From e696d2f40636a6613eddfb1a3afdf87aa7ffdedd Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: auth: logging in by key

POST /auth/challenge and /auth/login/key: a node-signed challenge,
valid five minutes and taken once, signed with one of the user's SSH
keys (ssh-keygen -Y sign -n continuum-login), for a token.

Auth plan M7 (key login, M2b).
---
 src/state/mod.rs | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/state/mod.rs')

diff --git a/src/state/mod.rs b/src/state/mod.rs
index 7ee0acb..5a36faa 100644
--- a/src/state/mod.rs
+++ b/src/state/mod.rs
@@ -153,6 +153,8 @@ pub(crate) struct AppState {
     /// Received changes waiting for their dependencies, and those refused, while the
     /// policy has them judged (`access::screen`). Locked after the document.
     pub(crate) screening: Arc<std::sync::Mutex<crate::access::screen::Screening>>,
+    /// The challenges logins by key used, until they expire (`access::challenge`).
+    pub(crate) challenges: Arc<std::sync::Mutex<crate::access::challenge::Used>>,
     pub(crate) token_lifetime: Duration,
     pub(crate) session_lifetime: Duration,
     /// Origins whose pages may call this node's open endpoints (`api::cors`).
-- 
cgit v1.3.1