Public Access
jaap-jan
e9cea2ccbc
Three things a user reported, one of which was a real bug and one of which was
not the bug it looked like.
**A vault shared with somebody never reached their machine.** The grant was
correct at both ends: the sharing client verified the recipient's key against the
key log and wrapped every generation to it, the server stored it, and /me would
have returned it. Nothing asked. VaultSession.RefreshVaultsAsync — the method
whose own summary says it is "called after a share and on a periodic pass" — had
no caller anywhere in the application, so the vault list was whatever the last
browser sign-in cached. A restart did not help: an offline unlock reads that same
cache. The vault appeared only if the recipient happened to sign in through the
browser again, which is why this looked like sharing being broken rather than
like a list that was never re-read.
So every synchronisation pass now re-reads it, before it syncs. SyncOnceAsync
takes the whole server rather than its sync half for that reason, and the order
matters: a vault admitted by the refresh is one that same pass then pulls, where
the other order would show a newly shared vault as an empty one until the minute
after. The shell is told only when the set actually changed — it rebuilds the tab
strip's vault menu from the session's list, and doing that on every quiet pass
would rebuild a menu once a minute for nothing.
The test needed the fake server to be able to do something no test here had
needed before: hand this account a vault it did not make. ShareVaultWithMe wraps
a real key to the encryption key this account enrolled, so the keyring opens it
exactly as it opens a real colleague's — a helper that filled the field with
bytes would let a vault appear in the list and never prove it could be read.
**Adding an S3 bucket on the desktop works, and could not be found.** The report
was that it is not possible; driving the real XAML headlessly says otherwise —
Keychain, + BUCKET, and the editor saves. What is true is that S3 is where
somebody goes looking, and from there SELECT BUCKET opened a combo box with
nothing in it and no sentence anywhere saying that a bucket is a keychain item.
From where the user was standing that is indistinguishable from an application
with no way to add one.
The empty state now says what a bucket is and offers a button that lands on the
keychain with the editor already open — navigating to the screen and leaving
+ BUCKET to be found among five buttons would be most of the same problem. The
phone gets the sentence and no button: its keychain screen reads and deletes and
edits nothing, so there is no editor to send anybody to, and naming the machine
that has one beats an empty control that reads as a screen still loading.
The keychain screen's layout test grew the two categories it never covered.
Tags and buckets arrived after it was written, and the header strip it measures
is one that has overflowed twice before.
**A vault can now be deleted.** DELETE /api/v1/vaults/{id}, gated on Admin —
the line the rename already drew, for a stronger version of its reason, since
this takes the vault from everybody in it at once. The row is soft-deleted and
every grant to it withdrawn in one write; VaultAccessService filters on the stamp
at both ends, so from that moment the vault is absent from every member's /me and
every call naming it answers 404. Their clients notice on the pass described
above.
The team behind it is archived when it owned nothing else, which is the mirror of
renaming it: a vault made from the vaults screen gets a team named after it that
nobody was ever shown, and leaving that behind would leave a membership list no
screen has a row for. That is a second call rather than one transaction —
archiving is TeamService's, it refuses while a team owns vaults, and it can only
tell that this one no longer does once the deletion is committed. A crash between
the two leaves an empty team: invisible, archivable afterwards, harmless, and a
better failure than a vault that could not be deleted because tidying up after it
did not work.
Two refusals worth stating. The personal vault cannot be deleted at either end:
it is created by enrollment, everything filed nowhere else lives in it, and no
call would make another. And the items are kept — ciphertext behind a vault
nothing will resolve, so deleting them buys no confidentiality while destroying
what an operator undoing a mistake would need.
The client drops the key from the keyring and the row from the cache rather than
waiting for a refresh, so the list is right immediately; the items stay, as they
stay for a vault whose grant was withdrawn, because a copy is on every other
member's machine too and removing these rows would be the client pretending to a
reach it does not have. The confirmation says that out loud before it is
answered. It is the one sentence this screen must not leave implied: deletion is
no more retroactive than revocation is. See ADR 0001.
Desktop only, deliberately. The Android vaults screen offers no rename and no
hand-over either, so adding delete alone there would be the one destructive vault
operation on a screen with no other.
Three places asserted that a vault can never be deleted — TeamService's refusal
message, the TeamNotEmpty problem code, and ADR 0009 — and each now names the
route instead.
179 lines
13 KiB
Markdown
179 lines
13 KiB
Markdown
# ADR 0009 — Team access: membership authorises, a grant unlocks
|
|
|
|
- Status: accepted
|
|
- Date: 2026-07-31
|
|
- Builds on: [ADR 0001](0001-e2ee-trust-model.md)
|
|
|
|
## Context
|
|
|
|
M3 makes vaults shareable. The obvious way to model that is one concept — "access" — with a role
|
|
attached, and to let the server hand it out. Every hosted competitor works that way, and it is what
|
|
the imported design drew: a members table with a role column, and a share button beside each item.
|
|
|
|
This architecture cannot implement that concept, and the interesting part of M3 was working out
|
|
what it can implement instead.
|
|
|
|
The server holds ciphertext and no keys. A vault key is 32 random bytes sealed to each member's
|
|
X25519 public key (`docs/crypto.md` §3), and only a client holding the plaintext key can produce a
|
|
seal for somebody else. So "give Bob access" decomposes into two operations that live on different
|
|
machines and cannot be performed by the same actor:
|
|
|
|
- deciding that the server will **serve** Bob this vault's rows, which is a database write; and
|
|
- **wrapping** the vault key to Bob's public key, which needs a client that already holds it.
|
|
|
|
The schema anticipated this — `team`, `team_membership`, `vault.team_id` and `vault_key_grant` have
|
|
existed since the first migration — but nothing had had to name the split.
|
|
|
|
## Decision
|
|
|
|
**Membership is authorisation. A grant is access. The product says so out loud.**
|
|
|
|
`VaultAccessService` resolves a team vault through `team_membership`, mapping the role to
|
|
`PermissionFlags` by a union with no Deny rules. That decides what the server serves and nothing
|
|
else. Whether the caller can read what it serves is decided by whether they hold a grant, which the
|
|
server records, cannot produce and cannot verify.
|
|
|
|
Five consequences, each of which is a place where a more reassuring design was rejected:
|
|
|
|
- **A member with no grant is a normal state, not an error.** `VaultSummary.WrappedVaultKey` is null
|
|
and the vault appears in their list saying it is waiting for a key. Hiding it until a grant existed
|
|
would have been tidier and would have implied the server was the thing granting access.
|
|
- **The roles are only the ones that are enforceable.** There is no `ConnectOnly`, despite the design
|
|
asking for one and `TeamRole` having room. SSH terminates on the client, so opening a session needs
|
|
the credential's plaintext on that machine; "may connect but may not read the key" cannot be
|
|
enforced here, and shipping it as a role would have been a lie in a dropdown. `Connect` rides along
|
|
with `Read` and is documented as an interface hint.
|
|
- **Sharing verifies the recipient's key against the append-only key log, or refuses.** A directory
|
|
lookup is a claim by the server about a third party's public key; wrapping to an unverified claim
|
|
hands the vault to whoever made it. `KeyLogAudit` reads the whole log, checks its hash chain from
|
|
genesis, and refuses unless the offered key appears in it unchanged. There is no override flag,
|
|
because a flag that exists gets used on the day the log is briefly unreachable.
|
|
- **Removal is named for what it does.** It revokes grants and flags the vault for rekey. It does not
|
|
claim to reach anything already downloaded, and the interface says the remediation is rotating the
|
|
credential — the same non-retroactive limit ADR 0001 records.
|
|
- **Ownership is sole, so handing it over is one write and not a role change.** If membership
|
|
authorises, the owner's membership is the last authority in the team, and a transfer that stopped
|
|
halfway would leave nobody with the standing to finish it — owned twice if the promotion went first,
|
|
owned by nobody if the demotion did, and in either case recoverable only by an operator editing the
|
|
database. So `POST /teams/{id}/owner` promotes the recipient and demotes the outgoing owner to
|
|
**admin** in one transaction, `ChangeRoleAsync` refuses `Owner` outright, and the recipient must
|
|
already be an active member — handing a team to an id supplied once is the same mistake as adding
|
|
somebody straight to the owner role. Demoting rather than removing is the deliberate half: removing
|
|
them would revoke their vault key grants and flag every team vault for rekey, which is a far larger
|
|
act than the one being asked for, and somebody handing over a team is usually staying in it.
|
|
|
|
One thing is deliberately **not** built, and it is a refusal rather than an omission:
|
|
|
|
- **The rekey itself.** Only a client holding the current vault key can re-wrap every item's data key
|
|
under a new one. The server records that a rotation is owed and the interface reports it. M5.
|
|
|
|
> **Superseded 2026-08-03 by [ADR 0010](0010-vault-key-rotation.md).** Rotation now ships, and it
|
|
> turned out to divide differently than this paragraph assumed: advancing the generation is one
|
|
> server transaction and is not the same act as re-wrapping the items, which is still outstanding.
|
|
> Removing a member rotates the vaults the removing client can open and hands the new key to whoever
|
|
> is left.
|
|
|
|
Two smaller choices, recorded because the alternative was written down first and rejected:
|
|
|
|
- **No `v_user_vault_permission` view.** ADR-adjacent notes and the old `VaultAccessService` remark
|
|
both anticipated one. The rules turned out to be about sixteen lines of C# shared by the two
|
|
methods that need them; a view would have moved the authorisation model into migrations, where a
|
|
test cannot reach it without a container.
|
|
- **Host key trust stays vault-scoped to the personal vault.** Pins in a team vault are listed but
|
|
not consulted at connect time. Consulting them would let any member with Write pre-approve a
|
|
fingerprint that another member's client then trusts silently for a host in their *own* vault,
|
|
which is a cross-boundary trust escalation. Scoping trust properly needs a scope on the SSH connect
|
|
path (`IKnownHostStore.FindAsync` takes host, port and algorithm and knows nothing about vaults);
|
|
until that exists, the safe direction is the narrow one, and the cost — approving a team host's key
|
|
once per member per machine — is stated in the README rather than hidden.
|
|
|
|
### An invitation is membership decided before there is an account to hold it
|
|
|
|
A membership names an account: `team_membership.user_id` is not nullable and carries a foreign key, so
|
|
somebody who has never signed in here has nothing for that row to point at. `MembershipStatus.Invited`
|
|
has existed since the first migration and is still never written — not as an oversight, but because a
|
|
membership waiting for a person is the one shape this model cannot store. An invitation is therefore its
|
|
own record, `team_invitation`, held against an **address**, and it becomes an ordinary active membership
|
|
the moment an account with that address signs in.
|
|
|
|
That extends the model rather than bending it. An invitation grants nothing readable and cannot be a
|
|
step towards sharing, because there is no account and so no public key to wrap a vault to. It moves the
|
|
first half of the split earlier and leaves the second half exactly where it was.
|
|
|
|
Three decisions inside it belong here, because each had a more convenient alternative:
|
|
|
|
- **The claim requires `email_verified` on the access token, and nothing relaxes it.** This is the whole
|
|
of the security boundary. Membership is authorisation, so an invitation that could be taken by anybody
|
|
able to obtain a token asserting somebody else's address is a way into a team — the same attack
|
|
`OidcOptions.AllowEmailLinking` exists to refuse, arriving by another door and deserving the same bar.
|
|
An unverified or absent claim claims nothing and logs a warning, which is the only signal an operator
|
|
gets that their provider is not sending it. There is deliberately no setting to trust an unverified
|
|
address: a flag that exists is a flag somebody turns on for the afternoon their provider is
|
|
misconfigured, and this is the one it must not be possible to turn on.
|
|
- **Nothing is sent, and the product says so rather than implying a mail path it has not got.** There is
|
|
no token and no link — the row is a standing instruction, and telling the invitee to go and sign in
|
|
happens over a channel this server does not carry. A link nobody can deliver would be worse than none.
|
|
The compensation, such as it is, is real: an invitation that is not a bearer credential is one that
|
|
cannot be forwarded, intercepted or replayed.
|
|
- **An address that already has an account here is accepted rather than refused.** Refusing and pointing
|
|
at the directory would have been tidier, and would have turned the endpoint into an oracle for which
|
|
addresses have accounts on this deployment, answerable by anybody willing to create a team first. Only
|
|
an address already belonging to a member of *this* team is refused, and that is a fact the caller can
|
|
already read off the members table, so naming it leaks nothing.
|
|
|
|
### Addendum: the vault is what the product shows, and the team is behind it
|
|
|
|
The model above is unchanged. What changed afterwards is which half of it a person is asked about.
|
|
|
|
The first interface built on this ADR made the team the subject: you created a team, then a vault in it,
|
|
then wrapped a key. Two of those three steps are about a concept nobody arrives wanting. So the screen now
|
|
lists **vaults**, and naming one creates the membership list that carries it — named after the vault,
|
|
owned by the creator, one per vault. Nothing on the server moved: `VaultAccessService` still resolves a
|
|
shared vault through `team_membership`, every membership call still names a team id, and the split this
|
|
ADR is about — membership authorises, a grant unlocks — is still what the screen is built around, now
|
|
stated per vault rather than per team.
|
|
|
|
Three consequences of the change belong here:
|
|
|
|
- **A team owning several vaults is still legal and is no longer produced.** The client cannot make one;
|
|
an operator or a pre-existing deployment can. The screen refuses to hide it: a vault whose membership
|
|
list carries others says so, because on a vault-shaped screen "adding somebody here adds them there" is
|
|
precisely the fact that would otherwise be invisible.
|
|
- **Archiving left the interface.** It was only ever possible for a team owning no vaults, and a screen
|
|
whose rows are vaults has no row for one — so the button would have been unreachable or always refused.
|
|
The endpoint is unchanged and the screen states the limit instead. The one place a vault-less team can
|
|
still appear is a create whose second call failed; cancelling that form archives it, which is a
|
|
deliberate exception to this client's rule against tidying up on the user's behalf, made because nothing
|
|
else can reach it.
|
|
- **A vault can be deleted**, which is the operation this ADR's first version said the product did not
|
|
have: `DELETE /api/v1/vaults/{id}` requires `PermissionFlags.Admin`, the same line the rename draws and
|
|
for a stronger reason — it takes the vault from everybody in it at once. It soft-deletes the row,
|
|
withdraws every grant to it, and archives the owning team when that team was made to carry this vault
|
|
alone, so deleting the last vault of a one-vault team does not leave a membership list no screen has a
|
|
row for. The personal vault is refused: it is created by enrollment, everything filed nowhere else lives
|
|
in it, and no call would make another. The items are kept — ciphertext behind a vault nothing resolves —
|
|
because deleting them buys no confidentiality and destroys what an operator would need to undo a
|
|
mistake. **It reaches no machine that has already synced the vault**, which is the same limit revocation
|
|
has and for the same reason; see ADR 0001. The client says so before asking for the confirmation.
|
|
- **A vault can be renamed**, which it could not before: `PUT /api/v1/vaults/{id}` requires
|
|
`PermissionFlags.Admin` — the line `UpdateTeamEndpoint` already draws, because a name is what everybody
|
|
in the vault sees it called rather than part of its contents. It renames the owning team with it when
|
|
that team carries nothing else, so the row an operator reads and the name a user says do not drift
|
|
apart. The slug never moves, for the reason it never moves on a team rename.
|
|
|
|
## Consequences
|
|
|
|
The sharing graph is visible to the operator: who is in which team, which vaults exist, and who holds
|
|
a grant are all plaintext rows. That was already true of metadata generally (`docs/crypto.md` §10)
|
|
and is not made worse here, but it is now a graph rather than a list. Invitations widen it by one
|
|
edge — an address that has been invited is on the graph before its owner has ever been here — which is
|
|
the same class of fact and worth naming rather than leaving to be noticed.
|
|
|
|
A malicious granter can seal garbage. The recipient detects it as a tag failure and the grant's
|
|
Ed25519 signature names who issued it — detectable and attributable, which is the most that is
|
|
achievable without the server holding a key.
|
|
|
|
The two-step model costs a step in the interface and buys the property the whole product is for. It
|
|
also makes a class of bug impossible: there is no code path on the server that could accidentally
|
|
grant read access to plaintext, because there is no plaintext on the server to grant.
|