halkyon/apps/learn/halkyon_learn_server/migrations/migration_registry.txt
Tizian 「ティツィアーン」 aea0c447fc
fix(auth)!: the recovery phrase is proved by a key of its own
A key proof was a signature by the account's signing key, which every
signed-in device keeps in its keyring: whoever could read one, with a
code from its authenticator, set a new password without the password or
the phrase (the second reading's H1). The phrase now proves itself with
an Ed25519 key derived from its bits alone (halkyon_keys'
recoveryProofKeysOf, KDF context hlkrprf1, a sibling of the recovery
key), whose public half every setup, new phrase and account reset sends
and the register keeps (account_password.recoveryProofKey); the device
derives the secret half only while the phrase is typed. An account
without one (none exist outside development) proves no phrase until it
sets a new one; decoys check against a decoy proof key alike.

Migration (module, Learn's and Todo's servers, Learn's device schema):
ALTER TABLE "account_password" ADD COLUMN "recoveryProofKey" bytea;
nullable, so rows made before keep working and no data is touched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
2026-10-23 14:12:43 +02:00

40 lines
1.3 KiB
Text

### AUTOMATICALLY GENERATED DO NOT MODIFY
###
### This file is generated by Serverpod when creating a migration, do not modify it
### manually. If a collision is detected in this file when doing a code merge, resolve
### the conflict by removing and recreating the conflicting migration.
20260916165410927
20260930094729362-studysets
20260930122235111-cards
20260930145136285-reviews
20261001064926911-tree-tags-assets
20261002035419149-file-allowance
20261002191122122-notes
20261002211346701-learning-paths
20261003110855698-pdf-sources
20261007205440868-card-buried-at
20261008165051407-pdf-position
20261008223835206-dictionaries
20261009123850448-dictionary-kind
20261009145434785-dictionary-entry-version
20261009184924904-public-profiles
20261009195137836-published-studysets
20261009202105673-explore
20261009215552429-learner-count
20261009220324372-based-on
20261009224606274-feedback
20261010095547719-assistant-connector
20261012162411835-studyset-deleted-at
20261013035552510-dictionary-keys
20261014153932647-release-colour
20261015171326465-email-sign-in
20261015220121195-verified-links
20261015220626303-discussions
20261017110130653
20261019121406578-halkyon-base
20261019201023295-profiles-in-halkyon-base
20261019204112282-deletion-notices
20261020111943300-passwords
20261020125117584-sessions-ended
20261020185750538-recovery-proof-key