Public Access
Build the three things the phone's + needs, before the + exists
Steps 1 to 3 of docs/adding-hosts-on-the-phone.md: the domain half. Nothing on either head has changed, which is deliberate — the plan orders these first because everything the editors will bind to has to exist and be merge-safe before a screen can offer it. HostGroupSecret gains a parent and four defaults, and the codec gains the version rule it never had. It stamped CurrentSchemaVersion unconditionally, which was harmless with one field and one version and stops being harmless here: upgrading one machine and renaming any group would have made that group uneditable on every machine still on the old build. It now emits the lowest version that loses nothing, so a flat group with no defaults still encodes at version 1, byte for byte, pinned against a literal. Tags become a real item over the reserved slot. Secret, codec, merge, cipher, repository, both registries, the EF entity and a generated AddTagItem migration. TagCipher names AadResourceType.Tag as a constant rather than casting the wire type, because Tag is 5 on the wire and 8 in the crypto enum and 5 there is Credential — a cast would seal every tag under the resource type for a password, encrypt and decrypt perfectly on the machine that wrote it, and only fail when another implementation refused the item, by which time the AAD is frozen into stored ciphertext. HostTag stays reserved and unused: the one thing the join buys over a set on the host is bought instead by merging TagIds per id. HostSecret grows TagIds and Port goes nullable, which is the change with the widest blast radius and the only one that loses an item rather than locking one. A host with no port of its own omits the property, an older build reads int Port as 0, and TryValidate refuses it — unreadable rather than read-only. That cost is confined to hosts which actually inherit, because the version is a maximum over the fields present; the alternative, writing 22 into every host, is the lie inheritance exists to stop telling. One decision the plan did not specify. "Three states where there were two" is four — key, credential, typed password, or the group's answer — and two nullable ids carry three. Naming neither id now means inherit, so AsksForPassword says "a typed password even under a group that lends a key" out loud. Only true is ever written and a decoded false folds back to null, so a host that never touched it encodes as it always did. Nothing already stored changed meaning: no group could lend a binding before this build, so every existing host resolves exactly as it did. HostInheritance is the resolver, and its visited set is load-bearing rather than defensive. Two clients can each re-parent A under B and B under A while offline; the merge sees one item against one item and the server sees ciphertext, so nothing upstream can refuse the pair. With inheritance the chain is walked at connect time, so an unguarded cycle is not an undrawable sidebar — it is a shell that never opens. Stopping at the first repeat degrades it to a group that reads as a root, and clearing the parent is the repair. A tag set turns out to be the one field on a host that can never ask the user anything. TagSet.ToIdMap keys by the value, so no key can hold two values, so the both-sides-moved-differently branch of the keyed merge is unreachable — asserted over the whole eight-row matrix. The conflict loop is kept anyway, because that proof is one edit from ceasing to hold and what it would cause is a discarded tag nothing records. Three guard tests failed by design and were fixed rather than relaxed: the ordered pull filter, the AAD pinning table, and the server's refusal of a plaintext parent — that last one survives with its reason rewritten, because the refusal now means "the parent is not the server's to hold" rather than "there is no such thing as a parent". The prose that said groups are flat is rewritten in all four places it appeared, not deleted. The five view-model sites that read Port directly now go through the resolver, which is a down payment on step 4 rather than the whole of it. HostFields.From still emits the stored port, and that is the one remaining place where an unresolved read would be a wrong wire rather than a wrong label. Verified by the whole suite: 1382 tests over nineteen projects, none failing. Both heads build. Nothing seen on a display, because nothing on a display has changed yet. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -164,11 +164,12 @@ public sealed class KnownHostKeyConfiguration : IEntityTypeConfiguration<VaultKn
|
||||
/// Maps <see cref="VaultHostGroup"/>.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The same shape again, and by now the sameness is the design rather than a coincidence: four item types
|
||||
/// hold nothing but an envelope and its bookkeeping. This one is worth a sentence anyway, because it is the
|
||||
/// type where a plaintext column would have been most tempting and least defensible — a <c>name</c> here
|
||||
/// would let the server order a list it never draws, in exchange for telling the operator how every user
|
||||
/// files their machines.
|
||||
/// The same shape again, and by now the sameness is the design rather than a coincidence: most item types
|
||||
/// hold nothing but an envelope and its bookkeeping. This one is worth a sentence anyway, because it is a
|
||||
/// type where plaintext columns would have been tempting and are not defensible — a <c>name</c> here would
|
||||
/// let the server order a list it never draws, and a <c>parent_id</c> would draw the shape of every user's
|
||||
/// estate, both in exchange for telling the operator how each of them files their machines. Groups nest
|
||||
/// through a pointer inside the payload; nothing about that is visible from this table.
|
||||
/// </remarks>
|
||||
public sealed class HostGroupConfiguration : IEntityTypeConfiguration<VaultHostGroup>
|
||||
{
|
||||
@@ -199,6 +200,43 @@ public sealed class HostGroupConfiguration : IEntityTypeConfiguration<VaultHostG
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Maps <see cref="VaultTag"/>.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <see cref="HostGroupConfiguration"/> again, down to the index names. The one thing worth stating is what
|
||||
/// is <em>not</em> here: no <c>host_tag</c> join table, because membership is a set inside each host's
|
||||
/// payload — see <see cref="VaultTag"/> — so there is nothing to join and no second table to keep in step.
|
||||
/// </remarks>
|
||||
public sealed class TagConfiguration : IEntityTypeConfiguration<VaultTag>
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public void Configure(EntityTypeBuilder<VaultTag> builder)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(builder);
|
||||
|
||||
builder.ToTable("tag");
|
||||
builder.HasKey(t => t.Id);
|
||||
|
||||
// Client-generated UUIDv7: a tag must be creatable offline, with its id, because the host that
|
||||
// wears it is created offline too and needs something to point at.
|
||||
builder.Property(t => t.Id).ValueGeneratedNever();
|
||||
builder.UseXminConcurrencyToken();
|
||||
|
||||
builder.Property(t => t.Payload).IsRequired();
|
||||
|
||||
builder.HasIndex(t => new { t.VaultId, t.ChangeSequence });
|
||||
|
||||
builder.HasIndex(t => t.VaultId)
|
||||
.HasFilter("deleted_at_utc IS NULL")
|
||||
.HasDatabaseName("ix_tag_vault_live");
|
||||
|
||||
builder.ToTable(t => t.HasCheckConstraint(
|
||||
"ck_tag_version",
|
||||
"version >= 1"));
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Maps <see cref="VaultSnippet"/>.
|
||||
/// </summary>
|
||||
|
||||
@@ -66,6 +66,9 @@ public class DodoDbContext(DbContextOptions<DodoDbContext> options) : DbContext(
|
||||
/// <summary>Host groups, held as ciphertext.</summary>
|
||||
public DbSet<VaultHostGroup> HostGroups => Set<VaultHostGroup>();
|
||||
|
||||
/// <summary>Tags hosts can wear, held as ciphertext.</summary>
|
||||
public DbSet<VaultTag> Tags => Set<VaultTag>();
|
||||
|
||||
/// <summary>Saved commands, held as ciphertext.</summary>
|
||||
public DbSet<VaultSnippet> Snippets => Set<VaultSnippet>();
|
||||
|
||||
|
||||
+1809
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,70 @@
|
||||
using System;
|
||||
using Microsoft.EntityFrameworkCore.Migrations;
|
||||
|
||||
#nullable disable
|
||||
|
||||
namespace DodoSSH.Infrastructure.Migrations
|
||||
{
|
||||
/// <inheritdoc />
|
||||
public partial class AddTagItem : Migration
|
||||
{
|
||||
/// <inheritdoc />
|
||||
protected override void Up(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.CreateTable(
|
||||
name: "tag",
|
||||
schema: "dodo",
|
||||
columns: table => new
|
||||
{
|
||||
id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
vault_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
payload = table.Column<byte[]>(type: "bytea", nullable: false),
|
||||
data_key_wrap = table.Column<byte[]>(type: "bytea", nullable: true),
|
||||
content_key_id = table.Column<Guid>(type: "uuid", nullable: true),
|
||||
key_generation = table.Column<int>(type: "integer", nullable: false),
|
||||
payload_aad_version = table.Column<short>(type: "smallint", nullable: false),
|
||||
version = table.Column<int>(type: "integer", nullable: false),
|
||||
change_sequence = table.Column<long>(type: "bigint", nullable: false),
|
||||
created_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
updated_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: false),
|
||||
deleted_at_utc = table.Column<DateTimeOffset>(type: "timestamp with time zone", nullable: true),
|
||||
created_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
updated_by_user_id = table.Column<Guid>(type: "uuid", nullable: false),
|
||||
xmin = table.Column<uint>(type: "xid", rowVersion: true, nullable: false)
|
||||
},
|
||||
constraints: table =>
|
||||
{
|
||||
table.PrimaryKey("pk_tag", x => x.id);
|
||||
table.CheckConstraint("ck_tag_version", "version >= 1");
|
||||
table.ForeignKey(
|
||||
name: "fk_tag_vaults_vault_id",
|
||||
column: x => x.vault_id,
|
||||
principalSchema: "dodo",
|
||||
principalTable: "vault",
|
||||
principalColumn: "id",
|
||||
onDelete: ReferentialAction.Cascade);
|
||||
});
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_tag_vault_id_change_sequence",
|
||||
schema: "dodo",
|
||||
table: "tag",
|
||||
columns: new[] { "vault_id", "change_sequence" });
|
||||
|
||||
migrationBuilder.CreateIndex(
|
||||
name: "ix_tag_vault_live",
|
||||
schema: "dodo",
|
||||
table: "tag",
|
||||
column: "vault_id",
|
||||
filter: "deleted_at_utc IS NULL");
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void Down(MigrationBuilder migrationBuilder)
|
||||
{
|
||||
migrationBuilder.DropTable(
|
||||
name: "tag",
|
||||
schema: "dodo");
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1475,6 +1475,87 @@ namespace DodoSSH.Infrastructure.Migrations
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.VaultTag", b =>
|
||||
{
|
||||
b.Property<Guid>("Id")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("id");
|
||||
|
||||
b.Property<long>("ChangeSequence")
|
||||
.HasColumnType("bigint")
|
||||
.HasColumnName("change_sequence");
|
||||
|
||||
b.Property<Guid?>("ContentKeyId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("content_key_id");
|
||||
|
||||
b.Property<DateTimeOffset>("CreatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("created_at_utc");
|
||||
|
||||
b.Property<Guid>("CreatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("created_by_user_id");
|
||||
|
||||
b.Property<byte[]>("DataKeyWrap")
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("data_key_wrap");
|
||||
|
||||
b.Property<DateTimeOffset?>("DeletedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("deleted_at_utc");
|
||||
|
||||
b.Property<int>("KeyGeneration")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("key_generation");
|
||||
|
||||
b.Property<byte[]>("Payload")
|
||||
.IsRequired()
|
||||
.HasColumnType("bytea")
|
||||
.HasColumnName("payload");
|
||||
|
||||
b.Property<short>("PayloadAadVersion")
|
||||
.HasColumnType("smallint")
|
||||
.HasColumnName("payload_aad_version");
|
||||
|
||||
b.Property<DateTimeOffset>("UpdatedAtUtc")
|
||||
.HasColumnType("timestamp with time zone")
|
||||
.HasColumnName("updated_at_utc");
|
||||
|
||||
b.Property<Guid>("UpdatedByUserId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("updated_by_user_id");
|
||||
|
||||
b.Property<Guid>("VaultId")
|
||||
.HasColumnType("uuid")
|
||||
.HasColumnName("vault_id");
|
||||
|
||||
b.Property<int>("Version")
|
||||
.HasColumnType("integer")
|
||||
.HasColumnName("version");
|
||||
|
||||
b.Property<uint>("xmin")
|
||||
.IsConcurrencyToken()
|
||||
.ValueGeneratedOnAddOrUpdate()
|
||||
.HasColumnType("xid")
|
||||
.HasColumnName("xmin");
|
||||
|
||||
b.HasKey("Id")
|
||||
.HasName("pk_tag");
|
||||
|
||||
b.HasIndex("VaultId")
|
||||
.HasDatabaseName("ix_tag_vault_live")
|
||||
.HasFilter("deleted_at_utc IS NULL");
|
||||
|
||||
b.HasIndex("VaultId", "ChangeSequence")
|
||||
.HasDatabaseName("ix_tag_vault_id_change_sequence");
|
||||
|
||||
b.ToTable("tag", "dodo", t =>
|
||||
{
|
||||
t.HasCheckConstraint("ck_tag_version", "version >= 1");
|
||||
});
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Device", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.UserAccount", "User")
|
||||
@@ -1687,6 +1768,18 @@ namespace DodoSSH.Infrastructure.Migrations
|
||||
b.Navigation("Vault");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.VaultTag", b =>
|
||||
{
|
||||
b.HasOne("DodoSSH.Domain.Vault", "Vault")
|
||||
.WithMany()
|
||||
.HasForeignKey("VaultId")
|
||||
.OnDelete(DeleteBehavior.Cascade)
|
||||
.IsRequired()
|
||||
.HasConstraintName("fk_tag_vaults_vault_id");
|
||||
|
||||
b.Navigation("Vault");
|
||||
});
|
||||
|
||||
modelBuilder.Entity("DodoSSH.Domain.Team", b =>
|
||||
{
|
||||
b.Navigation("Memberships");
|
||||
|
||||
Reference in New Issue
Block a user