From fe30860c58e0f1b1efd457ff5eb5146d1e592da0 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 01:03:43 +0200 Subject: feat: passphrase change and account recovery (auth-confirm) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The passphrase derives two independent client-side values: auth_key (the hub verifier) and bundle_key (AES-GCM key for the per-node identity bundles, which live on nodes and never on the hub). Changing or recovering a passphrase is therefore two operations — swap the hub verifier, and re-wrap every reachable node's identity bundle. Flow A — change a known passphrase (Profile page) - POST /v1/users/password re-proves the current passphrase, swaps pw_hash/salt/version, revokes every refresh token and returns a fresh pair so the tab that made the change stays signed in. - MeshBayTransport.rewrapAllNodes: for every group's online node, connect with the old key, read the identity off the handshake, store it back under the new key. Returns updated / unreachable / failed so the UI can point at the operator-unpin fallback for the gaps. Always-shown confirmation dialog listing reachable and unreachable groups. Recovery key - keyderive.js generateRecoveryKey (32 random bytes, grouped Base32) and deriveRecoveryKey (HKDF-SHA256, domain meshbay:recovery:v1:). - Every per-node identity gets a second copy wrapped under the recovery key: keypair_bundles.bundle_enc_recovery (node-only column, added in _SCHEMA_KEYPAIR and via a PRAGMA-guarded ALTER for existing DBs), carried on keypair_bundle_store / _resp. MNP 0.13 -> 0.14, additive. - session.recoveryKey is persisted in IndexedDB (slot rk) and lazy-loaded on connect, so a group joined in any later session still leaves a recovery copy. - Shown once at registration; optionally folded into the verification e-mail as a pass-through the hub never stores or logs, with an opt-out. - Profile -> Recovery key re-loads R and backfills every reachable node via rewrapAllNodes in bundleKey mode (no passphrase re-entry). Flow B — recover a lost passphrase (#/reset, linked from sign-in) - POST /v1/users/password/reset-request {username, email}: both must be the pair on file, checked against the blind email_hash (never decrypted). A mismatch — wrong e-mail, unknown username, non-active account — takes the identical no-op path (no code, no mail, same 200), so it reveals nothing and cannot be used to spray reset mail from a username alone. 5/min, 1-hour single-use code. - POST /v1/users/password/reset {username, code, new_auth_key}: same expiry / attempts / single-use checks as e-mail verification; revokes every session and deletes every registered device key so a stored one cannot sign back in past the reset. - ResetPasswordPage: request code -> code + optional recovery key + new passphrase -> reset + sign-in -> fan-out. connect() falls back to the recovery-wrapped copy when the passphrase key cannot open bundle_enc. Without a recovery key: sign-in is restored and each group needs the operator-unpin fallback. Supporting fixes (found in live testing) - member unpin now also deletes the keypair bundle; connect() mints a fresh identity when handed a bundle it cannot open (unless _rewrapOnly, set by rewrapAllNodes), so a rejoin completes instead of dead-ending before the invite-code prompt. - A browser with no bundle key gets a passphrase prompt on the group page instead of a "go back to the browser you registered on" message. - RegisterPage / LoginPage / ResetPasswordPage trim the username so every key derivation matches the hub's stored form. Docs: docs/auth-confirm.md. Locale keys across all ten catalogues. Tests: test_password_change, test_password_reset, test_recovery_email, test_recovery_key, test_rewrap_fanout, test_bundle_store_recovery, plus additions to test_admin_ops_mnp and test_webrtc_transport. Hub suite 492 passed; node suite 741 passed (the lone test_packaging_units failure is a pre-existing RPM-spec flake, reproducible on main). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01GGkxJW9br8Y9bhT8ywJ3oc --- .../tests/test_bundle_store_recovery.py | 76 ++++++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 packages/meshbay-node/tests/test_bundle_store_recovery.py (limited to 'packages/meshbay-node/tests/test_bundle_store_recovery.py') diff --git a/packages/meshbay-node/tests/test_bundle_store_recovery.py b/packages/meshbay-node/tests/test_bundle_store_recovery.py new file mode 100644 index 0000000..10a3400 --- /dev/null +++ b/packages/meshbay-node/tests/test_bundle_store_recovery.py @@ -0,0 +1,76 @@ +""" +The recovery-wrapped keypair copy (docs/auth-confirm.md §4.3, MNP 0.14). + +`bundle_enc_recovery` is a second copy of the identity bundle wrapped under the +account's recovery key. The store has to add the column to a database that +predates it, and a plain re-backup that omits the recovery copy must not erase +one already there. +""" + +import aiosqlite +import pytest +from meshbay_node.bundle_store import BundleStore + + +@pytest.mark.asyncio +async def test_round_trip_with_and_without_recovery(tmp_path): + store = BundleStore(db_path=tmp_path / "bundles.db") + await store.open() + + await store.store_keypair("u1", "pass-wrapped-1") + row = await store.fetch_keypair("u1") + assert row == {"bundle_enc": "pass-wrapped-1", "bundle_enc_recovery": None} + + await store.store_keypair("u2", "pass-wrapped-2", "recovery-wrapped-2") + row = await store.fetch_keypair("u2") + assert row["bundle_enc"] == "pass-wrapped-2" + assert row["bundle_enc_recovery"] == "recovery-wrapped-2" + + assert await store.fetch_keypair("nobody") is None + await store.close() + + +@pytest.mark.asyncio +async def test_re_backup_without_recovery_keeps_the_existing_copy(tmp_path): + """A passphrase-change re-wrap sends only bundle_enc; the recovery copy stays.""" + store = BundleStore(db_path=tmp_path / "bundles.db") + await store.open() + + await store.store_keypair("u1", "v1", "recovery-v1") + await store.store_keypair("u1", "v2") # no recovery arg + row = await store.fetch_keypair("u1") + assert row["bundle_enc"] == "v2" + assert row["bundle_enc_recovery"] == "recovery-v1" + + # An explicit new recovery copy does replace it. + await store.store_keypair("u1", "v3", "recovery-v3") + row = await store.fetch_keypair("u1") + assert row == {"bundle_enc": "v3", "bundle_enc_recovery": "recovery-v3"} + await store.close() + + +@pytest.mark.asyncio +async def test_migration_adds_the_column_to_an_old_database(tmp_path): + db_path = tmp_path / "bundles.db" + + # A keypair_bundles table as it looked before MNP 0.14. + async with aiosqlite.connect(str(db_path)) as db: + await db.execute( + "CREATE TABLE keypair_bundles (" + " user_id TEXT PRIMARY KEY," + " bundle_enc TEXT NOT NULL," + " stored_at TEXT NOT NULL DEFAULT (datetime('now')))") + await db.execute( + "INSERT INTO keypair_bundles (user_id, bundle_enc) VALUES ('old', 'legacy')") + await db.commit() + + store = BundleStore(db_path=db_path) + await store.open() # runs the migration + + row = await store.fetch_keypair("old") + assert row == {"bundle_enc": "legacy", "bundle_enc_recovery": None} + + await store.store_keypair("old", "legacy", "recovery-now") + row = await store.fetch_keypair("old") + assert row["bundle_enc_recovery"] == "recovery-now" + await store.close() -- cgit v1.2.3