Repository navigation
Conversation
openDB used to answer a revoked device with "does not have tenant access yet; the tenant admin must grant access first", the same as a device that was never granted. It now throws DeviceAccessRevokedError (with a wipeRequested flag) when the device's signing key is kept on the person's grant as a revoked pair or is targeted for remote wipe. isDeviceAccessRevokedError() also recognises it by its message prefix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
listCertifiedDevices answers which certified devices count now. Audit views (Haven's user list with its time travel) need every certificate with the trusted time it was accepted and, if the person withdrew it, when. listDeviceCertificates returns exactly that, unfiltered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Describe revoking and wiping a device in Manage user, available in every edition, what the wiped device does on its next connection, and what a revoked device shows, in all eight languages. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
getUserSigningKeyUniverse also returns the revoked keys (revoked pairs not active on any grant). AuthenticationService refuses them with USER_REVOKED and a "Device access revoked" message instead of "signing key is not yet in the tenant directory"; TenantManager passes the list through. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
Test results
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Karsten · project thread
Two SDK additions found while testing device self-grant end to end in Haven against a local server.
Changes
A revoked device is told that its access was revoked
openDBanswered a revoked device with "does not have tenant access yet; the tenant admin must grant access first", the same text a device gets before it was ever granted. Haven showed that on the Sync page of a revoked tablet.DeviceAccessRevokedError(exported withisDeviceAccessRevokedError()).wipeRequested.Device access revoked, so it is recognised after a network hop too.The sync server tells a revoked device the same
A device that was revoked but not wipe-targeted could not sign in, and the server answered "This device's signing key is not yet in the tenant directory on this server … After the administrator approved the join request, they must sync the directory …". That is the text for a new device whose join was not synced yet.
getUserSigningKeyUniverse()now also returnsrevoked: keys kept on a grant as revoked pairs (listed or certified devices) and not active on any grant. The field is optional in theMindooTenantDirectoryinterface.AuthenticationServicerefuses such a key withUSER_REVOKEDand a message starting withDevice access revoked, both when issuing the challenge and inauthenticate.TenantManagerdirectory wrapper passesrevokedthrough.directory.listDeviceCertificates()listCertifiedDevices(hash)answers which certified devices count now. Haven's user list has time travel and needs every certificate with the trusted time it was accepted and, if the person withdrew it, when. The new method returns that, unfiltered:Whether a certificate is valid at
Tis still decided byresolveSignerToGrant.Docs
docs/accesscontrol.md§6.5: what a revoked device sees (including the server refusal), and how apps apply a wipe (checkAndApplyRemoteWipe/wipeLocalTenant(dbIds)).docs/userkeys.md§9:listDeviceCertificatesin the API table.Haven side: klehmann/mindoodb-haven (PR linked below). It works with the published 0.0.95 and uses both additions once they are released.
Test plan
RemoteWipe.test.ts, 15 tests:DeviceAccessRevokedErrorwithwipeRequested.DeviceCertificates.test.ts, 5 tests:DeviceAccessRevokedErrorand is listed inrevokedof the key universe.listDeviceCertificateslists a revoked device's certificate, and a withdrawn certificate withdeletedAt.npx tscnpm test: see the comment below for the result.🤖 Generated with Claude Code