A failed Git test is also written to the --log journal, without any secret. A refused credential manager adds
+        its install lines under the refusal and offers the window that explains how to install it.
+        """
+        if outcome.check is not None and outcome.diagnostic is not None and self.diagnostic_log is not None:
+            self.diagnostic_log.write(outcome.diagnostic)
+        add_dialog.show_failure(outcome, keyring_reading=keyring_reading)
+        # The form keeps the refusal sentence and the install lines; closing the install window brings the user back
+        # to it, to click the sign-in button again once the credential manager is installed. Only Check again that
+        # finds a usable one takes them away.
+        refusal = outcome.credential_manager_refusal
+        if refusal is not None:
+            if refusal.problem in INSTALL_WINDOW_PROBLEM_SET:
+                add_dialog.show_install_text(self.authentication.credential_manager.install_lines(refusal))
+            if self.offer_credential_manager_install(refusal, add_dialog):
+                self.credential_manager_refusal_form = add_dialog
+
+    def cancel_account_sign_in(self, add_dialog: AddAccountDialog) -> None:
+        """Stop the exact running exchange and make sure its late result is ignored.
+
+        Once the exchange has ended with a refused store, only the keyring read that explains it is still running: the
+        refusal is already known, so Cancel shows it, with its output and without any keyring sentence, rather than
+        saying the sign-in was cancelled; the keyring's late answer then changes nothing.
+        """
+        if not isValid(add_dialog):
+            return
+        refused_outcome = add_dialog.refused_outcome
+        if refused_outcome is not None and not add_dialog.operation_id:
+            add_dialog.refused_outcome = None
+            add_dialog.generation += 1
+            add_dialog.forget_keyring_answer()
+            if add_dialog.closed:
+                add_dialog.set_running(False)
+                return
+            self._report_sign_in_failure(add_dialog, refused_outcome, UNKNOWN_KEYRING_READING)
+            return
+        add_dialog.refused_outcome = None
+        if add_dialog.operation_id:
+            self.authentication.cancel(add_dialog.operation_id)
+        add_dialog.operation_id = ""
+        add_dialog.generation += 1
+        add_dialog.forget_keyring_answer()
+        add_dialog.set_running(False)
+        if not add_dialog.closed:
+            add_dialog.show_cancelled()
+
+    def _log_line(self) -> Callable[[str], None]:
+        """Return what writes one line to the --log journal from any thread, or what writes nothing without a journal."""
+        if self.diagnostic_log is None:
+            return ignore_line
+        return self.diagnostic_log.write_line
+
+    def _log_keyring_reading(self, template: str, reading: KeyringReading) -> None:
+        """Write a keyring reading made for a sign-in to the --log journal: the state's value and the program's name, never a collection name or a secret."""
+        program = reading.program or UNREADABLE_PROGRAM_LOG_TEXT
+        self._log_line()(template.format(state=reading.state.value, program=program))
+
+    def _account_signed_in(self, dialog: SettingDialog, outcome: AuthOutcome, reconnect: bool) -> None:
+        """Reread the account list into Settings and say what happened to the account, and that it is already saved.
+
+        A refusal notice for the same address is cleared, since the account it asked for is now connected; the refused
+        operation is not started again, the user runs it again.
+        """
+        if self.session_registry_controller.setting_dialog is not dialog or not isValid(dialog):
+            return
+        account = transfer_account(outcome.selection)
+        if account is not None:
+            dialog.account_page.clear_account_notice(account.address)
+        if not self.refresh_account_page():
+            return
+        dialog.account_page.show_message(sign_in_result_text(outcome, reconnect=reconnect, saved_note=True), ResultTone.SUCCESS)
+
+    def remove_account(self, session_id: str | None, namespace: str) -> None:
+        """Remove the confirmed account: its stored secret is erased, then it leaves Connected accounts; no repository is touched.
+
+        The window that asked must still be allowed to manage settings. The result is shown only in the Settings window
+        that asked; if it closed meanwhile, the service still finishes a removal whose secret was erased.
+        """
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None or not isValid(dialog) or session_id is not None and not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        page = dialog.account_page
+        try:
+            catalogue = self.authentication.catalogue()
+        except (OSError, ValueError, TypeError) as error:
+            page.show_message(Diagnostic("Read accounts", "", "", [], str(error)).prepare().cause, ResultTone.FAILURE)
+            return
+        selection = None
+        for account in catalogue.accounts:
+            if account.namespace == namespace:
+                selection = account
+        if selection is None:
+            self.refresh_account_page()
+            return
+        page.set_removing(True, selection.label)
+
+        def is_current() -> bool:
+            """Accept the result only while the Settings window that asked is still the open one."""
+            return self.session_registry_controller.setting_dialog is dialog
+
+        def complete(outcome: AuthOutcome) -> None:
+            """Show the refreshed list and say what happened: removed and what to choose again, or which step failed."""
+            if self.session_registry_controller.setting_dialog is not dialog or not isValid(dialog):
+                return
+            page.set_removing(False)
+            self.refresh_account_page()
+            if outcome.status == OperationStatus.SUCCESS and outcome.removal is not None:
+                page.show_message(removal_result_text(selection, outcome.removal), ResultTone.SUCCESS)
+                return
+            page.show_message(removal_failure_text(selection, outcome), ResultTone.FAILURE)
+            if outcome.diagnostic is not None and self.diagnostic_log is not None:
+                self.diagnostic_log.write(outcome.diagnostic)
+            # The account stays listed and the page says it was not removed; the install window comes on top of Settings.
+            if outcome.credential_manager_refusal is not None:
+                self.offer_credential_manager_install(outcome.credential_manager_refusal, dialog)
+
+        self.authentication.remove_account(selection, complete, is_current=is_current)
+
+    def refresh_account_page(self) -> bool:
+        """Reread the accounts into the open Settings window; the page keeps every row the user changed.
+
+        Returns False when the read failed, after showing why on the page, or when no Settings window is open.
+        """
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None or not isValid(dialog):
+            return False
+        page = dialog.account_page
+        try:
+            page.show_catalogue(self.authentication.catalogue(dialog.git_setting_widget.context))
+        except (OSError, ValueError, TypeError) as error:
+            page.show_message(Diagnostic("Read accounts", "", "", [], str(error)).prepare().cause, ResultTone.FAILURE)
+            return False
+        return True
+
+    def lookup_account_secrets(self, dialog: SettingDialog) -> None:
+        """Check, in the background, which listed accounts lost their stored secret, and mark them in this Settings window when it answers.
+
+        The check never prompts, never contacts a server and writes nothing; it does not delay the opening of Settings,
+        and its answer only reaches the window that asked for it while it is still the open one.
+        """
+        try:
+            accounts = self.authentication.catalogue().accounts
+        except (OSError, ValueError, TypeError, KeyError):
+            return
+        if not accounts:
+            return
+
+        def is_current() -> bool:
+            """Accept the answer only while the Settings window that asked is still the open one."""
+            return self.session_registry_controller.setting_dialog is dialog and isValid(dialog)
+
+        self.authentication.lookup_secrets(accounts, self.show_account_status, is_current=is_current)
+
+    def show_account_status(self, lookup: SecretLookup) -> None:
+        """Mark again, in the open Settings window, the listed accounts whose stored secret is known to be gone, and those this check found."""
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None or not isValid(dialog):
+            return
+        dialog.account_page.show_needs_reconnect(frozenset(self.authentication.missing_secret_namespace_set), lookup.present_namespace_set)
+
+    def save_global_accounts(self) -> None:
+        """Write only the defaults changed in the Global block; a refusal is shown in that block and its draft is kept."""
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None or not isValid(dialog):
+            return
+        page = dialog.account_page
+        changes = page.global_changes()
+        if not changes:
+            return
+        try:
+            self.authentication.save_global_defaults(changes)
+        except (OSError, ValueError, TypeError) as error:
+            diagnostic = Diagnostic("Save global settings", "", "", [], str(error)).prepare()
+            page.show_global_error(diagnostic.cause)
+            if self.diagnostic_log is not None:
+                self.diagnostic_log.write(diagnostic)
+            return
+        page.global_saved()
+
+    def save_repository_accounts(self) -> None:
+        """Write only the rows changed in This repository, for the repository Settings was opened for; a refusal stays in that block with its draft."""
+        dialog = self.session_registry_controller.setting_dialog
+        if dialog is None or not isValid(dialog):
+            return
+        context = dialog.git_setting_widget.context
+        page = dialog.account_page
+        changes = page.repository_changes()
+        if context is None or not changes:
+            return
+        try:
+            self.authentication.save_repository_choices(changes, context)
+        except (OSError, ValueError, TypeError) as error:
+            diagnostic = Diagnostic("Save this repository settings", context.repository_dir, "", [], str(error)).prepare()
+            page.show_repository_error(diagnostic.cause)
+            if self.diagnostic_log is not None:
+                self.diagnostic_log.write(diagnostic)
+            return
+        page.repository_saved()
+
+    def read_account_remotes(self, dialog: SettingDialog) -> None:
+        """Read the remotes of the repository Settings was opened for, so This repository can show one row per HTTPS address.
+
+        Only reads: nothing is written to Git or to the preferences. The result reaches the page only while the same
+        Settings window is open and no newer read was started for it; an Add account or Reconnect window already open
+        from that page also learns the repository URL of each address, to test a username + password there.
+        """
+        context = dialog.git_setting_widget.context
+        if context is None:
+            return
+        page = dialog.account_page
+        page.remote_generation += 1
+        generation = page.remote_generation
+        git_filename = self.repository.git_filename
+
+        def complete(snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+            """Show the remotes, or why they could not be read, in the page that asked for this very read."""
+            if self.session_registry_controller.setting_dialog is not dialog or not isValid(dialog) or not isValid(page) or generation != page.remote_generation:
+                return
+            if error is not None or snapshot is None:
+                diagnostic = Diagnostic("Read remotes", context.repository_dir, "", [], str(error)).prepare()
+                page.show_remote_error(diagnostic.cause)
+                if self.diagnostic_log is not None:
+                    self.diagnostic_log.write(diagnostic)
+                return
+            entries = tuple(snapshot.entry_by_name.values())
+            page.show_remotes(entries)
+            sign_in_dialog = page.sign_in_dialog
+            if sign_in_dialog is None or not isValid(sign_in_dialog):
+                return
+            for origin, url in check_url_by_origin(entries).items():
+                sign_in_dialog.set_known_check_url(origin, url)
+
+        self.worktree_service.run(context, git_filename, self.remote.capture(context, git_filename, generation), complete)
+
+    def preference_changed_for_accounts(self, changed_value_by_key: dict[str, object]) -> None:
+        """Show again, in an open Settings window, the accounts a change of the shared preferences touched."""
+        # A sign-in, a block save or another window may have changed the accounts; an open Settings shows them without
+        # losing what the user chose.
+        if AUTHENTICATION_PREFERENCE_KEY in changed_value_by_key:
+            self.refresh_account_page()