Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Revoke a paired phone, and log who connected

Offen
  • Stimmt etwas nicht?
#1,166 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
25/100
Issue-Typ
Feature
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
typescript
Bereich
backend-api-design, desktop, security

Rechercherichtung

Start with docs/specs/remote-security-model.md, docs/specs/security.md, docs/specs/security-local.md, and docs/specs/security-remote.md, then trace BurrowAcl, BurrowService, BurrowRuntime, and the dor entry points named in the issue. The issue leaves the Relay revocation scope undecided and spans persisted ACL state, live sessions, interfaces, and auditing rules. Done means both Known gaps entries are removed, the guarantees table has revocation and access log rows with their pins, and the audited rules are documented.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

enhancement security

Two of the remote-control gaps on dormouse.sh/security are the ones a user of a paired phone feels first: nothing revokes a paired phone, and nothing records who connected. Both are about a user being able to see and control access to their own computer.

Revocation

Today BurrowAcl.revokeClient / revokePasskey have no callers and no relay frame carries a revocation, so revoking a phone means hand-editing Burrow state and restarting the Burrow (docs/specs/remote-security-model.md -> "Revocation propagation"). A lost or sold phone stays paired until the presence window lapses and, after that, until someone edits the ACL.

  • A Settings → Remote control list of paired phones (name, paired date, last seen), each with Revoke, on both Burrows (Standalone and VS Code).
  • Revoking takes effect on running sessions, not only on the next Burrow start: BurrowService currently hands BurrowRuntime one ACL snapshot for its whole lifetime.
  • A matching dor verb, so an agent or a script can list and revoke.
  • Whether the Relay pushing a revocation to a Burrow (from Pocket on another device, or from the Hosted account page) is in scope or a follow-up. The Burrow stays the only writer of its ACL.

Access log

The Burrow records approvals, and some rejections go to owner-local logs. Nothing answers "did anyone connect to my laptop last night" (docs/specs/security.md -> "Known gaps").

  • An owner-local, append-only, bounded log of connects, attaches, denials (with the specific ACL miss, which stays off the wire), pairings, revocations, and one-time sessions: which phone, when, the path (direct or relayed), and how long.
  • Visible beside the paired-phone list, and through dor.
  • No terminal content, ever. It sits under the same persisted-state boundary as the ACL (docs/specs/security-local.md -> "Persisted state").

Done means

Both Known gaps entries are gone from docs/specs/security.md, the guarantees table gains rows for revocation and the access log with their pins, and the audited rules land in docs/specs/security-remote.md.

Vorherrschende Sprache
TypeScript
Sterne
5
Forks
1
Ø Merge
10 Std. 51 Min.
Gemergte PRs (30 T.)
507

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus diffplug/dormouse

Alle Issues in diffplug/dormouse

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.