registry: sessions, linked identities and the account page (slice 1 of #16) #223
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
#224 registry: sign-in through GitHub, GitLab and Codeberg, OAuth 2.0 with PKCE (slice 2 of #16)
torbscript/language
#226 registry: passkeys, WebAuthn registration and sign-in (slice 4 of #16)
torbscript/language
#227 registry: TOTP and recovery codes (slice 5 of #16)
torbscript/language
Reference
torbscript/language#223
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Goal
The foundation every sign-in method of #16 builds on: server-side sessions, identities linked to an account, and the small account page the registry serves itself. Today accounts exist only when the operator creates them with the administrator token (
POST /api/1/accounts); after this slice an account can hold several sign-in identities and a browser session, still created by the operator until slice 2 (#224) adds sign-up through a provider.Owner decision (recorded on #16)
Pinned records
tools/registry/README.md, "Not built yet"Acceptance criteria
tools/registry/src/database.trb: tables for identities (account,provider,subject,UNIQUE(provider, subject)), sessions (id stored as its SHA-256, account, created, expires, last seen) and CSRF secrets; existing databases migrate in place, existing accounts and tokens keep working.HttpOnly; Secure; SameSite=Lax; Path=/, with an idle and an absolute expiry; signing out deletes the row.GET /account): the account's owner name, its linked identities, its passkeys and second factors (empty lists until slices 4 and 5), its tokens; served as HTML with a strictContent-Security-Policy, no third-party assets.tests/without a provider (test-only route or helper, never reachable in a production configuration).tests/server.test.trb(or a new test file) covers each call once as it works and once as it is refused (no session, expired session, wrong CSRF token, last identity);torb test tools/registry/testsgreen natively and in the VM.tools/registry/README.md(calls table, configuration, "Not built yet") and RELEASE.md's Accounts row updated.Seed impact
None: TorbScript in
tools/registryon existingstd; no syntax change, no native, no driver flag, no std name the compiler looks up by string.Size and dependencies
One PR, one or two Conventional Commits (
feat(registry): ...). No dependency. Parent: #16. Security-relevant: architect review of the diff before the PR.[loop:torbscript] implement: ready, but it edits
tools/registrywhile PR #237 (#17) is in CI and review on the same paths. next: waiting (PR #237 on the same paths) until 2026-10-09T05:10:00Z[loop:torbscript] implement: ready, but PR #245 (#18, registry search) is in CI and review and edits
tools/registry/src/database.trband the other registry sources this slice migrates; PR #237 has landed. next: waiting (PR #245 on the same paths)[loop:torbscript] claim implement by session:loop-torbscript-20261009 until 2026-10-09T10:20Z
Buffer<Item>as the heap storage primitive #54torb#21login,logout,ownerandyankcommands #22torb audit#23torb vendor#24std/http#30torb doc --checkfail #31Decimalthat computes #34Float32arithmetic, comparison, text and narrowing fromFloat64(slice 1) #35setVariable#38Flags#47ArrayList, the hash tables and the tries onBuffer#55TakeOut/PutBackon the map #56forover a concrete list is a counted loop #58torb build --explain-copies#61Into<Path>signatures (PATH slice 2) #68Storage(URI gap 13) #69101 Switching Protocolsand a duplex connection (NETWORK slice 14) #74std/toml#77std/xml#78std/htmldocuments (epic) #79Dualnumbers (forward mode) #83std/ecswith oneStoreper group type, andstd/transform(ECS slice 1) #89std/htmlmarkup (WEB slice 1) #93[loop:torbscript] implement: PR #249 (#249) implements all acceptance criteria in one Conventional Commit:
__Host-cookie carrying only 256 random bits;GET /accountwith a strict CSP;tools/registry/tests/account.test.trb, 21 tests covering every refusal path;An architect security review ran before the PR. It found nothing blocking, and its hardening points are applied: unlinking an identity ends the account's other sessions,
Sec-Fetch-Sitecross-site/same-site posts are refused, the check and delete of an unlink are in one transaction, and the Traefik route is narrower.CI is green on
c95f86be: gates, tier A/B, tools/registry, pdisc, commit check. Tier A needed one rerun for the known language-server flake #244.Left for slice 2, listed in the PR:
startSession/linkIdentity.Token usage: ~0.5M.
next: review (waiting on the merge gate argus)
[loop:torbscript] close: PR #249 approved and merged by argus at 2026-10-09T06:25Z as
13d7e718(one commit,feat(registry): sessions, linked identities and the account page). PR CI green onc95f86beafter the pdisc restamp fix. Main CI on the landed commit is running at the time of this comment. Worker usage: not reported (the worker's run ended with an oversized output after the PR was approved). Slice 1 of #16 done; claim released.