## Objective
Provide the shared configurable authentication lease that frontends use to unlock and automatically relock sensitive views.
## Scope
- Extend the shared TOML configuration with a security inactivity timeout defaulting to 120 seconds.
- Validate the duration and expose the same configuration object to CLI, TUI, desktop and Apple frontends.
- Implement storage-owned authentication sessions with authenticate, touch-user-activity, remaining-time, manual-lock, expiry and cancellation operations.
- Cache only the minimum unlock material in zeroizing memory for the active lease and require authentication again after expiry.
- Distinguish real user activity from background refresh, timers, Git work and repaint events.
## Acceptance criteria
- The default is two minutes and a valid TOML value overrides it deterministically.
- Expiry and manual lock revoke entry handles and secret access; subsequent operations require reauthentication.
- Clock-controlled tests cover activity extension, inactivity, cancellation, expiry races, zero/invalid durations and secret cleanup.
- No frontend reimplements timeout policy or stores a GPG passphrase itself.
## Prerequisites
TOML configuration and CLI contract; secure OS-backed secret storage; embedded GPG-compatible cryptography.
hugo
added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 19:10:09 +00:00
Added storage-owned AuthenticationSession and generation-bound AuthenticationHandle APIs for authenticate, explicit user-activity touch, remaining time, manual lock, expiry polling, and cancellation.
Added a monotonic injectable clock and serialized access/relock transitions so exact-deadline races cannot pass a stale check.
Made the session own an uncached SecretStore and cache only the passphrases actually requested by the active generation in zeroizing SecretBytes; relock clears them and locks the backend.
Gated both OpenPGP SecretProvider and HTTPS GitCredentialProvider access without extending the lease for reads, timers, refreshes, Git work, or repaint-like polling.
Added [security].inactivity_timeout_seconds to the shared strict TOML Config, defaulting to 120 seconds and validating 1 second through 24 hours.
Exposed whether imported key material requires a passphrase so unprotected keys do not create unnecessary cached material.
Documented the frontend/storage contract and configuration.
Implemented in commit f03fdc0 (pushed to main).
What changed:
- Added storage-owned AuthenticationSession and generation-bound AuthenticationHandle APIs for authenticate, explicit user-activity touch, remaining time, manual lock, expiry polling, and cancellation.
- Added a monotonic injectable clock and serialized access/relock transitions so exact-deadline races cannot pass a stale check.
- Made the session own an uncached SecretStore and cache only the passphrases actually requested by the active generation in zeroizing SecretBytes; relock clears them and locks the backend.
- Gated both OpenPGP SecretProvider and HTTPS GitCredentialProvider access without extending the lease for reads, timers, refreshes, Git work, or repaint-like polling.
- Added [security].inactivity_timeout_seconds to the shared strict TOML Config, defaulting to 120 seconds and validating 1 second through 24 hours.
- Exposed whether imported key material requires a passphrase so unprotected keys do not create unnecessary cached material.
- Documented the frontend/storage contract and configuration.
Isolation and review evidence:
- Focused: cargo test -p ironstorage --test authentication_leases --test config_contract --test secret_store --test read_domains (23 passed).
- New clock-controlled coverage verifies activity extension, inactivity, exact-deadline concurrency, cancellation, manual revocation, zero/invalid durations, cache cleanup/reauthentication, redaction, and real compatibility-fixture entry access before/after relock.
- Acceptance reread confirmed old handles cannot decrypt fixture entries after lock/expiry and reauthentication creates usable new handles.
Required gates passed from repository root:
- cargo fmt --all -- --check
- RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Objective
Provide the shared configurable authentication lease that frontends use to unlock and automatically relock sensitive views.
Scope
Acceptance criteria
Prerequisites
TOML configuration and CLI contract; secure OS-backed secret storage; embedded GPG-compatible cryptography.
Implemented in commit
f03fdc0(pushed to main).What changed:
Isolation and review evidence:
Required gates passed from repository root: