MikeFaith/authforge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(daemon): real GenerateRecoveryCode + ListRecoveryCodes + RevokeRecoveryCode

Browse Source 
Replace the random-number stub at dbus.rs:132 with state.issue_recovery,
add ListRecoveryCodes (returns Vec<RecoveryCodeSummary>) and RevokeRecoveryCode.
New polkit actions list-recovery / revoke-recovery (auth_admin_keep). Adds
4 D-Bus integration tests; the previously-stub generate-code test now
exercises the real Argon2id-backed write path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
michael
2026-04-27 09:39:16 -07:00
parent e9efde9077
commit a420aa5f75
7 changed files with 114 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
daemon/src/storage/recovery.rs
View File

@@ -161,7 +161,8 @@ impl RecoveryStore {
return Ok(false);
}
let ok = verify_code(candidate, phc).map_err(|e| RecoveryStoreError::Hash(e.to_string()))?;
let ok =
verify_code(candidate, phc).map_err(|e| RecoveryStoreError::Hash(e.to_string()))?;
if ok {
let _ = fs::remove_file(&path);
}

7
daemon/src/storage/safe_user.rs
View File

@@ -12,12 +12,7 @@ pub(crate) enum SegmentError {
/// Reject any username that could escape a single path segment. Centralized
/// so pending / recovery / future stores don't drift on what's "safe."
pub(crate) fn join_user_segment(dir: &Path, user: &str) -> Result<PathBuf, SegmentError> {
if user.is_empty()
|| user == "."
|| user == ".."
|| user.contains('/')
|| user.contains('\0')
{
if user.is_empty() || user == "." || user == ".." || user.contains('/') || user.contains('\0') {
return Err(SegmentError::Invalid(user.to_string()));
}
Ok(dir.join(user))