Repository navigation
feat: let m1ngsama ID members sign in with :login and reserve their handles - #108
Merged
Merged
Conversation
Add :login and :logout. An identity:write module signs a session in through identity.requested, identity.notice, identity.verified, and identity.reserve records, so the core makes no network requests. Signed-in handles are reserved in $TNT_STATE_DIR/identities with the SSH key fingerprints bound to them. A bound key signs the session in on connect, exec post under a reserved name requires that key, and message.created metadata marks verified senders. The server now refuses the SSH none method so that clients offer their public key. Keyless clients get in through keyboard-interactive with no prompts; keyless clients running with BatchMode can no longer connect.
Accept passwordless SSH again unless the login name is a signed-in member's handle, so anonymous and keyless BatchMode clients connect as before. A member is recognised by key when connecting as ssh HANDLE@host, and a keyless sign-in now says how to bind a key. A blank, invalid, or reserved nickname at the prompt now joins as the first free anonymousN instead of disconnecting when anonymous is taken.
The sign-in notice opens on every recognised connection. As a pager it swallowed whatever the person started typing until they pressed q.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Needs your call:
nonemethod, so the client offers its key (src/bootstrap.c). Every other login connects exactly as before.The room stays anonymous, but anyone could take any name, including a member's, and the app showed their photo next to it.
:loginasks the module holding the newidentity:writepermission to sign the session in. The gateway does this with an OAuth device grant against m1ngsama ID.$TNT_STATE_DIR/identitiesand becomes reserved: unverified sessions fall back toanonymousNinstead of using it, and exec posts under it need the matching key.ssh HANDLE@hostwith a key bound by an earlier:loginsigns in without asking.:logoutforgets the key.message.createdmetadata carriesverified: truefor signed-in senders.anonymousnickname now joins asanonymous2instead of being disconnected.make testpasses, including 25 new identity checks.