halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

fix(auth): codes wait after ten wrong in a row, and the owner is told

Browse source 
Whoever knew the password could guess codes at 10 an hour forever,
unnoticed, each guess checked against every authenticator (the second
reading's M4). Every code an account's second factor refuses after a
right password (sign-in, a phrase's reset, a change) or from a signed-in
device (removing an authenticator, new recovery codes, the code from one
confirmed before) now counts, per account, from every network; after
every tenth in a row no code is taken (codesWait, saying until when), an
hour, then twice as long each time, a day at the most (longestCodeWait,
second_factor_waits.dart): at a day, ten guesses a day still have about a
1 % chance a year against one authenticator, so the first wait mails the
owner that someone knows their password. The instance keeps no address,
so sign-in and the phrase's reset now send the address the device typed
(and its language), used only for that mail after its hash is checked
against the account's. A code accepted clears it all.

Migration (module, Learn's and Todo's servers, Learn's device schema):
CREATE TABLE "second_factor_failures" ("id" bigserial PRIMARY KEY,
"authUserId" uuid NOT NULL, "failures" bigint NOT NULL, "waits"
bigint NOT NULL, "waitUntil" timestamp, "updatedAt" timestamp NOT
NULL) with a unique index on "authUserId": a new table, nothing
touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 21:47:38 +02:00
commit 4a32f150db
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
69 changed files with 42635 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

7886
apps/learn/halkyon_learn_client/lib/migrations/20261020194228286-second-factor-waits/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

2625
apps/learn/halkyon_learn_client/lib/migrations/20261020194228286-second-factor-waits/definition_project.json Normal file
View file

File diff suppressed because it is too large Load diff

1930
apps/learn/halkyon_learn_client/lib/migrations/20261020194228286-second-factor-waits/migration.dart Normal file
View file

File diff suppressed because it is too large Load diff

87
apps/learn/halkyon_learn_client/lib/migrations/20261020194228286-second-factor-waits/migration.json Normal file
View file

@ -0,0 +1,87 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "second_factor_failures",
"dartName": "SecondFactorFailures",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "failures",
"fieldName": "failures",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "waits",
"fieldName": "waits",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "waitUntil",
"fieldName": "waitUntil",
"columnType": 4,
"isNullable": true,
"dartType": "DateTime?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "updatedAt",
"fieldName": "updatedAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "second_factor_failures_person_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "authUserId"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

2
apps/learn/halkyon_learn_client/lib/migrations/migration_registry.dart
View file

@ -21,6 +21,7 @@ part '20261019204112282-deletion-notices/migration.dart';
part '20261020111943300-passwords/migration.dart';
part '20261020125117584-sessions-ended/migration.dart';
part '20261020185750538-recovery-proof-key/migration.dart';
part '20261020194228286-second-factor-waits/migration.dart';
/// Migration registry for the client-side database.
class MigrationRegistry {
@ -44,6 +45,7 @@ class MigrationRegistry {
_Migration20261020111943300_passwords(),
_Migration20261020125117584_sessions_ended(),
_Migration20261020185750538_recovery_proof_key(),
_Migration20261020194228286_second_factor_waits(),
];
/// List of all client-side database migration versions.

9782
apps/learn/halkyon_learn_server/migrations/20261020194228286-second-factor-waits/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

2328
apps/learn/halkyon_learn_server/migrations/20261020194228286-second-factor-waits/definition.sql Normal file
View file

File diff suppressed because it is too large Load diff

4521
apps/learn/halkyon_learn_server/migrations/20261020194228286-second-factor-waits/definition_project.json Normal file
View file

File diff suppressed because it is too large Load diff

87
apps/learn/halkyon_learn_server/migrations/20261020194228286-second-factor-waits/migration.json Normal file
View file

@ -0,0 +1,87 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "second_factor_failures",
"dartName": "SecondFactorFailures",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "failures",
"fieldName": "failures",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "waits",
"fieldName": "waits",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "waitUntil",
"fieldName": "waitUntil",
"columnType": 4,
"isNullable": true,
"dartType": "DateTime?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "updatedAt",
"fieldName": "updatedAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "second_factor_failures_person_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "authUserId"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

68
apps/learn/halkyon_learn_server/migrations/20261020194228286-second-factor-waits/migration.sql Normal file
View file

@ -0,0 +1,68 @@
BEGIN;
--
-- ACTION CREATE TABLE
--
CREATE TABLE "second_factor_failures" (
"id" bigserial PRIMARY KEY,
"authUserId" uuid NOT NULL,
"failures" bigint NOT NULL,
"waits" bigint NOT NULL,
"waitUntil" timestamp without time zone,
"updatedAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE UNIQUE INDEX "second_factor_failures_person_idx" ON "second_factor_failures" USING btree ("authUserId");
--
-- MIGRATION VERSION FOR halkyon_learn
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_learn', '20261020194228286-second-factor-waits', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020194228286-second-factor-waits', "timestamp" = now();
--
-- MIGRATION VERSION FOR halkyon_base
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_base', '20261020194005842-second-factor-waits', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020194005842-second-factor-waits', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod', '20260824182259319', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_idp
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_idp', '20260924105404509', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_offline_sync
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_offline_sync', '20260914143806119', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260914143806119', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_core
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_core', '20260924105232991', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
COMMIT;

1
apps/learn/halkyon_learn_server/migrations/migration_registry.txt
View file

@ -38,3 +38,4 @@
20261020111943300-passwords
20261020125117584-sessions-ended
20261020185750538-recovery-proof-key
20261020194228286-second-factor-waits

4233
apps/todo/halkyon_todo_server/migrations/20261020194229631-second-factor-waits/definition.json Normal file
View file

File diff suppressed because it is too large Load diff

1002
apps/todo/halkyon_todo_server/migrations/20261020194229631-second-factor-waits/definition.sql Normal file
View file

File diff suppressed because it is too large Load diff

29
apps/todo/halkyon_todo_server/migrations/20261020194229631-second-factor-waits/definition_project.json Normal file
View file

@ -0,0 +1,29 @@
{
"__className__": "serverpod.DatabaseDefinition",
"schemaVersion": 2,
"moduleName": "halkyon_todo",
"tables": [],
"installedModules": [
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "halkyon_base",
"version": "20261020194005842-second-factor-waits"
},
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "serverpod",
"version": "20260824182259319"
},
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "serverpod_auth_idp",
"version": "20260924105404509"
},
{
"__className__": "serverpod.DatabaseMigrationVersion",
"module": "serverpod_auth_core",
"version": "20260924105232991"
}
],
"migrationApiVersion": 1
}

87
apps/todo/halkyon_todo_server/migrations/20261020194229631-second-factor-waits/migration.json Normal file
View file

@ -0,0 +1,87 @@
{
"__className__": "serverpod.DatabaseMigration",
"actions": [
{
"__className__": "serverpod.DatabaseMigrationAction",
"type": "createTable",
"createTable": {
"__className__": "serverpod.TableDefinition",
"name": "second_factor_failures",
"dartName": "SecondFactorFailures",
"module": "halkyon_base",
"schema": "public",
"columns": [
{
"__className__": "serverpod.ColumnDefinition",
"name": "id",
"fieldName": "id",
"columnType": 6,
"isNullable": false,
"columnDefault": "serial",
"dartType": "int?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "authUserId",
"fieldName": "authUserId",
"columnType": 7,
"isNullable": false,
"dartType": "UuidValue"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "failures",
"fieldName": "failures",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "waits",
"fieldName": "waits",
"columnType": 6,
"isNullable": false,
"dartType": "int"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "waitUntil",
"fieldName": "waitUntil",
"columnType": 4,
"isNullable": true,
"dartType": "DateTime?"
},
{
"__className__": "serverpod.ColumnDefinition",
"name": "updatedAt",
"fieldName": "updatedAt",
"columnType": 4,
"isNullable": false,
"dartType": "DateTime"
}
],
"foreignKeys": [],
"indexes": [
{
"__className__": "serverpod.IndexDefinition",
"indexName": "second_factor_failures_person_idx",
"elements": [
{
"__className__": "serverpod.IndexElementDefinition",
"type": 0,
"definition": "authUserId"
}
],
"type": "btree",
"isUnique": true,
"isPrimary": false
}
],
"managed": true
}
}
],
"warnings": [],
"migrationApiVersion": 1
}

60
apps/todo/halkyon_todo_server/migrations/20261020194229631-second-factor-waits/migration.sql Normal file
View file

@ -0,0 +1,60 @@
BEGIN;
--
-- ACTION CREATE TABLE
--
CREATE TABLE "second_factor_failures" (
"id" bigserial PRIMARY KEY,
"authUserId" uuid NOT NULL,
"failures" bigint NOT NULL,
"waits" bigint NOT NULL,
"waitUntil" timestamp without time zone,
"updatedAt" timestamp without time zone NOT NULL
);
-- Indexes
CREATE UNIQUE INDEX "second_factor_failures_person_idx" ON "second_factor_failures" USING btree ("authUserId");
--
-- MIGRATION VERSION FOR halkyon_todo
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_todo', '20261020194229631-second-factor-waits', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020194229631-second-factor-waits', "timestamp" = now();
--
-- MIGRATION VERSION FOR halkyon_base
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('halkyon_base', '20261020194005842-second-factor-waits', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20261020194005842-second-factor-waits', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod', '20260824182259319', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260824182259319', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_idp
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_idp', '20260924105404509', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105404509', "timestamp" = now();
--
-- MIGRATION VERSION FOR serverpod_auth_core
--
INSERT INTO "serverpod_migrations" ("module", "version", "timestamp")
VALUES ('serverpod_auth_core', '20260924105232991', now())
ON CONFLICT ("module")
DO UPDATE SET "version" = '20260924105232991', "timestamp" = now();
COMMIT;

1
apps/todo/halkyon_todo_server/migrations/migration_registry.txt
View file

@ -10,3 +10,4 @@
20261020111950710-passwords
20261020125124942-sessions-ended
20261020185752014-recovery-proof-key
20261020194229631-second-factor-waits

3
packages/halkyon_app/lib/l10n/halkyon_app_de.arb
View file

@ -208,5 +208,6 @@
"passwordUnsafeCosts": "Die Instanz wollte dein Passwort auf eine Weise prüfen lassen, die kein Konto nutzt, daher wurde nichts gesendet. Passiert es wieder, ist die Instanz nicht die, die sie zu sein behauptet.",
"passwordFailed": "Die Instanz war nicht erreichbar. Prüf die Verbindung und versuch es noch einmal.",
"passwordMinLength": "Mindestens {count} Zeichen",
"passwordTooShort": "Ein neues Passwort braucht mindestens {count} Zeichen: Sollte die Datenbank der Instanz je nach außen gelangen, wird ein kurzes zuerst erraten."
"passwordTooShort": "Ein neues Passwort braucht mindestens {count} Zeichen: Sollte die Datenbank der Instanz je nach außen gelangen, wird ein kurzes zuerst erraten.",
"passwordCodesWait": "Zu viele falsche Codes hintereinander: Bis {date} wird kein Code angenommen. Waren es nicht deine, kennt jemand dein Passwort: Ändere es dann."
}

8
packages/halkyon_app/lib/l10n/halkyon_app_en.arb
View file

@ -448,5 +448,13 @@
"type": "int"
}
}
},
"passwordCodesWait": "Too many wrong codes in a row: no code is taken until {date}. If they weren't yours, someone knows your password: change it then.",
"@passwordCodesWait": {
"placeholders": {
"date": {
"type": "String"
}
}
}
}

6
packages/halkyon_app/lib/l10n/halkyon_app_localizations.dart
View file

@ -1356,6 +1356,12 @@ abstract class HalkyonAppLocalizations {
/// In en, this message translates to:
/// **'A new password needs at least {count} characters: should the instance\'s database ever leak, a short one is guessed first.'**
String passwordTooShort(int count);
/// No description provided for @passwordCodesWait.
///
/// In en, this message translates to:
/// **'Too many wrong codes in a row: no code is taken until {date}. If they weren\'t yours, someone knows your password: change it then.'**
String passwordCodesWait(String date);
}
class _HalkyonAppLocalizationsDelegate

Some files were not shown because too many files have changed in this diff Show more