Repository navigation
feat(auth): sign the device app label into register and login - #128
Merged
Merged
Conversation
A device may name its app (planner or engineering). It then signs the v2 register or login message, which adds its trimmed name, platform and app to the v1 bytes. The server stores the label and lists it; a device with no label signs the v1 messages as before.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| let _turn = TURN.lock().await; | ||
| let server = server().await; | ||
| let email = email(); | ||
| let upload = server.registration_upload(&email, b"pw").await; |
| // A new device signs in under the same rule and is listed with its label while pending. | ||
| let phone = DeviceKeys::generate().expect("keys"); | ||
| let (status, phone_session) = server | ||
| .login_labelled(&email, b"pw", &phone, &labelled("Phone", "planner")) |
|
|
||
| // A known device that signs in again keeps what is stored; the claim does not rewrite it. | ||
| let (status, again) = server | ||
| .login_labelled(&email, b"pw", &keys, &labelled("Renamed", "planner")) |
| let _turn = TURN.lock().await; | ||
| let server = server().await; | ||
| let email = email(); | ||
| let upload = server.registration_upload(&email, b"pw").await; |
| }, | ||
| ]; | ||
| for (i, case) in cases.iter().enumerate() { | ||
| let answer = server.login_labelled(&email, b"pw", &phone, case).await; |
| let server = server().await; | ||
| let email = email(); | ||
| let keys = DeviceKeys::generate().expect("keys"); | ||
| let session = server.register(&email, b"pw", &keys).await; |
| let devices = server.device_list(&session).await; | ||
| assert_eq!(devices[0]["app"], Value::Null); | ||
| let phone = DeviceKeys::generate().expect("keys"); | ||
| let signed_in = server.login(&email, b"pw", &phone).await; |
| let server = server().await; | ||
| let email = email(); | ||
| let keys = DeviceKeys::generate().expect("keys"); | ||
| let session = server.register(&email, b"pw", &keys).await; |
|
|
||
| // A new device with a label meets the factor; the label rides in the sealed state. | ||
| let phone = DeviceKeys::generate().expect("keys"); | ||
| let (login, status, started) = server.login_start(&email, b"pw").await; |
| let (login, status, started) = server.login_start(&email, b"pw").await; | ||
| assert_eq!(status, StatusCode::OK, "{started}"); | ||
| let finish = login | ||
| .finish(b"pw", &unb64(&started["credential_response"])) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
planner/engineering); it signsdevice-register/v2anddevice-login/v2(v1 bytes + length-prefixed trimmed name, platform, app).app, else v1; stores and lists the label (migration 0019, pending sign-up and second-factor state carry it).ClientConfig.app; contracts bindings regenerated.Testing
Co-authors
none
AI usage
Checklist
docs/architecture.mdwith any rule change; generated wire types with any contract change