Public Access
jaap-jan
95816de0c5
M3's teams, sharing and ACLs. Teams with roles, a public-key directory, the append-only key log served for clients to check it against, team-owned vaults, and vault key grants wrapped by a client and stored opaquely by the server. VaultAccessService resolves team membership to PermissionFlags, so a viewer may pull and may not push; the desktop client reads and syncs every vault it holds a key for, and a real TEAMS screen replaces the one that said it did not exist. No migration: team, team_membership, vault.team_id and vault_key_grant have all been there since the first one, which is what carrying two unused tables bought. Membership is authorisation. A grant is access. The obvious model is one concept — "access", with a role attached, handed out by the server — and this architecture cannot implement it: a vault key is sealed to each member's X25519 key, and only a client holding the plaintext can seal it for somebody else. So "give Bob access" decomposes into a database write and a wrap, which happen on different machines. Adding a member makes the server serve them the vault; it cannot make it readable. VaultSummary.WrappedVaultKey is null in the meantime and the vault appears in their list saying it is waiting for a key, because hiding it until a grant existed would have been tidier and would have implied the server was the thing granting access. The screen says the same thing after every add, in the status line. ADR 0009 records the whole decision. Sharing verifies or refuses. A directory lookup is a claim by the server about a third party's public key, and wrapping to an unverified claim hands the vault to whoever made it — no amount of transport security helps, because the server is inside the threat model. KeyLogAudit reads the whole log, recomputes every entry's hash from its own contents, checks the chain from genesis, and refuses unless the offered key appears in it unchanged. There is no override flag: one that exists gets used on the day the log is briefly unreachable, and the resulting grant is indistinguishable from a correct one afterwards. What it still cannot promise is that the key is the right person's, so the fingerprint comes back for an out-of-band comparison and the success message says so every time. A test corrupts the fake server's log by one byte and watches the client refuse rather than warn. The roles are only the ones that are enforceable. There is no ConnectOnly, despite the design asking for one and TeamRole having room: SSH terminates on the client, so a session needs the credential's plaintext on that machine, and "may connect but may not read the key" cannot be enforced here. Shipping it as an option in a dropdown would have been a lie. Connect rides along with Read and is documented as an interface hint. Removal is named for what it does — it revokes grants and flags the vault for rekey, and claims nothing about what is already on somebody's laptop. Three things are deliberately absent, and each is a refusal rather than an omission. The rekey itself, because re-wrapping every item's data key under a new vault key needs a client holding the current one; the server records that a rotation is owed and the interface reports it, which is more honest than a button that only appears to do it. Ownership transfer, because allowing an owner to be removed without one leaves a team nobody can administer. And cross-vault host key trust: a pin in a team vault is listed but not consulted at connect time, because any member with Write could otherwise pre-approve a fingerprint another member's client then trusts silently for a host in their own vault. Scoping trust properly needs a scope on the SSH connect path, which IKnownHostStore has not got; until then the narrow direction is the safe one and the cost is in the README rather than hidden. Reading now spans vaults and writing still does not. Every list on the vault and hosts screens covers each vault the keyring opened, rows carry the vault they came from, and an edit goes back to that vault rather than to the active one — writing it to the active vault would fork the item and only show up when a colleague wondered why their change never arrived. A new item goes wherever a picker says, defaulting to the personal vault and never moving on its own, because an item filed into a team's vault is visible to that team and moving it back means deleting and retyping. The sidebar heading stops naming one vault once there are two, and each row names its own. The server checks what it can and nothing it cannot. It will not record a grant for a key its recipient no longer holds, for a superseded generation, or for somebody who is not in the team — each of those would otherwise surface days later at the far end as a tag failure indistinguishable from corruption. It does not verify the wrap or the signature, and the grant service says so: that would be a convenience and never the boundary, and would put an asymmetric implementation on a machine that is supposed to hold no keys. Two bugs the tests found. TeamsViewModel's busy gate blocked its own reload, so a team created a moment earlier was missing from the list it had just been added to. And syncing every vault turned a failure from an exception into a report, which made a background pass announce an unreachable vault once a minute — the exact behaviour AnAutomaticPassThatFails_LeavesTheStatusAlone exists to prevent. The fact is recorded and the message swallowed, as it was before; pressing Sync still names the vault and the reason. Also fixes a build break this branch started with: QuickConnectTests was never updated when M2 added ISftpSessionFactory to the shell's constructor, so nothing built at all.
90 lines
5.6 KiB
Markdown
90 lines
5.6 KiB
Markdown
# ADR 0009 — Team access: membership authorises, a grant unlocks
|
|
|
|
- Status: accepted
|
|
- Date: 2026-07-31
|
|
- Builds on: [ADR 0001](0001-e2ee-trust-model.md)
|
|
|
|
## Context
|
|
|
|
M3 makes vaults shareable. The obvious way to model that is one concept — "access" — with a role
|
|
attached, and to let the server hand it out. Every hosted competitor works that way, and it is what
|
|
the imported design drew: a members table with a role column, and a share button beside each item.
|
|
|
|
This architecture cannot implement that concept, and the interesting part of M3 was working out
|
|
what it can implement instead.
|
|
|
|
The server holds ciphertext and no keys. A vault key is 32 random bytes sealed to each member's
|
|
X25519 public key (`docs/crypto.md` §3), and only a client holding the plaintext key can produce a
|
|
seal for somebody else. So "give Bob access" decomposes into two operations that live on different
|
|
machines and cannot be performed by the same actor:
|
|
|
|
- deciding that the server will **serve** Bob this vault's rows, which is a database write; and
|
|
- **wrapping** the vault key to Bob's public key, which needs a client that already holds it.
|
|
|
|
The schema anticipated this — `team`, `team_membership`, `vault.team_id` and `vault_key_grant` have
|
|
existed since the first migration — but nothing had had to name the split.
|
|
|
|
## Decision
|
|
|
|
**Membership is authorisation. A grant is access. The product says so out loud.**
|
|
|
|
`VaultAccessService` resolves a team vault through `team_membership`, mapping the role to
|
|
`PermissionFlags` by a union with no Deny rules. That decides what the server serves and nothing
|
|
else. Whether the caller can read what it serves is decided by whether they hold a grant, which the
|
|
server records, cannot produce and cannot verify.
|
|
|
|
Four consequences, each of which is a place where a more reassuring design was rejected:
|
|
|
|
- **A member with no grant is a normal state, not an error.** `VaultSummary.WrappedVaultKey` is null
|
|
and the vault appears in their list saying it is waiting for a key. Hiding it until a grant existed
|
|
would have been tidier and would have implied the server was the thing granting access.
|
|
- **The roles are only the ones that are enforceable.** There is no `ConnectOnly`, despite the design
|
|
asking for one and `TeamRole` having room. SSH terminates on the client, so opening a session needs
|
|
the credential's plaintext on that machine; "may connect but may not read the key" cannot be
|
|
enforced here, and shipping it as a role would have been a lie in a dropdown. `Connect` rides along
|
|
with `Read` and is documented as an interface hint.
|
|
- **Sharing verifies the recipient's key against the append-only key log, or refuses.** A directory
|
|
lookup is a claim by the server about a third party's public key; wrapping to an unverified claim
|
|
hands the vault to whoever made it. `KeyLogAudit` reads the whole log, checks its hash chain from
|
|
genesis, and refuses unless the offered key appears in it unchanged. There is no override flag,
|
|
because a flag that exists gets used on the day the log is briefly unreachable.
|
|
- **Removal is named for what it does.** It revokes grants and flags the vault for rekey. It does not
|
|
claim to reach anything already downloaded, and the interface says the remediation is rotating the
|
|
credential — the same non-retroactive limit ADR 0001 records.
|
|
|
|
Two things were deliberately **not** built, and both are refusals rather than omissions:
|
|
|
|
- **The rekey itself.** Only a client holding the current vault key can re-wrap every item's data key
|
|
under a new one. The server records that a rotation is owed and the interface reports it. M5.
|
|
- **Ownership transfer.** The owner cannot be demoted or removed, with its own problem code. Allowing
|
|
it without a transfer would leave a team nobody can administer, recoverable only by an operator
|
|
editing the database.
|
|
|
|
Two smaller choices, recorded because the alternative was written down first and rejected:
|
|
|
|
- **No `v_user_vault_permission` view.** ADR-adjacent notes and the old `VaultAccessService` remark
|
|
both anticipated one. The rules turned out to be about sixteen lines of C# shared by the two
|
|
methods that need them; a view would have moved the authorisation model into migrations, where a
|
|
test cannot reach it without a container.
|
|
- **Host key trust stays vault-scoped to the personal vault.** Pins in a team vault are listed but
|
|
not consulted at connect time. Consulting them would let any member with Write pre-approve a
|
|
fingerprint that another member's client then trusts silently for a host in their *own* vault,
|
|
which is a cross-boundary trust escalation. Scoping trust properly needs a scope on the SSH connect
|
|
path (`IKnownHostStore.FindAsync` takes host, port and algorithm and knows nothing about vaults);
|
|
until that exists, the safe direction is the narrow one, and the cost — approving a team host's key
|
|
once per member per machine — is stated in the README rather than hidden.
|
|
|
|
## Consequences
|
|
|
|
The sharing graph is visible to the operator: who is in which team, which vaults exist, and who holds
|
|
a grant are all plaintext rows. That was already true of metadata generally (`docs/crypto.md` §10)
|
|
and is not made worse here, but it is now a graph rather than a list.
|
|
|
|
A malicious granter can seal garbage. The recipient detects it as a tag failure and the grant's
|
|
Ed25519 signature names who issued it — detectable and attributable, which is the most that is
|
|
achievable without the server holding a key.
|
|
|
|
The two-step model costs a step in the interface and buys the property the whole product is for. It
|
|
also makes a class of bug impossible: there is no code path on the server that could accidentally
|
|
grant read access to plaintext, because there is no plaintext on the server to grant.
|