stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Make access revocation atomic across passkeys and sessions #501

New Issue
Closed
opened 2026-08-10 17:19:27 +00:00 by timmy · 0 comments
timmy commented 2026-08-10 17:19:27 +00:00
Owner
Copy Link

Evidence

Global sign-out currently calls PasskeyStore.revoke_all() and dashboard_auth.revoke_all_sessions() as separate transactions. A failure in the second operation can delete passkeys while leaving active sessions authorized. Selective device revocation similarly performs credential and session changes separately even though both tables share the session database. No historical issue or recent commit makes the combined operation transactional.

User impact

Lost-device and account-lockdown actions must either revoke the selected access completely or leave it intact for a safe retry. Partial revocation gives operators an error while creating an unexpected and potentially unsafe credential state.

Acceptance criteria

  • Global sign-out removes passkeys, passkey challenges, step-up grants, and active sessions in one SQLite transaction.
  • A database failure rolls back every global revocation change and returns a sanitized 503.
  • Selective device revocation removes the targeted active session, its step-up grants, and any linked passkey in one transaction while preserving unrelated devices.
  • A selective revocation failure rolls back all targeted changes.
  • Behavioral tests prove rollback and successful isolation.
  • Existing security-event reservation/finalization semantics remain truthful.
## Evidence Global sign-out currently calls `PasskeyStore.revoke_all()` and `dashboard_auth.revoke_all_sessions()` as separate transactions. A failure in the second operation can delete passkeys while leaving active sessions authorized. Selective device revocation similarly performs credential and session changes separately even though both tables share the session database. No historical issue or recent commit makes the combined operation transactional. ## User impact Lost-device and account-lockdown actions must either revoke the selected access completely or leave it intact for a safe retry. Partial revocation gives operators an error while creating an unexpected and potentially unsafe credential state. ## Acceptance criteria - Global sign-out removes passkeys, passkey challenges, step-up grants, and active sessions in one SQLite transaction. - A database failure rolls back every global revocation change and returns a sanitized 503. - Selective device revocation removes the targeted active session, its step-up grants, and any linked passkey in one transaction while preserving unrelated devices. - A selective revocation failure rolls back all targeted changes. - Behavioral tests prove rollback and successful isolation. - Existing security-event reservation/finalization semantics remain truthful.
timmy self-assigned this 2026-08-10 17:19:27 +00:00
timmy closed this issue 2026-08-10 17:27:02 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#501
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?