From 988a0eecd522431980174910db28e45a63ff2710 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 12:32:24 +0200 Subject: feat(cli): account, rm -r and mkdir, Tab completion MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit account shows the account and does what the sign-up form and the Profile page do: register (the passphrase floor and the hub's proof of work checked here, the recovery key printed once), verify, change the passphrase, reset a forgotten one, change the e-mail address, sign out everywhere, delete. A new passphrase carries the copy of the account's keys each node keeps for browsers first — opened under the old M, the same keys sealed under the new one — and only then tells the hub; a refusal sets the copies back. A reset restores them from the recovery copy. The connections that do it never make keys nor ask for a device approval. This machine keeps the M it changed away from, so a node out of reach is carried at its next connection; a copy under an M it does not know is no longer rewritten, which locked the browsers out after a passphrase changed elsewhere. rm -r removes a folder and all it holds, from the node's operator key: the files, then the folders deepest first, one confirmation that counts them. mkdir makes folders, --parents the missing ones (not -p, the passphrase). completion bash|powershell prints the script that makes Tab complete actions, verbs, options and the paths of the groups this machine is signed in to, cached two minutes; the deb and rpm packages install the bash one. Co-Authored-By: Claude Opus 5.5 --- .../src/meshbay_cli/client/passphrase.py | 64 ++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 packages/meshbay-cli/src/meshbay_cli/client/passphrase.py (limited to 'packages/meshbay-cli/src/meshbay_cli/client/passphrase.py') diff --git a/packages/meshbay-cli/src/meshbay_cli/client/passphrase.py b/packages/meshbay-cli/src/meshbay_cli/client/passphrase.py new file mode 100644 index 0000000..071c708 --- /dev/null +++ b/packages/meshbay-cli/src/meshbay_cli/client/passphrase.py @@ -0,0 +1,64 @@ +""" +A new passphrase's floor, and the hub's proof of work — both checked here. + +The hub never sees a passphrase (docs/MESHBAY_DESIGN.md §3.1), so the floor — +12 characters and about 60 estimated bits — can only be enforced by the client: +`auth-page.js` `passwordBits`, the same estimate, so a passphrase the page +refuses is refused here too. +""" + +import hashlib +import math +import re + +MIN_LENGTH = 12 +MIN_BITS = 60 +_WEAK = re.compile(r"(password|motdepasse|azerty|qwerty|123456|meshbay)", re.I) + + +def passphrase_bits(pw: str) -> int: + if not pw: + return 0 + pool = 0 + if re.search(r"[a-z]", pw): + pool += 26 + if re.search(r"[A-Z]", pw): + pool += 26 + if re.search(r"[0-9]", pw): + pool += 10 + if re.search(r"[^A-Za-z0-9]", pw): + pool += 32 + # JavaScript counts UTF-16 units; a character outside the BMP is two. + length = len(pw.encode("utf-16-le")) // 2 + bits = length * math.log2(pool or 1) + if len(set(pw)) < length / 2: + bits *= 0.6 + if re.fullmatch(r"[0-9]+", pw): + bits *= 0.5 + if _WEAK.search(pw): + bits *= 0.3 + # Math.round: halves go up. + return math.floor(bits + 0.5) + + +def passphrase_problem(pw: str) -> str | None: + """Why a new passphrase is refused, or None.""" + if len(pw.encode("utf-16-le")) // 2 < MIN_LENGTH: + return f"A passphrase has {MIN_LENGTH} characters at least." + if passphrase_bits(pw) < MIN_BITS: + return ("This passphrase is too easy to guess: make it longer, or mix in " + "other kinds of characters.") + return None + + +def solve_captcha(challenge: dict) -> str | None: + """ + The answer to `GET /v1/users/captcha`: the number below `max_number` whose + `` hashes to `challenge` (`captcha.js` `solve`), as the token + the register and reset-request bodies carry. None if there is none. + """ + prefix, want = challenge["prefix"], bytes.fromhex(challenge["challenge"]) + for n in range(int(challenge["max_number"])): + if hashlib.sha256(f"{prefix}{n}".encode()).digest() == want: + return f"{prefix}{n}.{challenge['signature']}" + return None -- cgit v1.2.3