halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth): a member's clock running ahead of the register's is refused too

Browse source 
The full reading's L10: issueSessionAfter refused a member clock more than
five seconds behind the register's, but one running ahead without bound,
so sessions made on the member in the gap before a reset's moment
outlived the register's notice. Now a clock that far ahead is refused
alike (PasswordRefusal.passwordChanged: the reset is done, the device
signs in again), with a warning to set both clocks by NTP.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 13:38:07 +02:00
commit 8e6625855a
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
2 changed files with 73 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

25
packages/halkyon_base_server/lib/src/register/people.dart
View file

@ -73,9 +73,10 @@ Future<AuthSuccess> issueSession(
/// password or of the account): those here end first, as the register's
/// notice to this server will end them, and the new one is made only once
/// this server's clock is past that moment, so the notice, whenever it
/// arrives, leaves it. A clock more than [maxClockSkew] behind is refused
/// ([PasswordRefusal.passwordChanged]): the reset is done, and the device
/// signs in again with the new password.
/// arrives, leaves it. A clock more than [maxClockSkew] behind, or ahead
/// (the full reading's L10: sessions made here in the gap would outlive the
/// notice), is refused ([PasswordRefusal.passwordChanged]): the reset is
/// done, and the device signs in again with the new password.
Future<AuthSuccess> issueSessionAfter(
Session session,
UuidValue account, {
@ -94,6 +95,18 @@ Future<AuthSuccess> issueSessionAfter(
// The reset is done: the device signs in again, with the new password.
throw PasswordRefusedException(reason: PasswordRefusal.passwordChanged);
}
// Ahead as far, sessions made here in the gap before the register's
// moment would outlive its notice (the full reading's L10): refused alike.
// (The register answered moments ago: its moment can't be further back
// than that, but for a clock running ahead.)
if (-wait > maxClockSkew) {
session.log(
"This server's clock is ${(-wait).inSeconds} s ahead of the "
"register's: set both by NTP.",
level: LogLevel.warning,
);
throw PasswordRefusedException(reason: PasswordRefusal.passwordChanged);
}
if (!wait.isNegative) {
await Future<void>.delayed(wait + const Duration(milliseconds: 1));
}
@ -102,9 +115,9 @@ Future<AuthSuccess> issueSessionAfter(
/// How far behind the register's clock a member's may run for
/// [issueSessionAfter] to wait for it: further, the request would hang as
/// long, so it is refused. Clocks set by NTP differ by milliseconds; a
/// member's clock running ahead of the register's by up to this much
/// leaves sessions made in that gap, which the ADR accepts.
/// long, so it is refused; as far ahead, alike. Clocks set by NTP differ by
/// milliseconds; a member's clock running ahead of the register's by up to
/// this much leaves sessions made in that gap, which the ADR accepts.
const maxClockSkew = Duration(seconds: 5);
/// What [person] becomes here once a way in is theirs, as linking makes them

54
packages/halkyon_base_server/test/integration/register/member_test.dart
View file

@ -1474,6 +1474,60 @@ void main() {
0,
);
});
test("refuses a clock further ahead of the register's alike, as "
'sessions made here in the gap would outlive its notice (the '
"full reading's L10)", () async {
register
..proof = PasswordProof(
account: ben,
serverProof: ByteData(32),
encryptionPublicKey: ByteData(32),
signingPublicKey: ByteData(32),
passwordKeys: WrappedKeys(
nonce: ByteData(24),
cipherText: ByteData(112),
),
needsAuthenticator: false,
)
..endedBefore = DateTime.now().toUtc().subtract(
const Duration(minutes: 1),
);
Future<int> sessionsOfBen() => ServerSideSession.db.count(
session,
where: (t) => t.authUserId.equals(ben),
);
final before = await sessionsOfBen();
await expectLater(
endpoints.accountRecovery.resetPassword(
notSignedIn(),
challenge: const Uuid().v7obj(),
signature: ByteData(64),
password: NewPassword(
salt: ByteData(16),
costs: newPasswordCosts,
verifier: ByteData(384),
passwordKeys: WrappedKeys(
nonce: ByteData(24),
cipherText: ByteData(112),
),
),
totpCode: '123456',
host: testHost,
address: 'anna@example.org',
language: 'en',
),
throwsA(
isA<PasswordRefusedException>().having(
(error) => error.reason,
'reason',
PasswordRefusal.passwordChanged,
),
),
);
// Nobody signed in: no session made.
expect(await sessionsOfBen(), before);
});
});
group('pruning', () {