feat(vault): use integrity id as passphrase verifier - #3018
Merged
Conversation
JammingBen
force-pushed
the
feat/vault-integrity-token
branch
from
August 3, 2026 14:14
dc1f25e to
2b39d86
Compare
Adds a setProperties method for writing arbitrary WebDAV properties via PROPPATCH, plus an extraProps option on listFiles/getFileInfo to request namespaced props for a single call instead of registering them globally. Names listed in extraProps keep their own prefix in both the PROPFIND and the PROPPATCH body rather than being forced into the oc namespace, and every prefix they use is declared automatically as its own namespace. Apps can therefore bring their own without this package knowing about it, and the well-known d and oc prefixes cannot be overridden. Namespacing has to match on both sides or the value is stored under a key no PROPFIND can address: an unlisted custom name is written as oc:<name>, which the server accepts with a 207 and can never be read back.
JammingBen
force-pushed
the
feat/vault-integrity-token
branch
4 times, most recently
from
August 4, 2026 04:57
56dbaa4 to
490a970
Compare
Stores a random uuid, encrypted with the vault's own content cipher, as the ocrclone:integrity-id property on the vault root when a passphrase is first set. Its presence is what makes the passphrase permanent: an empty vault no longer re-offers setup and silently accepts a different one. Decrypting that token verifies a passphrase cryptographically, since every rclone-crypt block carries a Poly1305 tag. Vaults without a token - set up before this, or managed outside OpenCloud Web such as by the rclone CLI - fall back to decrypting a sample name, and get a token backfilled once the passphrase has been proven against a file's content. Name decryption has no authentication tag and accepts a wrong passphrase roughly 2% of the time, so it never commits a token on its own: doing so would lock the real passphrase out permanently. Files of exactly 32 bytes are skipped as evidence, being a bare header that seals no blocks and therefore authenticating nothing. Adds createIntegrityToken and verifyIntegrityToken to FolderVaultEngine and renames verifyKey to verifySegment, now that it names what it is handed and sits beside the token check. Also runs setProperties through the folder-vault decorator, like every other webdav method carrying a path. The vault root passes through untranslated as before, but a property set on vault content now addresses the encrypted path and fails closed while the vault is locked. The property lives in its own ocrclone namespace rather than the oc one the issue suggested, because the server answers unknown oc local names with 404. Closes #3009
JammingBen
force-pushed
the
feat/vault-integrity-token
branch
from
August 4, 2026 07:45
490a970 to
32c5843
Compare
JammingBen
marked this pull request as ready for review
August 4, 2026 08:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stores a random uuid, encrypted with the vault's content cipher, as the
ocrclone:integrity-idproperty on the vault root when a passphrase is first set. This means an empty vault no longer re-offers setup. It also has the added benefits of a) having a cryptographically safe way to validate a passphrase (it wasn't before) and 2) less server load because we don't need to list all files inside a vault.The old mechanism is kept as fallback however to ensure full compatibility with vaults created outside of Web (e.g. via rclone-crypt cli).
The webdav property lives in its own
ocrclonenamespace rather than theocone because the server answers unknownoclocal names with404. Also, the client has been extend to support extra properties on a per-request basis as well asetPropertiesmethod for writing arbitrary WebDAV properties viaPROPPATCH.closes #3009