External/beardrive
1
0
Fork 0
mirror of https://github.com/runbear-io/beardrive.git synced 2026-08-25 08:08:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: scope the plaintext-credentials claim to the server (BEA-120) (#176)

Browse Source 
"No plaintext credentials ever touch disk" sat in the paragraph about the
server's auth.json, where it is true, and read on its own as a product-wide
promise the client does not keep: the device token lives in plaintext at
~/.bdrive/settings.json.

Say what the server does, then say what the client does — path, 0600 mode, and
that `bdrive logout` revokes it — in the same passage. Both halves check out
against the code (config.go's 0600 for everything under $BDRIVE_HOME,
DELETE /api/auth/token on logout).

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Snow Lee (Sungwon)
2026-08-19 13:21:44 -07:00
committed by GitHub
co-authored by Claude Opus 5
parent b0029f914c
commit 899a840439
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/docs/src/content/docs/self-hosting/authentication.md
+4 -2
View File
@@ -9,8 +9,10 @@ whole API (web UI, uploads, project creation, device sync) needs a session; only
`bdrive serve ./folder`, remains auth-free. `bdrive serve ./folder`, remains auth-free.
Accounts are email, password, and name, kept in a file-backed registry Accounts are email, password, and name, kept in a file-backed registry
(`auth.json`): bcrypt password hashes and SHA-256 token digests, atomically (`auth.json`), atomically rewritten. No plaintext credentials are stored on the
rewritten. No plaintext credentials ever touch disk. server — passwords are bcrypt-hashed and tokens are kept as SHA-256 digests. On
a client device, the sync token is stored at `~/.bdrive/settings.json` with
`0600` permissions and can be revoked from that device with `bdrive logout`.
## Signup is invite-only by default ## Signup is invite-only by default