ui: refresh rules views when rules change in the db

 - Notify the views whenever rules are added, deleted or disabled in
   the db. Rules created from pop-ups, temporary rules expiration and
   rules received when a node connects were not displayed until
   interacting with the views, because the periodic refresh is skipped
   while there're rows selected.
 - Emit the notification once per batch when adding several rules, to
   avoid a refresh storm when a node connects.
 - Misc: moved the views update of the rules editor to the central
   rules class, and added tests for these notifications.

Author: redsies

ui/opensnitch/dialogs/ruleseditor/dialog.py

@@ -278,8 +278,6 @@ def cb_save_clicked(self):
         if constants.WORK_MODE == constants.ADD_RULE:
             constants.WORK_MODE = constants.EDIT_RULE
 
-        self._rules.updated.emit(0)
-
     @QtCore.pyqtSlot(str, ui_pb2.NotificationReply)
     def cb_notification_callback(self, addr, reply):
         #print(self.LOG_TAG, "Rule notification received: ", reply.id, reply.code)

ui/opensnitch/rules.py

@@ -94,7 +94,7 @@ def __init__(self):
         QObject.__init__(self)
         self._db = Database.instance()
 
-    def add(self, time, node, name, description, enabled, precedence, nolog, action, duration, op_type, op_sensitive, op_operand, op_data, created):
+    def add(self, time, node, name, description, enabled, precedence, nolog, action, duration, op_type, op_sensitive, op_operand, op_data, created, notify=True):
         # don't add rule if the user has selected to exclude temporary
         # rules
         if duration in Config.RULES_DURATION_FILTER:
@@ -104,6 +104,8 @@ def add(self, time, node, name, description, enabled, precedence, nolog, action,
                   "(time, node, name, description, enabled, precedence, nolog, action, duration, operator_type, operator_sensitive, operator_operand, operator_data, created)",
                   (time, node, name, description, enabled, precedence, nolog, action, duration, op_type, op_sensitive, op_operand, op_data, created),
                         action_on_conflict="REPLACE")
+        if notify:
+            self.updated.emit(0)
 
     def add_rules(self, addr, rules):
         try:
@@ -123,8 +125,12 @@ def add_rules(self, addr, rules):
                          r.operator.type,
                          str(r.operator.sensitive),
                          r.operator.operand, r.operator.data,
-                         str(datetime.fromtimestamp(r.created).strftime(DBDateFieldFormat)))
+                         str(datetime.fromtimestamp(r.created).strftime(DBDateFieldFormat)),
+                         notify=False)
 
+            # notify once per batch, to avoid a refresh storm when a node
+            # connects and sends all its rules.
+            self.updated.emit(0)
             return True
         except Exception as e:
             log.warning("exception adding node rules to db: %s", repr(e))
@@ -142,6 +148,7 @@ def delete(self, name, addr, callback):
         if not self._db.delete_rule(rule.name, addr):
             return None
 
+        self.updated.emit(0)
         return rule
 
     def delete_by_field(self, field, values):
@@ -184,6 +191,7 @@ def disable(self, addr, name):
             "name=? AND node=?",
             action_on_conflict="OR REPLACE"
         )
+        self.updated.emit(0)
 
     def update_time(self, time, name, addr):
         """Updates the time of a rule, whenever a new connection matched a

ui/opensnitch/service.py

@@ -23,6 +23,7 @@
 from opensnitch.notifications import DesktopNotifications
 from opensnitch.firewall import Rules as FwRules
 from opensnitch.nodes import Nodes
+from opensnitch.rules import Rules
 from opensnitch.config import Config
 from opensnitch.version import version
 from opensnitch.database import Database
@@ -129,6 +130,7 @@ def __init__(self, app, on_exit, start_in_bg=False):
 
         self._nodes = Nodes.instance()
         self._nodes.reset_status()
+        self._rules = Rules.instance()
 
         self._last_stats = {}
         self._last_items = {
@@ -898,7 +900,9 @@ def _disable_temp_rule(args):
                 ost.start()
 
         elif kwargs['action'] == self.DELETE_RULE:
-            self._db.delete_rule(kwargs['name'], kwargs['addr'])
+            # route it through Rules, so the views are notified of the
+            # change.
+            self._rules.delete(kwargs['name'], kwargs['addr'], None)
 
         elif kwargs['action'] == self.NODE_DELETE:
             self._delete_node(kwargs['peer'])

ui/tests/test_rules_signals.py

@@ -0,0 +1,92 @@
+#
+# pytest -v tests/test_rules_signals.py
+#
+# Regression tests for the Rules.updated signal: rule changes written to
+# the db from any source (pop-up answers, temporary rules expiration,
+# rules received on node connection) must notify the views, so they
+# refresh what they display.
+#
+
+from datetime import datetime
+
+import opensnitch.proto as proto
+ui_pb2, ui_pb2_grpc = proto.import_()
+
+# opensnitch.utils must be imported before opensnitch.database to resolve
+# their circular import
+import opensnitch.utils  # noqa: F401
+from opensnitch.rules import Rules
+
+TEST_NODE = "unix:/tmp/osui.sock"
+RULE_TIME = "2026-06-10 10:00:00"
+
+
+def new_proto_rule(name):
+    rule = ui_pb2.Rule(name=name)
+    rule.enabled = True
+    rule.action = "allow"
+    rule.duration = "always"
+    rule.created = int(datetime.now().timestamp())
+    rule.operator.type = "simple"
+    rule.operator.operand = "process.path"
+    rule.operator.data = "/bin/test-app"
+    return rule
+
+
+def add_test_rule(rules, name):
+    rules.add(
+        RULE_TIME, TEST_NODE, name, "", "True", "False", "False",
+        "allow", "always", "simple", "False", "process.path",
+        "/bin/test-app", RULE_TIME
+    )
+
+
+def count_emits(rules, operation):
+    emitted = []
+
+    def _on_updated(what):
+        emitted.append(what)
+
+    rules.updated.connect(_on_updated)
+    try:
+        operation()
+    finally:
+        rules.updated.disconnect(_on_updated)
+    return len(emitted)
+
+
+def test_add_emits_updated(qtbot):
+    rules = Rules.instance()
+    assert count_emits(rules, lambda: add_test_rule(rules, "sig-add")) == 1
+
+
+def test_add_rules_emits_once_per_batch(qtbot):
+    """A node sends all its rules on connection: one refresh per batch,
+    not one per rule."""
+    rules = Rules.instance()
+    batch = [new_proto_rule("sig-batch-0"), new_proto_rule("sig-batch-1")]
+    results = []
+    emits = count_emits(rules, lambda: results.append(rules.add_rules(TEST_NODE, batch)))
+    assert results == [True]
+    assert emits == 1
+
+
+def test_delete_emits_updated(qtbot):
+    rules = Rules.instance()
+    add_test_rule(rules, "sig-delete")
+    assert count_emits(rules, lambda: rules.delete("sig-delete", TEST_NODE, None)) == 1
+
+
+def test_disable_emits_updated(qtbot):
+    """Temporary rules are marked as disabled in the db when they expire."""
+    rules = Rules.instance()
+    add_test_rule(rules, "sig-disable")
+    assert count_emits(rules, lambda: rules.disable(TEST_NODE, "sig-disable")) == 1
+
+
+def test_update_time_does_not_emit(qtbot):
+    """update_time() runs for every connection matching a rule; emitting
+    here would refresh the views non-stop."""
+    rules = Rules.instance()
+    add_test_rule(rules, "sig-time")
+    assert count_emits(rules, lambda: rules.update_time(RULE_TIME, "sig-time", TEST_NODE)) == 0