DodoSSH/docs/adr/0009-team-access-model.md

ADR 0009 — Team access: membership authorises, a grant unlocks

• Status: accepted
• Date: 2026-07-31
• Builds on: ADR 0001

Context

M3 makes vaults shareable. The obvious way to model that is one concept — "access" — with a role attached, and to let the server hand it out. Every hosted competitor works that way, and it is what the imported design drew: a members table with a role column, and a share button beside each item.

This architecture cannot implement that concept, and the interesting part of M3 was working out what it can implement instead.

The server holds ciphertext and no keys. A vault key is 32 random bytes sealed to each member's X25519 public key (docs/crypto.md §3), and only a client holding the plaintext key can produce a seal for somebody else. So "give Bob access" decomposes into two operations that live on different machines and cannot be performed by the same actor:

• deciding that the server will serve Bob this vault's rows, which is a database write; and
• wrapping the vault key to Bob's public key, which needs a client that already holds it.

The schema anticipated this — team, team_membership, vault.team_id and vault_key_grant have existed since the first migration — but nothing had had to name the split.

Decision

Membership is authorisation. A grant is access. The product says so out loud.

VaultAccessService resolves a team vault through team_membership, mapping the role to PermissionFlags by a union with no Deny rules. That decides what the server serves and nothing else. Whether the caller can read what it serves is decided by whether they hold a grant, which the server records, cannot produce and cannot verify.

Five consequences, each of which is a place where a more reassuring design was rejected:

• A member with no grant is a normal state, not an error. VaultSummary.WrappedVaultKey is null and the vault appears in their list saying it is waiting for a key. Hiding it until a grant existed would have been tidier and would have implied the server was the thing granting access.
• The roles are only the ones that are enforceable. There is no ConnectOnly, despite the design asking for one and TeamRole having room. SSH terminates on the client, so opening a session needs the credential's plaintext on that machine; "may connect but may not read the key" cannot be enforced here, and shipping it as a role would have been a lie in a dropdown. Connect rides along with Read and is documented as an interface hint.
• Sharing verifies the recipient's key against the append-only key log, or refuses. A directory lookup is a claim by the server about a third party's public key; wrapping to an unverified claim hands the vault to whoever made it. KeyLogAudit reads the whole log, checks its hash chain from genesis, and refuses unless the offered key appears in it unchanged. There is no override flag, because a flag that exists gets used on the day the log is briefly unreachable.
• Removal is named for what it does. It revokes grants and flags the vault for rekey. It does not claim to reach anything already downloaded, and the interface says the remediation is rotating the credential — the same non-retroactive limit ADR 0001 records.
• Ownership is sole, so handing it over is one write and not a role change. If membership authorises, the owner's membership is the last authority in the team, and a transfer that stopped halfway would leave nobody with the standing to finish it — owned twice if the promotion went first, owned by nobody if the demotion did, and in either case recoverable only by an operator editing the database. So POST /teams/{id}/owner promotes the recipient and demotes the outgoing owner to admin in one transaction, ChangeRoleAsync refuses Owner outright, and the recipient must already be an active member — handing a team to an id supplied once is the same mistake as adding somebody straight to the owner role. Demoting rather than removing is the deliberate half: removing them would revoke their vault key grants and flag every team vault for rekey, which is a far larger act than the one being asked for, and somebody handing over a team is usually staying in it.

One thing is deliberately not built, and it is a refusal rather than an omission:

• The rekey itself. Only a client holding the current vault key can re-wrap every item's data key under a new one. The server records that a rotation is owed and the interface reports it. M5.

  Superseded 2026-08-03 by ADR 0010. Rotation now ships, and it turned out to divide differently than this paragraph assumed: advancing the generation is one server transaction and is not the same act as re-wrapping the items, which is still outstanding. Removing a member rotates the vaults the removing client can open and hands the new key to whoever is left.

Two smaller choices, recorded because the alternative was written down first and rejected:

• No v_user_vault_permission view. ADR-adjacent notes and the old VaultAccessService remark both anticipated one. The rules turned out to be about sixteen lines of C# shared by the two methods that need them; a view would have moved the authorisation model into migrations, where a test cannot reach it without a container.
• Host key trust stays vault-scoped to the personal vault. Pins in a team vault are listed but not consulted at connect time. Consulting them would let any member with Write pre-approve a fingerprint that another member's client then trusts silently for a host in their own vault, which is a cross-boundary trust escalation. Scoping trust properly needs a scope on the SSH connect path (IKnownHostStore.FindAsync takes host, port and algorithm and knows nothing about vaults); until that exists, the safe direction is the narrow one, and the cost — approving a team host's key once per member per machine — is stated in the README rather than hidden.

Addendum: invitations are gone, and an address is not a way into a team

There was an invitation here, and it is worth recording what it was before recording why it is not.

A membership names an account: team_membership.user_id is not nullable and carries a foreign key, so somebody who has never signed in has nothing for that row to point at. MembershipStatus.Invited has existed since the first migration and has never been written, because a membership waiting for a person is the one shape this model cannot store. So an invitation was its own record, team_invitation, held against an address, and it became an ordinary active membership the moment an account with that address signed in — provided the access token asserted email_verified over it.

That last clause was the whole feature, and it is why the feature is gone. Everything else in this model decides access from something a person did: an admin naming an account, a key holder wrapping a vault key to a public key they verified. The invitation decided access from an assertion about an address, made by an identity provider, on behalf of somebody the deployment had never seen. It was guarded as tightly as that can be guarded — the claim was refused outright on an unverified or absent claim, with no setting to relax it, for the same reason OidcOptions.AllowEmailLinking is off and stays off. But the guard and the risk were the same shape: the server was trusting a token's email claim to decide who is in a team, and the whole of the defence was one boolean sent by a system this deployment does not control.

So the decision now reads: membership is granted only to an account that already exists, named by somebody who can already see it. POST /api/v1/teams/{id}/members takes a user id from the directory, or an address it resolves to an existing account, and an address with no account is refused with ProblemCodes.NoSuchAccount. That refusal is the end of the road rather than a step on it — there is nothing to fall through to.

Three consequences, all of them stated rather than mitigated:

• Somebody who has never signed in here cannot be added yet. The remedy is theirs: they sign in once, which is what creates the account, and then they can be added. Both clients say exactly that when the refusal comes back. This is a real loss of convenience, and it is the price of not having a path where an address is a credential.
• Nothing reads the email claim for authorisation any more, anywhere in the server. OidcOptions.EmailVerifiedClaim was read by the claim path and by nothing else, so it went with it — a setting that changes no outcome is worse than no setting. The address is still recorded and still resolved by the directory, both for display and for naming an account that exists.
• Pending invitations were dropped rather than converted. Converting one would have meant creating a membership because an address matched, which is the property being removed; and an invitation to an address that did have an account here had already been claimed by the hourly sweep, so what was left was offers to people who never arrived. See the DropTeamInvitation migration.

The oracle question the old design worried about — whether this endpoint tells a caller which addresses have accounts here — is answered rather than avoided. NoSuchAccount does say so, to an admin or owner of the team the add names, which is the same fact the member list shows them a moment later. That was already true of adding by address before invitations existed.

Addendum: the vault is what the product shows, and the team is behind it

The model above is unchanged. What changed afterwards is which half of it a person is asked about.

The first interface built on this ADR made the team the subject: you created a team, then a vault in it, then wrapped a key. Two of those three steps are about a concept nobody arrives wanting. So the screen now lists vaults, and naming one creates the membership list that carries it — named after the vault, owned by the creator, one per vault. Nothing on the server moved: VaultAccessService still resolves a shared vault through team_membership, every membership call still names a team id, and the split this ADR is about — membership authorises, a grant unlocks — is still what the screen is built around, now stated per vault rather than per team.

Three consequences of the change belong here:

• A team owning several vaults is still legal and is no longer produced. The client cannot make one; an operator or a pre-existing deployment can. The screen refuses to hide it: a vault whose membership list carries others says so, because on a vault-shaped screen "adding somebody here adds them there" is precisely the fact that would otherwise be invisible.
• Archiving left the interface. It was only ever possible for a team owning no vaults, and a screen whose rows are vaults has no row for one — so the button would have been unreachable or always refused. The endpoint is unchanged and the screen states the limit instead. The one place a vault-less team can still appear is a create whose second call failed; cancelling that form archives it, which is a deliberate exception to this client's rule against tidying up on the user's behalf, made because nothing else can reach it.
• A vault can be deleted, which is the operation this ADR's first version said the product did not have: DELETE /api/v1/vaults/{id} requires PermissionFlags.Admin, the same line the rename draws and for a stronger reason — it takes the vault from everybody in it at once. It soft-deletes the row, withdraws every grant to it, and archives the owning team when that team was made to carry this vault alone, so deleting the last vault of a one-vault team does not leave a membership list no screen has a row for. The personal vault is refused: it is created by enrollment, everything filed nowhere else lives in it, and no call would make another. The items are kept — ciphertext behind a vault nothing resolves — because deleting them buys no confidentiality and destroys what an operator would need to undo a mistake. It reaches no machine that has already synced the vault, which is the same limit revocation has and for the same reason; see ADR 0001. The client says so before asking for the confirmation.
• A vault can be renamed, which it could not before: PUT /api/v1/vaults/{id} requires PermissionFlags.Admin — the line UpdateTeamEndpoint already draws, because a name is what everybody in the vault sees it called rather than part of its contents. It renames the owning team with it when that team carries nothing else, so the row an operator reads and the name a user says do not drift apart. The slug never moves, for the reason it never moves on a team rename.

Consequences

The sharing graph is visible to the operator: who is in which team, which vaults exist, and who holds a grant are all plaintext rows. That was already true of metadata generally (docs/crypto.md §10) and is not made worse here, but it is now a graph rather than a list. Every node on it is an account that exists: there is no longer an edge to an address whose owner has never been here, which is what invitations added and what removing them took back.

A malicious granter can seal garbage. The recipient detects it as a tag failure and the grant's Ed25519 signature names who issued it — detectable and attributable, which is the most that is achievable without the server holding a key.

The two-step model costs a step in the interface and buys the property the whole product is for. It also makes a class of bug impossible: there is no code path on the server that could accidentally grant read access to plaintext, because there is no plaintext on the server to grant.