d4b49b91b4
9845867gave it its own plugin because Tech Tools is browser-only and this needs storage. That was the right reading of the code and the wrong answer for the person using it: Tech Tools is where you go for a utility, and a tool nobody can find is a tool nobody uses. So Tech Tools now has a blueprint, a table and a migration chain where it had none. Its docstring and manifest say why, because "every tool here runs in the browser" was load-bearing documentation and is no longer true. WHAT MOVED /api/securesend -> /api/tools/secrets securesend.create -> tools.secrets securesend0001baseline -> tools0001securesend PLUGIN_TABLE_OWNERS, EXPECTED_HEAD_REVISION, EXEMPT_ENDPOINTS, the universal profile and the api-inventory surface all follow it. THE OLD "NO BACKEND" TEST IS NARROWED, NOT DELETED. It asserted get_blueprint() is None, which is the sort of guard that gets removed when it becomes inconvenient. It now asserts the blueprint serves EXACTLY the three secret routes, with their methods - so a future tool that quietly grows an endpoint or a table has to edit this test, and therefore make the decision on purpose rather than by drift. Asserting methods rather than paths also pins the detail this design turns on: redeeming is POST-ONLY. Chat and mail clients prefetch GET urls to build previews, and a preview that could redeem would consume a one-view secret before its recipient opened the link. Previously that was a comment; now it fails a test. UNINSTALLING THE OLD PLUGIN COULD NOT BE DONE WITH THE PLUGIN TOOLING. `flask plugin uninstall securesend` loads a plugin before uninstalling it, so a plugin whose directory has been deleted cannot be removed by the command that manages plugins - the registry entry had to be edited by hand. Worth fixing separately; it is the same registry-versus-code divergence the device work hit from the other side. MIGRATING A CHAIN THAT HAS ALREADY RUN needs the old table and its version row dropped first, because the relocated chain has no stamp and tries to create a table that exists. Only relevant to anyone who installed securesend during the hour it existed - it did reach the publication repo in4242028- and the fix is DROP TABLE securesendsecrets plus DROP TABLE alembic_version_securesend before running plugin upgrade-all. 1829 tests green. Still backend only: there are no pages yet, so nothing here is reachable by a person.
78 lines
3.0 KiB
Python
78 lines
3.0 KiB
Python
"""A secret handed over by link, encrypted before it ever reaches here.
|
|
|
|
NOT AN ASSET, so this is a standalone table rather than an extension keyed by
|
|
assetid: a shared credential is an event with a short life, not a thing the site
|
|
owns and inventories.
|
|
|
|
WHAT THIS TABLE CAN AND CANNOT SEE. The AES key lives in the URL fragment, which
|
|
browsers never send to a server, so what is stored is ciphertext and an IV and
|
|
nothing else. Compromising this table yields no secrets. It also means the
|
|
server cannot inspect what it is holding - which is the right trade for a
|
|
credential, and the reason the SIZE limit in the routes carries the whole weight
|
|
of "this is not a document transfer".
|
|
"""
|
|
|
|
from datetime import datetime, timezone
|
|
|
|
from shopdb.api import db, BaseModel
|
|
|
|
|
|
def _utcnow():
|
|
return datetime.now(timezone.utc).replace(tzinfo=None)
|
|
|
|
|
|
class SecureSecret(BaseModel):
|
|
"""One shared secret: opaque id, ciphertext, and the rules for its life."""
|
|
|
|
__tablename__ = 'securesendsecrets'
|
|
|
|
secretid = db.Column(db.Integer, primary_key=True)
|
|
|
|
# The unguessable half of the link. With no login on the read side this IS
|
|
# the credential, so it is 128 bits of randomness rendered as hex - never a
|
|
# sequence, which would be enumerable by anyone who received one link.
|
|
token = db.Column(db.String(64), unique=True, nullable=False, index=True)
|
|
|
|
# Base64 of the AES-GCM ciphertext, and the IV it was sealed with. Opaque
|
|
# here by design.
|
|
ciphertext = db.Column(db.Text, nullable=False)
|
|
iv = db.Column(db.String(64), nullable=False)
|
|
|
|
# Both limits apply, whichever comes first.
|
|
expiresat = db.Column(db.DateTime, nullable=False, index=True)
|
|
viewsremaining = db.Column(db.Integer, nullable=False, default=1)
|
|
|
|
# Who created it. The reader is anonymous by design, so this is the only
|
|
# person the row can name - and the reason creation requires a login.
|
|
createdbyuserid = db.Column(
|
|
db.Integer,
|
|
db.ForeignKey('users.userid', ondelete='SET NULL'),
|
|
nullable=True,
|
|
index=True,
|
|
)
|
|
|
|
# Recorded for the audit trail; the content of what was read is not
|
|
# recoverable, but that it was read, and when, is.
|
|
lastviewedat = db.Column(db.DateTime, nullable=True)
|
|
viewcount = db.Column(db.Integer, nullable=False, default=0)
|
|
|
|
def is_expired(self, now=None):
|
|
return (now or _utcnow()) >= self.expiresat
|
|
|
|
def is_spent(self):
|
|
return self.viewsremaining <= 0
|
|
|
|
def to_dict(self):
|
|
"""NEVER includes the ciphertext.
|
|
|
|
This is the shape the CREATOR sees back - a receipt. Handing the payload
|
|
back on create would put the secret in a second place for no reason.
|
|
"""
|
|
return {
|
|
'token': self.token,
|
|
'expiresat': self.expiresat.isoformat() if self.expiresat else None,
|
|
'viewsremaining': self.viewsremaining,
|
|
'viewcount': self.viewcount,
|
|
'createddate': self.createddate.isoformat() if self.createddate else None,
|
|
}
|