codex-bot
b157504ca6
waterfall-wiki CI and deployment / verify-and-deploy (pull_request) Failing after 3m15s
50 lines
3.2 KiB
Markdown
50 lines
3.2 KiB
Markdown
# Email accounts
|
|
|
|
`/account` offers registration, password login, email verification/resend, and logout.
|
|
`/api/account/session` returns the current account; other actions use same-origin POST.
|
|
Passwords require at least 12 characters and at most 256 UTF-8 bytes. Only verified
|
|
accounts can log in. Verification links expire after 30 minutes and are consumed once.
|
|
Session tokens expire after seven days; logout deletes the current token immediately.
|
|
Only token SHA-256 digests are stored. Passwords use individually salted scrypt.
|
|
|
|
## Runtime configuration
|
|
|
|
The existing production deployment reads `/etc/prompt.env` on ces-control. Set its
|
|
ownership to root and mode to 0600. The operator should update SMTP_PASSWORD there
|
|
through a secure remote session, without putting it in command arguments, repository,
|
|
CI output, release.env, or chat. Existing compose deployment reads this file without
|
|
copying credentials into the release directory. Do not run `docker compose config`
|
|
without `--quiet` against the production environment because interpolation shows secrets.
|
|
Docker administrators can inspect container environment; access to Docker is privileged.
|
|
|
|
Set ACCOUNT_PUBLIC_ORIGIN to the exact browser origin and SMTP_HOST=smtpdm.aliyun.com,
|
|
SMTP_PORT=465, SMTP_USERNAME and SMTP_FROM=noreply@notice.entroia.com. TLS certificate
|
|
validation stays enabled. Missing SMTP configuration returns a generic service failure;
|
|
resend with the registration password can recover an account whose initial delivery failed.
|
|
|
|
Keep AUTH_CONFIG_FILE configured for administrator access. Missing administrator
|
|
configuration fails closed. AUTH_DISABLED_FOR_TESTS is false by default and is enabled
|
|
only by the disposable legacy integration stack; never enable it in production.
|
|
Email account cookies never satisfy administrator authorization. With the current HTTP
|
|
acceptance origin use AUTH_COOKIE_SECURE=false; use true after enabling HTTPS.
|
|
|
|
Limits persist in PostgreSQL: 10 logins and 3 registration/resend attempts per email per
|
|
15 minutes, plus 300 requests per 15 minutes globally. ACCOUNT_TRUST_PROXY defaults
|
|
false. Enable it only when a trusted ingress overwrites x-forwarded-for; this changes
|
|
the global cap to 60 per trusted client address. Do not enable it on the direct public port.
|
|
Limits count failures and successes. Registration/resend always give the same success
|
|
response for existing/unknown emails, and login uses a dummy KDF for unknown accounts.
|
|
The rate limit itself can reveal recent activity for a known email; it does not reveal
|
|
whether an account exists. Synchronous SMTP latency can still expose a timing side channel;
|
|
a durable asynchronous mail queue would be needed to fully decouple delivery timing.
|
|
Logout remains available when login/mail limits are exhausted. No password recovery or
|
|
account deletion is included.
|
|
|
|
## Verification
|
|
|
|
ces-control runs crypto/origin tests, PostgreSQL verification-token replay races,
|
|
expired/revoked sessions, concurrent limit consumption and unverified login rejection.
|
|
Production-auth exercises verify that account cookies cannot authorize legacy writes.
|
|
Actual SMTP delivery and visual acceptance at http://8.211.154.134:18131/account require
|
|
operator runtime configuration and the normal manually approved deployment.
|