efiten and Claude Opus 5.5
9897d52cf6
feat(users): companion linking store (schema v6, device sessions, link challenges) ( #2174 )
...
Part 1 of 3 for #2173 (companion linking). This PR adds only the
`users.db` side: the schema and store methods the server (part 2) and
ingestor (part 3) build on. No route, no UI and no behaviour change for
a running server.
## Changes in this PR
- **Design spec** `docs/specs/2026-10-08-companion-linking-design.md`,
including the optional linked-only ingest.
- **Schema v6** (`internal/users/schema.go`):
- `sessions` gains `kind` (`'web'` or `'device'`), `label` and `scopes`
(`''` = full, for web sessions).
- `companion_links (pubkey PRIMARY KEY, user_id, name, linked_at)`,
cascading on user delete.
- `link_challenges`: single-use challenges bound to a user and a pubkey,
with an expiry.
- **Device sessions** (`sessions.go`): create a device session with a
label and scopes, list sessions with kind and label.
- **Challenges** (`challenges.go`): issue and consume a challenge
exactly once; consumed, expired, or bound to another user or pubkey all
fail.
- **Companion links** (`companions.go`): link, list, unlink. Linking a
pubkey that belongs to another user moves it and reports the previous
owner (transfer detection), so the server can audit and mail.
- **Janitor**: the existing janitor also prunes expired challenges
(`cmd/server/auth_service.go`, 3 lines).
## Upgrade note
The store migrates `users.db` to v6 on start. A binary that only knows
v5 refuses to open a v6 file (`users: database schema version 6 is newer
than this binary supports (5)`), so rolling back after this lands needs
the pre-upgrade `users.db` backup.
## Verification
- `internal/users`: new tests for the v6 migration from v5, device
sessions, challenges (single use, expiry, binding) and companion links
(transfer, cascade on user delete). `go vet` and `go test ./...` green.
- `cmd/server` full suite green against the v6 store.
## Not in this PR
- Routes, bearer auth and the link handshake: part 2.
- Ingestor filter, account page and "My coverage": part 3.
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com >
2026-10-10 18:08:51 +02:00
..
2026-04-21 09:09:39 -07:00
2026-10-08 22:16:49 +02:00
2026-10-08 22:16:49 +02:00
2026-10-07 09:25:29 +02:00
2026-10-07 09:25:29 +02:00
2026-10-08 21:38:30 +02:00
2026-10-08 21:38:30 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 21:38:30 +02:00
2026-10-08 21:38:30 +02:00
2026-10-08 21:38:30 +02:00
2026-10-03 12:16:55 +02:00
2026-04-03 13:51:13 -07:00
2026-10-03 12:16:55 +02:00
2026-10-03 12:16:55 +02:00
2026-10-03 12:16:55 +02:00
2026-10-03 12:16:55 +02:00
2026-09-22 07:55:37 +02:00
2026-05-21 14:00:15 -07:00
2026-09-22 07:55:37 +02:00
2026-09-13 19:59:37 +02:00
2026-09-13 19:59:37 +02:00
2026-09-04 16:02:59 +02:00
2026-09-03 18:52:03 +02:00
2026-10-07 09:25:29 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 21:38:30 +02:00
2026-10-07 09:25:29 +02:00
2026-10-08 21:38:30 +02:00
2026-10-10 18:08:51 +02:00
2026-10-08 21:38:30 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-07 09:25:29 +02:00
2026-10-07 11:20:44 +02:00
2026-10-08 22:16:49 +02:00
2026-10-10 18:08:51 +02:00
2026-10-07 09:25:29 +02:00
2026-10-07 11:20:44 +02:00
2026-05-03 17:56:42 -07:00
2026-05-03 17:56:42 -07:00
2026-10-08 16:26:10 +02:00
2026-09-16 09:02:13 +02:00
2026-05-18 22:51:23 -07:00
2026-05-18 22:51:23 -07:00
2026-05-18 22:51:23 -07:00
2026-06-27 22:03:05 -07:00
2026-06-04 03:21:26 -07:00
2026-09-03 18:52:03 +02:00
2026-10-09 19:58:42 +02:00
2026-10-09 19:58:42 +02:00
2026-06-04 13:14:09 +00:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-04-20 21:46:34 -07:00
2026-10-05 20:32:40 +02:00
2026-09-13 20:36:34 +02:00
2026-09-03 18:52:03 +02:00
2026-05-25 22:16:14 -07:00
2026-06-07 03:43:29 -07:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-09-03 18:52:03 +02:00
2026-10-03 12:16:55 +02:00
2026-06-03 13:58:04 -07:00
2026-06-06 22:45:05 -07:00
2026-09-02 09:50:18 +02:00
2026-09-03 18:52:03 +02:00
2026-09-02 09:50:18 +02:00
2026-05-18 12:27:44 -07:00
2026-09-03 18:52:03 +02:00
2026-09-13 19:59:37 +02:00
2026-05-21 14:00:15 -07:00
2026-05-21 11:39:49 -07:00
2026-05-21 11:39:49 -07:00
2026-05-21 11:39:49 -07:00
2026-09-03 18:52:03 +02:00
2026-10-08 15:56:42 +02:00
2026-06-06 22:45:05 -07:00
2026-10-08 21:51:42 +02:00
2026-05-30 13:22:41 -07:00
2026-05-30 13:22:41 -07:00
2026-05-30 13:22:41 -07:00
2026-06-19 11:37:16 -07:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-10-09 19:58:42 +02:00
2026-06-04 14:41:00 -07:00
2026-09-02 13:10:43 +00:00
2026-09-23 10:05:59 +02:00
2026-10-10 11:03:56 +02:00
2026-10-10 11:03:56 +02:00
2026-06-12 19:10:44 -07:00
2026-05-15 22:34:21 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-09-22 23:55:55 +02:00
2026-09-22 23:55:55 +02:00
2026-05-05 01:16:57 -07:00
2026-09-03 18:52:03 +02:00
2026-06-29 15:53:59 -07:00
2026-09-17 21:58:34 +02:00
2026-04-16 00:09:36 -07:00
2026-09-20 15:12:36 +02:00
2026-09-17 21:58:16 +02:00
2026-06-04 16:27:48 -07:00
2026-05-05 01:58:52 -07:00
2026-05-19 23:53:41 -07:00
2026-03-31 01:10:56 -07:00
2026-09-05 09:57:44 +02:00
2026-10-08 21:51:42 +02:00
2026-10-07 09:25:29 +02:00
2026-06-27 22:03:05 -07:00
2026-09-04 15:15:16 +02:00
2026-09-04 15:15:16 +02:00
2026-09-03 18:52:03 +02:00
2026-06-07 09:28:51 -07:00
2026-04-03 13:11:59 -07:00
2026-06-19 11:37:16 -07:00
2026-09-16 09:02:13 +02:00
2026-06-11 10:10:12 -07:00
2026-06-11 10:10:12 -07:00
2026-05-15 16:21:14 +00:00
2026-05-16 19:55:00 +00:00
2026-09-03 18:52:03 +02:00
2026-05-15 20:24:55 -07:00
2026-05-15 22:46:25 -07:00
2026-09-16 09:02:13 +02:00
2026-09-06 21:00:44 +02:00
2026-09-03 18:52:03 +02:00
2026-09-16 09:02:13 +02:00
2026-05-21 14:00:15 -07:00
2026-10-09 19:58:42 +02:00
2026-05-02 20:35:15 -07:00
2026-05-17 16:13:11 +00:00
2026-05-19 08:08:28 -07:00
2026-05-18 23:19:27 -07:00
2026-09-16 09:02:13 +02:00
2026-06-25 05:05:46 -07:00
2026-09-16 09:02:13 +02:00
2026-06-11 07:38:36 -07:00
2026-09-03 18:52:03 +02:00
2026-06-11 07:38:36 -07:00
2026-06-06 22:44:59 -07:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-10-07 09:25:29 +02:00
2026-10-07 09:25:29 +02:00
2026-10-07 09:25:29 +02:00
2026-09-03 18:52:03 +02:00
2026-09-16 09:02:13 +02:00
2026-09-16 09:02:13 +02:00
2026-09-02 10:27:48 +02:00
2026-06-30 15:16:31 -07:00
2026-06-12 08:11:02 -07:00
2026-09-02 10:27:48 +02:00
2026-10-08 15:58:07 +02:00
2026-09-16 09:02:13 +02:00
2026-05-03 08:56:09 -07:00
2026-05-21 14:00:15 -07:00
2026-09-16 09:02:13 +02:00
2026-09-03 18:52:03 +02:00
2026-04-02 23:45:03 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-05-29 02:42:21 -07:00
2026-05-29 02:42:21 -07:00
2026-05-29 02:42:21 -07:00
2026-05-29 02:42:21 -07:00
2026-05-16 10:14:44 -07:00
2026-09-02 11:07:18 +02:00
2026-09-03 18:52:03 +02:00
2026-09-16 09:02:13 +02:00
2026-09-13 19:59:56 +02:00
2026-09-16 09:02:13 +02:00
2026-05-19 23:53:41 -07:00
2026-10-10 11:03:56 +02:00
2026-10-10 11:03:56 +02:00
2026-09-03 18:52:03 +02:00
2026-09-13 21:09:51 +02:00
2026-09-22 07:55:37 +02:00
2026-09-22 07:55:37 +02:00
2026-09-13 19:59:56 +02:00
2026-09-13 19:59:56 +02:00
2026-09-16 09:02:13 +02:00
2026-06-09 03:23:48 -07:00
2026-10-08 16:26:15 +02:00
2026-09-16 09:02:13 +02:00
2026-10-09 21:20:34 +02:00
2026-10-09 21:20:34 +02:00
2026-06-19 11:37:16 -07:00
2026-06-19 11:37:16 -07:00
2026-09-23 09:45:18 +02:00
2026-05-18 09:22:27 -07:00
2026-09-03 18:52:03 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-10-08 22:02:39 +02:00
2026-04-03 13:33:26 -07:00
2026-09-22 11:08:17 +02:00
2026-09-03 18:52:03 +02:00
2026-09-02 11:07:08 +02:00
2026-09-03 18:52:03 +02:00
2026-09-02 09:50:26 +02:00
2026-05-29 01:08:12 -07:00
2026-05-29 01:08:12 -07:00
2026-05-29 02:42:21 -07:00
2026-05-29 02:42:21 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-10-10 17:39:33 +02:00
2026-07-07 00:12:44 -07:00
2026-09-03 18:52:03 +02:00
2026-10-10 17:39:33 +02:00
2026-09-02 18:34:59 +02:00
2026-05-17 16:13:11 +00:00
2026-05-25 22:32:00 -07:00
2026-06-04 23:48:47 -07:00
2026-10-05 20:32:40 +02:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-05-15 22:46:28 -07:00
2026-09-02 09:50:09 +02:00
2026-09-03 18:52:03 +02:00
2026-10-08 14:34:31 +02:00
2026-10-08 14:34:31 +02:00
2026-10-08 14:34:31 +02:00
2026-09-02 14:34:20 +02:00
2026-10-08 14:34:31 +02:00
2026-10-09 19:58:42 +02:00
2026-10-10 10:58:33 +02:00
2026-09-30 11:39:25 +02:00
2026-10-09 19:58:42 +02:00
2026-09-30 11:39:25 +02:00
2026-09-30 11:39:25 +02:00
2026-09-30 11:39:25 +02:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-05-08 16:29:23 -07:00
2026-05-08 16:29:23 -07:00
2026-06-07 09:28:51 -07:00
2026-05-05 17:56:56 -07:00
2026-09-16 09:02:13 +02:00
2026-04-01 19:26:11 -07:00
2026-06-06 22:45:05 -07:00
2026-05-15 09:16:39 -07:00
2026-09-16 09:02:13 +02:00
2026-10-08 21:51:42 +02:00
2026-10-08 21:51:42 +02:00
2026-10-08 21:51:42 +02:00
2026-10-07 09:25:29 +02:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-05-03 19:50:01 -07:00
2026-10-05 23:42:07 +02:00
2026-10-05 23:42:07 +02:00
2026-10-03 12:16:55 +02:00
2026-06-22 10:07:49 -07:00
2026-10-03 12:16:55 +02:00
2026-05-21 11:39:43 -07:00
2026-05-20 20:57:02 -07:00
2026-09-03 18:52:03 +02:00
2026-05-28 15:01:58 -07:00
2026-10-08 14:34:31 +02:00
2026-06-06 20:46:42 -07:00
2026-06-06 20:46:42 -07:00
2026-07-08 15:13:39 -07:00
2026-09-02 18:34:59 +02:00
2026-09-06 21:00:44 +02:00
2026-05-20 20:57:02 -07:00
2026-10-08 14:34:31 +02:00
2026-10-07 09:25:29 +02:00
2026-05-15 16:21:14 +00:00
2026-05-15 09:16:39 -07:00
2026-09-03 18:52:03 +02:00
2026-09-03 18:52:03 +02:00
2026-09-16 09:02:13 +02:00
2026-10-10 10:58:33 +02:00
2026-10-09 19:58:42 +02:00
2026-09-13 20:37:14 +02:00
2026-09-13 20:37:14 +02:00
2026-10-04 22:11:34 +02:00
2026-10-04 22:11:34 +02:00
2026-05-18 07:36:28 -07:00
2026-05-03 17:56:12 -07:00
2026-09-03 18:52:03 +02:00
2026-09-04 16:02:59 +02:00
2026-10-10 10:58:33 +02:00
2026-09-03 18:52:03 +02:00
2026-06-19 11:37:16 -07:00
2026-10-10 17:39:33 +02:00
2026-10-10 17:39:33 +02:00
2026-10-04 17:15:50 +02:00
2026-10-10 17:39:33 +02:00
2026-06-19 11:37:16 -07:00
2026-10-10 17:39:33 +02:00
2026-05-15 16:21:14 +00:00
2026-09-19 11:44:47 +02:00
2026-09-19 11:44:47 +02:00
2026-09-11 15:07:31 +02:00
2026-09-11 15:07:31 +02:00
2026-09-19 11:44:47 +02:00
2026-09-09 17:58:09 +02:00
2026-09-10 22:30:24 +02:00
2026-10-07 11:20:44 +02:00
2026-10-07 11:20:44 +02:00
2026-10-07 11:20:44 +02:00
2026-10-07 11:20:44 +02:00
2026-05-03 17:40:54 -07:00
2026-06-03 13:58:04 -07:00
2026-06-30 18:21:21 -07:00
2026-04-20 23:10:33 -07:00
2026-10-09 19:58:42 +02:00
2026-10-09 19:58:42 +02:00
2026-10-09 19:58:42 +02:00
2026-04-21 09:09:39 -07:00
2026-10-09 19:58:42 +02:00
2026-05-29 02:42:21 -07:00
2026-06-06 21:59:23 -07:00
2026-05-03 17:41:22 -07:00
2026-05-03 17:41:22 -07:00
2026-09-16 09:02:13 +02:00
2026-09-17 21:58:16 +02:00
2026-06-27 22:03:05 -07:00
2026-09-02 18:34:59 +02:00
2026-10-08 22:02:39 +02:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-06-27 22:03:05 -07:00
2026-10-08 22:16:49 +02:00
2026-10-08 22:16:49 +02:00
2026-10-08 22:16:49 +02:00
2026-10-08 22:16:49 +02:00
2026-10-08 22:16:49 +02:00
2026-06-29 05:48:58 -07:00
2026-09-13 19:59:18 +02:00
2026-09-13 19:59:18 +02:00
2026-09-06 21:11:29 +02:00
2026-09-06 21:11:29 +02:00
2026-09-02 14:21:42 +02:00