tranquil-pds/crates/tranquil-api/src/ at build · ave.zone/tranquil-pds · Tangled

ave.zone / tranquil-pds

0

Fork for PR & AGPL purposes pds.lavate.ch

0

tranquil-pds / crates / tranquil-api / src /

at build 6 folders 9 files

ave bsky(auth): add grace period to legacy session refresh 6w ago

bsky(auth): add grace period to legacy session refresh Concurrent or retried com.atproto.server.refreshSession calls presenting the same refresh token hit the reuse-detection path, which deleted the session and returned "Refresh token has been revoked due to suspected compromise" — logging users out at random. The legacy flow had no grace period, unlike OAuth. Mirror the reference atproto PDS: every rotated refresh token gets a 2h grace window measured from its own rotation time (used_refresh_tokens.used_at in postgres; a rotated_at_ms field appended to the metastore used-marker, with old-format markers decoding as outside the window). A refresh presenting a recently-rotated token is served the session's current tokens, re-minted on the fly with the same jti/expiry — signed JWTs are never persisted. Reuse outside the window still revokes the session. The grace lookup returns the session's encrypted signing key so the handler verifies the presented token's signature before minting replacement tokens or revoking a session; a forged token bearing a known jti gets a generic rejection with no side effects. Integration tests asserting the old replay-gets-401 behavior are reworked to the new contract and now also cover forged-signature replays and out-of-window revocation.

1 month ago

fix(config): signal gate is useless since needs admin work to activate anyway Lewis: May this revision serve well! <lu5a@proton.me>

2 months ago

refactor(auth): unify short-code generation onto util::generate_token_code Collapse the three ad-hoc short-code generators into one canonical generator plus a shared normalizer: - util::generate_token_code now emits the uppercase base32 XXXXX-XXXXX display form; new util::normalize_token_code canonicalizes user input (uppercase, strip hyphen/whitespace). - email_token and legacy_2fa now generate via util, store the normalized form, and compare normalized input. Their private generate_short_token/generate_code (and BASE32_CHARS/CODE_LENGTH) are removed. - PLC (request/sign) and password reset inline util::generate_token_code, persist the normalized form, email the display form, and normalize input before lookup. The generate_plc_token/generate_reset_code wrappers are removed. Behavior changes: legacy login-2FA codes go from 8-digit numeric to XXXXX-XXXXX; PLC and password-reset codes go from lowercase to uppercase. All four code types are now accepted case-/hyphen-insensitively. OAuth web-login 2FA, account deletion, and the long verification_token blobs are intentionally untouched. Tests: add util normalize tests + email_token/legacy_2fa case/hyphen tests; update integration tests to expect the canonical stored form and the new emailed format.

1 month ago

fix(auth): keep lxm optional and dont default to * when no lxm is given in getServiceAuth

3 months ago

fix(api): dont verify signature or DID during importRepo

1 month ago

bsky(auth): add grace period to legacy session refresh Concurrent or retried com.atproto.server.refreshSession calls presenting the same refresh token hit the reuse-detection path, which deleted the session and returned "Refresh token has been revoked due to suspected compromise" — logging users out at random. The legacy flow had no grace period, unlike OAuth. Mirror the reference atproto PDS: every rotated refresh token gets a 2h grace window measured from its own rotation time (used_refresh_tokens.used_at in postgres; a rotated_at_ms field appended to the metastore used-marker, with old-format markers decoding as outside the window). A refresh presenting a recently-rotated token is served the session's current tokens, re-minted on the fly with the same jti/expiry — signed JWTs are never persisted. Reuse outside the window still revokes the session. The grace lookup returns the session's encrypted signing key so the handler verifies the presented token's signature before minting replacement tokens or revoking a session; a forged token bearing a known jti gets a generic rejection with no side effects. Integration tests asserting the old replay-gets-401 behavior are reworked to the new contract and now also cover forged-signature replays and out-of-window revocation.

1 month ago

age_assurance.rs

refactor(api): migrate all endpoints to repos accessor pattern

4 months ago

fix(auth): no bsky chat access when not specifically privileged to have it Lewis: May this revision serve well! <lu5a@proton.me>

3 months ago

feat(tranquil-store): whole test suite working Lewis: May this revision serve well! <lu5a@proton.me>

4 months ago

discord_webhook.rs

feat(tranquil-store): blockstore Lewis: May this revision serve well! <lu5a@proton.me>

4 months ago

server: serve xrpc over http/3 Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

notification_prefs.rs

feat(tranquil-store): soak harness driving leak gate, signal tweaks Lewis: May this revision serve well! <lu5a@proton.me>

3 months ago

telegram_webhook.rs

feat(tranquil-store): blockstore Lewis: May this revision serve well! <lu5a@proton.me>

4 months ago

refactor(api): update repo batch/delete to use repo_ops, clean up remaining repo endpoints

4 months ago

verification.rs

fix(backups): remove useless backups concept

4 months ago