From 899a8404396eddd78d2fee266ee113734921b34e Mon Sep 17 00:00:00 2001 From: "Snow Lee (Sungwon)" Date: Wed, 19 Aug 2026 13:21:44 -0700 Subject: [PATCH] docs: scope the plaintext-credentials claim to the server (BEA-120) (#176) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "No plaintext credentials ever touch disk" sat in the paragraph about the server's auth.json, where it is true, and read on its own as a product-wide promise the client does not keep: the device token lives in plaintext at ~/.bdrive/settings.json. Say what the server does, then say what the client does — path, 0600 mode, and that `bdrive logout` revokes it — in the same passage. Both halves check out against the code (config.go's 0600 for everything under $BDRIVE_HOME, DELETE /api/auth/token on logout). Co-authored-by: Claude Opus 5 (1M context) --- web/docs/src/content/docs/self-hosting/authentication.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/web/docs/src/content/docs/self-hosting/authentication.md b/web/docs/src/content/docs/self-hosting/authentication.md index 7f2b66c..668f01e 100644 --- a/web/docs/src/content/docs/self-hosting/authentication.md +++ b/web/docs/src/content/docs/self-hosting/authentication.md @@ -9,8 +9,10 @@ whole API (web UI, uploads, project creation, device sync) needs a session; only `bdrive serve ./folder`, remains auth-free. Accounts are email, password, and name, kept in a file-backed registry -(`auth.json`): bcrypt password hashes and SHA-256 token digests, atomically -rewritten. No plaintext credentials ever touch disk. +(`auth.json`), atomically rewritten. No plaintext credentials are stored on the +server — passwords are bcrypt-hashed and tokens are kept as SHA-256 digests. On +a client device, the sync token is stored at `~/.bdrive/settings.json` with +`0600` permissions and can be revoked from that device with `bdrive logout`. ## Signup is invite-only by default