Ask for session verification before sharing with an unverified account

The incoming share is now displayed on top of the root, so the FTUE, and the session verification in particular, could be bypassed.

- When the current account is not verified, wait for the FTUE to be complete before displaying the incoming share, as before.
- When the user selects another account which is not verified in the room select screen, display the session verification flow of
  the FTUE for this account on top of the share. As in the FTUE, the user has to verify the session or to sign out.
- Expose the FTUE session verification flow with a new SessionVerificationEntryPoint, displayed by OtherSessionVerificationNode
  which sets up the session graph of the account to verify.
- Introduce RoomSelectNavigator so that RoomSelectPresenter can request the verification of the selected session.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

libraries/roomselect/api/src/main/kotlin/io/element/android/libraries/roomselect/api/RoomSelectEntryPoint.kt

@@ -41,6 +41,13 @@ interface RoomSelectEntryPoint : FeatureEntryPoint {
          */
         fun onRoomSelected(sessionId: SessionId, roomIds: List<RoomId>)
         fun onCancel()
+
+        /**
+         * Called in [RoomSelectMode.Share] mode when the user has selected an account whose session is not verified.
+         * The session has to be verified before the user can share content with it.
+         * @param sessionId the session to verify.
+         */
+        fun onSessionVerificationRequired(sessionId: SessionId)
     }
 
     companion object {

libraries/roomselect/impl/src/main/kotlin/io/element/android/libraries/roomselect/impl/RoomSelectNavigator.kt

@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2026 Element Creations Ltd.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial.
+ * Please see LICENSE files in the repository root for full details.
+ */
+
+package io.element.android.libraries.roomselect.impl
+
+import io.element.android.libraries.matrix.api.core.SessionId
+
+fun interface RoomSelectNavigator {
+    /**
+     * Navigate to the verification of the session [sessionId], which has to be verified before content can be shared with it.
+     */
+    fun navigateToSessionVerification(sessionId: SessionId)
+}

libraries/roomselect/impl/src/main/kotlin/io/element/android/libraries/roomselect/impl/RoomSelectNode.kt

@@ -33,7 +33,7 @@ class RoomSelectNode(
     @Assisted buildContext: BuildContext,
     @Assisted plugins: List<Plugin>,
     presenterFactory: RoomSelectPresenter.Factory,
-) : Node(buildContext, plugins = plugins) {
+) : Node(buildContext, plugins = plugins), RoomSelectNavigator {
     data class Inputs(
         val sessionId: SessionId,
         val mode: RoomSelectMode,
@@ -41,13 +41,18 @@ class RoomSelectNode(
     ) : NodeInputs
 
     private val inputs: Inputs = inputs()
+    private val callback: RoomSelectEntryPoint.Callback = callback()
     private val presenter = presenterFactory.create(
         initialSessionId = inputs.sessionId,
         mode = inputs.mode,
         maxNumberOfRooms = inputs.maxNumberOfRooms,
+        navigator = this,
     )
     private val stateFlow = launchMolecule { presenter.present() }
-    private val callback: RoomSelectEntryPoint.Callback = callback()
+
+    override fun navigateToSessionVerification(sessionId: SessionId) {
+        callback.onSessionVerificationRequired(sessionId)
+    }
 
     @Composable
     override fun View(modifier: Modifier) {

libraries/roomselect/impl/src/main/kotlin/io/element/android/libraries/roomselect/impl/RoomSelectPresenter.kt

@@ -31,12 +31,14 @@ import io.element.android.libraries.matrix.api.MatrixClientProvider
 import io.element.android.libraries.matrix.api.core.SessionId
 import io.element.android.libraries.matrix.api.user.MatrixUser
 import io.element.android.libraries.matrix.api.user.toMatrixUser
+import io.element.android.libraries.matrix.api.verification.SessionVerifiedStatus
 import io.element.android.libraries.matrix.ui.model.SelectRoomInfo
 import io.element.android.libraries.roomselect.api.RoomSelectMode
 import io.element.android.libraries.sessionstorage.api.SessionStore
 import kotlinx.collections.immutable.ImmutableList
 import kotlinx.collections.immutable.persistentListOf
 import kotlinx.collections.immutable.toImmutableList
+import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.flowOf
 import kotlinx.coroutines.launch
 import timber.log.Timber
@@ -46,6 +48,7 @@ class RoomSelectPresenter(
     @Assisted private val initialSessionId: SessionId,
     @Assisted private val mode: RoomSelectMode,
     @Assisted private val maxNumberOfRooms: Int,
+    @Assisted private val navigator: RoomSelectNavigator,
     private val dataSourceFactory: RoomSelectSearchDataSource.Factory,
     private val matrixClientProvider: MatrixClientProvider,
     private val sessionStore: SessionStore,
@@ -56,6 +59,7 @@ class RoomSelectPresenter(
             initialSessionId: SessionId,
             mode: RoomSelectMode,
             maxNumberOfRooms: Int,
+            navigator: RoomSelectNavigator,
         ): RoomSelectPresenter
     }
 
@@ -103,30 +107,41 @@ class RoomSelectPresenter(
         // data source is removed from the composition and its coroutine scope is cancelled.
         // Also use the validity of the session as a key, so that the data source is removed if the session is invalidated, and recreated
         // if the session becomes valid again.
-        val (dataSource, hasClientError) = key(selectedSessionId, isSelectedSessionInvalid) {
+        val (dataSource, hasClientError, isSessionNotVerified) = key(selectedSessionId, isSelectedSessionInvalid) {
             val sessionId = selectedSessionId
             if (isSelectedSessionInvalid) {
                 // Do not try to get the client of an invalid session: it cannot be restored, and an in-memory client would have been destroyed.
-                null to false
+                Triple(null, false, false)
             } else {
                 val dataSourceCoroutineScope = rememberCoroutineScope()
                 // The sessions are restored at startup, so the client should already be in memory.
                 // A null value means that the client is being restored.
-                val roomListServiceResult by produceState(matrixClientProvider.getOrNull(sessionId)?.roomListService?.let { Result.success(it) }) {
+                val clientResult by produceState(matrixClientProvider.getOrNull(sessionId)?.let { Result.success(it) }) {
                     if (value == null) {
                         value = matrixClientProvider.getOrRestore(sessionId)
                             .onFailure { Timber.e(it, "Failed to get the client for $sessionId") }
-                            .map { it.roomListService }
                     }
                 }
-                val roomListService = roomListServiceResult?.getOrNull()
-                val dataSource = remember(roomListService) {
-                    roomListService?.let { dataSourceFactory.create(dataSourceCoroutineScope, it) }
+                val client = clientResult?.getOrNull()
+                val dataSource = remember(client) {
+                    client?.let { dataSourceFactory.create(dataSourceCoroutineScope, it.roomListService) }
                 }
-                dataSource to (roomListServiceResult?.isFailure == true)
+                // Content cannot be shared with a session which is not verified. The initial session is verified, since the FTUE is complete.
+                val sessionVerifiedStatus by remember(client) {
+                    if (mode == RoomSelectMode.Share && sessionId != initialSessionId && client != null) {
+                        client.sessionVerificationService.sessionVerifiedStatus
+                    } else {
+                        MutableStateFlow(SessionVerifiedStatus.Unknown)
+                    }
+                }.collectAsState()
+                Triple(dataSource, clientResult?.isFailure == true, sessionVerifiedStatus == SessionVerifiedStatus.NotVerified)
             }
         }
         val hasRoomListError = hasClientError || isSelectedSessionInvalid
+        val sessionToVerify = selectedSessionId.takeIf { isSessionNotVerified }
+        LaunchedEffect(sessionToVerify) {
+            sessionToVerify?.let(navigator::navigateToSessionVerification)
+        }
 
         val searchQuery = queryState.text.toString()
         LaunchedEffect(dataSource, searchQuery) {

libraries/roomselect/impl/src/test/kotlin/io/element/android/libraries/roomselect/impl/DefaultRoomSelectEntryPointTest.kt

@@ -38,7 +38,7 @@ class DefaultRoomSelectEntryPointTest : RobolectricTest() {
             RoomSelectNode(
                 buildContext = buildContext,
                 plugins = plugins,
-                presenterFactory = { initialSessionId, mode, maxNumberOfRooms ->
+                presenterFactory = { initialSessionId, mode, maxNumberOfRooms, _ ->
                     assertThat(initialSessionId).isEqualTo(A_SESSION_ID)
                     assertThat(mode).isEqualTo(testMode)
                     assertThat(maxNumberOfRooms).isEqualTo(testMaxNumberOfRooms)
@@ -49,6 +49,7 @@ class DefaultRoomSelectEntryPointTest : RobolectricTest() {
         val callback = object : RoomSelectEntryPoint.Callback {
             override fun onRoomSelected(sessionId: SessionId, roomIds: List<RoomId>) = lambdaError()
             override fun onCancel() = lambdaError()
+            override fun onSessionVerificationRequired(sessionId: SessionId) = lambdaError()
         }
         val params = RoomSelectEntryPoint.Params(
             sessionId = A_SESSION_ID,

libraries/roomselect/impl/src/test/kotlin/io/element/android/libraries/roomselect/impl/RoomSelectPresenterTest.kt

@@ -17,6 +17,7 @@ import io.element.android.libraries.matrix.api.core.SessionId
 import io.element.android.libraries.matrix.api.roomlist.RoomListFilter
 import io.element.android.libraries.matrix.api.roomlist.RoomListService
 import io.element.android.libraries.matrix.api.user.MatrixUser
+import io.element.android.libraries.matrix.api.verification.SessionVerifiedStatus
 import io.element.android.libraries.matrix.test.AN_EXCEPTION
 import io.element.android.libraries.matrix.test.A_ROOM_ID
 import io.element.android.libraries.matrix.test.A_ROOM_ID_2
@@ -27,6 +28,7 @@ import io.element.android.libraries.matrix.test.FakeMatrixClientProvider
 import io.element.android.libraries.matrix.test.room.aRoomSummary
 import io.element.android.libraries.matrix.test.roomlist.FakeDynamicRoomList
 import io.element.android.libraries.matrix.test.roomlist.FakeRoomListService
+import io.element.android.libraries.matrix.test.verification.FakeSessionVerificationService
 import io.element.android.libraries.matrix.ui.model.toSelectRoomInfo
 import io.element.android.libraries.roomselect.api.RoomSelectEntryPoint
 import io.element.android.libraries.roomselect.api.RoomSelectMode
@@ -39,6 +41,7 @@ import io.element.android.tests.testutils.consumeItemsUntilPredicate
 import io.element.android.tests.testutils.lambda.assert
 import io.element.android.tests.testutils.lambda.lambdaError
 import io.element.android.tests.testutils.lambda.lambdaRecorder
+import io.element.android.tests.testutils.lambda.value
 import io.element.android.tests.testutils.test
 import io.element.android.tests.testutils.testCoroutineDispatchers
 import kotlinx.collections.immutable.persistentListOf
@@ -289,6 +292,80 @@ class RoomSelectPresenterTest {
         }
     }
 
+    @Test
+    fun `present - select another account which is not verified navigates to its verification`() = runTest {
+        val sessionVerificationService = FakeSessionVerificationService(SessionVerifiedStatus.NotVerified)
+        val navigateToSessionVerificationLambda = lambdaRecorder<SessionId, Unit> { }
+        val presenter = createRoomSelectPresenter(
+            navigator = RoomSelectNavigator(navigateToSessionVerificationLambda),
+            mode = RoomSelectMode.Share,
+            sessionStore = aSessionStoreWithTwoAccounts(),
+            matrixClientProvider = FakeMatrixClientProvider { sessionId ->
+                Result.success(
+                    FakeMatrixClient(
+                        sessionId = sessionId,
+                        sessionVerificationService = if (sessionId == A_SESSION_ID_2) sessionVerificationService else FakeSessionVerificationService(),
+                    )
+                )
+            },
+        )
+        presenter.test {
+            val state = awaitLastSequentialItem()
+            state.eventSink(RoomSelectEvent.SelectAccount(A_SESSION_ID_2))
+            consumeItemsUntilPredicate { it.selectedAccount.userId == A_SESSION_ID_2 }
+            testScheduler.advanceUntilIdle()
+            navigateToSessionVerificationLambda.assertions().isCalledOnce().with(value(A_SESSION_ID_2))
+            // The session is verified, no new navigation
+            sessionVerificationService.emitVerifiedStatus(SessionVerifiedStatus.Verified)
+            testScheduler.advanceUntilIdle()
+            navigateToSessionVerificationLambda.assertions().isCalledOnce()
+            cancelAndIgnoreRemainingEvents()
+        }
+    }
+
+    @Test
+    fun `present - the initial session is not verified, no navigation to its verification`() = runTest {
+        val presenter = createRoomSelectPresenter(
+            mode = RoomSelectMode.Share,
+            matrixClientProvider = FakeMatrixClientProvider { sessionId ->
+                Result.success(
+                    FakeMatrixClient(
+                        sessionId = sessionId,
+                        sessionVerificationService = FakeSessionVerificationService(SessionVerifiedStatus.NotVerified),
+                    )
+                )
+            },
+        )
+        presenter.test {
+            // The default navigator fails if it is invoked
+            awaitLastSequentialItem()
+            testScheduler.advanceUntilIdle()
+            cancelAndIgnoreRemainingEvents()
+        }
+    }
+
+    @Test
+    fun `present - forward mode, no navigation to the verification of the session`() = runTest {
+        val presenter = createRoomSelectPresenter(
+            mode = RoomSelectMode.Forward,
+            initialSessionId = A_SESSION_ID_2,
+            matrixClientProvider = FakeMatrixClientProvider { sessionId ->
+                Result.success(
+                    FakeMatrixClient(
+                        sessionId = sessionId,
+                        sessionVerificationService = FakeSessionVerificationService(SessionVerifiedStatus.NotVerified),
+                    )
+                )
+            },
+        )
+        presenter.test {
+            // The default navigator fails if it is invoked
+            awaitLastSequentialItem()
+            testScheduler.advanceUntilIdle()
+            cancelAndIgnoreRemainingEvents()
+        }
+    }
+
     @Test
     fun `present - forward mode with several accounts does not show the account switch`() = runTest {
         val presenter = createRoomSelectPresenter(
@@ -425,10 +502,12 @@ internal fun TestScope.createRoomSelectPresenter(
     matrixClientProvider: MatrixClientProvider = FakeMatrixClientProvider { sessionId ->
         Result.success(FakeMatrixClient(sessionId = sessionId, roomListService = roomListService))
     },
+    navigator: RoomSelectNavigator = RoomSelectNavigator { lambdaError() },
 ) = RoomSelectPresenter(
     initialSessionId = initialSessionId,
     mode = mode,
     maxNumberOfRooms = maxNumberOfRooms,
+    navigator = navigator,
     dataSourceFactory = object : RoomSelectSearchDataSource.Factory {
         override fun create(coroutineScope: CoroutineScope, roomListService: RoomListService): RoomSelectSearchDataSource {
             return RoomSelectSearchDataSource(