thepraandClaude Opus 5.5
cff75e3a47
Build / Build (push) Successful in 26s
Completion program R2 (docs/ROADMAP.md, 2026-10-17).
- An email address is set only with the password and a 6-digit code sent to it: /clientapi/user/email, /email/verify,
/email/remove and GET /clientapi/user/account (EmailVerification: an hour, five tries, the code's hash only;
EmailVerificationJob through the new IMailer). The request answers one sentence whether or not the address is free,
and nothing goes to an address another login verified. The old POST /clientapi/user/update, which changed the
address with neither and said when one was taken, answers 422.
- Recovery writes only to a verified address; migration _019 keeps the addresses given before verification existed.
- A changed password ends every session and every persona token, and answers a new JWT for the device that changed it.
- Sessions: every JWT carries its session's id ("si", kept by sniff/again). GET /clientapi/user/logout, which did
nothing, ends that session alone (RootUser.EndedSessions, until its tokens would expire); POST
/clientapi/user/logout/everywhere ends them all.
- AppConfiguration:HashingOptions was never bound, so passwords were hashed at the default 9789 iterations: it is
bound now, at 210,000, and a hash made at other iterations is made again at the next sign-in (matched on the old
hash, so two sign-ins never undo each other).
- Recovery and verification codes expire through TTL indexes; EmailVerification is never in a backup.
- AppConfigurationService reads appsettings as they are now, not the copy older builds saved in Mongo on first boot.
- ViewUserSettings and RootUserSettings carry SavedAt, so a client signing in keeps its own theme until one saved.
- Pasture: peers/mailpit.sh (Mailpit 1.31.4 as mailpit.test) receives PrivaPub's mail; recovery links open
https://decepub.test. scenarios/accounts.sh, in sweep batch A, checks all of the above (28 checks).
Verified: dotnet build PrivaPub.sln -c Release; the pasture with gts and mailpit: accounts 28/28 and gts, 91 passed,
0 failed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof
59 lines
2.3 KiB
C#
59 lines
2.3 KiB
C#
using MongoDB.Entities;
|
|
|
|
using System.ComponentModel.DataAnnotations;
|
|
|
|
namespace PrivaPub.Models.User
|
|
{
|
|
public class RootUser : Entity
|
|
{
|
|
[StringLength(32)]
|
|
public string UserName { get; set; }
|
|
[EmailAddress]
|
|
public string Email { get; set; }
|
|
public bool IsEmailValidated { get; set; } = false;
|
|
public bool IsBanned { get; set; } = false;
|
|
public string HashedPassword { get; set; }
|
|
public List<string> Policies { get; set; } = new() { ClientModels.Policies.IsUser };
|
|
public RootUserSettings Settings { get; set; } = new();
|
|
|
|
public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
|
|
public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
|
|
public DateTime? DeletedAt { get; set; }
|
|
public DateTime? CredentialsChangedAt { get; set; }//when RootSessions last ended every session
|
|
public string SessionStamp { get; set; }//carried by every /clientapi token; a new one ends the tokens issued before
|
|
public List<EndedSession> EndedSessions { get; set; } = new();//sessions signed out one by one, until their tokens expire
|
|
|
|
/// <summary>An administrator is a moderator too (IsAdminPolicy asks for both); otherwise a plain user.</summary>
|
|
public void SetAdmin(bool admin)
|
|
{
|
|
Policies.RemoveAll(p => p is ClientModels.Policies.IsAdmin or ClientModels.Policies.IsModerator);
|
|
if (admin)
|
|
Policies.AddRange([ClientModels.Policies.IsAdmin, ClientModels.Policies.IsModerator]);
|
|
if (!Policies.Contains(ClientModels.Policies.IsUser))
|
|
Policies.Add(ClientModels.Policies.IsUser);
|
|
UpdatedAt = DateTime.UtcNow;
|
|
}
|
|
}
|
|
|
|
// a session that signed out: its tokens carry Sid, and are refused until Until, when they would have expired anyway
|
|
public class EndedSession
|
|
{
|
|
public string Sid { get; set; }
|
|
public DateTime Until { get; set; }
|
|
}
|
|
|
|
public class RootUserSettings
|
|
{
|
|
public string LanguageCode { get; set; } = "en-GB";
|
|
public DateTime? SavedAt { get; set; }//when a client last saved them; until then a client keeps its own
|
|
|
|
public short IconsThemeIndexColour { get; set; } = 25;
|
|
public short LightThemeIndexColour { get; set; } = 25;
|
|
public short DarkThemeIndexColour { get; set; } = 215;
|
|
public bool PreferSystemTheming { get; set; } = true;
|
|
public bool ThemeIsDarkMode { get; set; } = false;
|
|
public bool ThemeIsDarkGray { get; set; } = false;
|
|
public bool ThemeIsLightGray { get; set; } = true;
|
|
}
|
|
}
|