coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile recovery by support reference and bound provider lookup
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m4s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 21:11:03 +02:00
parent cb51584f58
commit d15f4dde0b
4 changed files with 43 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/recovery_service.py
View file

@ -4,7 +4,7 @@ import hashlib
import hmac
import json
import time
from factor_recovery import ProviderStore, RecoveryError, recover
from factor_recovery import ProviderStore, RecoveryError, recover, fingerprint
def authorized_actor(claims, now=None):
@ -64,6 +64,27 @@ class RecoveryService:
preview['confirmation'] = self.ticket(dict(request, expected_version=preview['version']))
factors.append(preview)
return dict(success=True, status='preview', user=user, reference=reference, factors=factors)
if body.get('action') == 'status':
import re
reference = body.get('reference', '')
if not isinstance(reference,str) or not re.fullmatch(r'[A-Za-z0-9_.@:/-]{1,150}',reference):
raise RecoveryError('invalid_request')
row = self.store.receipt(reference)
if row is None:
return dict(success=True,status='not_found',reference=reference)
current = self.store.snapshot(row['user'],row['serial'])
if current is None or fingerprint(dict(current,active=True)) != row['version']:
raise RecoveryError('factor_changed_after_recovery')
result = dict(success=True,status='pending',reference=reference,user=row['user'],
serial=row['serial'],active=current['active'],actor=row['actor'])
if row['complete']:
if current['active']:
raise RecoveryError('factor_changed_after_recovery')
result.update(status='recovered',replayed=True,changes_applied=False)
elif row['actor'] == actor:
result['confirmation'] = self.ticket(dict(user=row['user'],serial=row['serial'],
realm=row['realm'],actor=actor,reference=reference,expected_version=row['version']))
return result
if body.get('action') == 'apply':
if body.get('identity_verified') is not True:
raise RecoveryError('identity_verification_required')