Repository navigation
Server 2.0.0-alpha.3: share a vault between accounts, and keep a log - #12
Merged
Merged
Conversation
SecretSpace 3, phase 4. A vault can now have several members: - PUT /v2/vaults/<id>/members/<user>: an owner adds an account (role owner, editor or reader) with the vault key wrapped to that account's public key by the owner's device, or changes a member's role. The server never holds a vault key. A reader's upload is refused, as before. - POST /v2/vaults/<id>/rotate: an owner gives the vault a new key and can remove members in the same call. The re-encrypted vault, its re-sealed name and a wrapped key for every member who stays are swapped in together; earlier revisions (under the old key) are dropped. The vault's key generation goes up, and an upload whose header carries another generation is refused, so a device that missed the change cannot put back a copy the removed members can read. - DELETE /v2/vaults/<id>/members/<me>: a member leaves. The only owner cannot. - GET /v2/vaults/<id>/members, GET /v2/accounts/<user>/public-key, PUT /v2/me/signing-key (set once; the key an account signs its changes with). - The log: _v2/vaults/<id>/audit.log per vault (made, renamed, deleted, uploads, members, key changes; owners read it with GET .../log) and _v2/logins.log (logins, failed logins, accounts made, password changes). One JSON line each, appended, rotated at 2 MB. No vault content, key or name is in it, and nothing about who viewed or copied an entry. - /health lists "sharing". Names in /v2/ paths are percent-decoded, so an account with a space in its name can log in. - The limit of 50 vaults per account counts the vaults an account made, not the ones shared with it. 2.x routes are unchanged. Accounts and vaults made with 2.0.0-alpha.1/2 keep working (a vault without a stored key generation is at 0). Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011ojnyVg7ccsR3pZ64s7aRH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SecretSpace 3, phase 4, server side: a vault can be shared between accounts, and the server keeps a log. Server version 2.0.0-alpha.3 (a test version; Latest stays as it is).
What changes
PUT /v2/vaults/<id>/members/<user>). The vault key arrives wrapped to that account's public key by the owner's device; the server never holds a vault key. A reader's upload is refused.POST /v2/vaults/<id>/rotate). The re-encrypted vault, its re-sealed name and a wrapped key for every member who stays are swapped in together, or nothing changes. Earlier revisions are dropped, because they are under the old key.DELETE /v2/vaults/<id>/members/<me>); the only owner cannot.GET /v2/accounts/<user>/public-key, andPUT /v2/me/signing-key(set once)._v2/vaults/<id>/audit.logper vault (owners read it withGET /v2/vaults/<id>/log) and_v2/logins.log. One JSON line per event, appended, rotated at 2 MB. No vault content, keys or names, and nothing about who viewed or copied an entry./healthlists"sharing"./v2/paths are percent-decoded, so an account with a space in its name can log in.What does not change
/vault/<user>with the token).Tests
tests/test_server_v2_sharing.py: 151 tests over real HTTP. Every refused call is also checked to have changed nothing on disk.server/passman_server.pyis the same file in SecretSpace-Server-Linux and SecretSpace-Server-Windows.🤖 Generated with Claude Code
https://claude.ai/code/session_011ojnyVg7ccsR3pZ64s7aRH