Public Access
laurensandClaude Opus 5.5
ef365f462e
A Spelunk API key reaches one organisation, so a server elsewhere - oc-linux in Orange Climate - was refused before it reached the agent. Each device now signs in to a Spelunk once, under Settings -> Security -> Spelunk or from a Spelunk host's editor: the OAuth authorization code flow with PKCE for a native app (RFC 8252), with Spelunk as the authorization server. The browser opens Spelunk's /api/app-sign-in/authorize with a loopback redirect (the app's own scheme on Android), the person signs in there however they normally do and allows "DodoSSH on <device>", and the code is redeemed at /api/app-sign-in/token for an app session token. That token opens terminals in every organisation its person is in, with the role they have on each server at the time; tunnel tickets send no organisation. The sign-in stays on the device: sealed in the local cache under the LocalCacheKey (AAD resource type 18, bound to its row), never synced, wiped with the cache, and only ever sent to the Spelunk it came from. A 401 from Spelunk forgets it; SIGN OUT ends it there and here, and so does signing out of DodoSSH. Before every Spelunk connection DodoSSH asks its own identity provider whether its sign-in still stands (a forced refresh, at most once a minute), and an account it refuses is signed out of DodoSSH and of every Spelunk on the device. A route names no key any more: Spelunk hosts are written at host schema 11, which an older build shows read-only and asks to be updated for, and a payload that still names a key credential decodes with the id skipped. The SpelunkKey item type is gone: SyncEntityType 14, ChangeEntityType 14 and AAD type 17 are retired, the server drops spelunk_key and its change-log rows, and the client cache drops its cached items, outbox entries and conflicts of that type. A link still never starts a sign-in: from a Spelunk this device is not signed in to it opens the editor, which offers to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
109 lines
4.3 KiB
C#
109 lines
4.3 KiB
C#
using DodoSSH.Domain;
|
|
using Microsoft.EntityFrameworkCore;
|
|
|
|
namespace DodoSSH.Infrastructure;
|
|
|
|
/// <summary>
|
|
/// The application database context.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// <para>
|
|
/// Everything lives in the <c>dodo</c> schema with snake_case names. Timestamps are
|
|
/// <c>timestamptz</c> and always UTC, so there is no tzdata dependency and no conflict with
|
|
/// <c>InvariantGlobalization</c>.
|
|
/// </para>
|
|
/// <para>
|
|
/// Two concurrency mechanisms coexist deliberately. <c>Version</c> on item rows is the
|
|
/// client-visible, monotonic value used for <c>expectedVersion</c> conflict detection.
|
|
/// <c>xmin</c> is the server-side optimistic guard and is never exposed, because it is not stable
|
|
/// across <c>VACUUM FREEZE</c> and must never become a client cursor.
|
|
/// </para>
|
|
/// </remarks>
|
|
public class DodoDbContext(DbContextOptions<DodoDbContext> options) : DbContext(options)
|
|
{
|
|
/// <summary>The database schema every table lives in.</summary>
|
|
public const string SchemaName = "dodo";
|
|
|
|
/// <summary>User accounts.</summary>
|
|
public DbSet<UserAccount> Users => Set<UserAccount>();
|
|
|
|
/// <summary>Identity key generations.</summary>
|
|
public DbSet<UserKey> UserKeys => Set<UserKey>();
|
|
|
|
/// <summary>Wraps of users' secret bundles.</summary>
|
|
public DbSet<UserKeyWrap> UserKeyWraps => Set<UserKeyWrap>();
|
|
|
|
/// <summary>Enrolled devices.</summary>
|
|
public DbSet<Device> Devices => Set<Device>();
|
|
|
|
/// <summary>The append-only key transparency log.</summary>
|
|
public DbSet<KeyLogEntry> KeyLog => Set<KeyLogEntry>();
|
|
|
|
/// <summary>Teams.</summary>
|
|
public DbSet<Team> Teams => Set<Team>();
|
|
|
|
/// <summary>Team memberships.</summary>
|
|
public DbSet<TeamMembership> TeamMemberships => Set<TeamMembership>();
|
|
|
|
/// <summary>Vaults.</summary>
|
|
public DbSet<Vault> Vaults => Set<Vault>();
|
|
|
|
/// <summary>Wrapped vault keys.</summary>
|
|
public DbSet<VaultKeyGrant> VaultKeyGrants => Set<VaultKeyGrant>();
|
|
|
|
/// <summary>SSH hosts.</summary>
|
|
public DbSet<SshHost> Hosts => Set<SshHost>();
|
|
|
|
/// <summary>SSH key pairs, held as ciphertext.</summary>
|
|
public DbSet<VaultSshKey> SshKeys => Set<VaultSshKey>();
|
|
|
|
/// <summary>Usernames and passwords, held as ciphertext.</summary>
|
|
public DbSet<VaultCredential> Credentials => Set<VaultCredential>();
|
|
|
|
/// <summary>Trusted SSH host keys, held as ciphertext.</summary>
|
|
public DbSet<VaultKnownHostKey> KnownHostKeys => Set<VaultKnownHostKey>();
|
|
|
|
/// <summary>Host groups, held as ciphertext.</summary>
|
|
public DbSet<VaultHostGroup> HostGroups => Set<VaultHostGroup>();
|
|
|
|
/// <summary>Tags hosts can wear, held as ciphertext.</summary>
|
|
public DbSet<VaultTag> Tags => Set<VaultTag>();
|
|
|
|
/// <summary>Saved commands, held as ciphertext.</summary>
|
|
public DbSet<VaultSnippet> Snippets => Set<VaultSnippet>();
|
|
|
|
/// <summary>Connections that were made, held as ciphertext.</summary>
|
|
public DbSet<VaultConnectionLogEntry> ConnectionLog => Set<VaultConnectionLogEntry>();
|
|
|
|
/// <summary>Changes made to keychain items, held as ciphertext.</summary>
|
|
public DbSet<VaultActivityLogEntry> ActivityLog => Set<VaultActivityLogEntry>();
|
|
|
|
/// <summary>S3-compatible buckets and their credentials, held as ciphertext.</summary>
|
|
public DbSet<VaultObjectStore> ObjectStores => Set<VaultObjectStore>();
|
|
|
|
/// <summary>The per-vault change log that delta sync reads.</summary>
|
|
public DbSet<VaultChange> VaultChanges => Set<VaultChange>();
|
|
|
|
/// <summary>Applied-operation receipts, for exactly-once retries.</summary>
|
|
public DbSet<SyncOperationReceipt> SyncOperationReceipts => Set<SyncOperationReceipt>();
|
|
|
|
/// <summary>Redeemed relay tickets: the replay guard ADR 0004 shares between nodes.</summary>
|
|
public DbSet<RelayTicketUse> RelayTicketUses => Set<RelayTicketUse>();
|
|
|
|
/// <summary>The relay's audit record, one row per session.</summary>
|
|
public DbSet<RelaySession> RelaySessions => Set<RelaySession>();
|
|
|
|
/// <inheritdoc />
|
|
protected override void OnModelCreating(ModelBuilder modelBuilder)
|
|
{
|
|
ArgumentNullException.ThrowIfNull(modelBuilder);
|
|
|
|
modelBuilder.HasDefaultSchema(SchemaName);
|
|
modelBuilder.HasPostgresExtension("citext");
|
|
|
|
modelBuilder.ApplyConfigurationsFromAssembly(typeof(DodoDbContext).Assembly);
|
|
|
|
base.OnModelCreating(modelBuilder);
|
|
}
|
|
}
|