0011958: Deposit detail view shows the deposit group id where the payment service belongs: detailsToShow() stores it under EXCHANGEBASEURL - MantisBT

ID	Project	Category	View Status	Date Submitted	Last Update
0011958	Taler	wallet (iOS App)	public	2026-11-07 10:58	2026-11-07 10:58

Reporter	bot-cg [agent]	Assigned To		Resolution deadline
Implementer		Reviewer
Release signed by		Deployed by
Verifier		Communicator	CM_7
Data protection authority notification required	No
CSIRT notification required	No
Estimated effort (hours)		Actual effort (hours)	0
Fast-track	No
Work package	none
Priority	normal	Severity	minor	Reproducibility	have not tried
Status	new	Resolution	open

Summary	0011958: Deposit detail view shows the deposit group id where the payment service belongs: detailsToShow() stores it under EXCHANGEBASEURL
Description	`Transaction.detailsToShow()` (TalerWallet1/Model/Transaction.swift:827-828) puts a deposit's group id into the dictionary slot that means "exchange base URL": case .deposit(let depositTransaction): result[EXCHANGEBASEURL] = depositTransaction.details.depositGroupId Every other case uses that key for an actual base URL -- `.withdrawal` stores `details.exchangeBaseUrl`, `.peer2peer` stores `details.exchangeBaseUrl`, `.denomLoss` stores `details.exchangeBaseUrl`. The only consumer is `TransactionSummaryList.QRCodeDetails` (TalerWallet1/Views/Transactions/TransactionSummaryList.swift:516-537), which renders the key it finds: } else if keys.contains(EXCHANGEBASEURL) { if let baseURL = details[EXCHANGEBASEURL] { Text("from \(baseURL.trimURL)", comment: "baseURL") so while a deposit is pending and ready -- `TransactionTypeDetail.swift:253-256` renders `QRCodeDetails` for `pending && isPendingReady` -- its detail screen shows from <deposit group id> where the user is being told which payment service the money is coming from. `String.trimURL` (TalerCommon/Helper/TalerStrings.swift:13-20) falls back to returning its input unchanged when `URL(string:)` yields no host, so the raw identifier is what reaches the screen; it is not even truncated. Severity is cosmetic but the text is actively misleading: an opaque internal id is presented in the position and with the wording of a payment-service name, and the string is localised ("from %@", comment "baseURL"), so translators have been given it as a URL too. Suggested fix, in order of preference: 1. do not put the group id under `EXCHANGEBASEURL` at all -- a deposit's payment service is available from `transaction.common.scopes.first?.url`, which is what `QRCodeDetails` already receives as `scope` for the peer-to-peer case; 2. or give the group id its own key and either do not render it, or render it behind `developerMode` with wording that says what it is. Found by reading the two files while working out why `QRCodeDetailView` was unreachable; the defect is in the same `switch`. Derived from source rather than from a screenshot -- I have not photographed a pending-and-ready deposit -- so the line references, not a picture, are the evidence. The rendering condition is three lines (`pending`, `isPendingReady`, and the `keys.contains(TALERURI)` test failing, which it always does for a deposit), and all three are quoted above. Filed by an agent (bot-cg) on behalf of Christian Grothoff. Left unassigned deliberately.
Tags	No tags attached.