Changing Journalist Codename causes old content to be hidden

[eloquence]

Steps to reproduce

1. Submit a message as a new Source through the Source Interface
2. Refresh the client to fetch the message
3. Through the web interface, click "Change codename" to rotate the journalist codename for that source
4. Refresh the client

Expected behavior

The client updates the source codename and retains all messages/documents

Actual behavior

(On master, 660f5a0, development environment)

The client shows "Content deleted" overlays for previously received messages. Subsequent messages from the same Source are successfully synchronized.

[sssoleileraaa]

More info about bug

The filenames in the data directory use the old journalist_designation and the filenames in the submissions table uses the new designation. When the client displays all the conversation items for a source, it tries to grab the files in the data directory using the filenames stored in the submissions table, which will not exist.

Proposed solution

As discussed with @redshiftzero, we don't need to update the names of old submissions in the submissions table. This keeps our code simpler since we will no longer need to overwrite filenames in the table or add new logic that keeps track of old source names.

[sssoleileraaa]

The proposed solution above would change the current behavior of SecureDrop since it is a server-side change.

Current Behavior on the journalist interface

Here you can see true hairdressing was renamed to unwanted plotter and how both the source name and the old filenames change.

New Behavior on the journalist interface

Here you can see waiting sigmoidoscopy was renamed to activating supernova and how only the source name changes (not the old filenames). Any new submissions or replies will use the new source name.

Behavior on the client

Currently you don't see the filenames on the client, but the filenames would show up when the journalist needs to select documents to download or to view.

[redshiftzero]

Ahh thanks for digging into this @creviera. So I forgot that the server side was renaming files, but it makes sense since journalists who renamed sources mid-conversation using Tails could otherwise be very confused. This is because without renaming files, their correspondence (kept in a folder on their airgapped secure viewing station) would have an odd discontinuity like ['1-spoiled-potato.msg', '2-spoiled-potato.msg', '3-new-name.msg']. If they're not dilligent about organizing files, they might not be sure these files correspond to the same source.

It's worth noting that even with renaming files on the server side, the journalist designation changing can still lead to confusion if the journalist does not re-download the entire conversation and bring the renamed files across the airgap, meaning that they will still have this discontinuity.

Given this is a server-side behavior, it seems like the most reasonable thing to do is to copy the server-side behavior here in the client: that is, when the journalist designation changes, to rename the files locally. This is being done on the database level as you correctly point out, but the missing piece is to rename the files in the client data directory. What do you think?

[sssoleileraaa]

@redshiftzero - Ah, I see. So the filenames help the journalist group submissions together after they've been transferred to the air-gapped secure viewing station.

It's worth noting that even with renaming files on the server side, the journalist designation changing can still lead to confusion if the journalist does not re-download the entire conversation and bring the renamed files across the airgap, meaning that they will still have this discontinuity.

Good point, and good user story. Luckily, with the client and unified workstation, this will be less of an issue since there will be fewer file transfers from the Qubes workstation (only a transfer to the publishing area is needed, I believe).

I agree that we should provide feature parity with the journalist interface + SVS, which means changing the journalist designation as well as the files on the filesystem, and then do more user research! :)