Tizian 「ティツィアーン」
a3a8ed3890
The register's side of signing in with an address, a password that never leaves the device (SRP-6a) and a code from an authenticator (ADR 0017), with members forwarding every step through AccountRegister: - password.set: salt, Argon2id's costs, SRP's verifier, the public keys and the private keys wrapped twice, all made on the device; with the address a mailed code proves, an anonymous person becomes identified under their ID. It signs in once an authenticator is confirmed. - passwordSignIn.begin and complete: SRP's two steps with a TOTP or recovery code. An address nobody has is answered from a decoy key as an account would be; every wrong credential is refused alike. - authenticator: secrets sealed under totpKey (XChaCha20-Poly1305, bound to their row), each code accepted once, ten recovery codes with the first, the last one kept. - accountRecovery: a lost authenticator reset 72 hours after the password and a mailed code or the recovery phrase ask, a lost password set anew with the phrase's signature, or the account reset with new keys 72 hours after a mailed code asks; a mail at each start, a sign-in calling it off. - An account with a password no longer signs in by a mailed code or GitHub; no new GitHub account is linked where passwords are offered, and from GITHUB_SIGN_IN_ENDS GitHub signs nobody in and its IDs go. Five tables, added by the module's migration; deletePerson deletes their rows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
name: halkyon_base_server
|
|
description: >-
|
|
What every Halkyon server has, as a Serverpod module: signing in
|
|
(anonymous, a password with TOTP, a code by mail, GitHub), getting back
|
|
into an account, the account's ways in and its deletion, the pruning of
|
|
what nobody can return to, and the instance's basics.
|
|
version: 0.1.0
|
|
publish_to: none
|
|
|
|
environment:
|
|
sdk: ^3.13.0
|
|
|
|
resolution: workspace
|
|
|
|
dependencies:
|
|
clock: ^1.1.3
|
|
crypto: ^3.0.7
|
|
# Pure Dart XChaCha20-Poly1305, which keeps TOTP secrets under the
|
|
# instance's key, and Ed25519, which checks a recovery phrase's proof (ADR
|
|
# 0017): what a server needs of both, without libsodium. Pinned exactly, as
|
|
# what keeps secrets must never move by accident.
|
|
cryptography: 2.9.0
|
|
# Reads the pages profile links point to, for their rel="me" back-links.
|
|
html: ^0.15.6
|
|
# Asks the instance's register, and tells its members (ADR 0016).
|
|
http: ^1.6.0
|
|
# Mails email sign-in's codes over SMTP (Halkyon Learn's ADR 0010).
|
|
mailer: ^7.2.0
|
|
meta: ^1.16.0
|
|
serverpod: 4.0.4
|
|
serverpod_auth_idp_server: 4.0.4
|
|
|
|
dev_dependencies:
|
|
# SRP's client half, to hold the register's half to it (test/unit/srp/).
|
|
halkyon_base_client:
|
|
path: ../halkyon_base_client
|
|
serverpod_test: 4.0.4
|
|
test: ^1.25.5
|