fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

gRPC Accounts: Provision from pre-derived SCRAM verifiers

Browse source 
Adds Accounts.Provision(name, scram256, scram512, email) so an external
authority that stores verifiers rather than passwords (a website) can bulk-
backfill accounts it never had the plaintext for. It creates the account
with the given SCRAM verifiers — SCRAM and keycard login work immediately;
typed-password login stays disabled (empty password_hash) until a real
password lands via Register/SetPassword. Refuses an existing account, so a
re-run can't clobber a fully-credentialed one. scram512 may be empty
(SCRAM-SHA-512 then falls back to 256).
This commit is contained in:
Jean Chevronnet 2026-07-14 03:33:17 +00:00
parent fba91b4d62
commit 3f8649414f
No known key found for this signature in database
4 changed files with 105 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
proto/fedserv.proto
View file

@ -96,6 +96,10 @@ message ChannelDescSet { string name = 1; string description = 2; }
// an IRC-originated one does — gossip doesn't know or care where it came from.
service Accounts {
rpc Register(RegisterRequest) returns (AccountReply);
// Create-or-update an account from pre-derived SCRAM verifiers instead of a
// plaintext password. For bulk backfill from an authority (e.g. a website)
// that stores verifiers, not passwords. scram512 may be empty.
rpc Provision(ProvisionRequest) returns (AccountReply);
rpc Authenticate(AuthenticateRequest) returns (AuthenticateReply);
rpc SetPassword(SetPasswordRequest) returns (AccountReply);
rpc SetEmail(SetEmailRequest) returns (AccountReply);
@ -121,6 +125,7 @@ message AccountReply {
}
message RegisterRequest { string name = 1; string password = 2; string email = 3; }
message ProvisionRequest { string name = 1; string scram256 = 2; string scram512 = 3; string email = 4; }
message AuthenticateRequest { string name = 1; string password = 2; }
message AuthenticateReply {