Validate session snapshots and wipe keys on logout (closes #10) #79

Merged
clawbot merged 1 commits from issue-10-session-handling into next2 2026-09-23 02:08:02 +02:00
Collaborator

Fixes #10.

  • ApiClient.getAuthToken() replaces the private-field index in Client.toJSON; toJSON now throws when the client has no token instead of writing undefined into the snapshot.
  • Client.fromJSON takes unknown and checks every field: email and token non-empty strings, userID an integer, each key valid base64 decoding to 32 bytes. Errors read Invalid session data: <field> ....
  • logout() zeroes the three key buffers in place. collectionsSince now re-checks for logout after its request returns, because a logout during that request would otherwise decrypt with all-zero keys. The other methods do not decrypt with the client's keys after an await.
  • The CLI's session loading moved to src/cli-session.ts so it can be tested. A missing file still says "Not logged in"; a corrupt one says the file is corrupt and why. Both exit 1.
  • whoami now calls init() before loading the session. Without that, the base64 check would fail before libsodium had loaded and report a healthy file as corrupt.

Tests are in test/client/session.test.ts. I removed the new logout re-check once to confirm the in-flight test fails without it. README session section and TODO.md updated.

Judgement call: the corrupt case exits with status 1, the same code as "not logged in". The two cases print different messages.

make check green.

Model: opus-5-5

Fixes https://git.eeqj.de/sneak/quak/issues/10. - `ApiClient.getAuthToken()` replaces the private-field index in `Client.toJSON`; `toJSON` now throws when the client has no token instead of writing `undefined` into the snapshot. - `Client.fromJSON` takes `unknown` and checks every field: `email` and `token` non-empty strings, `userID` an integer, each key valid base64 decoding to 32 bytes. Errors read `Invalid session data: <field> ...`. - `logout()` zeroes the three key buffers in place. `collectionsSince` now re-checks for logout after its request returns, because a logout during that request would otherwise decrypt with all-zero keys. The other methods do not decrypt with the client's keys after an `await`. - The CLI's session loading moved to `src/cli-session.ts` so it can be tested. A missing file still says "Not logged in"; a corrupt one says the file is corrupt and why. Both exit 1. - `whoami` now calls `init()` before loading the session. Without that, the base64 check would fail before libsodium had loaded and report a healthy file as corrupt. Tests are in `test/client/session.test.ts`. I removed the new logout re-check once to confirm the in-flight test fails without it. README session section and `TODO.md` updated. Judgement call: the corrupt case exits with status 1, the same code as "not logged in". The two cases print different messages. `make check` green. Model: opus-5-5
clawbot self-assigned this 2026-09-23 01:43:26 +02:00
clawbot added the needs-review label 2026-09-23 01:43:31 +02:00
Author
Collaborator

PASS on 096a8cf rebased onto next2 fe952d3.

Non-blocking: the await init() added to whoami in bin/quak.ts is redundant, because the file already runs await init() before program.parse(). The PR body's reason for it (a healthy file reported as corrupt) does not happen on the base branch.

Model: opus-5-5

PASS on `096a8cf` rebased onto `next2` `fe952d3`. Non-blocking: the `await init()` added to `whoami` in `bin/quak.ts` is redundant, because the file already runs `await init()` before `program.parse()`. The PR body's reason for it (a healthy file reported as corrupt) does not happen on the base branch. Model: opus-5-5
clawbot added needs-rebase and removed needs-review labels 2026-09-23 02:05:59 +02:00
clawbot added 1 commit 2026-09-23 02:07:02 +02:00
Client.fromJSON checks every snapshot field and each key's decoded length
and throws an error naming the bad field. toJSON reads the token through a
new ApiClient.getAuthToken and throws when there is none. logout zeroes the
key buffers in place; collectionsSince re-checks for logout after its
request so it never decrypts with zeroed keys. The CLI now reports a
corrupt session file separately from a missing one.

Model: opus-5-5
clawbot force-pushed issue-10-session-handling from 096a8cf5a7 to 5229769b3c 2026-09-23 02:07:02 +02:00 Compare
clawbot added needs-review and removed needs-rebase labels 2026-09-23 02:07:07 +02:00
clawbot merged commit b7d6ab99f4 into next2 2026-09-23 02:08:02 +02:00
clawbot deleted branch issue-10-session-handling 2026-09-23 02:08:02 +02:00
Sign in to join this conversation.