tranquil-pds/crates/ at main · maybeanerd.bsky.social/tranquil-pds · Tangled

maybeanerd.bsky.social / tranquil-pds

0

Our Personal Data Server from scratch!

0

tranquil-pds / crates /

at main 22 folders

Lewis dns: fall back to defaults if smth bad 2w ago

dns: fall back to defaults if smth bad Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

bsky(auth): add grace period to legacy session refresh Concurrent or retried com.atproto.server.refreshSession calls presenting the same refresh token hit the reuse-detection path, which deleted the session and returned "Refresh token has been revoked due to suspected compromise" — logging users out at random. The legacy flow had no grace period, unlike OAuth. Mirror the reference atproto PDS: every rotated refresh token gets a 2h grace window measured from its own rotation time (used_refresh_tokens.used_at in postgres; a rotated_at_ms field appended to the metastore used-marker, with old-format markers decoding as outside the window). A refresh presenting a recently-rotated token is served the session's current tokens, re-minted on the fly with the same jti/expiry — signed JWTs are never persisted. Reuse outside the window still revokes the session. The grace lookup returns the session's encrypted signing key so the handler verifies the presented token's signature before minting replacement tokens or revoking a session; a forged token bearing a known jti gets a generic rejection with no side effects. Integration tests asserting the old replay-gets-401 behavior are reworked to the new contract and now also cover forged-signature replays and out-of-window revocation.

1 month ago

ripple: fail-closed startup, bind policy Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

dns: fall back to defaults if smth bad Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

tranquil-config

plc: always keep signing key in rotationKeys Lewis: May this revision serve well! <lu5a@proton.me>

3 weeks ago

tranquil-crypto

small bug fixes, code dedup

6 months ago

session: deletes scope to did, route muts by did Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

tranquil-db-traits

session: deletes scope to did, route muts by did Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

fix(backups): remove useless backups concept

4 months ago

tranquil-lexicon

dns: fall back to defaults if smth bad Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

chore: allow native certs during local dev Allows Traefik certs to be trusted by Tranquil. Signed-off-by: Trezy <tre@trezy.com>

2 months ago

tranquil-oauth-server

delegation: preset scopes grant identity & account Lewis: May this revision serve well! <lu5a@proton.me>

3 weeks ago

dns: fall back to defaults if smth bad Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

feat(tranquil-store): gc and hardening Lewis: May this revision serve well! <lu5a@proton.me>

3 months ago

tranquil-ripple

ripple: anti-entropy gossip sync Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

tranquil-scopes

dns: fall back to defaults if smth bad Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

tranquil-server

plc: always keep signing key in rotationKeys Lewis: May this revision serve well! <lu5a@proton.me>

3 weeks ago

tranquil-signal

fix(config): signal gate is useless since needs admin work to activate anyway Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

tranquil-storage

fix(backups): remove useless backups concept

4 months ago

session: deletes scope to did, route muts by did Lewis: May this revision serve well! <lu5a@proton.me>

2 weeks ago

repo: the pg side of MST structural repair Lewis: May this revision serve well! <lu5a@proton.me>

1 month ago

feat: cross-pds delegation

4 months ago