{"header":{"message":"Bind the /login/ssh signature to a server-issued challenge","description":"The signed payload was the bare hostname — a constant. A signature over it was therefore a permanent credential: anyone who ever obtained one (a reverse-proxy log, a stray .sig file, a compromised client) could mint fresh 24h tokens forever, and neither the token TTL nor token_not_before helped, since the attacker could simply re-mint. Host-binding meant a signature was useless against a different Nest, but against this one it never expired.\n\nGET /login/ssh/challenge now issues nonce(16) || iat(8) || HMAC(subkey, ...), and the client signs host\\nchallenge. The challenge is stateless until it is spent, so the endpoint stays a cheap unauthenticated rand + HMAC; used_login_nonces then makes it single-use, pruned by TTL so it holds only the last two minutes of logins. Across several API instances a challenge could be spent once per instance, but the MAC and issued-at still cap any replay at 120s.\n\nThe challenge is spent before the signature is verified, so a failed attempt cannot leave a replayable challenge behind.\n\nThis changes the wire format: any other client of POST /login/ssh must now fetch a challenge and send it alongside the signature.","timestamp":"2026-09-24T17:33:09.16107685Z","authors":[{}]},"hash":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC","authors":[{"login":"pmeunier","key":"AAAAC3NzaC1lZDI1NTE5AAAAILagOJFgwaMNhBWQINinKOXmqS4Gh5NgxgriXwdOoINJ"}],"deps":{"hashes":[["W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC","Bind the /login/ssh signature to a server-issued challenge"],["AA",null],["HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC","Missing files"],["KYWMDDGZTYQVRUO5QIXPLEPMW6JG5EDR2GO523XIPQZCB5B6577AC","Zulip mentions in notifications"],["F6ZE3DZWOS23KKQPBWHX3SYNZ3R6HAUXFMRA2G3RWTKNV3IFEZVQC","amphion M0: split nest into nest_core lib + thin bin, add 9 extension seams"],["43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC","Let API clients authenticate with the /login/ssh bearer token"],["3UYOLOBPKKDEBN4VX4GZT2KXVH3WJF3SBTWZADD2SQW4463KDKBAC","Rollback failed CI/CD jobs, and allow CI-only channels"],["FH4M4ZUWFB2GK3RAFVM4O7M35KOPW723QMK5NYS4753CYSWJRYHQC","amphion M0 follow-up: route HTTP Perm checks through Authorizer seam, emit DiscussionCreated/Login events, dedup serve() state; drop editor/build cruft"],["D4SBRY6KHEAMGUEVWSUYHNCRYXCOC5JJ3N3DQ47ZXOXQGT73VERAC","Initial patch"],["J7PGV42W2HVWCRSD7OUGYICUO2CQQ2GF4S2BZHPCLRYR7SIMZB2QC","mod db in lib.rs"]],"deps":["HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC","KYWMDDGZTYQVRUO5QIXPLEPMW6JG5EDR2GO523XIPQZCB5B6577AC","F6ZE3DZWOS23KKQPBWHX3SYNZ3R6HAUXFMRA2G3RWTKNV3IFEZVQC","43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC"],"known":["3UYOLOBPKKDEBN4VX4GZT2KXVH3WJF3SBTWZADD2SQW4463KDKBAC","FH4M4ZUWFB2GK3RAFVM4O7M35KOPW723QMK5NYS4753CYSWJRYHQC"]},"hunks":[{"Replacement":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":3,"ins":{"up_context":[{"change":2,"pos":121}],"down_context":[{"change":2,"pos":358}],"flag":"BLOCK","start":0,"end":240,"inode":{"change":2,"pos":37}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":121},"to":{"change":2,"start":121,"end":358},"introduced_by":2}],"inode":{"change":2,"pos":37}},"ins_contents":[{"Add":{"text":"//! A client asks `GET /login/ssh/challenge` for a fresh, server-issued nonce,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:78"}},{"Add":{"text":"//! signs it together with this host (SSHSIG, namespace `pijul-http-login`), and","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:159"}},{"Add":{"text":"//! posts the pair to `/login/ssh`. In return it gets a stateless bearer token:","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:239"}}],"del_contents":[{"Del":{"text":"//! A client proves possession of one of its registered SSH login keys by","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:194"}},{"Del":{"text":"//! signing a canonical, host-bound payload (SSHSIG, namespace `pijul-http-login`)","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:277"}},{"Del":{"text":"//! and posting it to `/login/ssh`. In return it gets a stateless bearer token:","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:357"}}]}},{"Edit":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":29,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":1197}],"down_context":[{"change":2,"pos":1197}],"flag":"BLOCK","start":241,"end":693,"inode":{"change":2,"pos":37}}},"contents":[{"Add":{"text":"/// How long a login challenge stays usable. Short: it only has to cover one","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:317"}},{"Add":{"text":"/// round-trip plus the client's signing, and it bounds both the replay window","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:396"}},{"Add":{"text":"/// and the size of the spent-nonce map.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:437"}},{"Add":{"text":"const CHALLENGE_TTL_SECS: u64 = 120;","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:474"}},{"Add":{"text":"const CHALLENGE_LEN: usize = 16 + 8 + 32;","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:516"}},{"Add":{"text":"/// Tolerance for a challenge that looks issued in the future — only clock skew","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:598"}},{"Add":{"text":"/// within this process's own view, so it can stay tight.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:656"}},{"Add":{"text":"const CHALLENGE_SKEW_SECS: u64 = 5;","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:692"}}]}},{"Edit":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":42,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":1338}],"down_context":[{"change":2,"pos":1338}],"flag":"BLOCK","start":694,"end":857,"inode":{"change":2,"pos":37}}},"contents":[{"Add":{"text":" /// The challenge from `/login/ssh/challenge`, verbatim. It is part of the","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:772"}},{"Add":{"text":" /// signed payload, so it cannot be swapped for another.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:833"}},{"Add":{"text":" challenge: String,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:856"}}]}},{"Edit":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":71,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":2027}],"down_context":[{"change":2,"pos":2027}],"flag":"BLOCK","start":858,"end":2881,"inode":{"change":2,"pos":37}}},"contents":[{"Add":{"text":"}","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:859"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:860"}},{"Add":{"text":"// Domain-separated subkey for challenge MACs, so a challenge can never be","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:935"}},{"Add":{"text":"// mistaken for a token (or a cookie) and vice versa.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:989"}},{"Add":{"text":"fn challenge_key(config: &Config) -> Vec {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1036"}},{"Add":{"text":" hmac(&config.hmac_secret, b\"pijul-http-challenge-v1\")","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1094"}},{"Add":{"text":"}","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1096"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1097"}},{"Add":{"text":"/// The payload the client signs: this host, then the server's challenge.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1171"}},{"Add":{"text":"///","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1175"}},{"Add":{"text":"/// The host binds the signature to one Nest, so a signature collected by one","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1253"}},{"Add":{"text":"/// server is useless against another. The challenge binds it to one login","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1328"}},{"Add":{"text":"/// attempt: without it the payload would be a constant, and the signature would","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1409"}},{"Add":{"text":"/// be a password that never expires — anyone who ever obtained a copy (a proxy","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1491"}},{"Add":{"text":"/// log, a stray `.sig` file, a compromised client) could mint fresh tokens","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1567"}},{"Add":{"text":"/// forever. Neither component contains a newline, so the join is unambiguous.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1646"}},{"Add":{"text":"fn login_payload(host: &str, challenge: &str) -> Vec {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1705"}},{"Add":{"text":" format!(\"{host}\\n{challenge}\").into_bytes()","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1753"}},{"Add":{"text":"}","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1755"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1756"}},{"Add":{"text":"#[derive(Serialize)]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1777"}},{"Add":{"text":"pub struct ChallengeResponse {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1808"}},{"Add":{"text":" challenge: String,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1831"}},{"Add":{"text":" expires_in: u64,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1852"}},{"Add":{"text":"}","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1854"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1855"}},{"Add":{"text":"/// Issue a login challenge: `nonce(16) ‖ iat(8, big-endian) ‖ HMAC(subkey, …)`.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1942"}},{"Add":{"text":"///","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:1946"}},{"Add":{"text":"/// Stateless, like the token — the server keeps nothing until the challenge is","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2028"}},{"Add":{"text":"/// actually spent, so this endpoint stays a cheap unauthenticated `rand` + HMAC","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2109"}},{"Add":{"text":"/// and cannot be used to exhaust memory.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2151"}},{"Add":{"text":"pub async fn ssh_challenge(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2179"}},{"Add":{"text":" State(config): State,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2213"}},{"Add":{"text":") -> Result, crate::Error> {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2266"}},{"Add":{"text":" let mut nonce = [0u8; 16];","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2297"}},{"Add":{"text":" openssl::rand::rand_bytes(&mut nonce).map_err(|_| crate::Error::WrongSignature)?;","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2383"}},{"Add":{"text":" Ok(Json(ChallengeResponse {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2415"}},{"Add":{"text":" challenge: mint_challenge(&challenge_key(&config), nonce, now()),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2489"}},{"Add":{"text":" expires_in: CHALLENGE_TTL_SECS,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2529"}},{"Add":{"text":" }))","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2537"}},{"Add":{"text":"}","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2539"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2540"}},{"Add":{"text":"fn mint_challenge(key: &[u8], nonce: [u8; 16], iat: u64) -> String {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2609"}},{"Add":{"text":" let mut payload = Vec::with_capacity(24);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2655"}},{"Add":{"text":" payload.extend_from_slice(&nonce);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2694"}},{"Add":{"text":" payload.extend_from_slice(&iat.to_be_bytes());","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2745"}},{"Add":{"text":" let mut blob = payload.clone();","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2781"}},{"Add":{"text":" blob.extend_from_slice(&hmac(key, &payload));","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2831"}},{"Add":{"text":" data_encoding::BASE64URL_NOPAD.encode(&blob)","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2880"}}]}},{"Replacement":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":122,"ins":{"up_context":[{"change":2,"pos":2030}],"down_context":[{"change":2,"pos":2260}],"flag":"BLOCK","start":2882,"end":4886,"inode":{"change":2,"pos":37}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":2030},"to":{"change":2,"start":2030,"end":2260},"introduced_by":2}],"inode":{"change":2,"pos":37}},"ins_contents":[{"Add":{"text":"/// Verify a challenge and spend it. Fails if it wasn't issued here, has expired,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2963"}},{"Add":{"text":"/// or has already been used.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2993"}},{"Add":{"text":"///","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:2997"}},{"Add":{"text":"/// Single-use is enforced through `used_login_nonces`, which lives in this","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3073"}},{"Add":{"text":"/// process. Across several API instances a challenge could therefore be spent","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3152"}},{"Add":{"text":"/// once per instance inside its TTL; the MAC and the issued-at still cap any","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3230"}},{"Add":{"text":"/// replay at `CHALLENGE_TTL_SECS`, which is the property that matters.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3302"}},{"Add":{"text":"fn take_challenge(config: &Config, challenge: &str) -> Result<(), crate::Error> {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3384"}},{"Add":{"text":" take_challenge_at(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3407"}},{"Add":{"text":" &challenge_key(config),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3439"}},{"Add":{"text":" &config.used_login_nonces,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3474"}},{"Add":{"text":" challenge,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3493"}},{"Add":{"text":" now(),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3508"}},{"Add":{"text":" )","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3514"}},{"Add":{"text":"}","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3516"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3517"}},{"Add":{"text":"/// `take_challenge` with the clock and the spent-set injected, so the expiry and","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3599"}},{"Add":{"text":"/// replay rules are testable without a live `Config`.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3654"}},{"Add":{"text":"fn take_challenge_at(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3676"}},{"Add":{"text":" key: &[u8],","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3692"}},{"Add":{"text":" used: &dashmap::DashMap<[u8; 16], u64>,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3736"}},{"Add":{"text":" challenge: &str,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3757"}},{"Add":{"text":" now: u64,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3771"}},{"Add":{"text":") -> Result<(), crate::Error> {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3803"}},{"Add":{"text":" let raw = data_encoding::BASE64URL_NOPAD","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3848"}},{"Add":{"text":" .decode(challenge.as_bytes())","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3886"}},{"Add":{"text":" .map_err(|_| crate::Error::WrongSignature)?;","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3939"}},{"Add":{"text":" if raw.len() != CHALLENGE_LEN {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:3975"}},{"Add":{"text":" return Err(crate::Error::WrongSignature);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4025"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4031"}},{"Add":{"text":" let (payload, tag) = raw.split_at(24);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4074"}},{"Add":{"text":" if !openssl::memcmp::eq(&hmac(key, payload), tag) {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4130"}},{"Add":{"text":" return Err(crate::Error::WrongSignature);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4180"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4186"}},{"Add":{"text":" let iat = u64::from_be_bytes(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4220"}},{"Add":{"text":" payload[16..24]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4244"}},{"Add":{"text":" .try_into()","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4268"}},{"Add":{"text":" .map_err(|_| crate::Error::WrongSignature)?,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4325"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4332"}},{"Add":{"text":" if now.saturating_sub(iat) > CHALLENGE_TTL_SECS || iat.saturating_sub(now) > CHALLENGE_SKEW_SECS","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4433"}},{"Add":{"text":" {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4439"}},{"Add":{"text":" return Err(crate::Error::WrongSignature);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4489"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4495"}},{"Add":{"text":" let mut nonce = [0u8; 16];","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4526"}},{"Add":{"text":" nonce.copy_from_slice(&payload[..16]);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4569"}},{"Add":{"text":" // Drop what can no longer be presented, then claim this one. `insert`","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4644"}},{"Add":{"text":" // returning a previous value means someone already spent it.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4710"}},{"Add":{"text":" used.retain(|_, expiry| *expiry > now);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4754"}},{"Add":{"text":" if used.insert(nonce, iat + CHALLENGE_TTL_SECS).is_some() {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4818"}},{"Add":{"text":" return Err(crate::Error::WrongSignature);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4868"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4874"}},{"Add":{"text":" Ok(())","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4885"}}],"del_contents":[{"Del":{"text":"/// The payload the client signs: just this host, under a dedicated namespace.","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:2108"}},{"Del":{"text":"/// Over HTTPS there's nothing to replay, so no timestamp/nonce is needed here.","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:2188"}},{"Del":{"text":"fn login_payload(host: &str) -> Vec {","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:2230"}},{"Del":{"text":" host.as_bytes().to_vec()","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:2259"}}]}},{"Replacement":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":197,"ins":{"up_context":[{"change":2,"pos":3022}],"down_context":[{"change":2,"pos":3073}],"flag":"BLOCK","start":4887,"end":5097,"inode":{"change":2,"pos":37}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":3022},"to":{"change":2,"start":3022,"end":3073},"introduced_by":2}],"inode":{"change":2,"pos":37}},"ins_contents":[{"Add":{"text":" // Right ceremony, this host, this challenge, valid signature. The challenge","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:4967"}},{"Add":{"text":" // is spent first: a signature that doesn't verify must not leave a replayable","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5050"}},{"Add":{"text":" // challenge behind for the next attempt.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5096"}}],"del_contents":[{"Del":{"text":" // Right ceremony, this host, valid signature.","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:3072"}}]}},{"Edit":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":203,"atom":{"NewVertex":{"up_context":[{"change":2,"pos":3174}],"down_context":[{"change":2,"pos":3174}],"flag":"BLOCK","start":5098,"end":5144,"inode":{"change":2,"pos":37}}},"contents":[{"Add":{"text":" take_challenge(&config, &req.challenge)?;","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5143"}}]}},{"Replacement":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":205,"ins":{"up_context":[{"change":2,"pos":3189}],"down_context":[{"change":2,"pos":3235}],"flag":"BLOCK","start":5145,"end":5207,"inode":{"change":2,"pos":37}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":3189},"to":{"change":2,"start":3189,"end":3235},"introduced_by":2}],"inode":{"change":2,"pos":37}},"ins_contents":[{"Add":{"text":" .verify(&login_payload(&config.host, &req.challenge))","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5206"}}],"del_contents":[{"Del":{"text":" .verify(&login_payload(&config.host))","pos":"HY6KW56TNL5TWFPDQLZBDURE2DZSHKSBDKW53VQOR55DSEU7I7QQC:3234"}}]}},{"Edit":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":311,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":2530}],"down_context":[{"change":5,"pos":2530}],"flag":"BLOCK","start":5208,"end":5269,"inode":{"change":2,"pos":37}}},"contents":[{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5208"}},{"Add":{"text":" const KEY: &[u8] = b\"a challenge subkey, 32+ bytes ok\";","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5268"}}]}},{"Edit":{"inode":{"change":2,"pos":37},"path":"api/src/http_auth.rs","line":314,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":2531}],"down_context":[{"change":5,"pos":2531}],"flag":"BLOCK","start":5270,"end":8623,"inode":{"change":2,"pos":37}}},"contents":[{"Add":{"text":" fn spent() -> dashmap::DashMap<[u8; 16], u64> {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5321"}},{"Add":{"text":" dashmap::DashMap::new()","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5353"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5359"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5360"}},{"Add":{"text":" /// The happy path: a freshly minted challenge is accepted exactly once.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5437"}},{"Add":{"text":" #[test]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5449"}},{"Add":{"text":" fn challenge_is_single_use() {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5484"}},{"Add":{"text":" let used = spent();","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5512"}},{"Add":{"text":" let c = mint_challenge(KEY, [1u8; 16], 1000);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5566"}},{"Add":{"text":" assert!(take_challenge_at(KEY, &used, &c, 1000).is_ok());","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5632"}},{"Add":{"text":" assert!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5649"}},{"Add":{"text":" take_challenge_at(KEY, &used, &c, 1001).is_err(),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5711"}},{"Add":{"text":" \"a challenge must not be spendable twice\"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5765"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5776"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5782"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5783"}},{"Add":{"text":" /// The whole point of the change: a captured login must stop working. The","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5862"}},{"Add":{"text":" /// challenge expires on its own, independently of the spent-set.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5932"}},{"Add":{"text":" #[test]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5944"}},{"Add":{"text":" fn challenge_expires() {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:5973"}},{"Add":{"text":" let c = mint_challenge(KEY, [2u8; 16], 1000);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6027"}},{"Add":{"text":" assert!(take_challenge_at(KEY, &spent(), &c, 1000 + CHALLENGE_TTL_SECS).is_ok());","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6117"}},{"Add":{"text":" assert!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6134"}},{"Add":{"text":" take_challenge_at(KEY, &spent(), &c, 1000 + CHALLENGE_TTL_SECS + 1).is_err(),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6224"}},{"Add":{"text":" \"a challenge must not outlive its TTL\"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6275"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6286"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6292"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6293"}},{"Add":{"text":" /// A challenge dated in the future is a forged or replayed timestamp, not a","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6374"}},{"Add":{"text":" /// clock-skew artefact, past a small tolerance.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6427"}},{"Add":{"text":" #[test]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6439"}},{"Add":{"text":" fn challenge_rejects_future_issuance() {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6484"}},{"Add":{"text":" let c = mint_challenge(KEY, [3u8; 16], 1000);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6538"}},{"Add":{"text":" assert!(take_challenge_at(KEY, &spent(), &c, 1000 - CHALLENGE_SKEW_SECS).is_ok());","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6629"}},{"Add":{"text":" assert!(take_challenge_at(KEY, &spent(), &c, 1000 - CHALLENGE_SKEW_SECS - 1).is_err());","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6725"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6731"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6732"}},{"Add":{"text":" /// A client cannot mint its own challenges, nor flip a bit in one it was","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6810"}},{"Add":{"text":" /// given — both would defeat single-use.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6858"}},{"Add":{"text":" #[test]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6870"}},{"Add":{"text":" fn challenge_is_authenticated() {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6908"}},{"Add":{"text":" let c = mint_challenge(KEY, [4u8; 16], 1000);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6962"}},{"Add":{"text":" assert!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:6979"}},{"Add":{"text":" take_challenge_at(b\"a different subkey, also 32 byte\", &spent(), &c, 1000).is_err(),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7076"}},{"Add":{"text":" \"a challenge minted under another key must be rejected\"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7144"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7155"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7156"}},{"Add":{"text":" let mut raw = data_encoding::BASE64URL_NOPAD.decode(c.as_bytes()).unwrap();","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7240"}},{"Add":{"text":" raw[0] ^= 1; // flip a nonce bit, keep the MAC","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7295"}},{"Add":{"text":" let tampered = data_encoding::BASE64URL_NOPAD.encode(&raw);","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7363"}},{"Add":{"text":" assert!(take_challenge_at(KEY, &spent(), &tampered, 1000).is_err());","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7440"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7441"}},{"Add":{"text":" for junk in [\"\", \"not base64!!\", \"AAAA\"] {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7492"}},{"Add":{"text":" assert!(take_challenge_at(KEY, &spent(), junk, 1000).is_err());","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7568"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7578"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7584"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7585"}},{"Add":{"text":" /// The signed payload must commit to both the host and the challenge, so a","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7665"}},{"Add":{"text":" /// signature is useless on another Nest or for another login attempt.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7740"}},{"Add":{"text":" #[test]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7752"}},{"Add":{"text":" fn login_payload_binds_host_and_challenge() {","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7802"}},{"Add":{"text":" assert_ne!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7822"}},{"Add":{"text":" login_payload(\"a.example\", \"CHAL\"),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7870"}},{"Add":{"text":" login_payload(\"b.example\", \"CHAL\")","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7917"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7928"}},{"Add":{"text":" assert_ne!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7948"}},{"Add":{"text":" login_payload(\"a.example\", \"CHAL\"),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:7996"}},{"Add":{"text":" login_payload(\"a.example\", \"OTHER\")","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8044"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8055"}},{"Add":{"text":" // The `host\\nchallenge` join would be ambiguous if either field could","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8134"}},{"Add":{"text":" // contain the delimiter. `host` comes from the server's own config, and","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8215"}},{"Add":{"text":" // a challenge is only ever used after `take_challenge` has decoded it as","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8297"}},{"Add":{"text":" // base64url — which cannot yield a newline. Pin that second half here,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8379"}},{"Add":{"text":" // since it is the one an attacker controls.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8432"}},{"Add":{"text":" assert!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8449"}},{"Add":{"text":" take_challenge_at(KEY, &spent(), \"AAAA\\nBBBB\", 1000).is_err(),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8524"}},{"Add":{"text":" \"a challenge carrying the payload delimiter must never be accepted\"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8604"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8615"}},{"Add":{"text":" }","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8621"}},{"Add":{"text":"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8622"}}]}},{"Edit":{"inode":{"change":9,"pos":532759},"path":"api/src/config.rs","line":82,"atom":{"NewVertex":{"up_context":[{"change":3,"pos":5288}],"down_context":[{"change":4,"pos":40915}],"flag":"BLOCK","start":8624,"end":9056,"inode":{"change":9,"pos":532759}}},"contents":[{"Add":{"text":" /// Login challenges already spent, nonce → the unix time it stops mattering.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8707"}},{"Add":{"text":" /// The challenge itself is stateless (MAC + issued-at), so this map exists","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8787"}},{"Add":{"text":" /// only to make it single-use; entries older than the challenge TTL are","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8864"}},{"Add":{"text":" /// pruned on each login, which bounds it to the logins of the last two","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8940"}},{"Add":{"text":" /// minutes. See `http_auth::take_challenge`.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:8990"}},{"Add":{"text":" pub used_login_nonces: Arc>,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9055"}}]}},{"Edit":{"inode":{"change":9,"pos":532759},"path":"api/src/config.rs","line":247,"atom":{"NewVertex":{"up_context":[{"change":3,"pos":5432}],"down_context":[{"change":4,"pos":41101}],"flag":"BLOCK","start":9057,"end":9119,"inode":{"change":9,"pos":532759}}},"contents":[{"Add":{"text":" used_login_nonces: Arc::new(dashmap::DashMap::new()),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9118"}}]}},{"Edit":{"inode":{"change":10,"pos":31},"path":"api/src/lib.rs","line":224,"atom":{"NewVertex":{"up_context":[{"change":4,"pos":5596}],"down_context":[{"change":4,"pos":5596}],"flag":"BLOCK","start":9120,"end":9190,"inode":{"change":10,"pos":31}}},"contents":[{"Add":{"text":" .route(\"/login/ssh/challenge\", get(http_auth::ssh_challenge))","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9189"}}]}},{"Replacement":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":3,"ins":{"up_context":[{"change":5,"pos":4737}],"down_context":[{"change":5,"pos":4969}],"flag":"BLOCK","start":9191,"end":9423,"inode":{"change":5,"pos":4654}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":4737},"to":{"change":5,"start":4737,"end":4969},"introduced_by":5}],"inode":{"change":5,"pos":4654}},"ins_contents":[{"Add":{"text":"//! An API client (for instance `.claude/skills/nest-discussions`) signs","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9263"}},{"Add":{"text":"//! `host\\nchallenge`, strips the PEM armor `ssh-keygen` wraps the SSHSIG in,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9341"}},{"Add":{"text":"//! and sends the blob as unpadded base64. This test reproduces that exactly and","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9422"}}],"del_contents":[{"Del":{"text":"//! An API client (for instance `.claude/skills/nest-discussions`) signs the","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:4813"}},{"Del":{"text":"//! bare hostname, strips the PEM armor `ssh-keygen` wraps the SSHSIG in, and","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:4891"}},{"Del":{"text":"//! sends the blob as unpadded base64. This test reproduces that exactly and","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:4968"}}]}},{"Edit":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":11,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":5201}],"down_context":[{"change":5,"pos":5201}],"flag":"BLOCK","start":9424,"end":9474,"inode":{"change":5,"pos":4654}}},"contents":[{"Add":{"text":"const CHALLENGE: &str = \"cJ7xQ1s9TfWq0aBcDeFgHi\";","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9473"}}]}},{"Edit":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":44,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":6181}],"down_context":[{"change":5,"pos":6181}],"flag":"BLOCK","start":9475,"end":9524,"inode":{"change":5,"pos":4654}}},"contents":[{"Add":{"text":" let signed = format!(\"{HOST}\\n{CHALLENGE}\");","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9523"}}]}},{"Replacement":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":46,"ins":{"up_context":[{"change":5,"pos":6227}],"down_context":[{"change":5,"pos":6272}],"flag":"BLOCK","start":9525,"end":9573,"inode":{"change":5,"pos":4654}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":6227},"to":{"change":5,"start":6227,"end":6272},"introduced_by":5}],"inode":{"change":5,"pos":4654}},"ins_contents":[{"Add":{"text":" std::fs::write(&payload, &signed).unwrap();","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9572"}}],"del_contents":[{"Del":{"text":" std::fs::write(&payload, HOST).unwrap();","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:6271"}}]}},{"Replacement":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":68,"ins":{"up_context":[{"change":5,"pos":7135}],"down_context":[{"change":5,"pos":7252}],"flag":"BLOCK","start":9574,"end":9694,"inode":{"change":5,"pos":4654}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":7135},"to":{"change":5,"start":7135,"end":7252},"introduced_by":5}],"inode":{"change":5,"pos":4654}},"ins_contents":[{"Add":{"text":" sshsig.verify(signed.as_bytes()).expect(\"verify runs\"),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9637"}},{"Add":{"text":" \"signature must verify over `host\\\\nchallenge`\"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9693"}}],"del_contents":[{"Del":{"text":" sshsig.verify(HOST.as_bytes()).expect(\"verify runs\"),","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:7196"}},{"Del":{"text":" \"signature must verify over the bare hostname\"","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:7251"}}]}},{"Replacement":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":72,"ins":{"up_context":[{"change":5,"pos":7272}],"down_context":[{"change":5,"pos":7335}],"flag":"BLOCK","start":9695,"end":9816,"inode":{"change":5,"pos":4654}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":7272},"to":{"change":5,"start":7272,"end":7335},"introduced_by":5}],"inode":{"change":5,"pos":4654}},"ins_contents":[{"Add":{"text":" !sshsig","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9710"}},{"Add":{"text":" .verify(format!(\"other.example.org\\n{CHALLENGE}\").as_bytes())","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9784"}},{"Add":{"text":" .unwrap_or(false),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9815"}}],"del_contents":[{"Del":{"text":" !sshsig.verify(b\"other.example.org\").unwrap_or(false),","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:7334"}}]}},{"Edit":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":76,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":7390}],"down_context":[{"change":5,"pos":7390}],"flag":"BLOCK","start":9817,"end":10017,"inode":{"change":5,"pos":4654}}},"contents":[{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9823"}},{"Add":{"text":" assert!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9836"}},{"Add":{"text":" !sshsig","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9852"}},{"Add":{"text":" .verify(format!(\"{HOST}\\nsomeOtherChallenge\").as_bytes())","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9922"}},{"Add":{"text":" .unwrap_or(false),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:9953"}},{"Add":{"text":" \"a signature must not carry over to another challenge\"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10016"}}]}},{"Edit":{"inode":{"change":5,"pos":4654},"path":"api/tests/http_login_sig.rs","line":83,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":7397}],"down_context":[{"change":5,"pos":7397}],"flag":"BLOCK","start":10018,"end":10154,"inode":{"change":5,"pos":4654}}},"contents":[{"Add":{"text":" assert!(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10030"}},{"Add":{"text":" !sshsig.verify(HOST.as_bytes()).unwrap_or(false),","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10088"}},{"Add":{"text":" \"the pre-challenge payload must no longer verify\"","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10146"}},{"Add":{"text":" );","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10153"}}]}},{"Replacement":{"inode":{"change":5,"pos":13005},"path":".claude/skills/nest-discussions/scripts/nest.py","line":50,"ins":{"up_context":[{"change":5,"pos":14338}],"down_context":[{"change":5,"pos":14441}],"flag":"BLOCK","start":10156,"end":10256,"inode":{"change":5,"pos":13005}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":14338},"to":{"change":5,"start":14338,"end":14441},"introduced_by":5}],"inode":{"change":5,"pos":13005}},"ins_contents":[{"Add":{"text":"def sign(key_path, payload):","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10184"}},{"Add":{"text":" \"\"\"SSHSIG over `payload`, as `http_auth::login_payload` builds it.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10255"}}],"del_contents":[{"Del":{"text":"def sign(key_path, host):","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:14363"}},{"Del":{"text":" \"\"\"SSHSIG over the bare hostname, as `http_auth::login_payload` expects.","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:14440"}}]}},{"Replacement":{"inode":{"change":5,"pos":13005},"path":".claude/skills/nest-discussions/scripts/nest.py","line":60,"ins":{"up_context":[{"change":5,"pos":14815}],"down_context":[{"change":5,"pos":14862}],"flag":"BLOCK","start":10257,"end":10312,"inode":{"change":5,"pos":13005}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":14815},"to":{"change":5,"start":14815,"end":14862},"introduced_by":5}],"inode":{"change":5,"pos":13005}},"ins_contents":[{"Add":{"text":" f.write(payload)","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10281"}},{"Add":{"text":" payload_file = f.name","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10311"}}],"del_contents":[{"Del":{"text":" f.write(host)","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:14836"}},{"Del":{"text":" payload = f.name","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:14861"}}]}},{"Replacement":{"inode":{"change":5,"pos":13005},"path":".claude/skills/nest-discussions/scripts/nest.py","line":64,"ins":{"up_context":[{"change":5,"pos":14902}],"down_context":[{"change":5,"pos":14981}],"flag":"BLOCK","start":10313,"end":10397,"inode":{"change":5,"pos":13005}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":14902},"to":{"change":5,"start":14902,"end":14981},"introduced_by":5}],"inode":{"change":5,"pos":13005}},"ins_contents":[{"Add":{"text":" [\"ssh-keygen\", \"-Y\", \"sign\", \"-f\", key, \"-n\", NAMESPACE, payload_file],","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10396"}}],"del_contents":[{"Del":{"text":" [\"ssh-keygen\", \"-Y\", \"sign\", \"-f\", key, \"-n\", NAMESPACE, payload],","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:14980"}}]}},{"Replacement":{"inode":{"change":5,"pos":13005},"path":".claude/skills/nest-discussions/scripts/nest.py","line":70,"ins":{"up_context":[{"change":5,"pos":15149}],"down_context":[{"change":5,"pos":15210}],"flag":"BLOCK","start":10398,"end":10464,"inode":{"change":5,"pos":13005}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":15149},"to":{"change":5,"start":15149,"end":15210},"introduced_by":5}],"inode":{"change":5,"pos":13005}},"ins_contents":[{"Add":{"text":" armored = pathlib.Path(payload_file + \".sig\").read_text()","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10463"}}],"del_contents":[{"Del":{"text":" armored = pathlib.Path(payload + \".sig\").read_text()","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:15209"}}]}},{"Replacement":{"inode":{"change":5,"pos":13005},"path":".claude/skills/nest-discussions/scripts/nest.py","line":72,"ins":{"up_context":[{"change":5,"pos":15223}],"down_context":[{"change":5,"pos":15269}],"flag":"BLOCK","start":10465,"end":10521,"inode":{"change":5,"pos":13005}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":15223},"to":{"change":5,"start":15223,"end":15269},"introduced_by":5}],"inode":{"change":5,"pos":13005}},"ins_contents":[{"Add":{"text":" for p in (payload_file, payload_file + \".sig\"):","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10520"}}],"del_contents":[{"Del":{"text":" for p in (payload, payload + \".sig\"):","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:15268"}}]}},{"Edit":{"inode":{"change":5,"pos":13005},"path":".claude/skills/nest-discussions/scripts/nest.py","line":136,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":17701}],"down_context":[{"change":5,"pos":17701}],"flag":"BLOCK","start":10522,"end":10751,"inode":{"change":5,"pos":13005}}},"contents":[{"Add":{"text":" # Ask for a fresh challenge, then sign `host\\nchallenge`: the signature is","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10600"}},{"Add":{"text":" # good for this Nest and this login attempt only, so capturing it buys an","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10678"}},{"Add":{"text":" # attacker nothing once the challenge is spent or expired (~2 min).","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10750"}}]}},{"Replacement":{"inode":{"change":5,"pos":13005},"path":".claude/skills/nest-discussions/scripts/nest.py","line":140,"ins":{"up_context":[{"change":5,"pos":17759}],"down_context":[{"change":5,"pos":17855}],"flag":"BLOCK","start":10752,"end":10975,"inode":{"change":5,"pos":13005}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":17759},"to":{"change":5,"start":17759,"end":17855},"introduced_by":5}],"inode":{"change":5,"pos":13005}},"ins_contents":[{"Add":{"text":" challenge = request(base_url, \"/login/ssh/challenge\")[\"challenge\"]","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10822"}},{"Add":{"text":" sig = sign(key_path, f\"{host}\\n{challenge}\")","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10871"}},{"Add":{"text":" resp = json_post(","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10893"}},{"Add":{"text":" base_url, \"/login/ssh\", {\"signature\": sig, \"challenge\": challenge}","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10968"}},{"Add":{"text":" )","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:10974"}}],"del_contents":[{"Del":{"text":" sig = sign(key_path, host)","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:17789"}},{"Del":{"text":" resp = json_post(base_url, \"/login/ssh\", {\"signature\": sig})","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:17854"}}]}},{"Replacement":{"inode":{"change":5,"pos":7514},"path":".claude/skills/nest-discussions/SKILL.md","line":19,"ins":{"up_context":[{"change":5,"pos":8348}],"down_context":[{"change":5,"pos":8628}],"flag":"BLOCK","start":10976,"end":11438,"inode":{"change":5,"pos":7514}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":8348},"to":{"change":5,"start":8348,"end":8628},"introduced_by":5}],"inode":{"change":5,"pos":7514}},"ins_contents":[{"Add":{"text":"Auth is an SSH login key — the same key `pijul` pushes with. The script fetches","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:11057"}},{"Add":{"text":"a challenge from `GET /login/ssh/challenge`, signs `host\\nchallenge` (SSHSIG,","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:11135"}},{"Add":{"text":"namespace `pijul-http-login`), trades that for a 24h bearer token at","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:11204"}},{"Add":{"text":"`POST /login/ssh`, and caches the token under `$XDG_CACHE_HOME/nest-discussions/`.","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:11287"}},{"Add":{"text":"The signature is good for one login attempt on one host and expires in about two","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:11368"}},{"Add":{"text":"minutes, so it is not a reusable credential. Defaults: `NEST_URL` or","pos":"W4M7OD5UD6COJF2LLDNXI73RHSBTFDTUEVIUVA2W5EI6XSF6MBDAC:11437"}}],"del_contents":[{"Del":{"text":"Auth is an SSH login key — the same key `pijul` pushes with. The script signs","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:8427"}},{"Del":{"text":"the hostname (SSHSIG, namespace `pijul-http-login`), trades the signature for a","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:8507"}},{"Del":{"text":"24h bearer token at `POST /login/ssh`, and caches it under","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:8566"}},{"Del":{"text":"`$XDG_CACHE_HOME/nest-discussions/`. Defaults: `NEST_URL` or","pos":"43XFLKFCQVZW6A56NB2QT2P4Y5B54DJHNGOFESO3YBX7OB6GCEQAC:8627"}}]}}],"owner":"pijul","repo":"nest","login":null}

…

Dependencies

Change contents

Review