tranquil-pds/crates/ at build · ave.zone/tranquil-pds · Tangled

ave.zone / tranquil-pds

0

Fork for PR & AGPL purposes pds.lavate.ch

0

tranquil-pds / crates /

at build 22 folders

ave Revert "chore(auth): align at+jwt/refresh+jwt expiry with reference PDS" 6w ago

Revert "chore(auth): align at+jwt/refresh+jwt expiry with reference PDS" This reverts commit fe9b88141c61b0aca4e97c7428856835dad7f594.

1 month ago

Revert "chore(auth): align at+jwt/refresh+jwt expiry with reference PDS" This reverts commit fe9b88141c61b0aca4e97c7428856835dad7f594.

1 month ago

ripple: fail-closed startup, bind policy Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

feat(locales): add french locale, fix missing error keys, remove dead keys Adds french locale registration and translation file. Fixes 4 missing error keys that were referenced in code but absent from all locale files. Removes 2 unreferenced keys from `register.validation` that duplicated `registerPasskey.errors`. I *think* that's all that's needed for french locale? Couldn't find anything else required to make it work!

2 months ago

tranquil-config

feat(proxy): opt-in default appview fallback app.bsky.* requests with no atproto-proxy header are rejected by default. When server.default_appview (DEFAULT_APPVIEW) is set, proxy them to that AppView instead, matching the reference PDS. Protected/local methods and chat.bsky.* are unaffected; age-assurance override still wins.

1 month ago

tranquil-crypto

small bug fixes, code dedup

6 months ago

bsky(auth): add grace period to legacy session refresh Concurrent or retried com.atproto.server.refreshSession calls presenting the same refresh token hit the reuse-detection path, which deleted the session and returned "Refresh token has been revoked due to suspected compromise" — logging users out at random. The legacy flow had no grace period, unlike OAuth. Mirror the reference atproto PDS: every rotated refresh token gets a 2h grace window measured from its own rotation time (used_refresh_tokens.used_at in postgres; a rotated_at_ms field appended to the metastore used-marker, with old-format markers decoding as outside the window). A refresh presenting a recently-rotated token is served the session's current tokens, re-minted on the fly with the same jti/expiry — signed JWTs are never persisted. Reuse outside the window still revokes the session. The grace lookup returns the session's encrypted signing key so the handler verifies the presented token's signature before minting replacement tokens or revoking a session; a forged token bearing a known jti gets a generic rejection with no side effects. Integration tests asserting the old replay-gets-401 behavior are reworked to the new contract and now also cover forged-signature replays and out-of-window revocation.

1 month ago

tranquil-db-traits

bsky(auth): add grace period to legacy session refresh Concurrent or retried com.atproto.server.refreshSession calls presenting the same refresh token hit the reuse-detection path, which deleted the session and returned "Refresh token has been revoked due to suspected compromise" — logging users out at random. The legacy flow had no grace period, unlike OAuth. Mirror the reference atproto PDS: every rotated refresh token gets a 2h grace window measured from its own rotation time (used_refresh_tokens.used_at in postgres; a rotated_at_ms field appended to the metastore used-marker, with old-format markers decoding as outside the window). A refresh presenting a recently-rotated token is served the session's current tokens, re-minted on the fly with the same jti/expiry — signed JWTs are never persisted. Reuse outside the window still revokes the session. The grace lookup returns the session's encrypted signing key so the handler verifies the presented token's signature before minting replacement tokens or revoking a session; a forged token bearing a known jti gets a generic rejection with no side effects. Integration tests asserting the old replay-gets-401 behavior are reworked to the new contract and now also cover forged-signature replays and out-of-window revocation.

1 month ago

fix(backups): remove useless backups concept

4 months ago

tranquil-lexicon

fix(tranquil-store): atomic record commits, hint-as-truth recovery Lewis: May this revision serve well! <lu5a@proton.me>

3 months ago

chore: allow native certs during local dev Allows Traefik certs to be trusted by Tranquil. Signed-off-by: Trezy <tre@trezy.com>

2 months ago

tranquil-oauth-server

feat: tranquil's own TLS handling Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

bsky(auth): add grace period to legacy session refresh Concurrent or retried com.atproto.server.refreshSession calls presenting the same refresh token hit the reuse-detection path, which deleted the session and returned "Refresh token has been revoked due to suspected compromise" — logging users out at random. The legacy flow had no grace period, unlike OAuth. Mirror the reference atproto PDS: every rotated refresh token gets a 2h grace window measured from its own rotation time (used_refresh_tokens.used_at in postgres; a rotated_at_ms field appended to the metastore used-marker, with old-format markers decoding as outside the window). A refresh presenting a recently-rotated token is served the session's current tokens, re-minted on the fly with the same jti/expiry — signed JWTs are never persisted. Reuse outside the window still revokes the session. The grace lookup returns the session's encrypted signing key so the handler verifies the presented token's signature before minting replacement tokens or revoking a session; a forged token bearing a known jti gets a generic rejection with no side effects. Integration tests asserting the old replay-gets-401 behavior are reworked to the new contract and now also cover forged-signature replays and out-of-window revocation.

1 month ago

feat(tranquil-store): gc and hardening Lewis: May this revision serve well! <lu5a@proton.me>

3 months ago

tranquil-ripple

ripple: anti-entropy gossip sync Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

tranquil-scopes

fix: derive lexicon DNS authority from all-but-last NSID segment Permission-set expansion resolved the lexicon's DNS authority using a fixed `parts[..2]`, which only works for three-segment NSIDs. For a four-segment NSID such as community.lexicon.bookmarks.authManageBookmarks this dropped a segment and queried _lexicon.lexicon.community instead of _lexicon.bookmarks.lexicon.community, failing with "DNS resolution failed: ... no record found". The authority is every NSID segment except the last (the name), reversed. Use parts[..parts.len() - 1] to match the spec and the existing extract_namespace_authority helper, and update the DNS authority test with three/four-segment and bookmarks regression cases.

1 month ago

tranquil-server

server: serve xrpc over http/3 Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

tranquil-signal

fix(config): signal gate is useless since needs admin work to activate anyway Lewis: May this revision serve well! <lu5a@proton.me>

2 months ago

tranquil-storage

fix(backups): remove useless backups concept

4 months ago

bsky(auth): add grace period to legacy session refresh Concurrent or retried com.atproto.server.refreshSession calls presenting the same refresh token hit the reuse-detection path, which deleted the session and returned "Refresh token has been revoked due to suspected compromise" — logging users out at random. The legacy flow had no grace period, unlike OAuth. Mirror the reference atproto PDS: every rotated refresh token gets a 2h grace window measured from its own rotation time (used_refresh_tokens.used_at in postgres; a rotated_at_ms field appended to the metastore used-marker, with old-format markers decoding as outside the window). A refresh presenting a recently-rotated token is served the session's current tokens, re-minted on the fly with the same jti/expiry — signed JWTs are never persisted. Reuse outside the window still revokes the session. The grace lookup returns the session's encrypted signing key so the handler verifies the presented token's signature before minting replacement tokens or revoking a session; a forged token bearing a known jti gets a generic rejection with no side effects. Integration tests asserting the old replay-gets-401 behavior are reworked to the new contract and now also cover forged-signature replays and out-of-window revocation.

1 month ago

repo: the pg side of MST structural repair Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

feat: cross-pds delegation

4 months ago