Public Access
jaap-jan
b08f2c58e3
Settings → Security gains a SPELUNK section: an API address and a key, saved as a new keychain item, a Spelunk key (SyncEntityType 14, AadResourceType 17, server table spelunk_key via the AddSpelunkKeyItem migration). It is ciphertext only on the server, lives in the personal vault, syncs like every secret, and holds the key together with the one address it may be sent to. The key box empties once saved; the list shows name, address and how many hosts use each key, never the key. Saving a key for an address that already has one replaces it, and deleting goes through the shared confirmation card with the hosts that would stop connecting. A host's route names a saved key where it named a credential, in the same apiKeyCredentialId field, so no host schema changes and an older build reads such a host as one whose key credential has gone. At connect a saved key is sent only to its own address; a host naming it with another Spelunk address is refused in words. Keys kept as a credential's password still work. The editor offers saved keys first and picks the one saved for an address as it is typed. A link from a Spelunk with a saved key now connects straight away, including the first one: saving the key is the user's say-so that the first-link editor used to ask for. The address and key merge as one pair, so two concurrent edits can never pair one device's key with another's address, and the key never reaches the conflict log.
80 lines
2.8 KiB
C#
80 lines
2.8 KiB
C#
namespace DodoSSH.Contracts;
|
|
|
|
/// <summary>
|
|
/// The kind of vault item a sync change refers to.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Values are persisted in the change log and are part of the wire contract. Append only;
|
|
/// never renumber. These mirror <c>CryptoSpec.AadResourceType</c> for the item types, but are
|
|
/// a separate enum because only syncable items appear here.
|
|
/// </remarks>
|
|
public enum SyncEntityType
|
|
{
|
|
/// <summary>Not a legal value.</summary>
|
|
Unspecified = 0,
|
|
|
|
/// <summary>An SSH host.</summary>
|
|
Host = 1,
|
|
|
|
/// <summary>A credential.</summary>
|
|
Credential = 2,
|
|
|
|
/// <summary>An SSH key pair.</summary>
|
|
SshKey = 3,
|
|
|
|
/// <summary>A host group.</summary>
|
|
HostGroup = 4,
|
|
|
|
/// <summary>A tag.</summary>
|
|
Tag = 5,
|
|
|
|
/// <summary>A host-to-tag association.</summary>
|
|
HostTag = 6,
|
|
|
|
/// <summary>A host-to-credential association.</summary>
|
|
HostCredential = 7,
|
|
|
|
/// <summary>A command snippet.</summary>
|
|
Snippet = 8,
|
|
|
|
/// <summary>A port forward.</summary>
|
|
PortForward = 9,
|
|
|
|
/// <summary>A known SSH host key.</summary>
|
|
KnownHostKey = 10,
|
|
|
|
/// <summary>One connection that was made, and how long it lasted.</summary>
|
|
/// <remarks>
|
|
/// The first member added here since the contract was frozen; every one before it was reserved in
|
|
/// advance. Logs are synced items rather than local files because they are audit records — an
|
|
/// administrator has to be able to read a shared vault's history once teams land, and a log kept only on
|
|
/// the machine that produced it can be neither read nor trusted by anybody else. See ADR 0001 for what
|
|
/// that costs in metadata.
|
|
/// </remarks>
|
|
ConnectionLogEntry = 11,
|
|
|
|
/// <summary>One create, edit or delete of a vault item.</summary>
|
|
/// <inheritdoc cref="ConnectionLogEntry" path="/remarks" />
|
|
ActivityLogEntry = 12,
|
|
|
|
/// <summary>
|
|
/// An S3-compatible bucket, and the credentials that reach it.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Named for the protocol's shape rather than for Amazon, because what it addresses is any service
|
|
/// speaking S3 — MinIO, R2, Backblaze, Ceph — and a member called <c>S3</c> would read as a claim about
|
|
/// the vendor. The interface says S3, which is what people call the protocol.
|
|
/// </remarks>
|
|
ObjectStore = 13,
|
|
|
|
/// <summary>
|
|
/// A Spelunk API key, and the one Spelunk address it may be sent to.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// An item of its own rather than a credential's password, because the address is the point: a link from
|
|
/// Spelunk can be sent by anything on the machine, so a key may only go where the user said it goes, and
|
|
/// only an item that carries both can say so. See <c>SpelunkKeySecret</c>.
|
|
/// </remarks>
|
|
SpelunkKey = 14,
|
|
}
|