Public Access
jaap-jan
0b261c4d39
Three things a machine that has been set up could not do. Unlock now takes Enter, which is the gesture everybody makes after typing a password and which did nothing until they found the button. Signing in survives a relaunch. The refresh token is kept in the local cache, sealed under the vault's own cache key, so a later launch resumes the session through the refresh grant with no browser and nobody present — and because it is sealed under that key, only an unlocked vault can resume it. A locked client therefore cannot reach the server at all, which is a consequence worth stating rather than working around; docs/crypto.md §3.2 records it. Every sync pass asks the shell for a connection rather than reading one captured at unlock, so a laptop that unlocked on a train is online within a minute of finding a network, with nothing pressed. Unlocking itself still never waits on a socket. Signing out empties this machine: the profile, the cached items, the outbox and this machine's device key, with the account's row withdrawn when the server can be reached. It asks first and says what it costs — the outbox count when the vault is open, an admission that it cannot be counted when it is not, and the shells that keep running either way. The vault is on the server and is untouched, which is what makes the same button the only honest answer to a forgotten passphrase, so it is on the unlock screen as well as in preferences. It cannot end the session at the identity provider, and says so. Two defects surfaced on the way. The synchronisation pass that runs when the vault opens never ran at all: the loop is started from inside the unlock command, so the busy flag it yields to was raised by that command — the first sync was a minute late on every launch. And signing in from preferences while unlocked threw an unlock screen over an open vault whose keys were still in memory. The unlock card and the new confirmation live in their own controls because MainWindow cannot be laid out headless, so markup left inside it is markup no test can measure; both are now measured at the window's minimum size in the shapes that grow. What is still unverified is the composed window itself.
99 lines
5.6 KiB
XML
99 lines
5.6 KiB
XML
<UserControl xmlns="https://github.com/avaloniaui"
|
|
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
|
|
xmlns:vm="using:DodoSSH.Client.App.ViewModels"
|
|
x:Class="DodoSSH.Client.App.Views.UnlockCard"
|
|
x:DataType="vm:MainWindowViewModel">
|
|
|
|
<!--
|
|
The unlock screen's contents.
|
|
|
|
Extracted from MainWindow.axaml so that it can be laid out and looked at: MainWindow cannot be shown in
|
|
the headless session at all — WebView2's adapter refuses its thread, which LayoutHarnessTests pins — so
|
|
markup that stays inside that file is markup no test can measure. This card is the one on the screen
|
|
with the least room to spare and the most conditional content: a disclosure about shells left running,
|
|
and a way out for a forgotten passphrase, both of which appear underneath a form that already fills most
|
|
of the height the window guarantees.
|
|
|
|
A bare StackPanel rather than a card, because the card is the frame MainWindow puts around it.
|
|
-->
|
|
|
|
<StackPanel Spacing="12">
|
|
|
|
<TextBlock Classes="heading" Text="Unlock your vault" />
|
|
<TextBlock Text="{Binding AccountName}" Foreground="{StaticResource Info}" />
|
|
|
|
<!--
|
|
Named because locking has to put the keyboard here explicitly, and reached from the window through
|
|
PassphraseBox. The terminal's native child window keeps Win32 focus when it is collapsed, so without
|
|
that this box would show a caret and silently swallow the passphrase — see NativeKeyboardFocus.
|
|
|
|
Enter unlocks. A KeyBinding on the box rather than a handler on the window, because this is a property
|
|
of the control the passphrase is typed into and not of the shell's state: the keyboard is put here on
|
|
every lock, so the one gesture everybody makes after typing a password reaches the command this box
|
|
exists for. A single-line TextBox does not handle Enter itself, so nothing is being fought over.
|
|
-->
|
|
<TextBox x:Name="UnlockPassphrase" Text="{Binding Passphrase}"
|
|
PlaceholderText="vault passphrase" PasswordChar="•">
|
|
<TextBox.KeyBindings>
|
|
<KeyBinding Gesture="Enter" Command="{Binding UnlockCommand}" />
|
|
</TextBox.KeyBindings>
|
|
</TextBox>
|
|
|
|
<StackPanel Orientation="Horizontal" Spacing="8">
|
|
<Button Classes="accent" Content="UNLOCK" Command="{Binding UnlockCommand}"
|
|
IsEnabled="{Binding !IsBusy}" />
|
|
<!--
|
|
Shown only when this machine has both a registered wrap and a keystore still willing to release the
|
|
key. Absent rather than disabled, because a greyed-out "Use Windows Hello" on a machine that never
|
|
had it invites the reading that something is broken — and the passphrase box beside it is not a
|
|
fallback, it is the ordinary way in.
|
|
-->
|
|
<Button Classes="ghost" Content="USE WINDOWS HELLO"
|
|
Command="{Binding UnlockWithDeviceCommand}"
|
|
IsEnabled="{Binding !IsBusy}"
|
|
IsVisible="{Binding CanUnlockWithDevice}"
|
|
ToolTip.Tip="Opens the vault with this machine's device key. Windows will ask you to confirm." />
|
|
</StackPanel>
|
|
|
|
<TextBlock Classes="hint" Text="{Binding StatusMessage}" TextWrapping="Wrap" />
|
|
<TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
|
|
Text="This works with no network: the salt and the wrapped key are already on this machine." />
|
|
|
|
<!--
|
|
Stated here because the lock screen is what hides it. The terminal's WebView is collapsed while
|
|
locked, so a shell left running is invisible as well as unstopped — and a screen saying "Unlock your
|
|
vault" over a machine that still holds authenticated SSH channels is exactly the kind of half-truth
|
|
this project writes down instead of implying. Visible only when there is something to disclose, so an
|
|
ordinary launch stays quiet.
|
|
-->
|
|
<Border Background="{StaticResource Panel}" BorderBrush="{StaticResource Border}"
|
|
BorderThickness="1" CornerRadius="4" Padding="10,8"
|
|
IsVisible="{Binding HasLiveSessions, FallbackValue=False}">
|
|
<StackPanel Spacing="4">
|
|
<TextBlock Text="{Binding LiveSessionSummary}" Foreground="{StaticResource Info}"
|
|
FontWeight="SemiBold" TextWrapping="Wrap" />
|
|
<TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
|
|
Text="Locking closes the vault, not your terminals: a job you started keeps running, and its output is waiting behind this screen. It also means this machine still holds an open, authenticated channel to those hosts — locked describes the vault, not the connections. Quit DodoSSH to end them." />
|
|
</StackPanel>
|
|
</Border>
|
|
|
|
<!--
|
|
The way out of a forgotten passphrase, and the only one there is. Nothing can recover a passphrase —
|
|
there is no server-side reset by design — so the honest offer is to reset this machine and sign in
|
|
again, which costs whatever this machine had not yet pushed and nothing else. Stated here rather than
|
|
left to be discovered, because somebody stuck on this screen has no other route and quitting the
|
|
application does not help.
|
|
-->
|
|
<Border Height="1" Background="{StaticResource BorderSubtle}" />
|
|
|
|
<StackPanel Spacing="6">
|
|
<TextBlock Classes="hint" FontSize="11" TextWrapping="Wrap"
|
|
Text="Forgotten your passphrase? Nothing can recover it — not even whoever runs the server. What you can do is reset this machine and sign in again; the vault is on the server and comes back." />
|
|
<Button Classes="ghost" Content="RESET THIS MACHINE"
|
|
Command="{Binding SignOutCommand}" HorizontalAlignment="Left" />
|
|
</StackPanel>
|
|
|
|
</StackPanel>
|
|
|
|
</UserControl>
|