capauth 0.3.11__tar.gz → 0.3.13__tar.gz

{capauth-0.3.11 → capauth-0.3.13}/.github/workflows/ci.yml

@@ -37,11 +37,16 @@ jobs:
       # `import skcapstone` succeeds without it while
       # `from skcapstone.coordination import Board` does not. --no-deps means we
       # have to name it ourselves.
+      # skcapstone requires Python 3.11+, capauth supports 3.10: on 3.10 the
+      # integration tests skip (pytest.importorskip); on 3.11+ the import is
+      # asserted here so those tests can never skip silently.
       - name: Install skcapstone (optional integration backbone) from source
+        if: matrix.python-version != '3.10'
         run: |
           pip install --no-deps --no-cache-dir \
             "skcapstone @ git+https://github.com/smilinTux/skcapstone" \
             "skcoord @ git+https://github.com/smilinTux/skcoord"
+          python -c "from skcapstone.scheduler_jobs import load_jobs_with_dropins"
       - name: Run tests with coverage
         run: python -m pytest tests/ -v --tb=short --cov=capauth --cov-report=xml --cov-report=term-missing
       - name: Upload coverage

capauth-0.3.13/.github/workflows/image.yml

@@ -0,0 +1,90 @@
+name: Container image
+
+# Publishes the CapAuth service image (the OIDC IdP and verify service) for a
+# release tag as ghcr.io/smilintux/capauth:<version>, and records its digest.
+# Consumers pin <version>@sha256:<digest> (SKStacks sksso.CAPAUTH_IMAGE refuses
+# anything else). A published version is never overwritten.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to (re)build if its image is missing, e.g. v0.3.13"
+        required: true
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: image-${{ inputs.tag || github.ref }}
+  cancel-in-progress: false
+
+env:
+  IMAGE: ghcr.io/smilintux/capauth
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
+          fetch-tags: true
+      - name: Resolve the version and refuse a tag that is not on main
+        id: v
+        env:
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          case "$TAG" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "::error::not a release tag: $TAG"; exit 1 ;; esac
+          version="${TAG#v}"
+          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::not a release version: $version"; exit 1
+          fi
+          git fetch --no-tags origin main:refs/remotes/origin/main
+          sha="$(git rev-parse "refs/tags/$TAG^{commit}")"
+          git merge-base --is-ancestor "$sha" refs/remotes/origin/main || {
+            echo "::error::$TAG ($sha) is not on main"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+      - name: Log in to ghcr.io
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "$TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+      - name: Refuse to overwrite a published version
+        run: |
+          if docker manifest inspect "$IMAGE:${{ steps.v.outputs.version }}" >/dev/null 2>&1; then
+            echo "::error::$IMAGE:${{ steps.v.outputs.version }} already exists; versions are immutable"
+            exit 1
+          fi
+      - name: Build
+        run: |
+          docker build \
+            --build-arg CAPAUTH_VERSION="${{ steps.v.outputs.version }}" \
+            --label org.opencontainers.image.source="https://github.com/${{ github.repository }}" \
+            --label org.opencontainers.image.revision="${{ steps.v.outputs.sha }}" \
+            --label org.opencontainers.image.version="${{ steps.v.outputs.version }}" \
+            -t "$IMAGE:${{ steps.v.outputs.version }}" .
+      - name: Smoke test (version, service answers)
+        run: |
+          set -euo pipefail
+          v="${{ steps.v.outputs.version }}"
+          docker run --rm "$IMAGE:$v" capauth --version | tee /dev/stderr | grep -F "$v"
+          docker run -d --name smoke -p 18420:8420 "$IMAGE:$v"
+          for i in $(seq 1 30); do
+            curl -fsS http://127.0.0.1:18420/capauth/v1/status >/dev/null && break
+            sleep 2
+          done
+          curl -fsS http://127.0.0.1:18420/capauth/v1/status >/dev/null
+          docker rm -f smoke
+      - name: Push and record the digest
+        run: |
+          set -euo pipefail
+          v="${{ steps.v.outputs.version }}"
+          docker push "$IMAGE:$v"
+          ref="$(docker inspect --format '{{index .RepoDigests 0}}' "$IMAGE:$v")"
+          echo "Pinned reference: \`$IMAGE:$v@${ref#*@}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "pinned: $IMAGE:$v@${ref#*@}"

{capauth-0.3.11 → capauth-0.3.13}/CHANGELOG.md

@@ -6,6 +6,40 @@ All notable changes to `capauth` are documented here. The format is based on
 
 ## [Unreleased]
 
+- Release tags (`v*`) now also publish the service image
+  `ghcr.io/smilintux/capauth:<version>` (`.github/workflows/image.yml`): the
+  tag must be on main, a published version is never overwritten, the image is
+  smoke-tested (`capauth --version`, `/capauth/v1/status`) before the push,
+  and the job summary records the digest to pin (`<version>@sha256:...`).
+
+- `capauth sign-challenge`: reads the CapAuth login challenge from the
+  clipboard (or `--stdin`), refuses anything that is not a complete
+  `CAPAUTH_NONCE_V1`/`V2` challenge, signs it with gpg (gpg-agent's pinentry
+  asks for the passphrase; the tool never handles it) and puts the armored
+  signature back on the clipboard (or `--stdout`), printing only
+  `signed, paste it now`. Key: `--key`, `$CAPAUTH_SIGN_KEY`, or the profile.
+  The OIDC login page gains a "Paste signature and continue" button, names
+  the command in its steps and remembers the fingerprint of the last manual
+  login, so a repeat login is copy, sign, paste. Docs: `docs/SIGN_CHALLENGE.md`.
+
+- Service image builds from a plain checkout again: the Dockerfile takes
+  `--build-arg CAPAUTH_VERSION=<version>` (default `0.0.0+docker`) for
+  setuptools-scm, because `.dockerignore` keeps `.git` out of the context.
+
+- OIDC IdP: a static client may set `require_nonce: false` so stock
+  Authentik's OAuth source, which never sends an OIDC `nonce`, can use the
+  authorization code flow. State, PKCE S256 and the confidential client secret
+  stay mandatory; the default is unchanged (nonce required), and a nonce that
+  is sent must still be well formed.
+
+- CI: green on main again. `ruff format` (pinned 0.15.4) applied to
+  `tests/test_backup_fallback.py`; the Python 3.10 job no longer installs
+  skcapstone (it requires 3.11+), and the skcapstone integration tests skip
+  there while 3.11+ asserts the import so they cannot skip silently.
+
+- Raise operator proof absolute and idle ceilings to 24 hours while keeping
+  access capabilities bounded to five minutes (card `4af0ae7f`).
+
 - Normalize control-plane authorization decisions to the actual reconstructed
   token lifetime before exact owner-policy evaluation, while retaining the raw
   signed decision for replay and currentness receipts (card `9b0c6dce`).

{capauth-0.3.11 → capauth-0.3.13}/Dockerfile

@@ -16,6 +16,10 @@ COPY src/ ./src/
 # resolves these relative to the package root → /app/phone-signer.
 COPY phone-signer/ ./phone-signer/
 
+# The build context has no .git (.dockerignore), so setuptools-scm cannot
+# derive a version: pass one with --build-arg CAPAUTH_VERSION=<version>.
+ARG CAPAUTH_VERSION=0.0.0+docker
+ENV SETUPTOOLS_SCM_PRETEND_VERSION=${CAPAUTH_VERSION}
 RUN pip install --no-cache-dir -e ".[service]"
 RUN pip install --no-cache-dir python-multipart>=0.0.6
 

{capauth-0.3.11 → capauth-0.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capauth
-Version: 0.3.11
+Version: 0.3.13
 Summary: Capability-based Authentication — decentralized, PGP-based identity and authorization
 Author-email: smilinTux <admin@smilintux.org>
 License: GPL-3.0-or-later
@@ -254,6 +254,7 @@ capauth pqc-report                           # live PQC posture per surface
 
 # Auth & integration
 capauth login <service_url> [--no-claims]    # passwordless PGP login (caches OIDC token)
+capauth sign-challenge                        # sign the copied browser login challenge, paste the result
 capauth setup forgejo --capauth-url <url>    # generate Forgejo OIDC app.ini block
 
 # Mesh & membership
@@ -294,6 +295,7 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
 | **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
 | **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
+| **[Sign a login: copy, sign, paste](docs/SIGN_CHALLENGE.md)** | `capauth sign-challenge`: the four-step browser login with your gpg key, one-time setup, desktop shortcut |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters

{capauth-0.3.11 → capauth-0.3.13}/README.md

@@ -191,6 +191,7 @@ capauth pqc-report                           # live PQC posture per surface
 
 # Auth & integration
 capauth login <service_url> [--no-claims]    # passwordless PGP login (caches OIDC token)
+capauth sign-challenge                        # sign the copied browser login challenge, paste the result
 capauth setup forgejo --capauth-url <url>    # generate Forgejo OIDC app.ini block
 
 # Mesh & membership
@@ -231,6 +232,7 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
 | **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
 | **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
+| **[Sign a login: copy, sign, paste](docs/SIGN_CHALLENGE.md)** | `capauth sign-challenge`: the four-step browser login with your gpg key, one-time setup, desktop shortcut |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters

{capauth-0.3.11 → capauth-0.3.13}/docs/CAPAUTH_OIDC_IDP.md

@@ -175,10 +175,17 @@ Add an entry to your CapAuth client registry for Authentik:
   "client_secret": "<long-random-secret>",
   "redirect_uris": ["https://<authentik-host>/source/oauth/callback/capauth/"],
   "name": "Authentik",
-  "scopes": ["openid", "profile", "email", "groups"]
+  "scopes": ["openid", "profile", "email", "groups"],
+  "require_nonce": false
 }
 ```
 
+`require_nonce: false` is needed because Authentik's OAuth source never sends
+an OIDC `nonce` (checked against Authentik 2025.12). Without it `/oidc/authorize`
+answers `400 invalid_nonce`. The flow stays bound by `state`, PKCE S256 and the
+client secret. Set the source's **PKCE** field to **S256** (Authentik 2025.2+;
+older Authentik has no source PKCE and cannot use this IdP).
+
 > The redirect URI Authentik uses for an OAuth source is
 > `https://<authentik-host>/source/oauth/callback/<source-slug>/`. If you name
 > the source slug `capauth`, the URI is the one above. Confirm the exact value

capauth-0.3.13/docs/SIGN_CHALLENGE.md

@@ -0,0 +1,80 @@
+# Signing a CapAuth login: copy, sign, paste
+
+`capauth sign-challenge` is the simple way to log in with your PGP key when an
+application (for example skmesh, through Authentik) offers "Sign in with
+CapAuth". You never type a key, a fingerprint (after the first time) or a gpg
+command.
+
+## The four steps
+
+1. On the login page click **Sign in with CapAuth** (the button next to the
+   normal username and password form). You land on the CapAuth page; open
+   "Other sign-in and recovery options" if it is closed.
+2. Click **Copy message**. (The first time only: type your key's fingerprint
+   into the fingerprint box first. The page remembers it in this browser, so
+   next time the section is already open with a fresh message.)
+3. Run **`capauth sign-challenge`** in a terminal, or press your desktop
+   shortcut (below). gpg shows its own passphrase window; type the key's
+   passphrase there. The terminal prints `signed, paste it now`.
+4. Click **Paste signature and continue** (or paste into the box with Ctrl+V
+   and click Verify & Continue). You are logged in.
+
+The message you copy is only valid for a few minutes. If it expired, reload
+the page and start again at step 2.
+
+## What the command does, and what it does not
+
+- Reads the copied text from the clipboard (Wayland `wl-paste`, X11 `xclip`
+  or `xsel`, macOS `pbpaste`), or from stdin with `--stdin`.
+- Refuses anything that is not a complete CapAuth login challenge
+  (`CAPAUTH_NONCE_V1` or `CAPAUTH_NONCE_V2` with every field in order). It
+  never signs arbitrary clipboard text.
+- Signs with `gpg --armor --detach-sign --local-user <key>`. The passphrase
+  goes from you to gpg-agent's pinentry dialog; the command never sees,
+  stores or prints it.
+- Puts the ASCII-armored signature on the clipboard (or prints it with
+  `--stdout`) and prints only `signed, paste it now`.
+
+Which key: `--key <fingerprint>`, else `$CAPAUTH_SIGN_KEY`, else the key of
+your CapAuth profile (`capauth profile show`).
+
+## One-time setup
+
+1. Install capauth (`pip install capauth`) and a clipboard tool
+   (`sudo apt install wl-clipboard` on Wayland, `xclip` on X11).
+2. gpg must hold the private key. A CapAuth profile keeps it in
+   `<CapAuth home>/identity/private.asc` (home: `~/.skcapstone/capauth`, or
+   `capauth --home`). Import it once; gpg asks for its passphrase in the
+   pinentry window and keeps it protected with that passphrase:
+
+   ```bash
+   gpg --import ~/.skcapstone/capauth/identity/private.asc
+   ```
+
+   This is a second protected copy of the key (in `~/.gnupg`). If the key's
+   passphrase is ever changed, change it in gpg too (`gpg --edit-key <fp>`,
+   then `passwd`), or delete the gpg copy and import again.
+3. The key must be enrolled and approved in CapAuth and linked to your user
+   (the admin does the approval and the link; you send them your **public**
+   key: `capauth export-pubkey`).
+
+### Desktop shortcut
+
+Bind a keyboard shortcut (GNOME: Settings, Keyboard, Custom Shortcuts;
+Cinnamon and KDE have the same) to:
+
+```bash
+capauth sign-challenge
+```
+
+gpg-agent needs a graphical pinentry for this (`pinentry-gnome3` or
+`pinentry-qt`, the default on desktop installs). Then the flow is: Copy
+message, shortcut, passphrase window, Paste signature and continue.
+
+## Later upgrade: sign on the phone
+
+The CapAuth Bunker phone signer ([CAPAUTH_BUNKER_REMOTE_SIGNER.md](CAPAUTH_BUNKER_REMOTE_SIGNER.md))
+keeps the key on your phone and signs by scanning a QR code ("Sign from
+another device (QR)" on the same page). It needs the `/bunker/` routes and a
+relay configured on the server side, so it is a follow-up to this copy and
+paste flow.

{capauth-0.3.11 → capauth-0.3.13}/phone-signer/app.js

@@ -19,6 +19,28 @@ import { chunkPayload, parseKeyFrame, KeyFrameCollector } from "./lib/keyqr.js";
 const openpgp = globalThis.openpgp;
 const STORE_KEY = "capauth_bunker_envelope";
 const FP_KEY = "capauth_bunker_fp";
+const RETURN_KEY = "capauth_bunker_return";
+
+function safeSetupReturn() {
+  const raw = sessionStorage.getItem(RETURN_KEY) || "";
+  sessionStorage.removeItem(RETURN_KEY);
+  if (!raw || raw.length > 2048 || /[\u0000-\u001F\u007F]/.test(raw)) return "";
+  try {
+    const target = new URL(raw, location.origin);
+    if (
+      target.origin !== location.origin ||
+      target.username ||
+      target.password ||
+      target.hash ||
+      target.pathname !== "/oidc/authorize"
+    ) {
+      return "";
+    }
+    return target.pathname + target.search;
+  } catch {
+    return "";
+  }
+}
 
 const session = {
   armoredKey: null, // decrypted (from vault) armored key, in-memory only
@@ -117,6 +139,8 @@ async function storeKey() {
     $("vault-pass-confirm").value = "";
     setStatus($("key-status"), "Identity saved in this browser. Continue to passkey setup.", "ok");
     renderKeyState();
+    const returnTo = safeSetupReturn();
+    if (returnTo) location.assign(returnTo);
   } catch (err) {
     setStatus($("key-status"), "Could not read/store key: " + err.message, "err");
   }
@@ -145,14 +169,44 @@ async function unlockKey() {
   }
 }
 
-function forgetKey() {
+function clearLocalIdentity(message) {
   localStorage.removeItem(STORE_KEY);
   localStorage.removeItem(FP_KEY);
   session.armoredKey = null;
   session.signingKey = null;
   session.fingerprint = "";
   renderKeyState();
-  setStatus($("key-status"), "Key forgotten.", "");
+  setStatus($("key-status"), message, "");
+}
+
+function forgetKey() {
+  if (!confirm("Remove this encrypted identity from this browser? Make sure you have another protected copy first.")) return;
+  clearLocalIdentity("Identity removed from this browser.");
+}
+
+function replaceKey() {
+  if (!confirm("Replace this browser's encrypted identity? Make sure you have another protected copy first.")) return;
+  clearLocalIdentity("Choose the identity file you want to use on this browser.");
+}
+
+function downloadEncryptedBackup() {
+  const envelope = localStorage.getItem(STORE_KEY);
+  const fingerprint = localStorage.getItem(FP_KEY);
+  if (!envelope || !fingerprint) return setStatus($("key-status"), "No local identity is available to back up.", "err");
+  try {
+    const parsed = JSON.parse(envelope);
+    if (!isEncryptedEnvelope(parsed)) throw new Error("invalid encrypted vault");
+    const payload = JSON.stringify({ version: 1, fingerprint, encryptedEnvelope: parsed }, null, 2);
+    const url = URL.createObjectURL(new Blob([payload], { type: "application/json" }));
+    const link = document.createElement("a");
+    link.href = url;
+    link.download = `capauth-${fingerprint.slice(-8).toLowerCase()}-encrypted-backup.json`;
+    link.click();
+    URL.revokeObjectURL(url);
+    setStatus($("key-status"), "Encrypted backup downloaded. Store it somewhere protected.", "ok");
+  } catch (err) {
+    setStatus($("key-status"), "Could not create the encrypted backup: " + err.message, "err");
+  }
 }
 
 function renderKeyState() {
@@ -170,7 +224,7 @@ function renderKeyState() {
   } else {
     $("key-import").classList.remove("hidden");
     $("key-unlock").classList.add("hidden");
-    setStatus($("key-status"), "Setup needed: choose your existing identity file.");
+    setStatus($("key-status"), "Setup needed: choose your existing identity or encrypted backup file.");
   }
 }
 
@@ -179,8 +233,23 @@ async function loadKeyFile() {
   if (!file) return;
   try {
     const armored = await file.text();
+    if (file.name.toLowerCase().endsWith(".json")) {
+      const backup = JSON.parse(armored);
+      const fp = String(backup.fingerprint || "").trim().toUpperCase();
+      if (backup.version !== 1 || ![40, 64].includes(fp.length) || !/^[0-9A-F]+$/.test(fp)) {
+        throw new Error("This is not a valid CapAuth encrypted backup.");
+      }
+      if (!isEncryptedEnvelope(backup.encryptedEnvelope)) throw new Error("The encrypted vault is invalid.");
+      localStorage.setItem(STORE_KEY, JSON.stringify(backup.encryptedEnvelope));
+      localStorage.setItem(FP_KEY, fp);
+      setStatus($("key-status"), "Encrypted identity restored. Use its browser vault passphrase to sign in.", "ok");
+      renderKeyState();
+      const returnTo = safeSetupReturn();
+      if (returnTo) location.assign(returnTo);
+      return;
+    }
     if (!armored.includes("BEGIN PGP PRIVATE KEY BLOCK")) {
-      throw new Error("This is not an armored PGP private key file.");
+      throw new Error("Choose an armored PGP private key or CapAuth encrypted backup.");
     }
     $("priv-key").value = armored;
     setStatus($("key-status"), "Identity file loaded. Complete the two passphrase fields below.", "ok");
@@ -498,6 +567,8 @@ $("btn-store").onclick = storeKey;
 $("key-file").onchange = loadKeyFile;
 $("btn-unlock").onclick = unlockKey;
 $("btn-forget").onclick = forgetKey;
+$("btn-replace").onclick = replaceKey;
+$("btn-backup").onclick = downloadEncryptedBackup;
 $("btn-pair").onclick = connect;
 $("btn-push").onclick = enablePush;
 $("btn-scan").onclick = startScan;

{capauth-0.3.11 → capauth-0.3.13}/phone-signer/index.html

@@ -94,6 +94,8 @@
       max-height:140px; overflow:auto; margin-top:6px;
     }
     .warn { color:#f59e0b; font-size:11px; margin-top:8px; }
+    .management { border-top:1px solid rgba(124,58,237,.25); margin-top:16px; padding-top:12px; }
+    .management summary { cursor:pointer; color:var(--accent2); font-size:12px; font-weight:600; }
   </style>
 </head>
 <body>
@@ -107,9 +109,9 @@
     <h2>1. Load your existing identity</h2>
     <div id="key-status" class="status">Checking this browser...</div>
     <div id="key-import">
-      <label for="key-file">Choose your armored PGP private key file</label>
-      <input id="key-file" type="file" accept=".asc,.pgp,.gpg,text/plain" />
-      <div class="hint">Example: <code>jarvis-private.asc</code>. The file is read only in this browser and is never uploaded.</div>
+      <label for="key-file">Choose your identity file</label>
+      <input id="key-file" type="file" accept=".asc,.pgp,.gpg,.json,text/plain,application/json" />
+      <div class="hint">Use an armored PGP private key such as <code>jarvis-private.asc</code>, or a CapAuth encrypted backup. The file is read only in this browser and is never uploaded.</div>
       <details class="hint">
         <summary>Advanced: paste an armored key instead</summary>
         <label for="priv-key">Armored PGP private key</label>
@@ -150,11 +152,17 @@
       <input id="unlock-pass" type="password" autocomplete="current-password" />
       <div class="row">
         <button id="btn-unlock">Unlock</button>
-        <button id="btn-forget" class="secondary">Forget key</button>
       </div>
       <button id="btn-push" class="secondary">🔔 Enable background approvals</button>
       <div id="push-status" class="hint">Get a notification to approve sign-ins even when this page is closed.</div>
       </details>
+      <details class="management" id="device-management">
+        <summary>Manage identity on this device</summary>
+        <p class="hint">Download an encrypted browser-vault backup, replace this browser's identity, or remove its local copy. CapAuth never exports an unencrypted private key here.</p>
+        <button id="btn-backup" class="secondary">Download encrypted backup</button>
+        <button id="btn-replace" class="secondary">Replace identity</button>
+        <button id="btn-forget" class="danger">Remove from this browser</button>
+      </details>
     </div>
   </section>
 

{capauth-0.3.11 → capauth-0.3.13}/scripts/capauth-backup.sh

@@ -152,8 +152,16 @@ backup_keystore() {
                 # Online backup: consistent snapshot of a live DB, source untouched.
                 sqlite3 "$DB_PATH" ".backup '$dst'"
             else
-                warn "sqlite3 not found; falling back to cp (best-effort consistency)"
-                cp -p "$DB_PATH" "$dst"
+                log "sqlite3 CLI not found; using Python SQLite online backup"
+                python3 - "$DB_PATH" "$dst" <<'PY'
+import sqlite3
+import sys
+
+source, destination = sys.argv[1:]
+with sqlite3.connect(f"file:{source}?mode=ro", uri=True) as live:
+    with sqlite3.connect(destination) as backup:
+        live.backup(backup)
+PY
             fi
             chmod 600 "$dst"
             manifest "keys.db: source=$DB_PATH bytes=$(stat -c%s "$dst" 2>/dev/null || stat -f%z "$dst") sha256=$(sha "$dst")"

{capauth-0.3.11 → capauth-0.3.13}/src/capauth/cli.py

@@ -646,6 +646,47 @@ def export_pubkey(ctx: click.Context, output: Optional[str]) -> None:
         raise SystemExit(1)
 
 
+@main.command("sign-challenge")
+@click.option(
+    "--key",
+    default=None,
+    help="Fingerprint to sign with (default: $CAPAUTH_SIGN_KEY, then your CapAuth profile).",
+)
+@click.option("--stdin", "from_stdin", is_flag=True, help="Read the challenge from stdin.")
+@click.option("--stdout", "to_stdout", is_flag=True, help="Print the signature instead.")
+@click.pass_context
+def sign_challenge_cmd(
+    ctx: click.Context, key: Optional[str], from_stdin: bool, to_stdout: bool
+) -> None:
+    """Sign the CapAuth login challenge on the clipboard.
+
+    On the login page click "Copy message", run this, then paste: the
+    signature replaces the challenge on the clipboard. gpg-agent asks for the
+    key's passphrase in its own dialog; this command never sees it.
+    """
+    from .sign_challenge import (
+        ChallengeError,
+        normalize_challenge,
+        read_clipboard,
+        resolve_key,
+        write_clipboard,
+    )
+    from .sign_challenge import sign as gpg_sign
+
+    try:
+        fp = resolve_key(key, ctx.obj.get("home"))
+        text = click.get_text_stream("stdin").read() if from_stdin else read_clipboard()
+        signature = gpg_sign(normalize_challenge(text), fp)
+        if to_stdout:
+            click.echo(signature, nl=False)
+        else:
+            write_clipboard(signature)
+            click.echo("signed, paste it now")
+    except ChallengeError as exc:
+        click.echo(f"Error: {exc}", err=True)
+        raise SystemExit(1)
+
+
 @main.command("verify")
 @click.option(
     "--pubkey",

{capauth-0.3.11 → capauth-0.3.13}/src/capauth/control_plane_session.py

@@ -38,8 +38,8 @@ from .control_plane_authorizer import (
 from .delegated import CapabilityScope, PresentedCapability, Principal, parse_presented_token
 
 UTC = timezone.utc
-MAX_SESSION_TTL = timedelta(hours=8)
-MAX_SESSION_IDLE = timedelta(minutes=30)
+MAX_SESSION_TTL = timedelta(hours=24)
+MAX_SESSION_IDLE = timedelta(hours=24)
 _OPS = {entry.capability: entry.operation.value for entry in CAPABILITY_MATRIX if entry.capability}
 _REQUEST_FACTORY = object()
 _VERIFIER_FACTORY = object()

{capauth-0.3.11 → capauth-0.3.13}/src/capauth/service/oidc/clients.py

@@ -17,10 +17,16 @@ Each client entry:
       "client_secret": "change-me",
       "redirect_uris": ["https://authentik.example/source/oauth/callback/capauth/"],
       "name": "Authentik",
-      "scopes": ["openid", "profile", "email", "groups"]
+      "scopes": ["openid", "profile", "email", "groups"],
+      "require_nonce": true
     }
 
 ``redirect_uris`` is matched EXACTLY (no wildcard) per OAuth2 security guidance.
+
+``require_nonce`` (default true) may be set to false for a relying party that
+never sends an OIDC ``nonce``, such as stock Authentik's OAuth source. The code
+flow stays bound by state, PKCE S256 and the confidential client secret; a
+nonce that is sent must still be well formed and is echoed in the ID token.
 """
 
 from __future__ import annotations
@@ -44,6 +50,7 @@ class OIDCClient:
     redirect_uris: list[str]
     name: str = ""
     scopes: list[str] = field(default_factory=lambda: list(DEFAULT_SCOPES))
+    require_nonce: bool = True
 
     def redirect_uri_allowed(self, redirect_uri: str) -> bool:
         """Return True if *redirect_uri* exactly matches a registered URI."""
@@ -93,6 +100,7 @@ class ClientRegistry:
             redirect_uris=list(entry.get("redirect_uris", [])),
             name=entry.get("name", entry["client_id"]),
             scopes=list(entry.get("scopes", DEFAULT_SCOPES)),
+            require_nonce=entry.get("require_nonce", True) is not False,
         )
 
     # ------------------------------------------------------------------