halkyon/apps/todo/halkyon_todo_server/migrations/20261020185752014-recovery-proof-key/definition_project.json

{
  "__className__": "serverpod.DatabaseDefinition",
  "schemaVersion": 2,
  "moduleName": "halkyon_todo",
  "tables": [],
  "installedModules": [
    {
      "__className__": "serverpod.DatabaseMigrationVersion",
      "module": "halkyon_base",
      "version": "20261020185619505-recovery-proof-key"
    },
    {
      "__className__": "serverpod.DatabaseMigrationVersion",
      "module": "serverpod",
      "version": "20260824182259319"
    },
    {
      "__className__": "serverpod.DatabaseMigrationVersion",
      "module": "serverpod_auth_idp",
      "version": "20260924105404509"
    },
    {
      "__className__": "serverpod.DatabaseMigrationVersion",
      "module": "serverpod_auth_core",
      "version": "20260924105232991"
    }
  ],
  "migrationApiVersion": 1
}
fix(auth)!: the recovery phrase is proved by a key of its own A key proof was a signature by the account's signing key, which every signed-in device keeps in its keyring: whoever could read one, with a code from its authenticator, set a new password without the password or the phrase (the second reading's H1). The phrase now proves itself with an Ed25519 key derived from its bits alone (halkyon_keys' recoveryProofKeysOf, KDF context hlkrprf1, a sibling of the recovery key), whose public half every setup, new phrase and account reset sends and the register keeps (account_password.recoveryProofKey); the device derives the secret half only while the phrase is typed. An account without one (none exist outside development) proves no phrase until it sets a new one; decoys check against a decoy proof key alike. Migration (module, Learn's and Todo's servers, Learn's device schema): ALTER TABLE "account_password" ADD COLUMN "recoveryProofKey" bytea; nullable, so rows made before keep working and no data is touched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-20 21:03:15 +02:00			`{`
			`"__className__": "serverpod.DatabaseDefinition",`
			`"schemaVersion": 2,`
			`"moduleName": "halkyon_todo",`
			`"tables": [],`
			`"installedModules": [`
			`{`
			`"__className__": "serverpod.DatabaseMigrationVersion",`
			`"module": "halkyon_base",`
			`"version": "20261020185619505-recovery-proof-key"`
			`},`
			`{`
			`"__className__": "serverpod.DatabaseMigrationVersion",`
			`"module": "serverpod",`
			`"version": "20260824182259319"`
			`},`
			`{`
			`"__className__": "serverpod.DatabaseMigrationVersion",`
			`"module": "serverpod_auth_idp",`
			`"version": "20260924105404509"`
			`},`
			`{`
			`"__className__": "serverpod.DatabaseMigrationVersion",`
			`"module": "serverpod_auth_core",`
			`"version": "20260924105232991"`
			`}`
			`],`
			`"migrationApiVersion": 1`
			`}`