DodoTech-Public/DodoSSH
Public Access
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Spelunk: sign each device in through the browser instead of keeping Spelunk API keys in the vault

Browse Source 
A Spelunk API key reaches one organisation, so a server elsewhere - oc-linux in Orange Climate - was
refused before it reached the agent. Each device now signs in to a Spelunk once, under Settings ->
Security -> Spelunk or from a Spelunk host's editor: the OAuth authorization code flow with PKCE for a
native app (RFC 8252), with Spelunk as the authorization server. The browser opens Spelunk's
/api/app-sign-in/authorize with a loopback redirect (the app's own scheme on Android), the person signs
in there however they normally do and allows "DodoSSH on <device>", and the code is redeemed at
/api/app-sign-in/token for an app session token. That token opens terminals in every organisation its
person is in, with the role they have on each server at the time; tunnel tickets send no organisation.

The sign-in stays on the device: sealed in the local cache under the LocalCacheKey (AAD resource type
18, bound to its row), never synced, wiped with the cache, and only ever sent to the Spelunk it came
from. A 401 from Spelunk forgets it; SIGN OUT ends it there and here, and so does signing out of
DodoSSH. Before every Spelunk connection DodoSSH asks its own identity provider whether its sign-in
still stands (a forced refresh, at most once a minute), and an account it refuses is signed out of
DodoSSH and of every Spelunk on the device.

A route names no key any more: Spelunk hosts are written at host schema 11, which an older build shows
read-only and asks to be updated for, and a payload that still names a key credential decodes with the
id skipped. The SpelunkKey item type is gone: SyncEntityType 14, ChangeEntityType 14 and AAD type 17
are retired, the server drops spelunk_key and its change-log rows, and the client cache drops its
cached items, outbox entries and conflicts of that type. A link still never starts a sign-in: from a
Spelunk this device is not signed in to it opens the editor, which offers to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
laurensandClaude Opus 5.5 committed 2026-10-20 16:26:25 +02:00
1 parent 902761d37b
commit ef365f462e
62 files changed
+4327 -1945
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/DodoSSH.Client.App/Views/SettingsSecurityPage.axaml
+32 -43
View File
@@ -26,13 +26,12 @@
on purpose — known-hosts is a MAIN-chrome screen, and there is no honest way to show it without leaving;
ShowScreenCommand already does that for any target that is not Preferences or Vaults.
SPELUNK is where a Spelunk API key is filled in: an address and a key, saved as a Spelunk key item in the
personal vault (VaultViewModel.SaveSpelunkKeyCommand) and synced like every secret. The address is the
point — a key saved here is only ever sent there, and links from that Spelunk connect straight away
because saving it is the user saying so. A second key for an address already saved replaces the first.
The key box is a password box and is emptied the moment the key is in the keychain; the list below it
shows the name, the address and how many hosts use each key, never the key. Deleting goes through the
same ConfirmDeleteCard every other deletion does, with a count of the hosts that would stop connecting.
SPELUNK is where this device signs in to a Spelunk: an address and SIGN IN, which opens the browser at
Spelunk and waits for it (VaultViewModel.SignInToSpelunkCommand, cancellable while it waits). What comes
back stays on this device — it is not a keychain item and does not sync — and links from that Spelunk
connect straight away because signing in is the user saying so. Signing in again to an address replaces
the sign-in. The list below shows who each sign-in is and how many hosts reach Spelunk through it, never
its token, and SIGN OUT ends it in Spelunk and here.
RECENT SECURITY EVENTS is the link row alone, not the design's own list of rows. A real list would mean
building a filtered read over LogsViewModel's activity and connection logs — which entries count as
@@ -115,76 +114,66 @@
<TextBlock Classes="settingssection" Text="SPELUNK" />
<!--
Signing this device in to a Spelunk. Spelunk asks in the browser, however its person signs in there,
and what it gives back stays on this device: each device signs in on its own, and signing out of
DodoSSH signs out of every Spelunk too. See VaultViewModel.SpelunkSignIns.cs.
-->
<Border Classes="settingscard">
<StackPanel>
<Border Classes="settingsrow">
<StackPanel Spacing="10">
<StackPanel Spacing="6" MaxWidth="640" HorizontalAlignment="Left">
<TextBlock Classes="settingsrowtitle" Text="Spelunk API key" />
<TextBlock Classes="settingsrowtitle" Text="Sign in to Spelunk" />
<TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
Text="Hosts reached through Spelunk use this key, and links from that Spelunk connect straight away. It is kept encrypted in your personal vault, syncs to your other devices, and is only ever sent to the address below. Use a key with the Admin role." />
Text="Hosts reached through Spelunk connect as you, in every organisation you are in there, and links from that Spelunk connect straight away. Spelunk asks in your browser. The sign-in stays on this device and ends when you sign out here, in Spelunk, or of DodoSSH." />
</StackPanel>
<Grid ColumnDefinitions="*,*,Auto" ColumnSpacing="10"
<Grid ColumnDefinitions="*,Auto" ColumnSpacing="10"
IsEnabled="{Binding Vault, Converter={x:Static ObjectConverters.IsNotNull}}">
<TextBox Grid.Column="0" Height="38" Text="{Binding Vault.SpelunkKeyFormApi}"
PlaceholderText="Spelunk API address (https://api.…)" />
<TextBox Grid.Column="1" Height="38" PasswordChar="•" Text="{Binding Vault.SpelunkKeyFormKey}"
PlaceholderText="API key (spelunk_…)">
<TextBox Grid.Column="0" Height="38" Text="{Binding Vault.SpelunkSignInFormApi}"
PlaceholderText="Spelunk API address (https://api.…)">
<TextBox.KeyBindings>
<KeyBinding Gesture="Enter" Command="{Binding Vault.SaveSpelunkKeyCommand}" />
<KeyBinding Gesture="Enter" Command="{Binding Vault.SignInToSpelunkCommand}" />
</TextBox.KeyBindings>
</TextBox>
<Button Grid.Column="2" Classes="accent" Height="38" Content="SAVE KEY"
Command="{Binding Vault.SaveSpelunkKeyCommand}"
IsEnabled="{Binding !Vault.IsBusy, FallbackValue=False}" />
<Button Grid.Column="1" Classes="accent" Height="38" Content="SIGN IN"
Command="{Binding Vault.SignInToSpelunkCommand}"
IsVisible="{Binding !Vault.IsSigningInToSpelunk, FallbackValue=True}" />
<Button Grid.Column="1" Classes="ghost" Height="38" Content="CANCEL"
Command="{Binding Vault.SignInToSpelunkCancelCommand}"
IsVisible="{Binding Vault.IsSigningInToSpelunk, FallbackValue=False}" />
</Grid>
<TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
Text="{Binding Vault.SpelunkKeyFormNote}"
IsVisible="{Binding Vault.HasSpelunkKeyFormNote, FallbackValue=False}" />
Text="{Binding Vault.SpelunkSignInFormNote}"
IsVisible="{Binding Vault.HasSpelunkSignInFormNote, FallbackValue=False}" />
<TextBlock Classes="settingsrowcaption" TextWrapping="Wrap"
IsVisible="{Binding Vault, Converter={x:Static ObjectConverters.IsNull}}"
Text="Unlock your keychain to save a Spelunk key." />
Text="Unlock your keychain to sign in to Spelunk." />
</StackPanel>
</Border>
<!-- The delete confirmation, in place, as the tags and groups pages draw it. -->
<Border Margin="24,12" Padding="20" CornerRadius="12"
Background="{StaticResource DangerWash}" BorderBrush="{StaticResource DangerSoft}"
BorderThickness="1"
IsVisible="{Binding Vault.PendingDeletion, Converter={x:Static ObjectConverters.IsNotNull}, FallbackValue=False}">
<views:ConfirmDeleteCard DataContext="{Binding Vault}" />
</Border>
<ItemsControl ItemsSource="{Binding Vault.SpelunkKeys}">
<ItemsControl ItemsSource="{Binding Vault.SpelunkSignIns}">
<ItemsControl.ItemsPanel>
<ItemsPanelTemplate>
<StackPanel />
</ItemsPanelTemplate>
</ItemsControl.ItemsPanel>
<ItemsControl.ItemTemplate>
<DataTemplate x:DataType="vm:SpelunkKeyRowViewModel">
<DataTemplate x:DataType="vm:SpelunkSignInRowViewModel">
<Border Classes="settingsrow" Padding="24,14">
<Grid ColumnDefinitions="*,Auto,Auto" ColumnSpacing="12">
<StackPanel Grid.Column="0" Spacing="4" VerticalAlignment="Center">
<StackPanel Orientation="Horizontal" Spacing="8">
<TextBlock Classes="settingsrowtitle" Text="{Binding Label}" />
<Border Classes="chip" IsVisible="{Binding HasVaultBadge}" VerticalAlignment="Center">
<TextBlock Text="{Binding VaultBadge}" />
</Border>
<TextBlock Classes="hint" FontSize="11" Text="{Binding Badge}" VerticalAlignment="Center" />
</StackPanel>
<TextBlock Classes="settingsrowtitle" Text="{Binding Who}" />
<TextBlock Classes="mono" FontSize="11.5" Foreground="{StaticResource TextFaint}"
Text="{Binding ApiBase}" />
</StackPanel>
<TextBlock Grid.Column="1" Classes="settingsrowcaption" VerticalAlignment="Center"
Text="{Binding UsedBy}" />
<Button Grid.Column="2" Classes="paneicon danger" Width="30" Height="30" FontSize="13"
<Button Grid.Column="2" Classes="ghost" Height="30" Content="SIGN OUT"
VerticalAlignment="Center"
Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vault.DeleteSpelunkKeyRowCommand}"
Command="{Binding #Root.((vm:MainWindowViewModel)DataContext).Vault.SignOutOfSpelunkCommand}"
CommandParameter="{Binding}"
ToolTip.Tip="Delete this key. Hosts that reach Spelunk with it stop connecting until they name another.">
<TextBlock FontFamily="{StaticResource IconFont}" Text="&#xE872;" />
</Button>
ToolTip.Tip="Sign this device out of this Spelunk. Hosts reached through it stop connecting until you sign in again." />
</Grid>
</Border>
</DataTemplate>