From fe30860c58e0f1b1efd457ff5eb5146d1e592da0 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 01:03:43 +0200 Subject: feat: passphrase change and account recovery (auth-confirm) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The passphrase derives two independent client-side values: auth_key (the hub verifier) and bundle_key (AES-GCM key for the per-node identity bundles, which live on nodes and never on the hub). Changing or recovering a passphrase is therefore two operations — swap the hub verifier, and re-wrap every reachable node's identity bundle. Flow A — change a known passphrase (Profile page) - POST /v1/users/password re-proves the current passphrase, swaps pw_hash/salt/version, revokes every refresh token and returns a fresh pair so the tab that made the change stays signed in. - MeshBayTransport.rewrapAllNodes: for every group's online node, connect with the old key, read the identity off the handshake, store it back under the new key. Returns updated / unreachable / failed so the UI can point at the operator-unpin fallback for the gaps. Always-shown confirmation dialog listing reachable and unreachable groups. Recovery key - keyderive.js generateRecoveryKey (32 random bytes, grouped Base32) and deriveRecoveryKey (HKDF-SHA256, domain meshbay:recovery:v1:). - Every per-node identity gets a second copy wrapped under the recovery key: keypair_bundles.bundle_enc_recovery (node-only column, added in _SCHEMA_KEYPAIR and via a PRAGMA-guarded ALTER for existing DBs), carried on keypair_bundle_store / _resp. MNP 0.13 -> 0.14, additive. - session.recoveryKey is persisted in IndexedDB (slot rk) and lazy-loaded on connect, so a group joined in any later session still leaves a recovery copy. - Shown once at registration; optionally folded into the verification e-mail as a pass-through the hub never stores or logs, with an opt-out. - Profile -> Recovery key re-loads R and backfills every reachable node via rewrapAllNodes in bundleKey mode (no passphrase re-entry). Flow B — recover a lost passphrase (#/reset, linked from sign-in) - POST /v1/users/password/reset-request {username, email}: both must be the pair on file, checked against the blind email_hash (never decrypted). A mismatch — wrong e-mail, unknown username, non-active account — takes the identical no-op path (no code, no mail, same 200), so it reveals nothing and cannot be used to spray reset mail from a username alone. 5/min, 1-hour single-use code. - POST /v1/users/password/reset {username, code, new_auth_key}: same expiry / attempts / single-use checks as e-mail verification; revokes every session and deletes every registered device key so a stored one cannot sign back in past the reset. - ResetPasswordPage: request code -> code + optional recovery key + new passphrase -> reset + sign-in -> fan-out. connect() falls back to the recovery-wrapped copy when the passphrase key cannot open bundle_enc. Without a recovery key: sign-in is restored and each group needs the operator-unpin fallback. Supporting fixes (found in live testing) - member unpin now also deletes the keypair bundle; connect() mints a fresh identity when handed a bundle it cannot open (unless _rewrapOnly, set by rewrapAllNodes), so a rejoin completes instead of dead-ending before the invite-code prompt. - A browser with no bundle key gets a passphrase prompt on the group page instead of a "go back to the browser you registered on" message. - RegisterPage / LoginPage / ResetPasswordPage trim the username so every key derivation matches the hub's stored form. Docs: docs/auth-confirm.md. Locale keys across all ten catalogues. Tests: test_password_change, test_password_reset, test_recovery_email, test_recovery_key, test_rewrap_fanout, test_bundle_store_recovery, plus additions to test_admin_ops_mnp and test_webrtc_transport. Hub suite 492 passed; node suite 741 passed (the lone test_packaging_units failure is a pre-existing RPM-spec flake, reproducible on main). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01GGkxJW9br8Y9bhT8ywJ3oc --- .../src/meshbay_hub/static/locales/en.js | 62 ++++++++++++++++++++++ 1 file changed, 62 insertions(+) (limited to 'packages/meshbay-hub/src/meshbay_hub/static/locales/en.js') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js index a6f77b3..14a42a9 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js @@ -32,6 +32,25 @@ export default { 'login.loading': 'Logging in...', 'login.no_account': 'No account?', 'login.register_link': 'Register', + 'login.forgot': 'Forgot your passphrase?', + 'reset.title': 'Reset passphrase', + 'reset.request_intro': 'Enter your username and the email on the account. If they match, a reset code is sent to it.', + 'reset.send_code': 'Send code', + 'reset.form_intro': 'Enter the code from your email and choose a new passphrase. If you have your recovery key, add it to also restore access to your groups.', + 'reset.code': 'Reset code', + 'reset.recovery_key': 'Recovery key (optional)', + 'reset.recovery_key_hint': 'Leave blank if you do not have it. Without it your sign-in is restored, but each group must be rejoined.', + 'reset.new_pass': 'New passphrase', + 'reset.new_pass_repeat': 'Repeat new passphrase', + 'reset.submit': 'Reset passphrase', + 'reset.working': 'Restoring your group identities…', + 'reset.signin_restored': 'Your sign-in has been restored.', + 'reset.groups_restored': 'Your group identities were restored on every reachable node.', + 'reset.no_recovery': 'Your group identities were not restored. For each group, ask its operator to unpin you and send a new invitation code, then rejoin.', + 'reset.needs_operator': 'These groups still need action — ask each operator to unpin you and send a new code:', + 'reset.go_app': 'Go to the app', + 'reset.back_to_login': 'Back to sign in', + 'reset.err_unsupported': 'Passphrase reset needs the browser crypto module, which is not available here.', // Register 'register.title': 'Register', @@ -43,6 +62,16 @@ export default { 'register.loading': 'Creating account...', 'register.has_account': 'Already have an account?', 'register.login_link': 'Login', + 'register.recovery_title': 'Save your recovery key', + 'register.recovery_intro': 'This key restores your group identities if you ever forget your passphrase. Store it in a password manager or somewhere safe — it is shown only once, and the hub never sees it.', + 'register.recovery_copy': 'Copy', + 'register.recovery_copied': 'Copied', + 'register.recovery_warning': 'If you lose both your passphrase and this key, your files stay on their nodes but you rejoin each group with a new identity.', + 'register.recovery_saved': 'I have saved my recovery key somewhere safe.', + 'register.recovery_continue': 'Continue', + 'register.recovery_email_opt': 'Also email this recovery key to me as a backup', + 'register.recovery_emailed': 'A copy has also been sent to your email, in the same message as your verification code.', + 'register.recovery_not_emailed': 'This was not emailed. Save it now — this is the only time it is shown.', 'register.success_title': 'Verify your email', 'register.success_msg': 'A verification code has been sent to your email address. Enter it below to activate your account.', 'register.go_login': 'Go to login', @@ -288,6 +317,36 @@ export default { other: '{n} pinned', }, 'settings.node_pins_clear': 'Clear pinned identities', + 'settings.passphrase': 'Passphrase', + 'settings.passphrase_hint': "Change this account's passphrase. Your identity keys are re-wrapped on every group whose node is online; a group whose node is offline has to be rejoined afterwards.", + 'settings.passphrase_change': 'Change passphrase', + 'settings.passphrase_current': 'Current passphrase', + 'settings.passphrase_new': 'New passphrase', + 'settings.passphrase_new_repeat': 'Repeat new passphrase', + 'settings.continue': 'Continue', + 'settings.done': 'Done', + 'settings.passphrase_confirm_intro': 'Your identity keys will be re-wrapped now on every group whose node can be reached:', + 'settings.passphrase_reachable': 'Updated now', + 'settings.passphrase_unreachable': 'Cannot be reached', + 'settings.passphrase_fallback_note': 'For a group that cannot be reached, ask its operator to unpin you and send a fresh invitation code, then rejoin. Your files and messages are not lost.', + 'settings.passphrase_confirm_btn': 'Change it', + 'settings.passphrase_working': 'Re-wrapping your keys…', + 'settings.passphrase_done': 'Passphrase changed.', + 'settings.passphrase_needs_operator': 'These groups still need action — ask each operator to unpin you and send a new code:', + 'settings.pw_too_short': 'The new passphrase must be at least 12 characters.', + 'settings.pw_mismatch': 'The two new passphrases do not match.', + 'settings.pw_same': 'The new passphrase must differ from the current one.', + 'settings.pw_wrong_current': 'The current passphrase is not correct. Nothing was changed.', + 'settings.recovery': 'Recovery key', + 'settings.recovery_hint': 'Add a recovery-wrapped copy of your identity to every group. Do this once in each browser you use; without it, a lost passphrase means rejoining each group by hand.', + 'settings.recovery_loaded': 'Loaded in this browser — new groups are covered automatically.', + 'settings.recovery_open': 'Enter recovery key', + 'settings.recovery_input_ph': 'Paste your recovery key', + 'settings.recovery_submit': 'Add backup copies', + 'settings.recovery_working': 'Updating your groups…', + 'settings.recovery_done': 'Your groups now have a recovery copy.', + 'settings.recovery_partial': 'These groups could not be reached. Open them later, or run this again:', + 'settings.recovery_need_relogin': 'Please sign out and back in, then try again.', 'settings.danger': 'Delete account', 'settings.delete_hint': 'Removes your account, your group memberships and your ' + 'notifications from the hub, and frees your username. It cannot reach what ' @@ -604,6 +663,9 @@ export default { 'group.join_code_hint': 'Ask whoever invited you for the one-time code, and enter ' + 'it here. After that this browser is recognised and you will not be asked again.', 'group.join_code_btn': 'Join', + 'group.pass_title': 'Enter your passphrase', + 'group.pass_hint': 'This browser has not unlocked your keys yet. Enter your passphrase once to open your groups here.', + 'group.pass_btn': 'Unlock', 'notif.purge': 'Clear all', 'notif.title': 'Notifications', -- cgit v1.2.3