NEC-152: A refresh reply lost to the network signs the vault out: no grace window for the rotated-out token #211

Merged

nectenda-agent merged 4 commits from worktree-nec-152-a-refresh-reply-lost-to-the-network-sign into main 2026-09-29 14:43:48 +01:00

Conversation 0 Commits 4 Files changed 10 +475 -19

nectenda-agent commented 2026-09-29 14:30:55 +01:00

Collaborator

Copy link

Task: NEC-152 — https://projectron.nerchure.com/tasks/160

A refresh whose reply is lost to the network no longer signs the vault out. For 10 minutes after a rotation (REFRESH_GRACE_SECONDS), the rotated-out token is answered with a new one when it comes from the session's own install id. So that a stolen token stays detectable, every displaced token hash is now kept for 30 days (RETIRED_REFRESH_TOKEN_DAYS, pruned hourly and when the session ends), and its return revokes the session. This also closes an older gap on main, where refreshing a stolen token twice pushed the owner out silently. The reuse log now dates a retired token's return correctly and marks it retired: true. Ride-along NEC-153: a sign-out with a pushed-out token now ends the session. Two fresh-context reviews shaped this; the retention and table design were the user's decisions.

Spec: docs/changes/NEC-152-refresh-grace-window/spec.md

Also fixes NEC-153: Signing out with a refresh token two rotations back revokes nothing

Changelog

Losing the network in the middle of a sign-in refresh no longer signs your vault out.

Task: NEC-152 — https://projectron.nerchure.com/tasks/160 A refresh whose reply is lost to the network no longer signs the vault out. For 10 minutes after a rotation (REFRESH_GRACE_SECONDS), the rotated-out token is answered with a new one when it comes from the session's own install id. So that a stolen token stays detectable, every displaced token hash is now kept for 30 days (RETIRED_REFRESH_TOKEN_DAYS, pruned hourly and when the session ends), and its return revokes the session. This also closes an older gap on main, where refreshing a stolen token twice pushed the owner out silently. The reuse log now dates a retired token's return correctly and marks it retired: true. Ride-along NEC-153: a sign-out with a pushed-out token now ends the session. Two fresh-context reviews shaped this; the retention and table design were the user's decisions. Spec: `docs/changes/NEC-152-refresh-grace-window/spec.md` Also fixes NEC-153: Signing out with a refresh token two rotations back revokes nothing ## Changelog Losing the network in the middle of a sign-in refresh no longer signs your vault out.

nectenda-agent added the

area:identity

label 2026-09-29 14:30:55 +01:00

nectenda-agent added 4 commits 2026-09-29 14:30:56 +01:00

Answer a refresh whose reply was lost, instead of signing the vault out ... 31db29c978

A rotated-out refresh token presented within ten minutes of its rotation,
from the session's own install id, is a reply lost to the network rather
than theft. It is now answered with a new token. The lost token moves
into the previous slot, and the window stays anchored to the rotation,
so a replay from elsewhere or after the window still revokes the session.

REFRESH_GRACE_SECONDS sets the window; 0 restores the old behaviour.

Task: NEC-152
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gj4XQjqZgapxUHWKa9Pk53

Remember displaced refresh tokens, so a thief refreshing twice cannot push the owner out ... e6c3965b0d

Review found that grace plus one ordinary refresh left the other holder's
token two rotations back, where it read as unknown: that holder was signed
out while the session lived on. The same was already true of a stolen
current token refreshed twice. Every token a rotation pushes out of the
previous slot is now kept, as a hash, in retired_refresh_tokens, and its
return revokes the session. Rows are pruned hourly after 30 days
(RETIRED_REFRESH_TOKEN_DAYS), or at once when their session is over.

Task: NEC-152
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gj4XQjqZgapxUHWKa9Pk53

Date a retired token's return from when it was pushed out ... ec6997f5d2

The reuse log line reported the gap from the session's latest rotation,
so a thief refreshing just before the owner came back made a weeks-old
token look like the harmless double-present. It now counts from when the
token left the previous slot, and says `retired: true`; the runbook reads
it accordingly.

Task: NEC-152
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gj4XQjqZgapxUHWKa9Pk53

Let a sign-out with a pushed-out refresh token end the session ... 42faac7252

`/auth/logout` matched only the current and previous tokens. Once a thief
had refreshed twice, the owner's sign-out answered 200 and revoked
nothing. It now also matches a retired token.

Task: NEC-152
Also-fixes: NEC-153
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gj4XQjqZgapxUHWKa9Pk53

cruelacid force-pushed worktree-nec-152-a-refresh-reply-lost-to-the-network-sign from 42faac7252 to f73afaa09d 2026-09-29 14:37:49 +01:00 Compare

nectenda-agent merged commit f73afaa09d into main 2026-09-29 14:43:48 +01:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:docs

docs/

  

area:identity

packages/identity

  

area:ops

deploy/, CI, hosting

  

area:plugin

packages/plugin

  

area:server

packages/server

  

channel:community

Obsidian forum, Obsidian Discord, Reddit

  

channel:direct

Cold outreach to named firms

  

channel:owned

nectenda.com pages, the feedback board

  

channel:press

Hacker News, newsletters, outlets, YouTube creators

  

channel:social

Bluesky, Mastodon, X, YouTube accounts

  

e2ee-constrained

End-to-end encryption changes the shape of the answer

  

gate:at-ga

Held until Gates A-C close and terms/privacy leave DRAFT

  

gate:pre-ga

Safe to do before the launch gates close

  

marketing

Reach and positioning; work published off nectenda.com

  

parity

Relay feature-parity programme

  

relay:absent

4 - Not supported, not requested, not planned at Relay

  

relay:planned

2 - On Relay's roadmap (Active/Planned) or has an open PR

  

relay:requested

3 - Asked for by Relay users or under 'Considering'; not committed

  

relay:supported

1 - Relay ships this today

  

risk:additive

New message type, table or column; backward compatible

  

risk:contract

Changes something existing accounts or stored data depend on

  

risk:none

Client-only; the server is untouched

  

usability

How the product is understood and learned, not what it does

No labels

area:docs

area:identity

area:ops

area:plugin

area:server

channel:community

channel:direct

channel:owned

channel:press

channel:social

e2ee-constrained

gate:at-ga

gate:pre-ga

marketing

parity

relay:absent

relay:planned

relay:requested

relay:supported

risk:additive

risk:contract

risk:none

usability

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Nectenda/nectenda!211

No description provided.