shelldeck 0.0.2__tar.gz → 0.0.4__tar.gz

{shelldeck-0.0.2 → shelldeck-0.0.4}/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to shelldeck are listed here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/).
 
+## [0.0.4] - 2026-09-29
+
+### Added
+
+- Share approval: opening a share link puts the device on a waiting page until you allow it in the `sd share` window (`Allow it? [y/N]`); then it still needs the password.
+- `sd share --new-link` prints another one-use link for the running share.
+- Security headers on every response (no framing, no MIME sniffing, no referrer) and `Cache-Control: no-store` on the API.
+
+### Changed
+
+- Share links work once and expire after 10 minutes unopened. A new link voids the unused old one.
+- Sharing needs a password of 12+ characters (an existing one that long counts after the next login).
+- Revoking a shared device in Devices also voids its approval, so it needs a new link.
+- README: `sd share` is encrypted in transit but not end to end; Cloudflare can see the traffic.
+
+### Fixed
+
+- A share left open when `sd share` was killed or its window closed: the server now closes a share within a minute of its last heartbeat and signs its browsers out. Devices no longer shows "sharing via" a dead tunnel.
+
+## [0.0.3] - 2026-09-29
+
+### Added
+
+- Devices page: every signed-in browser with where it came from (this machine, network, or a share), when it signed in, last activity, and whether it is in use; revoke one or sign out all others.
+- One device at a time: other browsers stay signed in but idle; logging in on one takes over and shows the others an "In use on another device" screen.
+
+### Changed
+
+- Logging in again in the same browser replaces its old login instead of adding one.
+- Share logins are stored with their share and removed when it stops, is replaced, or the server restarts.
+
+### Fixed
+
+- Re-running the one-line installer now upgrades an existing install to the latest release.
+
 ## [0.0.2] - 2026-09-29
 
 ### Added
@@ -32,5 +67,7 @@ First public release.
 - Mandatory password with per-browser logins, idle lock, and HTTPS or SSH-tunnel remote access.
 - `sd` CLI with a startup banner, `sd search` (LLM-free code search), and one-line installers for Windows and Linux.
 
+[0.0.4]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.4
+[0.0.3]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.3
 [0.0.2]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.2
 [0.0.1]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.1

{shelldeck-0.0.2 → shelldeck-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: shelldeck
-Version: 0.0.2
+Version: 0.0.4
 Summary: Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser
 Project-URL: Homepage, https://github.com/codejunction/shelldeck
 Project-URL: Source, https://github.com/codejunction/shelldeck
@@ -70,7 +70,7 @@ irm https://raw.githubusercontent.com/codejunction/shelldeck/main/install.ps1 |
 curl -fsSL https://raw.githubusercontent.com/codejunction/shelldeck/main/install.sh | sh
 ```
 
-The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Already use Python tooling? Any of these work too:
+The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Run it again to update to the latest release (or `uv tool upgrade shelldeck`); stop the server first with `sd stop` so Windows can replace `sd.exe`. Already use Python tooling? Any of these work too:
 
 ```sh
 uv tool install shelldeck      # or: pipx install shelldeck, or: pip install shelldeck
@@ -130,6 +130,7 @@ sd ~/code/api      # add a folder as a project and open a terminal in it
 ### Secure by default
 
 - **Password required.** Every browser logs in separately and locks after 30 minutes idle.
+- **One device at a time.** Any number of browsers can stay signed in, but only one uses shelldeck; logging in on another takes over and idles the rest. The **Devices** page lists every signed-in browser (where from, last active, in use or idle) and revokes any of them.
 - **Local only.** shelldeck listens on `127.0.0.1` and refuses requests from other websites.
 - **Remote use** goes over an SSH tunnel or HTTPS. See [Remote access](#remote-access).
 
@@ -195,7 +196,7 @@ sd schedule list|add|run|toggle|delete|logs
 sd task list|add|move|delete|alarms
 sd serve [--host H]                  run the server in the foreground
 sd stop                              stop the background server (closes all terminals)
-sd share                             share over an HTTPS Cloudflare tunnel with a QR link (needs cloudflared)
+sd share [--new-link]                share over an HTTPS Cloudflare tunnel: one-use QR link, host approval (needs cloudflared)
 sd login-link                        emergency: one-time login URL (host only)
 sd reset-password                    emergency: forget the password (host only)
 ```
@@ -220,13 +221,16 @@ ssh -N -L 5455:127.0.0.1:5455 you@vm      # on your machine, then open http://12
 **`sd share` (any device, no setup).** Needs [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (`winget install Cloudflare.cloudflared`); no Cloudflare account.
 
 ```sh
-sd share          # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share              # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share --new-link   # another one-use link for the running share (a second device)
 ```
 
-- **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
-- **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
+- **Encrypted in transit, not end to end.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened. Cloudflare ends the TLS connection, so it can see the traffic (terminal input and output, your password as you log in). For sensitive work use the SSH tunnel or Tailscale instead.
+- **Three locks.** The random `trycloudflare.com` address alone is refused. The printed link works **once** and only for **10 minutes**; opening it makes the device wait until you allow it in the `sd share` window (`Allow it? [y/N]`). Then it still needs your password.
+- **Long password.** Sharing needs a password of 12+ characters. An older password that long counts after your next login.
+- **Self-closing.** `sd share` renews the share every few seconds. If it stops without Ctrl+C (window closed, process killed), the server closes the share within a minute and signs those browsers out.
 - **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
-- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it. Each `sd share` gets a new address and link.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Revoking a shared device in **Devices** also voids its approval, so it needs a new link. Each `sd share` gets a new address and link.
 
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
@@ -242,6 +246,9 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
+- **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
+- **Headers.** Every response forbids framing (`X-Frame-Options: DENY`, `frame-ancestors 'none'`), sniffing and referrers, and API responses are never cached.
+- **Sharing** adds a one-use, 10-minute link, approval on the host and a 12+ character password; see [Remote access](#remote-access).
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.2 → shelldeck-0.0.4}/README.md

@@ -35,7 +35,7 @@ irm https://raw.githubusercontent.com/codejunction/shelldeck/main/install.ps1 |
 curl -fsSL https://raw.githubusercontent.com/codejunction/shelldeck/main/install.sh | sh
 ```
 
-The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Already use Python tooling? Any of these work too:
+The installer sets up [uv](https://docs.astral.sh/uv/) if you don't have it, then installs shelldeck with its own Python 3.12+. Run it again to update to the latest release (or `uv tool upgrade shelldeck`); stop the server first with `sd stop` so Windows can replace `sd.exe`. Already use Python tooling? Any of these work too:
 
 ```sh
 uv tool install shelldeck      # or: pipx install shelldeck, or: pip install shelldeck
@@ -95,6 +95,7 @@ sd ~/code/api      # add a folder as a project and open a terminal in it
 ### Secure by default
 
 - **Password required.** Every browser logs in separately and locks after 30 minutes idle.
+- **One device at a time.** Any number of browsers can stay signed in, but only one uses shelldeck; logging in on another takes over and idles the rest. The **Devices** page lists every signed-in browser (where from, last active, in use or idle) and revokes any of them.
 - **Local only.** shelldeck listens on `127.0.0.1` and refuses requests from other websites.
 - **Remote use** goes over an SSH tunnel or HTTPS. See [Remote access](#remote-access).
 
@@ -160,7 +161,7 @@ sd schedule list|add|run|toggle|delete|logs
 sd task list|add|move|delete|alarms
 sd serve [--host H]                  run the server in the foreground
 sd stop                              stop the background server (closes all terminals)
-sd share                             share over an HTTPS Cloudflare tunnel with a QR link (needs cloudflared)
+sd share [--new-link]                share over an HTTPS Cloudflare tunnel: one-use QR link, host approval (needs cloudflared)
 sd login-link                        emergency: one-time login URL (host only)
 sd reset-password                    emergency: forget the password (host only)
 ```
@@ -185,13 +186,16 @@ ssh -N -L 5455:127.0.0.1:5455 you@vm      # on your machine, then open http://12
 **`sd share` (any device, no setup).** Needs [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (`winget install Cloudflare.cloudflared`); no Cloudflare account.
 
 ```sh
-sd share          # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share              # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share --new-link   # another one-use link for the running share (a second device)
 ```
 
-- **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
-- **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
+- **Encrypted in transit, not end to end.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened. Cloudflare ends the TLS connection, so it can see the traffic (terminal input and output, your password as you log in). For sensitive work use the SSH tunnel or Tailscale instead.
+- **Three locks.** The random `trycloudflare.com` address alone is refused. The printed link works **once** and only for **10 minutes**; opening it makes the device wait until you allow it in the `sd share` window (`Allow it? [y/N]`). Then it still needs your password.
+- **Long password.** Sharing needs a password of 12+ characters. An older password that long counts after your next login.
+- **Self-closing.** `sd share` renews the share every few seconds. If it stops without Ctrl+C (window closed, process killed), the server closes the share within a minute and signs those browsers out.
 - **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
-- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it. Each `sd share` gets a new address and link.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Revoking a shared device in **Devices** also voids its approval, so it needs a new link. Each `sd share` gets a new address and link.
 
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
@@ -207,6 +211,9 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
+- **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
+- **Headers.** Every response forbids framing (`X-Frame-Options: DENY`, `frame-ancestors 'none'`), sniffing and referrers, and API responses are never cached.
+- **Sharing** adds a one-use, 10-minute link, approval on the host and a 12+ character password; see [Remote access](#remote-access).
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.2 → shelldeck-0.0.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shelldeck"
-version = "0.0.2"
+version = "0.0.4"
 description = "Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser"
 readme = "README.md"
 license = "MIT"

{shelldeck-0.0.2 → shelldeck-0.0.4}/shelldeck/auth.py

@@ -20,9 +20,11 @@ from . import db
 
 LOCK_TIMEOUT_SECONDS = 30 * 60
 MIN_PASSWORD = 8
+SHARE_MIN_PASSWORD = 12  # `sd share` puts the login page on the internet
 COOKIE = "sd_session"
 TOKEN_HEADER = "x-shelldeck-token"
 _PASSWORD_KEY = "auth_password_hash"
+_STRONG_KEY = "auth_password_strong"  # "1" when the password is long enough to share
 _TOUCH_EVERY = 60  # seconds; last_seen writes are throttled
 _CACHE_TTL = 5  # seconds a session lookup is trusted before re-reading the db
 
@@ -57,7 +59,20 @@ def has_password() -> bool:
 
 def check_password(password: str) -> bool:
     stored = db.get_setting(_PASSWORD_KEY)
-    return bool(stored) and _verify_password(password, stored)
+    ok = bool(stored) and _verify_password(password, stored)
+    if ok:
+        _note_strength(password)  # passwords set before this flag existed get it at their next login
+    return ok
+
+
+def _note_strength(password: str) -> None:
+    strong = "1" if len(password) >= SHARE_MIN_PASSWORD else ""
+    if db.get_setting(_STRONG_KEY, "") != strong:
+        db.set_setting(_STRONG_KEY, strong)
+
+
+def strong_password() -> bool:
+    return db.get_setting(_STRONG_KEY, "") == "1"
 
 
 def validate_new(password: str, confirm: str) -> str | None:
@@ -71,6 +86,7 @@ def validate_new(password: str, confirm: str) -> str | None:
 
 def set_password(password: str) -> None:
     db.set_setting(_PASSWORD_KEY, _hash_password(password))
+    _note_strength(password)
     _file("setup-code").unlink(missing_ok=True)
 
 
@@ -128,6 +144,7 @@ def init_auth() -> str | None:
 def reset() -> str:
     """Emergency, host-only: forget the password and every login. Returns the new setup code."""
     db.delete_setting(_PASSWORD_KEY)
+    db.delete_setting(_STRONG_KEY)
     db.delete_auth_sessions()
     _file("setup-code").unlink(missing_ok=True)
     _cache.clear()
@@ -141,12 +158,21 @@ def _h(token: str) -> str:
     return hashlib.sha256(token.encode()).hexdigest()
 
 
-def new_session(client: str) -> str:
+def new_session(client: str, via: str = "local") -> str:
     token = secrets.token_urlsafe(32)
-    db.add_auth_session(_h(token), time.time(), client)
+    db.add_auth_session(_h(token), time.time(), client, via)
     return token
 
 
+def alive(h: str | None) -> bool:
+    """A session (by hash) that still exists and hasn't idled out."""
+    if not h:
+        return False
+    hit = _cache.get(h)
+    row = hit[1] if hit and time.time() - hit[0] < _CACHE_TTL else db.get_auth_session(h)
+    return bool(row) and time.time() - row["last_seen"] <= LOCK_TIMEOUT_SECONDS
+
+
 def session_hash(token: str | None) -> str | None:
     """sha256 of a live session token, else None. Idle sessions are removed here."""
     if not token:

{shelldeck-0.0.2 → shelldeck-0.0.4}/shelldeck/cli.py

@@ -1,10 +1,12 @@
 import json
 import os
+import queue
 import re
 import shutil
 import ssl
 import subprocess
 import sys
+import threading
 import time
 import urllib.error
 import urllib.request
@@ -308,13 +310,53 @@ def _show_share(url: str) -> None:
     if sys.stdout.isatty():
         segno.make(url, error="l").terminal(compact=(sys.stdout.encoding or "").lower().startswith("utf"))
     typer.echo(f"\n  {url}\n")
-    typer.echo("  Scan or open it on the other device, then log in with your shelldeck password.")
-    typer.echo("  Without this link the tunnel URL is refused. Ctrl+C stops sharing and signs those browsers out.")
+    typer.echo("  Open it on the other device within 10 minutes. It works once; allow the device here, then log in")
+    typer.echo("  with your password. Another device: `sd share --new-link`. Ctrl+C stops sharing and signs them out.")
+
+
+def _watch_share() -> None:
+    """Renew the share's lease (the server closes it ~60s after this stops) and ask here before a
+    device that opened the link gets in."""
+    asks: queue.Queue = queue.Queue()
+
+    def poll() -> None:
+        asked: set[str] = set()
+        while True:
+            try:
+                for p in _api("/api/share").get("pending", []):
+                    if p["id"] not in asked:
+                        asked.add(p["id"])
+                        asks.put(p)
+            except typer.Exit:
+                pass  # server busy or restarting; try again
+            time.sleep(3)
+
+    def ask() -> None:
+        while True:
+            p = asks.get()
+            typer.echo(f"\n  A device opened the link: {p['ip']}\n  {p['agent'][:100]}")
+            allow = input("  Allow it? [y/N] ").strip().lower() in ("y", "yes")
+            try:
+                _api("/api/share/decide", "POST", {"id": p["id"], "allow": allow})
+                typer.echo("  allowed; it can log in with your password now" if allow else "  denied")
+            except typer.Exit:
+                typer.echo("  that request expired; open a new link")
+
+    for target in (poll, ask):
+        threading.Thread(target=target, daemon=True).start()
 
 
 @app.command()
-def share():
-    """Reach this shelldeck from another device: HTTPS Cloudflare quick tunnel, QR link, then your password."""
+def share(
+    new_link: bool = typer.Option(False, "--new-link", help="Print a fresh one-use link for the running share."),
+):
+    """Reach this shelldeck from another device: HTTPS Cloudflare quick tunnel, one-use QR link, host approval, then your password."""
+    if new_link:
+        if not (_health() == "ok" and _api("/api/share").get("host")):
+            typer.echo("not sharing; start with `sd share`", err=True)
+            raise typer.Exit(1)
+        _show_share(f"https://{_api('/api/share')['host']}" + _api("/api/share/link", "POST", {})["path"])
+        return
     exe = shutil.which("cloudflared")
     if not exe:
         hint = "winget install Cloudflare.cloudflared" if sys.platform == "win32" else "see https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"
@@ -324,6 +366,13 @@ def share():
     if not _api("/api/auth/status").get("has_password"):
         typer.echo("Set a password first: open shelldeck on this machine (`sd`), then run `sd share` again.", err=True)
         raise typer.Exit(1)
+    if not _api("/api/share").get("strong_password"):
+        typer.echo(
+            f"Sharing puts the login page on the internet, so it needs a password of {auth.SHARE_MIN_PASSWORD}+ characters.\n"
+            "Change it in Settings (or, if it is already that long, log in once), then run `sd share` again.",
+            err=True,
+        )
+        raise typer.Exit(1)
     # the tunnel ends at our own loopback server, whose certificate (if any) is self-signed
     cmd = [exe, "tunnel", "--no-autoupdate", "--url", _url()] + (["--no-tls-verify"] if _scheme() == "https" else [])
     proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True, errors="replace")
@@ -335,6 +384,7 @@ def share():
             elif host and not shared and "Registered tunnel connection" in line:
                 shared = f"https://{host}" + _api("/api/share", "POST", {"host": host})["path"]
                 _show_share(shared)
+                _watch_share()
     except KeyboardInterrupt:
         pass
     finally:

{shelldeck-0.0.2 → shelldeck-0.0.4}/shelldeck/db.py

@@ -136,7 +136,8 @@ def init_db() -> None:
                 token_hash TEXT PRIMARY KEY,
                 created_at REAL NOT NULL,
                 last_seen REAL NOT NULL,
-                client TEXT
+                client TEXT,
+                via TEXT
             );
 
             -- command history (sessions/projects may be deleted later; keep the text)
@@ -162,6 +163,9 @@ def init_db() -> None:
         cols = {r[1] for r in conn.execute("PRAGMA table_info(sessions)")}
         if "name" not in cols:
             conn.execute("ALTER TABLE sessions ADD COLUMN name TEXT")
+        if "via" not in {r[1] for r in conn.execute("PRAGMA table_info(auth_sessions)")}:
+            conn.execute("ALTER TABLE auth_sessions ADD COLUMN via TEXT")
+        conn.execute("DELETE FROM auth_sessions WHERE via LIKE 'share:%'")  # shares end with the server
         cols = {r[1] for r in conn.execute("PRAGMA table_info(projects)")}
         if "color" not in cols:
             conn.execute("ALTER TABLE projects ADD COLUMN color INTEGER")
@@ -317,15 +321,30 @@ def list_sessions_with_project() -> list[dict]:
         return [dict(r) for r in rows]
 
 
-def add_auth_session(token_hash: str, now: float, client: str) -> None:
+def add_auth_session(token_hash: str, now: float, client: str, via: str = "local") -> None:
     with _connect() as conn:
         conn.execute(
-            "INSERT INTO auth_sessions (token_hash, created_at, last_seen, client) VALUES (?, ?, ?, ?)",
-            (token_hash, now, now, client[:200]),
+            "INSERT INTO auth_sessions (token_hash, created_at, last_seen, client, via) VALUES (?, ?, ?, ?, ?)",
+            (token_hash, now, now, client[:200], via),
         )
         conn.commit()
 
 
+def list_auth_sessions() -> list[dict]:
+    with _connect() as conn:
+        conn.row_factory = sqlite3.Row
+        return [dict(r) for r in conn.execute("SELECT * FROM auth_sessions ORDER BY last_seen DESC")]
+
+
+def delete_auth_sessions_via(via: str) -> list[str]:
+    """Delete the logins made through `via` (e.g. one share); returns their hashes."""
+    with _connect() as conn:
+        gone = [r[0] for r in conn.execute("SELECT token_hash FROM auth_sessions WHERE via = ?", (via,))]
+        conn.execute("DELETE FROM auth_sessions WHERE via = ?", (via,))
+        conn.commit()
+        return gone
+
+
 def get_auth_session(token_hash: str) -> dict | None:
     with _connect() as conn:
         conn.row_factory = sqlite3.Row