Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Revoke a paired phone, and log who connected

Abierto
  • ¿Algo no está bien?
#1,166 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
backend-api-design, desktop, security

Línea de trabajo

Start with docs/specs/remote-security-model.md, docs/specs/security.md, docs/specs/security-local.md, and docs/specs/security-remote.md, then trace BurrowAcl, BurrowService, BurrowRuntime, and the dor entry points named in the issue. The issue leaves the Relay revocation scope undecided and spans persisted ACL state, live sessions, interfaces, and auditing rules. Done means both Known gaps entries are removed, the guarantees table has revocation and access log rows with their pins, and the audited rules are documented.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement security

Two of the remote-control gaps on dormouse.sh/security are the ones a user of a paired phone feels first: nothing revokes a paired phone, and nothing records who connected. Both are about a user being able to see and control access to their own computer.

Revocation

Today BurrowAcl.revokeClient / revokePasskey have no callers and no relay frame carries a revocation, so revoking a phone means hand-editing Burrow state and restarting the Burrow (docs/specs/remote-security-model.md -> "Revocation propagation"). A lost or sold phone stays paired until the presence window lapses and, after that, until someone edits the ACL.

  • A Settings → Remote control list of paired phones (name, paired date, last seen), each with Revoke, on both Burrows (Standalone and VS Code).
  • Revoking takes effect on running sessions, not only on the next Burrow start: BurrowService currently hands BurrowRuntime one ACL snapshot for its whole lifetime.
  • A matching dor verb, so an agent or a script can list and revoke.
  • Whether the Relay pushing a revocation to a Burrow (from Pocket on another device, or from the Hosted account page) is in scope or a follow-up. The Burrow stays the only writer of its ACL.

Access log

The Burrow records approvals, and some rejections go to owner-local logs. Nothing answers "did anyone connect to my laptop last night" (docs/specs/security.md -> "Known gaps").

  • An owner-local, append-only, bounded log of connects, attaches, denials (with the specific ACL miss, which stays off the wire), pairings, revocations, and one-time sessions: which phone, when, the path (direct or relayed), and how long.
  • Visible beside the paired-phone list, and through dor.
  • No terminal content, ever. It sits under the same persisted-state boundary as the ACL (docs/specs/security-local.md -> "Persisted state").

Done means

Both Known gaps entries are gone from docs/specs/security.md, the guarantees table gains rows for revocation and the access log with their pins, and the audited rules land in docs/specs/security-remote.md.

Lenguaje dominante
TypeScript
Estrellas
5
Forks
1
Merge medio
10 h 51 min
PR fusionados (30 d)
507

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de diffplug/dormouse

Todos los issues de diffplug/dormouse

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.