Implement shared authentication leases and inactivity relock #16

New Issue

hugo · 2026-08-09T19:10:09Z

hugo commented

2026-08-09 19:10:09 +00:00

Objective

Provide the shared configurable authentication lease that frontends use to unlock and automatically relock sensitive views.

Scope

Extend the shared TOML configuration with a security inactivity timeout defaulting to 120 seconds.
Validate the duration and expose the same configuration object to CLI, TUI, desktop and Apple frontends.
Implement storage-owned authentication sessions with authenticate, touch-user-activity, remaining-time, manual-lock, expiry and cancellation operations.
Cache only the minimum unlock material in zeroizing memory for the active lease and require authentication again after expiry.
Distinguish real user activity from background refresh, timers, Git work and repaint events.

Acceptance criteria

The default is two minutes and a valid TOML value overrides it deterministically.
Expiry and manual lock revoke entry handles and secret access; subsequent operations require reauthentication.
Clock-controlled tests cover activity extension, inactivity, cancellation, expiry races, zero/invalid durations and secret cleanup.
No frontend reimplements timeout policy or stores a GPG passphrase itself.

Prerequisites

TOML configuration and CLI contract; secure OS-backed secret storage; embedded GPG-compatible cryptography.

## Objective Provide the shared configurable authentication lease that frontends use to unlock and automatically relock sensitive views. ## Scope - Extend the shared TOML configuration with a security inactivity timeout defaulting to 120 seconds. - Validate the duration and expose the same configuration object to CLI, TUI, desktop and Apple frontends. - Implement storage-owned authentication sessions with authenticate, touch-user-activity, remaining-time, manual-lock, expiry and cancellation operations. - Cache only the minimum unlock material in zeroizing memory for the active lease and require authentication again after expiry. - Distinguish real user activity from background refresh, timers, Git work and repaint events. ## Acceptance criteria - The default is two minutes and a valid TOML value overrides it deterministically. - Expiry and manual lock revoke entry handles and secret access; subsequent operations require reauthentication. - Clock-controlled tests cover activity extension, inactivity, cancellation, expiry races, zero/invalid durations and secret cleanup. - No frontend reimplements timeout policy or stores a GPG passphrase itself. ## Prerequisites TOML configuration and CLI contract; secure OS-backed secret storage; embedded GPG-compatible cryptography.

hugo added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 19:10:09 +00:00

hugo added the enhancement label 2026-08-09 19:10:09 +00:00

hugo referenced this issue

2026-08-10 01:52:11 +00:00

Complete the end-to-end CLI parity audit #14

hugo commented

2026-08-10 02:19:26 +00:00

Implemented in commit f03fdc0 (pushed to main).

What changed:

Added storage-owned AuthenticationSession and generation-bound AuthenticationHandle APIs for authenticate, explicit user-activity touch, remaining time, manual lock, expiry polling, and cancellation.
Added a monotonic injectable clock and serialized access/relock transitions so exact-deadline races cannot pass a stale check.
Made the session own an uncached SecretStore and cache only the passphrases actually requested by the active generation in zeroizing SecretBytes; relock clears them and locks the backend.
Gated both OpenPGP SecretProvider and HTTPS GitCredentialProvider access without extending the lease for reads, timers, refreshes, Git work, or repaint-like polling.
Added [security].inactivity_timeout_seconds to the shared strict TOML Config, defaulting to 120 seconds and validating 1 second through 24 hours.
Exposed whether imported key material requires a passphrase so unprotected keys do not create unnecessary cached material.
Documented the frontend/storage contract and configuration.

Isolation and review evidence:

Focused: cargo test -p ironstorage --test authentication_leases --test config_contract --test secret_store --test read_domains (23 passed).
New clock-controlled coverage verifies activity extension, inactivity, exact-deadline concurrency, cancellation, manual revocation, zero/invalid durations, cache cleanup/reauthentication, redaction, and real compatibility-fixture entry access before/after relock.
Acceptance reread confirmed old handles cannot decrypt fixture entries after lock/expiry and reauthentication creates usable new handles.

Required gates passed from repository root:

cargo fmt --all -- --check
RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

Implemented in commit f03fdc0 (pushed to main). What changed: - Added storage-owned AuthenticationSession and generation-bound AuthenticationHandle APIs for authenticate, explicit user-activity touch, remaining time, manual lock, expiry polling, and cancellation. - Added a monotonic injectable clock and serialized access/relock transitions so exact-deadline races cannot pass a stale check. - Made the session own an uncached SecretStore and cache only the passphrases actually requested by the active generation in zeroizing SecretBytes; relock clears them and locks the backend. - Gated both OpenPGP SecretProvider and HTTPS GitCredentialProvider access without extending the lease for reads, timers, refreshes, Git work, or repaint-like polling. - Added [security].inactivity_timeout_seconds to the shared strict TOML Config, defaulting to 120 seconds and validating 1 second through 24 hours. - Exposed whether imported key material requires a passphrase so unprotected keys do not create unnecessary cached material. - Documented the frontend/storage contract and configuration. Isolation and review evidence: - Focused: cargo test -p ironstorage --test authentication_leases --test config_contract --test secret_store --test read_domains (23 passed). - New clock-controlled coverage verifies activity extension, inactivity, exact-deadline concurrency, cancellation, manual revocation, zero/invalid durations, cache cleanup/reauthentication, redaction, and real compatibility-fixture entry access before/after relock. - Acceptance reread confirmed old handles cannot decrypt fixture entries after lock/expiry and reauthentication creates usable new handles. Required gates passed from repository root: - cargo fmt --all -- --check - RUSTFLAGS="-D warnings" cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace

hugo closed this issue

2026-08-10 02:19:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#16