Christian Nennemann
0bdc222724
Phase 1 — Foundation: - Constant-time token comparison via subtle::ConstantTimeEq (Fix 11) - Structured error codes E001–E020 in new error_codes.rs (Fix 15) - Remove dead envelope.capnp code and related types (Fix 16) Phase 2 — Auth Hardening: - Registration collision check via has_user_record() (Fix 5) - Auth required on uploadHybridKey/fetchHybridKey RPCs (Fix 1) - Identity-token binding at registration and login (Fix 2) - Session token expiry with 24h TTL and background reaper (Fix 3) - Bounded pending logins with 5-minute timeout (Fix 4) Phase 3 — Resource Limits: - Rate limiting: 100 enqueues/60s per token (Fix 6) - Queue depth cap at 1000 + 7-day message TTL/GC (Fix 7) - Partial queue drain via limit param on fetch/fetchWait (Fix 8) Phase 4 — Crypto Fixes: - OPAQUE KSF switched from Identity to Argon2id (Fix 10) - Random AEAD nonce in hybrid KEM instead of HKDF-derived (Fix 12) - Zeroize secret fields in HybridKeypairBytes (Fix 13) - Encrypted client state files via QPCE format (Fix 9) Phase 5 — Protocol: - Commit fan-out to all existing members on invite (Fix 14) - Add member_identities() to GroupMember Breaking: existing OPAQUE registrations invalidated (Argon2 KSF). Schema: added auth to hybrid key ops, identityKey to OPAQUE finish RPCs, limit to fetch/fetchWait. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
1.3 KiB
TOML
52 lines
1.3 KiB
TOML
[package]
|
|
name = "quicnprotochat-server"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "Delivery Service and Authentication Service for quicnprotochat."
|
|
license = "MIT"
|
|
|
|
[[bin]]
|
|
name = "quicnprotochat-server"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
quicnprotochat-core = { path = "../quicnprotochat-core" }
|
|
quicnprotochat-proto = { path = "../quicnprotochat-proto" }
|
|
|
|
# Serialisation + RPC
|
|
capnp = { workspace = true }
|
|
capnp-rpc = { workspace = true }
|
|
|
|
# Async
|
|
tokio = { workspace = true }
|
|
tokio-util = { workspace = true }
|
|
futures = { workspace = true }
|
|
|
|
# Server utilities
|
|
dashmap = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
quinn = { workspace = true }
|
|
quinn-proto = { workspace = true }
|
|
rustls = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
|
|
# Crypto — OPAQUE PAKE
|
|
opaque-ke = { workspace = true }
|
|
rand = { workspace = true }
|
|
subtle = { workspace = true }
|
|
|
|
# Database
|
|
rusqlite = { workspace = true }
|
|
|
|
# Error handling
|
|
anyhow = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
bincode = { workspace = true }
|
|
serde = { workspace = true }
|
|
|
|
# CLI
|
|
clap = { workspace = true }
|
|
toml = { version = "0.8" }
|