halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

fix(auth)!: proofs are bound to the instance the device addresses

Browse source 
Nothing tied a sign-in's proof to the instance it was made for: an
instance a person was lured into adding could pass A, M1 and the code on
to the real register and get a session there, and pass a phrase's proof
on with a password of its own in place of the person's (the second
reading's M6). SRP's identity is now a label, the challenge's ID and
the host the device addressed (passwordIdentity, in halkyon_base_client
and halkyon_base_server alike), and the phrase's proof signs that host,
what it is for (an authenticator's reset or a new password) and the new
password's digest (key proof v2). Every proving call carries the host;
in production it must be the server's apiServer.publicHost (otherwise
otherInstance, which the app shows as an instance it can't trust), in
development any; a member forwards its own. The tests prove that a
relayed sign-in, a proof for another host or purpose, and a swapped
password are refused, nothing changing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-20 21:20:12 +02:00
commit dab2c80524
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 966 additions and 137 deletions
Download patch file Download diff file Expand all files Collapse all files

5
packages/halkyon_base_server/lib/src/register/account_register.dart
View file

@ -170,6 +170,7 @@ abstract interface class AccountRegister {
String? recoveryCode,
UuidValue? request,
String? code,
required String host,
});
/// Signs up with the address [code] proves for [request] and the password
@ -236,6 +237,7 @@ abstract interface class AccountRegister {
String? code,
UuidValue? keyChallenge,
ByteData? signature,
required String host,
});
/// The first step of proving the recovery phrase for [address], the
@ -256,6 +258,7 @@ abstract interface class AccountRegister {
required NewPassword password,
String? totpCode,
String? recoveryCode,
required String host,
});
/// Asks for the reset of a whole account. Refusals as
@ -298,6 +301,7 @@ abstract interface class AccountRegister {
String? recoveryCode,
required NewPassword password,
UuidValue? keepSession,
required String host,
});
/// Replaces the wrapping of [person]'s keys under their recovery phrase
@ -313,6 +317,7 @@ abstract interface class AccountRegister {
String? recoveryCode,
required WrappedKeys recoveryKeys,
required ByteData recoveryProofKey,
required String host,
});
/// Deletes the account [person] with everything the register's server has