Repository navigation
API v2: SecretSpace 3 accounts and sessions (2.0.0-alpha.1) - #10
Merged
Merged
Conversation
…a.1) Phase 2 of the 3.0 design (DESIGN-3.0.md section 6). New routes under /v2/, beside the 2.x /vault/<user> routes, which are unchanged: - GET /v2/prelogin/<user> the Argon2id salt and cost from the stored keyset; for a name with no account a made-up but stable answer (HMAC with a server key), so it does not tell which names exist - POST /v2/accounts sign-up, with the server's token as the code; makes the account and its personal vault - POST /v2/login Login Key -> session (12 h); scrypt-hashed Login Key compared in constant time, a dummy hash for unknown names, 10 wrong tries in 15 min pause the name for a minute - POST /v2/logout, GET /v2/me - PUT /v2/me/keyset new password: new keyset + Login Key, every other session of the account ends - GET/PUT /v2/vaults/<id>[/meta] the 2.x blob rules per vault (revision, If-Match, 428/409, history, key generation), members only (404 alike for "not yours" and "no such vault"), readers cannot PUT (403), and a blob must be PMV3 naming this vault Data in <store>/_v2/ (a 2.x name cannot start with "_"). Sessions are stored hashed; nothing on disk logs anyone in. The 2.x vault GET/PUT code moved into _send_blob/_store_blob, shared by both APIs; 2.x behaviour is unchanged (POST on a 2.x path still answers 501). /health also says "api": [1, 2]. Deviation from the design: the Login Key is hashed with scrypt (standard library) rather than Argon2id; it is already a 256-bit HKDF output, so a slow hash adds nothing, and the server keeps needing no packages. tests/test_server_v2.py: 48 tests. Mutation check: 11 deliberately broken guards (reader write, vault-id check, session expiry, non-member access, lockout, sign-up token, duplicate names, sessions after a password change, exact-name login, disabled accounts, pre-login leak), all caught. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011ojnyVg7ccsR3pZ64s7aRH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Phase 2 of SecretSpace 3, server side: accounts, sessions and per-vault blobs. Version 2.0.0-alpha.1, a test version for the Lab.
New routes under
/v2/. The 2.x routes (/vault/<user>with the shared token) are unchanged, so 2.x clients, including prod, sync as before.GET /v2/prelogin/<user>POST /v2/accountsPOST /v2/loginPOST /v2/logout,GET /v2/mePUT /v2/me/keysetGET/PUT /v2/vaults/<id>[/meta]Never on the server: a master password, a Secret Key or a vault key. The Login Key is stored as a salted scrypt hash, and sessions are stored hashed.
Where the data lives:
<store>/_v2/. No 2.x name can start with_, so it never collides with a 2.x vault.Design deviation: the Login Key is hashed with scrypt from the standard library instead of Argon2id. It's already a 256-bit key, so a slow hash adds nothing, and the server stays package-free.
Checks
tests/test_server_v2.py: 48 new tests. All server tests pass.passman_server.pyis identical in both server repos.2.0.0.1, as in the client). The test build ofSecretSpace-Server-Installer.exe2.0.0-alpha.1 compiled fine; it was not installed.The clients that use this come in the matching client PRs (3.0.0-alpha.3 / 1.0.0-alpha.3).
🤖 Generated with Claude Code
https://claude.ai/code/session_011ojnyVg7ccsR3pZ64s7aRH