Public Access

Files

T

jaap-janandClaude Opus 5 a43286ece8 Let a team change hands, and be joined by somebody with no account yet

M3 built teams and stopped short of the two operations that decide who
controls one. Both were written down as refusals rather than omissions:
ADR 0009 listed ownership transfer under "deliberately not built", and
design-import-gaps said an invitation needed "a token with a lifetime and an
outbound mail path". One of those reasons had expired and the other never
applied — an invitation does not need a token if it is not a thing anybody
presents.

Handing a team over is one write. The member you name becomes owner and you
become an admin, in a single transaction, because ownership is sole: promoting
first leaves the team owned twice, demoting first leaves it owned by nobody,
and there is nobody left with the authority to finish a transfer that stopped
in the middle. That is also why it is not two calls to the role endpoint, which
refuses Owner outright. The outgoing owner is demoted rather than removed —
removing them would revoke their vault key grants and flag every team vault for
rekey, which is a far larger act than the one asked for, and somebody handing
over a team is usually staying in it. It unblocks the thing that was impossible
before: an owner can now leave, by handing the team on first.

An invitation is a standing instruction rather than a message. This server has
no outbound mail path, so nothing is sent and there is nothing for the invitee
to present. The row says the next account signing in with that address joins
this team at this role, and telling them to sign in is the caller's job over a
channel this server does not carry. A link nobody can deliver would be worse
than none. It lives in its own table rather than becoming a membership with
MembershipStatus.Invited, and that member stays unwritten for the reason it
always was: team_membership.user_id is not nullable and carries a foreign key,
so somebody who has never signed in has nothing for that row to point at.
Widening it would make the unique index on (team, user) meaningless, because
PostgreSQL counts every NULL as distinct.

Verification is the security boundary, and nothing in this server read it
before. A claim requires the access token to assert email_verified. An
invitation decides what the server will serve, so one claimable by anybody able
to obtain a token carrying somebody else's address is a way into a team — which
is precisely the attack OidcOptions.AllowEmailLinking exists to refuse, and it
would have been reintroduced by the back door. There is deliberately no setting
that relaxes it: a flag that exists is one somebody turns on for the afternoon
their provider is misconfigured. Absence is refused rather than trusted, and
logged, because a provider that never sends the claim otherwise leaves every
invitation pending with nothing anywhere saying why.

Claiming happens at just-in-time provisioning and again on an hourly sweep. The
sweep is what makes it recoverable rather than one-shot — an invitation issued
between an account being created and that person next signing in would
otherwise be stranded for ever — and it shares its rate with the last-seen
write because both are housekeeping nobody is waiting on.

Archiving is refused while a team owns a vault, and that refusal is the end of
the road rather than a step on it. A team vault is readable because of
membership, so archiving one that still owned vaults would take them away from
everybody holding a key, including the caller, quietly and all at once. Nothing
in this product deletes a vault, so no order of operations gets past it today —
which is stated with a count of what is in the way, for the reason the SFTP
layer refuses a recursive delete: a refusal is visible and a quiet removal is
not. It is owner-only, as handing over is; renaming is not, because a rename is
visible to everybody and reversible by anybody who can do it. The slug is not
renameable at all: it is unique only among live teams, so a rename could take
one an archived team is still holding, and that team could then never be
restored.

LAST ACTIVE is real and coarse on purpose. UserAccount.LastSeenAtUtc is
refreshed on ordinary authenticated requests, at most once per account per
hour, through ExecuteUpdateAsync — user_account carries the xmin concurrency
token, so a read-then-write on the hot path would start losing races between
one user's own overlapping requests. An hour is the granularity the question is
actually asked at, and the interface draws it to the day rather than the minute
so it does not read as a precision that is not there. The remarks in Contracts
and in the view model that argued at length for the column's absence are
rewritten rather than extended; both had become false.

Two endpoints already existed and nothing called them. ChangeTeamMemberRole and
ListVaultGrants have been reachable since M3. The role picker refuses Owner
itself rather than letting the server do it, since the interface already knew
the rule; the key-holder list sits under the vault rather than beside the
member, because a grant is per vault and a count on a member row would imply
per-item sharing, which is M5. It lists withdrawn and stale grants and says
which they are — a list that dropped them would show a departed colleague as
merely absent rather than as somebody whose key was taken away — and staleness
is decided by comparing generations, since a grant can be Active and still open
nothing.

ADD MEMBER stopped being a dead end. An address the directory did not know used
to end at a sentence telling the user their colleague had to sign in first. It
invites them instead, from the same button, because which of the two applies is
a fact about the server's account table rather than about what the user is
doing; which one happened is reported afterwards, because that decides what
they do next. An address that merely has an account is invited rather than
refused: refusing would have made the endpoint an oracle for which addresses
have accounts here, answerable by anybody willing to create a team first.

The phone has a TEAMS screen, behind MORE, and it is the reverse of every other
row in design-import-gaps: a shipped screen the design had no slot for. It is
there because an invitation is claimed by signing in, so somebody told they are
now in a team is at least as likely to be holding a phone — and a membership
visible only on a head they never installed is one they cannot see. It draws
SHARE KEY and nothing that takes something away: wrapping a key is the one act
on that screen a server cannot perform at all, and the desktop guards its
revocations with a tooltip, which is a control a touch screen cannot show.

Two defects were found by an adversarial pass and both were green against the
whole suite at the time. The owner-only check on archiving and handing over had
been weakened to the admin check while their messages and comments still said
owner — and since nothing behind the archive endpoint re-checks it, an admin
the owner had promoted could have archived the team out from under them. And
the rename endpoint built its response with a hardcoded Owner role, so an admin
who renamed a team was handed a summary claiming they owned it, and a client
trusting that instead of re-listing would have offered them the two owner-only
buttons the server then refuses.

The new table gets its constraints tested rather than merely migrated: live
uniqueness per (team, address), the citext proof that an address typed by a
person matches one cased by a provider, and reissue after both revocation and
acceptance. The teams screen gets its first entries in the layout suite, at the
minimum window with every list populated and with each of the two states that
cover half of it — it had none, and it just grew four sections and a second
line in the member row.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-03 14:31:43 +02:00

9.3 KiB

Raw Blame History

ADR 0009 — Team access: membership authorises, a grant unlocks

Status: accepted
Date: 2026-07-31
Builds on: ADR 0001

Context

M3 makes vaults shareable. The obvious way to model that is one concept — "access" — with a role attached, and to let the server hand it out. Every hosted competitor works that way, and it is what the imported design drew: a members table with a role column, and a share button beside each item.

This architecture cannot implement that concept, and the interesting part of M3 was working out what it can implement instead.

The server holds ciphertext and no keys. A vault key is 32 random bytes sealed to each member's X25519 public key (docs/crypto.md §3), and only a client holding the plaintext key can produce a seal for somebody else. So "give Bob access" decomposes into two operations that live on different machines and cannot be performed by the same actor:

deciding that the server will serve Bob this vault's rows, which is a database write; and
wrapping the vault key to Bob's public key, which needs a client that already holds it.

The schema anticipated this — team, team_membership, vault.team_id and vault_key_grant have existed since the first migration — but nothing had had to name the split.

Decision

Membership is authorisation. A grant is access. The product says so out loud.

VaultAccessService resolves a team vault through team_membership, mapping the role to PermissionFlags by a union with no Deny rules. That decides what the server serves and nothing else. Whether the caller can read what it serves is decided by whether they hold a grant, which the server records, cannot produce and cannot verify.

Five consequences, each of which is a place where a more reassuring design was rejected:

A member with no grant is a normal state, not an error. VaultSummary.WrappedVaultKey is null and the vault appears in their list saying it is waiting for a key. Hiding it until a grant existed would have been tidier and would have implied the server was the thing granting access.
The roles are only the ones that are enforceable. There is no ConnectOnly, despite the design asking for one and TeamRole having room. SSH terminates on the client, so opening a session needs the credential's plaintext on that machine; "may connect but may not read the key" cannot be enforced here, and shipping it as a role would have been a lie in a dropdown. Connect rides along with Read and is documented as an interface hint.
Sharing verifies the recipient's key against the append-only key log, or refuses. A directory lookup is a claim by the server about a third party's public key; wrapping to an unverified claim hands the vault to whoever made it. KeyLogAudit reads the whole log, checks its hash chain from genesis, and refuses unless the offered key appears in it unchanged. There is no override flag, because a flag that exists gets used on the day the log is briefly unreachable.
Removal is named for what it does. It revokes grants and flags the vault for rekey. It does not claim to reach anything already downloaded, and the interface says the remediation is rotating the credential — the same non-retroactive limit ADR 0001 records.
Ownership is sole, so handing it over is one write and not a role change. If membership authorises, the owner's membership is the last authority in the team, and a transfer that stopped halfway would leave nobody with the standing to finish it — owned twice if the promotion went first, owned by nobody if the demotion did, and in either case recoverable only by an operator editing the database. So POST /teams/{id}/owner promotes the recipient and demotes the outgoing owner to admin in one transaction, ChangeRoleAsync refuses Owner outright, and the recipient must already be an active member — handing a team to an id supplied once is the same mistake as adding somebody straight to the owner role. Demoting rather than removing is the deliberate half: removing them would revoke their vault key grants and flag every team vault for rekey, which is a far larger act than the one being asked for, and somebody handing over a team is usually staying in it.

One thing is deliberately not built, and it is a refusal rather than an omission:

The rekey itself. Only a client holding the current vault key can re-wrap every item's data key under a new one. The server records that a rotation is owed and the interface reports it. M5.

Two smaller choices, recorded because the alternative was written down first and rejected:

No v_user_vault_permission view. ADR-adjacent notes and the old VaultAccessService remark both anticipated one. The rules turned out to be about sixteen lines of C# shared by the two methods that need them; a view would have moved the authorisation model into migrations, where a test cannot reach it without a container.
Host key trust stays vault-scoped to the personal vault. Pins in a team vault are listed but not consulted at connect time. Consulting them would let any member with Write pre-approve a fingerprint that another member's client then trusts silently for a host in their own vault, which is a cross-boundary trust escalation. Scoping trust properly needs a scope on the SSH connect path (IKnownHostStore.FindAsync takes host, port and algorithm and knows nothing about vaults); until that exists, the safe direction is the narrow one, and the cost — approving a team host's key once per member per machine — is stated in the README rather than hidden.

An invitation is membership decided before there is an account to hold it

A membership names an account: team_membership.user_id is not nullable and carries a foreign key, so somebody who has never signed in here has nothing for that row to point at. MembershipStatus.Invited has existed since the first migration and is still never written — not as an oversight, but because a membership waiting for a person is the one shape this model cannot store. An invitation is therefore its own record, team_invitation, held against an address, and it becomes an ordinary active membership the moment an account with that address signs in.

That extends the model rather than bending it. An invitation grants nothing readable and cannot be a step towards sharing, because there is no account and so no public key to wrap a vault to. It moves the first half of the split earlier and leaves the second half exactly where it was.

Three decisions inside it belong here, because each had a more convenient alternative:

The claim requires email_verified on the access token, and nothing relaxes it. This is the whole of the security boundary. Membership is authorisation, so an invitation that could be taken by anybody able to obtain a token asserting somebody else's address is a way into a team — the same attack OidcOptions.AllowEmailLinking exists to refuse, arriving by another door and deserving the same bar. An unverified or absent claim claims nothing and logs a warning, which is the only signal an operator gets that their provider is not sending it. There is deliberately no setting to trust an unverified address: a flag that exists is a flag somebody turns on for the afternoon their provider is misconfigured, and this is the one it must not be possible to turn on.
Nothing is sent, and the product says so rather than implying a mail path it has not got. There is no token and no link — the row is a standing instruction, and telling the invitee to go and sign in happens over a channel this server does not carry. A link nobody can deliver would be worse than none. The compensation, such as it is, is real: an invitation that is not a bearer credential is one that cannot be forwarded, intercepted or replayed.
An address that already has an account here is accepted rather than refused. Refusing and pointing at the directory would have been tidier, and would have turned the endpoint into an oracle for which addresses have accounts on this deployment, answerable by anybody willing to create a team first. Only an address already belonging to a member of this team is refused, and that is a fact the caller can already read off the members table, so naming it leaks nothing.

Consequences

The sharing graph is visible to the operator: who is in which team, which vaults exist, and who holds a grant are all plaintext rows. That was already true of metadata generally (docs/crypto.md §10) and is not made worse here, but it is now a graph rather than a list. Invitations widen it by one edge — an address that has been invited is on the graph before its owner has ever been here — which is the same class of fact and worth naming rather than leaving to be noticed.

A malicious granter can seal garbage. The recipient detects it as a tag failure and the grant's Ed25519 signature names who issued it — detectable and attributable, which is the most that is achievable without the server holding a key.

The two-step model costs a step in the interface and buys the property the whole product is for. It also makes a class of bug impossible: there is no code path on the server that could accidentally grant read access to plaintext, because there is no plaintext on the server to grant.

9.3 KiB Raw Blame History