feat(gui): Approve dialog before publishing Bitcoin lock transaction (#291)

This diff introduces a new "approvals" mechanism that alters the swap flow by requiring explicit user intervention before the Bitcoin lock transaction is broadcast. Previously, the Bitcoin lock was executed automatically without any user prompt. Now, the backend defines `ApprovalRequestType` (e.g. a `PreBtcLock` variant with details like `btc_lock_amount`, `btc_network_fee`, and `xmr_receive_amount`) and `ApprovalEvent` (with statuses such as `Pending`, `Resolved`, and `Rejected`). The method `request_approval()` in the `TauriHandle` struct uses a oneshot channel and concurrent timeout handling via `tokio::select!` to wait for the user's decision. Based on the outcome—explicit approval or timeout/rejection—the approval event is emitted through the `emit_approval()` helper, thereby gating the subsequent broadcast of the Bitcoin lock transaction.

On the UI side, changes have been made to reflect the new flow; the modal (for example, in `SwapSetupInflightPage.tsx`) now displays the swap details along with explicit action buttons that call `resolveApproval()` via RPC when clicked. The Redux store, selectors, and hooks like `usePendingPreBtcLockApproval()` have been updated to track and display these approval events. As a result, the overall functionality now requires the user to explicitly approve the swap offer before proceeding, ensuring they are aware of the swap's key parameters and that the locking of funds occurs only after their confirmation.

swap/src/cli/api.rs

@@ -194,7 +194,6 @@ pub struct Context {
 }
 
 /// A conveniant builder struct for [`Context`].
-#[derive(Debug)]
 #[must_use = "ContextBuilder must be built to be useful"]
 pub struct ContextBuilder {
     monero: Option<Monero>,
@@ -512,6 +511,10 @@ impl Context {
     pub fn bitcoin_wallet(&self) -> Option<Arc<bitcoin::Wallet>> {
         self.bitcoin_wallet.clone()
     }
+
+    pub fn tauri_handle(&self) -> Option<TauriHandle> {
+        self.tauri_handle.clone()
+    }
 }
 
 impl fmt::Debug for Context {

swap/src/cli/api/request.rs

@@ -1375,3 +1375,32 @@ impl CheckElectrumNodeArgs {
         })
     }
 }
+
+#[typeshare]
+#[derive(Deserialize, Serialize)]
+pub struct ResolveApprovalArgs {
+    pub request_id: String,
+    pub accept: bool,
+}
+
+#[typeshare]
+#[derive(Deserialize, Serialize)]
+pub struct ResolveApprovalResponse {
+    pub success: bool,
+}
+
+impl Request for ResolveApprovalArgs {
+    type Response = ResolveApprovalResponse;
+
+    async fn request(self, ctx: Arc<Context>) -> Result<Self::Response> {
+        let request_id = Uuid::parse_str(&self.request_id).context("Invalid request ID")?;
+
+        if let Some(handle) = ctx.tauri_handle.clone() {
+            handle.resolve_approval(request_id, self.accept).await?;
+        } else {
+            bail!("Cannot resolve approval without a Tauri handle");
+        }
+
+        Ok(ResolveApprovalResponse { success: true })
+    }
+}

swap/src/cli/api/tauri_bindings.rs

@@ -1,8 +1,15 @@
+use crate::bitcoin;
 use crate::{bitcoin::ExpiredTimelocks, monero, network::quote::BidQuote};
-use anyhow::Result;
+use anyhow::{anyhow, Context, Result};
 use bitcoin::Txid;
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
 use strum::Display;
+use tokio::sync::{oneshot, Mutex as TokioMutex};
 use typeshare::typeshare;
 use url::Url;
 use uuid::Uuid;
@@ -16,12 +23,70 @@ const TIMELOCK_CHANGE_EVENT_NAME: &str = "timelock-change";
 const CONTEXT_INIT_PROGRESS_EVENT_NAME: &str = "context-init-progress-update";
 const BALANCE_CHANGE_EVENT_NAME: &str = "balance-change";
 const BACKGROUND_REFUND_EVENT_NAME: &str = "background-refund";
+const APPROVAL_EVENT_NAME: &str = "approval_event";
 
-#[derive(Debug, Clone)]
+#[typeshare]
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LockBitcoinDetails {
+    #[typeshare(serialized_as = "number")]
+    #[serde(with = "::bitcoin::util::amount::serde::as_sat")]
+    pub btc_lock_amount: bitcoin::Amount,
+    #[typeshare(serialized_as = "number")]
+    #[serde(with = "::bitcoin::util::amount::serde::as_sat")]
+    pub btc_network_fee: bitcoin::Amount,
+    #[typeshare(serialized_as = "number")]
+    pub xmr_receive_amount: monero::Amount,
+    #[typeshare(serialized_as = "string")]
+    pub swap_id: Uuid,
+}
+
+#[typeshare]
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "type", content = "content")]
+pub enum ApprovalRequestDetails {
+    /// Request approval before locking Bitcoin.
+    /// Contains specific details for review.
+    LockBitcoin(LockBitcoinDetails),
+}
+
+#[typeshare]
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "state", content = "content")]
+pub enum ApprovalRequest {
+    Pending {
+        request_id: String,
+        #[typeshare(serialized_as = "number")]
+        expiration_ts: u64,
+        details: ApprovalRequestDetails,
+    },
+    Resolved {
+        request_id: String,
+        details: ApprovalRequestDetails,
+    },
+    Rejected {
+        request_id: String,
+        details: ApprovalRequestDetails,
+    },
+}
+
+struct PendingApproval {
+    responder: Option<oneshot::Sender<bool>>,
+    details: ApprovalRequestDetails,
+    #[allow(dead_code)]
+    expiration_ts: u64,
+}
+
+#[cfg(feature = "tauri")]
+struct TauriHandleInner {
+    app_handle: tauri::AppHandle,
+    pending_approvals: TokioMutex<HashMap<Uuid, PendingApproval>>,
+}
+
+#[derive(Clone)]
 pub struct TauriHandle(
     #[cfg(feature = "tauri")]
     #[cfg_attr(feature = "tauri", allow(unused))]
-    std::sync::Arc<tauri::AppHandle>,
+    Arc<TauriHandleInner>,
 );
 
 impl TauriHandle {
@@ -29,20 +94,146 @@ impl TauriHandle {
     pub fn new(tauri_handle: tauri::AppHandle) -> Self {
         Self(
             #[cfg(feature = "tauri")]
-            std::sync::Arc::new(tauri_handle),
+            Arc::new(TauriHandleInner {
+                app_handle: tauri_handle,
+                pending_approvals: TokioMutex::new(HashMap::new()),
+            }),
         )
     }
 
     #[allow(unused_variables)]
     pub fn emit_tauri_event<S: Serialize + Clone>(&self, event: &str, payload: S) -> Result<()> {
         #[cfg(feature = "tauri")]
-        tauri::Emitter::emit(self.0.as_ref(), event, payload).map_err(anyhow::Error::from)?;
+        {
+            let inner = self.0.as_ref();
+            tauri::Emitter::emit(&inner.app_handle, event, payload).map_err(anyhow::Error::from)?;
+        }
 
         Ok(())
     }
+
+    /// Helper to emit a approval event via the unified event name
+    fn emit_approval(&self, event: ApprovalRequest) -> Result<()> {
+        self.emit_tauri_event(APPROVAL_EVENT_NAME, event)
+    }
+
+    pub async fn request_approval(
+        &self,
+        request_type: ApprovalRequestDetails,
+        timeout_secs: u64,
+    ) -> Result<bool> {
+        #[cfg(not(feature = "tauri"))]
+        {
+            return Ok(true);
+        }
+
+        #[cfg(feature = "tauri")]
+        {
+            // Compute absolute expiration timestamp, and UUID for the request
+            let request_id = Uuid::new_v4();
+            let now_secs = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_secs();
+            let expiration_ts = now_secs + timeout_secs;
+
+            // Build the approval event
+            let details = request_type.clone();
+            let pending_event = ApprovalRequest::Pending {
+                request_id: request_id.to_string(),
+                expiration_ts,
+                details: details.clone(),
+            };
+
+            // Emit the creation of the approval request to the frontend
+            self.emit_approval(pending_event.clone())?;
+
+            tracing::debug!(%request_id, request=?pending_event, "Emitted approval request event");
+
+            // Construct the data structure we use to internally track the approval request
+            let (responder, receiver) = oneshot::channel();
+            let timeout_duration = Duration::from_secs(timeout_secs);
+
+            let pending = PendingApproval {
+                responder: Some(responder),
+                details: request_type.clone(),
+                expiration_ts,
+            };
+
+            // Lock map and insert the pending approval
+            {
+                let mut pending_map = self.0.pending_approvals.lock().await;
+                pending_map.insert(request_id, pending);
+            }
+
+            // Determine if the request will be accepted or rejected
+            // Either by being resolved by the user, or by timing out
+            let accepted = tokio::select! {
+                res = receiver => res.map_err(|_| anyhow!("Approval responder dropped"))?,
+                _ = tokio::time::sleep(timeout_duration) => {
+                    tracing::debug!(%request_id, "Approval request timed out and was therefore rejected");
+                    false
+                },
+            };
+
+            let mut map = self.0.pending_approvals.lock().await;
+            if let Some(pending) = map.remove(&request_id) {
+                let event = if accepted {
+                    ApprovalRequest::Resolved {
+                        request_id: request_id.to_string(),
+                        details: pending.details,
+                    }
+                } else {
+                    ApprovalRequest::Rejected {
+                        request_id: request_id.to_string(),
+                        details: pending.details,
+                    }
+                };
+
+                self.emit_approval(event)?;
+                tracing::debug!(%request_id, %accepted, "Resolved approval request");
+            }
+
+            Ok(accepted)
+        }
+    }
+
+    pub async fn resolve_approval(&self, request_id: Uuid, accepted: bool) -> Result<()> {
+        #[cfg(not(feature = "tauri"))]
+        {
+            return Err(anyhow!(
+                "Cannot resolve approval: Tauri feature not enabled."
+            ));
+        }
+
+        #[cfg(feature = "tauri")]
+        {
+            let mut pending_map = self.0.pending_approvals.lock().await;
+            if let Some(pending) = pending_map.get_mut(&request_id) {
+                let _ = pending
+                    .responder
+                    .take()
+                    .context("Approval responder was already consumed")?
+                    .send(accepted);
+
+                Ok(())
+            } else {
+                Err(anyhow!("Approval not found or already handled"))
+            }
+        }
+    }
 }
 
 pub trait TauriEmitter {
+    fn request_approval<'life0, 'async_trait>(
+        &'life0 self,
+        request_type: ApprovalRequestDetails,
+        timeout_secs: u64,
+    ) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>
+    where
+        'life0: 'async_trait,
+        Self: 'async_trait;
+
     fn emit_tauri_event<S: Serialize + Clone>(&self, event: &str, payload: S) -> Result<()>;
 
     fn emit_swap_progress_event(&self, swap_id: Uuid, event: TauriSwapProgressEvent) {
@@ -94,6 +285,18 @@ pub trait TauriEmitter {
 }
 
 impl TauriEmitter for TauriHandle {
+    fn request_approval<'life0, 'async_trait>(
+        &'life0 self,
+        request_type: ApprovalRequestDetails,
+        timeout_secs: u64,
+    ) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>
+    where
+        'life0: 'async_trait,
+        Self: 'async_trait,
+    {
+        Box::pin(self.request_approval(request_type, timeout_secs))
+    }
+
     fn emit_tauri_event<S: Serialize + Clone>(&self, event: &str, payload: S) -> Result<()> {
         self.emit_tauri_event(event, payload)
     }
@@ -103,9 +306,28 @@ impl TauriEmitter for Option<TauriHandle> {
     fn emit_tauri_event<S: Serialize + Clone>(&self, event: &str, payload: S) -> Result<()> {
         match self {
             Some(tauri) => tauri.emit_tauri_event(event, payload),
+
+            // If no TauriHandle is available, we just ignore the event and pretend as if it was emitted
             None => Ok(()),
         }
     }
+
+    fn request_approval<'life0, 'async_trait>(
+        &'life0 self,
+        request_type: ApprovalRequestDetails,
+        timeout_secs: u64,
+    ) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>
+    where
+        'life0: 'async_trait,
+        Self: 'async_trait,
+    {
+        Box::pin(async move {
+            match self {
+                Some(tauri) => tauri.request_approval(request_type, timeout_secs).await,
+                None => Ok(true),
+            }
+        })
+    }
 }
 
 #[typeshare]

swap/src/protocol/alice/swap.rs

@@ -81,7 +81,7 @@ where
                 Err(_) => {
                     tracing::info!(
                         minutes = %env_config.bitcoin_lock_mempool_timeout.as_secs_f64() / 60.0,
-                        "TxLock lock was not seen in mempool in time",
+                        "TxLock lock was not seen in mempool in time. Alice might have denied our offer.",
                     );
                     AliceState::SafelyAborted
                 }

swap/src/protocol/bob/swap.rs

@@ -1,17 +1,22 @@
 use crate::bitcoin::wallet::ScriptStatus;
 use crate::bitcoin::{ExpiredTimelocks, TxCancel, TxRefund};
-use crate::cli::api::tauri_bindings::{TauriEmitter, TauriHandle, TauriSwapProgressEvent};
+use crate::cli::api::tauri_bindings::ApprovalRequestDetails;
+use crate::cli::api::tauri_bindings::{
+    LockBitcoinDetails, TauriEmitter, TauriHandle, TauriSwapProgressEvent,
+};
 use crate::cli::EventLoopHandle;
 use crate::network::cooperative_xmr_redeem_after_punish::Response::{Fullfilled, Rejected};
 use crate::network::swap_setup::bob::NewSwap;
 use crate::protocol::bob::state::*;
 use crate::protocol::{bob, Database};
 use crate::{bitcoin, monero};
-use anyhow::{bail, Context, Result};
+use anyhow::{bail, Context as AnyContext, Result};
 use std::sync::Arc;
 use tokio::select;
 use uuid::Uuid;
 
+const PRE_BTC_LOCK_APPROVAL_TIMEOUT_SECS: u64 = 120;
+
 pub fn is_complete(state: &BobState) -> bool {
     matches!(
         state,
@@ -145,6 +150,8 @@ async fn next_state(
             // which can lead to the wallet not detect the transaction.
             let monero_wallet_restore_blockheight = monero_wallet.block_height().await?;
 
+            let xmr_receive_amount = state2.xmr;
+
             // Alice and Bob have exchanged info
             // Sign the Bitcoin lock transaction
             let (state3, tx_lock) = state2.lock_btc().await?;
@@ -153,12 +160,50 @@ async fn next_state(
                 .await
                 .context("Failed to sign Bitcoin lock transaction")?;
 
-            // Publish the signed Bitcoin lock transaction
-            let (..) = bitcoin_wallet.broadcast(signed_tx, "lock").await?;
+            let btc_network_fee = tx_lock.fee().context("Failed to get fee")?;
+            let btc_lock_amount = bitcoin::Amount::from_sat(
+                signed_tx
+                    .output
+                    .get(0)
+                    .context("Failed to get lock amount")?
+                    .value,
+            );
 
-            BobState::BtcLocked {
-                state3,
-                monero_wallet_restore_blockheight,
+            let request = ApprovalRequestDetails::LockBitcoin(LockBitcoinDetails {
+                btc_lock_amount,
+                btc_network_fee,
+                xmr_receive_amount,
+                swap_id,
+            });
+
+            // We request approval before publishing the Bitcoin lock transaction, as the exchange rate determined at this step might be different from the
+            // we previously displayed to the user.
+            let approval_result = event_emitter
+                .request_approval(request, PRE_BTC_LOCK_APPROVAL_TIMEOUT_SECS)
+                .await;
+
+            match approval_result {
+                Ok(true) => {
+                    tracing::debug!("User approved swap offer");
+
+                    // Publish the signed Bitcoin lock transaction
+                    let (..) = bitcoin_wallet.broadcast(signed_tx, "lock").await?;
+
+                    BobState::BtcLocked {
+                        state3,
+                        monero_wallet_restore_blockheight,
+                    }
+                }
+                Ok(false) => {
+                    tracing::warn!("User denied or timed out on swap offer approval");
+
+                    BobState::SafelyAborted
+                }
+                Err(err) => {
+                    tracing::warn!(%err, "Failed to get user approval for swap offer. Assuming swap was aborted.");
+
+                    BobState::SafelyAborted
+                }
             }
         }
         // Bob has locked Bitcoin