fix(geofence): restrict crossing alerts to creator, add per-geofence opt-in (#6117)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: jamesarich

.skills/compose-ui/strings-index.txt

@@ -143,6 +143,7 @@ import org.meshtastic.feature.map.LastHeardFilter
 import org.meshtastic.feature.map.component.EditWaypointDialog
 import org.meshtastic.feature.map.component.MapButton
 import org.meshtastic.feature.map.component.MapControlsOverlay
+import org.meshtastic.feature.map.component.WaypointInfoDialog
 import org.meshtastic.proto.Waypoint
 import org.osmdroid.bonuspack.utils.BonusPackHelper.getBitmapFromVectorDrawable
 import org.osmdroid.config.Configuration
@@ -256,6 +257,7 @@ fun MapView(
     var showDownloadButton: Boolean by remember { mutableStateOf(false) }
     var showEditWaypointDialog by remember { mutableStateOf<Waypoint?>(null) }
     var showDeleteWaypointDialog by remember { mutableStateOf<Waypoint?>(null) }
+    var showGeofenceInfoDialog by remember { mutableStateOf<Waypoint?>(null) }
     var showCacheManagerDialog by remember { mutableStateOf(false) }
     var showCurrentCacheInfo by remember { mutableStateOf(false) }
     var showPurgeTileSourceDialog by remember { mutableStateOf(false) }
@@ -424,11 +426,15 @@ fun MapView(
         performHapticFeedback()
         Logger.d { "marker long pressed id=$id" }
         val waypoint = waypoints[id]?.waypoint ?: return
-        // edit only when unlocked or lockedTo myNodeNum
-        if (waypoint.locked_to in setOf(0, mapViewModel.myNodeNum ?: 0) && isConnected) {
-            showEditWaypointDialog = waypoint
-        } else {
-            showDeleteWaypointDialog = waypoint
+        when {
+            // Foreign geofences: read-only view hosting the receiver-local crossing-alert opt-in.
+            waypoint.toGeofence() != null && !mapViewModel.isMyWaypoint(id) -> showGeofenceInfoDialog = waypoint
+
+            // edit only when unlocked or lockedTo myNodeNum
+            waypoint.locked_to in setOf(0, mapViewModel.myNodeNum ?: 0) && isConnected ->
+                showEditWaypointDialog = waypoint
+
+            else -> showDeleteWaypointDialog = waypoint
         }
     }
 
@@ -819,6 +825,28 @@ fun MapView(
         )
     }
 
+    showGeofenceInfoDialog?.let { waypoint ->
+        val optIns by mapViewModel.geofenceAlertOptIns.collectAsStateWithLifecycle()
+        WaypointInfoDialog(
+            waypoint = waypoint,
+            displayUnits = displayUnits,
+            alertsEnabled = waypoint.id in optIns,
+            onToggleAlerts = { mapViewModel.setGeofenceAlertOptIn(waypoint.id, it) },
+            onDismissRequest = { showGeofenceInfoDialog = null },
+            // Unlocked foreign geofences can still be edited/re-broadcast (only while connected, since editing means
+            // re-sending); locked ones stay read-only.
+            onEdit =
+            if (waypoint.locked_to == 0 && isConnected) {
+                {
+                    showGeofenceInfoDialog = null
+                    showEditWaypointDialog = waypoint
+                }
+            } else {
+                null
+            },
+        )
+    }
+
     if (showDeleteWaypointDialog != null) {
         val waypoint = showDeleteWaypointDialog ?: return
         val canDeleteForEveryone = waypoint.locked_to in setOf(0, mapViewModel.myNodeNum ?: 0) && isConnected

androidApp/src/fdroid/kotlin/org/meshtastic/app/map/MapView.kt

@@ -24,6 +24,7 @@ import org.koin.core.annotation.KoinViewModel
 import org.meshtastic.core.common.BuildConfigProvider
 import org.meshtastic.core.repository.MapPrefs
 import org.meshtastic.core.repository.NodeRepository
+import org.meshtastic.core.repository.NotificationPrefs
 import org.meshtastic.core.repository.PacketRepository
 import org.meshtastic.core.repository.RadioConfigRepository
 import org.meshtastic.core.repository.RadioController
@@ -37,9 +38,17 @@ class MapViewModel(
     nodeRepository: NodeRepository,
     radioController: RadioController,
     radioConfigRepository: RadioConfigRepository,
+    notificationPrefs: NotificationPrefs,
     buildConfigProvider: BuildConfigProvider,
     savedStateHandle: SavedStateHandle,
-) : BaseMapViewModel(mapPrefs, nodeRepository, packetRepository, radioController, radioConfigRepository) {
+) : BaseMapViewModel(
+    mapPrefs,
+    nodeRepository,
+    packetRepository,
+    radioController,
+    radioConfigRepository,
+    notificationPrefs,
+) {
 
     private val _selectedWaypointId = MutableStateFlow(savedStateHandle.get<Int>("waypointId"))
     val selectedWaypointId: StateFlow<Int?> = _selectedWaypointId.asStateFlow()

androidApp/src/fdroid/kotlin/org/meshtastic/app/map/MapViewModel.kt

@@ -150,6 +150,7 @@ import org.meshtastic.feature.map.LastHeardFilter
 import org.meshtastic.feature.map.component.EditWaypointDialog
 import org.meshtastic.feature.map.component.MapButton
 import org.meshtastic.feature.map.component.MapControlsOverlay
+import org.meshtastic.feature.map.component.WaypointInfoDialog
 import org.meshtastic.feature.map.tracerouteNodeSelection
 import org.meshtastic.proto.BoundingBox
 import org.meshtastic.proto.Config.DisplayConfig.DisplayUnits
@@ -250,6 +251,7 @@ fun MapView(
     val mapFilterState by mapViewModel.mapFilterStateFlow.collectAsStateWithLifecycle()
     val ourNodeInfo by mapViewModel.ourNodeInfo.collectAsStateWithLifecycle()
     var editingWaypoint by remember { mutableStateOf<Waypoint?>(null) }
+    var geofenceInfoWaypoint by remember { mutableStateOf<Waypoint?>(null) }
     val displayUnits by mapViewModel.displayUnits.collectAsStateWithLifecycle()
 
     // --- Geofence box authoring (Main mode) ---
@@ -648,6 +650,7 @@ fun MapView(
                         myNodeNum = myNodeNum,
                         isConnected = isConnected,
                         onEditWaypointRequest = { editingWaypoint = it },
+                        onShowGeofenceInfo = { geofenceInfoWaypoint = it },
                         selectedWaypointId = selectedWaypointId,
                         mapLayers = mapLayers,
                         mapViewModel = mapViewModel,
@@ -719,6 +722,28 @@ fun MapView(
                     },
                 )
             }
+
+            geofenceInfoWaypoint?.let { waypoint ->
+                val optIns by mapViewModel.geofenceAlertOptIns.collectAsStateWithLifecycle()
+                WaypointInfoDialog(
+                    waypoint = waypoint,
+                    displayUnits = displayUnits,
+                    alertsEnabled = waypoint.id in optIns,
+                    onToggleAlerts = { mapViewModel.setGeofenceAlertOptIn(waypoint.id, it) },
+                    onDismissRequest = { geofenceInfoWaypoint = null },
+                    // Unlocked foreign geofences can still be edited/re-broadcast (only while connected, since editing
+                    // means re-sending); locked ones stay read-only.
+                    onEdit =
+                    if (waypoint.locked_to == 0 && isConnected) {
+                        {
+                            geofenceInfoWaypoint = null
+                            editingWaypoint = waypoint
+                        }
+                    } else {
+                        null
+                    },
+                )
+            }
         }
 
         // Box-authoring affordance: instruct the user to tap two corners, with a cancel that re-opens the editor.
@@ -901,6 +926,7 @@ private fun MainMapContent(
     myNodeNum: Int?,
     isConnected: Boolean,
     onEditWaypointRequest: (Waypoint) -> Unit,
+    onShowGeofenceInfo: (Waypoint) -> Unit,
     selectedWaypointId: Int?,
     mapLayers: List<MapLayerItem>,
     mapViewModel: MapViewModel,
@@ -942,6 +968,8 @@ private fun MainMapContent(
         myNodeNum = myNodeNum ?: 0,
         isConnected = isConnected,
         onEditWaypointRequest = onEditWaypointRequest,
+        isMyWaypoint = mapViewModel::isMyWaypoint,
+        onShowGeofenceInfo = onShowGeofenceInfo,
         selectedWaypointId = selectedWaypointId,
     )
 

androidApp/src/google/kotlin/org/meshtastic/app/map/MapView.kt

@@ -52,6 +52,7 @@ import org.meshtastic.core.di.CoroutineDispatchers
 import org.meshtastic.core.model.NodeAddress
 import org.meshtastic.core.repository.MapPrefs
 import org.meshtastic.core.repository.NodeRepository
+import org.meshtastic.core.repository.NotificationPrefs
 import org.meshtastic.core.repository.PacketRepository
 import org.meshtastic.core.repository.RadioConfigRepository
 import org.meshtastic.core.repository.RadioController
@@ -91,8 +92,16 @@ class MapViewModel(
     radioController: RadioController,
     private val customTileProviderRepository: CustomTileProviderRepository,
     uiPrefs: UiPrefs,
+    notificationPrefs: NotificationPrefs,
     savedStateHandle: SavedStateHandle,
-) : BaseMapViewModel(mapPrefs, nodeRepository, packetRepository, radioController, radioConfigRepository) {
+) : BaseMapViewModel(
+    mapPrefs,
+    nodeRepository,
+    packetRepository,
+    radioController,
+    radioConfigRepository,
+    notificationPrefs,
+) {
 
     private val _selectedWaypointId = MutableStateFlow(savedStateHandle.get<Int>("waypointId"))
     val selectedWaypointId: StateFlow<Int?> = _selectedWaypointId.asStateFlow()

androidApp/src/google/kotlin/org/meshtastic/app/map/MapViewModel.kt

@@ -50,6 +50,8 @@ fun WaypointMarkers(
     myNodeNum: Int,
     isConnected: Boolean,
     onEditWaypointRequest: (Waypoint) -> Unit,
+    isMyWaypoint: (Int) -> Boolean,
+    onShowGeofenceInfo: (Waypoint) -> Unit,
     selectedWaypointId: Int? = null,
 ) {
     val scope = rememberCoroutineScope()
@@ -92,10 +94,14 @@ fun WaypointMarkers(
                 snippet = snippet,
                 visible = true,
                 onInfoWindowClick = {
-                    if (waypoint.locked_to == 0 || waypoint.locked_to == myNodeNum || !isConnected) {
-                        onEditWaypointRequest(waypoint)
-                    } else {
-                        scope.launch { context.showToast(Res.string.locked) }
+                    when {
+                        // Foreign geofences: read-only view hosting the receiver-local crossing-alert opt-in.
+                        waypoint.toGeofence() != null && !isMyWaypoint(waypoint.id) -> onShowGeofenceInfo(waypoint)
+
+                        waypoint.locked_to == 0 || waypoint.locked_to == myNodeNum || !isConnected ->
+                            onEditWaypointRequest(waypoint)
+
+                        else -> scope.launch { context.showToast(Res.string.locked) }
                     }
                 },
             )

androidApp/src/google/kotlin/org/meshtastic/app/map/component/WaypointMarkers.kt

@@ -20,16 +20,18 @@ import co.touchlab.kermit.Logger
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.flow.catch
+import kotlinx.coroutines.flow.combine
 import kotlinx.coroutines.launch
 import org.koin.core.annotation.Named
 import org.koin.core.annotation.Single
 import org.meshtastic.core.common.util.nowSeconds
 import org.meshtastic.core.model.geofence.activeWaypointPackets
-import org.meshtastic.core.model.geofence.notifiesOnCrossing
+import org.meshtastic.core.model.geofence.geofencesToMonitor
 import org.meshtastic.core.model.geofence.toGeofence
 import org.meshtastic.core.model.util.GeoConstants.DEG_D
 import org.meshtastic.core.repository.MeshNotificationManager
 import org.meshtastic.core.repository.NodeManager
+import org.meshtastic.core.repository.NotificationPrefs
 import org.meshtastic.core.repository.PacketRepository
 import org.meshtastic.core.resources.Res
 import org.meshtastic.core.resources.geofence
@@ -50,7 +52,10 @@ import kotlin.concurrent.Volatile
  *
  * Hooked from [MeshDataHandlerImpl.handlePosition]; holds the active geofence-bearing waypoints in memory (refreshed
  * from [PacketRepository.getWaypoints], normalised via [activeWaypointPackets] so stale/expired transmissions can't
- * fire). Crossing state lives in [GeofenceCrossingStore] (in-memory, baseline-on-first-sighting).
+ * fire). By default only waypoints created by THIS device are tracked — geofences are mesh-broadcast, so without that
+ * filter every receiver in range would alert on the creator's crossings — but the user can opt in to specific foreign
+ * geofences via [NotificationPrefs.geofenceAlertOptIns]. Crossing state lives in [GeofenceCrossingStore] (in-memory,
+ * baseline-on-first-sighting).
  *
  * Received positions are funnelled through a single ordered worker so that two positions for the same node can never be
  * evaluated out of order (which would corrupt the inside/outside baseline and fire a spurious or missed alert).
@@ -61,6 +66,7 @@ class GeofenceMonitor(
     private val nodeManager: NodeManager,
     private val serviceNotifications: MeshNotificationManager,
     private val crossingStore: GeofenceCrossingStore,
+    private val notificationPrefs: NotificationPrefs,
     @Named("ServiceScope") private val scope: CoroutineScope,
 ) {
 
@@ -85,18 +91,19 @@ class GeofenceMonitor(
                 }
             }
         }
-        // A bad emission must not tear down the snapshot for the rest of the session.
+        // A bad emission must not tear down the snapshot for the rest of the session. Combined with myNodeNum (so the
+        // creator-only filter recomputes once our node number is known — waypoints can arrive before we're connected)
+        // and the opt-in set (so subscribing to a foreign geofence takes effect immediately).
         scope.launch {
-            packetRepository.value
-                .getWaypoints()
+            combine(
+                packetRepository.value.getWaypoints(),
+                nodeManager.myNodeNum,
+                notificationPrefs.geofenceAlertOptIns,
+            ) { packets, myNodeNum, optIns ->
+                packets.activeWaypointPackets(nowSeconds).values.geofencesToMonitor(myNodeNum, optIns)
+            }
                 .catch { Logger.e(it) { "Geofence waypoint stream failed; geofence tracking paused" } }
-                .collect { packets ->
-                    val active =
-                        packets
-                            .activeWaypointPackets(nowSeconds)
-                            .values
-                            .mapNotNull { it.waypoint }
-                            .filter { it.notifiesOnCrossing }
+                .collect { active ->
                     activeGeofences = active
                     crossingStore.retainOnly(active.map { it.id }.toSet())
                 }

core/data/src/commonMain/kotlin/org/meshtastic/core/data/manager/GeofenceMonitor.kt

@@ -25,6 +25,7 @@ import dev.mokkery.verify.VerifyMode.Companion.exactly
 import dev.mokkery.verifySuspend
 import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.flowOf
 import kotlinx.coroutines.test.StandardTestDispatcher
 import kotlinx.coroutines.test.TestScope
@@ -34,6 +35,7 @@ import org.meshtastic.core.model.DataPacket
 import org.meshtastic.core.model.Node
 import org.meshtastic.core.repository.MeshNotificationManager
 import org.meshtastic.core.repository.NodeManager
+import org.meshtastic.core.repository.NotificationPrefs
 import org.meshtastic.core.repository.PacketRepository
 import org.meshtastic.proto.Position
 import org.meshtastic.proto.Waypoint
@@ -72,33 +74,59 @@ class GeofenceMonitorTest {
         notify_favorites_only = favoritesOnly,
     )
 
+    private data class Mocks(
+        val packetRepository: PacketRepository,
+        val nodeManager: NodeManager,
+        val notifications: MeshNotificationManager,
+        val notificationPrefs: NotificationPrefs,
+    )
+
     private fun mocks(
         wp: Waypoint,
         senderIsFavorite: Boolean = false,
-    ): Triple<PacketRepository, NodeManager, MeshNotificationManager> {
+        createdByLocal: Boolean = true,
+        optedInIds: Set<Int> = emptySet(),
+    ): Mocks {
         val packetRepository: PacketRepository = mock(MockMode.autofill)
         val nodeManager: NodeManager = mock(MockMode.autofill)
         val notifications: MeshNotificationManager = mock(MockMode.autofill)
-        every { packetRepository.getWaypoints() } returns
-            flowOf(listOf(DataPacket(to = "!abcdabcd", channel = 0, waypoint = wp)))
+        val notificationPrefs: NotificationPrefs = mock(MockMode.autofill)
+        // from defaults to ^local (locally created); a remote creator uses another node's hex id.
+        val packet =
+            DataPacket(to = "!abcdabcd", channel = 0, waypoint = wp).also {
+                if (!createdByLocal) it.from = "!0000000$sender"
+            }
+        every { packetRepository.getWaypoints() } returns flowOf(listOf(packet))
+        every { nodeManager.myNodeNum } returns MutableStateFlow(myNodeNum)
         every { nodeManager.nodeDBbyNodeNum } returns mapOf(sender to Node(num = sender, isFavorite = senderIsFavorite))
-        return Triple(packetRepository, nodeManager, notifications)
+        every { notificationPrefs.geofenceAlertOptIns } returns MutableStateFlow(optedInIds)
+        return Mocks(packetRepository, nodeManager, notifications, notificationPrefs)
     }
 
     private fun expectNoNotification(
         wp: Waypoint,
         senderIsFavorite: Boolean = false,
+        createdByLocal: Boolean = true,
+        optedInIds: Set<Int> = emptySet(),
         drive: (GeofenceMonitor) -> Unit,
     ) = runTest {
         val scope = TestScope(StandardTestDispatcher(testScheduler))
-        val (repo, nodes, notifications) = mocks(wp, senderIsFavorite)
-        val monitor = GeofenceMonitor(lazy { repo }, nodes, notifications, GeofenceCrossingStore(), scope)
+        val m = mocks(wp, senderIsFavorite, createdByLocal, optedInIds)
+        val monitor =
+            GeofenceMonitor(
+                lazy { m.packetRepository },
+                m.nodeManager,
+                m.notifications,
+                GeofenceCrossingStore(),
+                m.notificationPrefs,
+                scope,
+            )
         scope.advanceUntilIdle() // collect the active-geofence snapshot
 
         drive(monitor)
         scope.advanceUntilIdle()
 
-        verifySuspend(exactly(0)) { notifications.updateWaypointNotification(any(), any(), any(), any(), any()) }
+        verifySuspend(exactly(0)) { m.notifications.updateWaypointNotification(any(), any(), any(), any(), any()) }
         scope.cancel() // stop the serial worker so runTest sees no leaked coroutine
     }
 
@@ -118,6 +146,12 @@ class GeofenceMonitorTest {
         m.onPositionReceived(myNodeNum, myNodeNum, inside) // sender == self
     }
 
+    @Test
+    fun remoteCreatedGeofenceDoesNotNotify() = expectNoNotification(waypoint(), createdByLocal = false) { m ->
+        m.onPositionReceived(sender, myNodeNum, outside) // baseline
+        m.onPositionReceived(sender, myNodeNum, inside) // genuine ENTER, but we didn't create this geofence
+    }
+
     @Test
     fun enterOnlyWaypointDoesNotNotifyOnExit() = expectNoNotification(waypoint(enter = true, exit = false)) { m ->
         m.onPositionReceived(sender, myNodeNum, inside) // baseline inside