Add recovery key rotation in account settings #47

Merged

LHa merged 4 commits from feature/recovery-key-rotation into main

2026-08-11 22:16:56 +00:00

LHa commented

2026-08-11 22:13:08 +00:00

Owner

Summary

Closes #44.

Implements the recovery key rotation feature requested by @antonsxh. Users can now generate a new E2EE recovery key from the account settings while logged in.

How it works

The user enters their current password in Settings → Recovery key.
The browser derives the old authKey (PBKDF2 + HKDF) and unwraps the master key with the old KEK (extractable once, same proven flow as e2eeChangePassword).
A fresh recovery key is generated locally (generateRecoveryKey), and the master key is wrapped under it.
The server verifies the current password, validates the new recovery wrap and auth key, atomically replaces wrappedMkRecovery and recoveryHash, and revokes all sessions (issuing a fresh one).
The new recovery key is shown once in a modal for the user to store safely.

The master key never changes — no data re-encryption is needed. The old recovery key stops working immediately.

Security model

Same zero-knowledge pattern as password change: the raw password never leaves the browser; only the derived authKey is sent.
Server-side validation: password verification, E2EE scheme-2 check, isValidAuthKey, isValidEnvelope.
replaceUserSessions revokes all existing sessions and issues one fresh session.
CSRF and Origin guards apply automatically through the router.

Changes

src/server/services/auth-http-service.js — handleRotateRecovery
src/server/routes/definitions/core-routes.js — /api/session/rotate-recovery and /api/auth/rotate-recovery
public/js/core/e2ee-session.js — e2eeRotateRecovery
public/app.js — UI wiring, recovery key modal
src/ui/partials/settings.html — Recovery key settings card
i18n/en.json, i18n/de.json — 9 new keys each
CHANGELOG.md — Unreleased entry
tests/auth-http-service.test.mjs — 3 tests (success, wrong password, non-scheme-2)

Checks

All safe local checks pass:

npm run lint (architecture + i18n)
npm run test:docs
npm run test:unit — 760 tests, 0 failures
npm run test:ui — desktop + mobile + boot

## Summary Closes #44. Implements the recovery key rotation feature requested by @antonsxh. Users can now generate a new E2EE recovery key from the account settings while logged in. ## How it works 1. The user enters their current password in Settings → Recovery key. 2. The browser derives the old authKey (PBKDF2 + HKDF) and unwraps the master key with the old KEK (extractable once, same proven flow as `e2eeChangePassword`). 3. A fresh recovery key is generated locally (`generateRecoveryKey`), and the master key is wrapped under it. 4. The server verifies the current password, validates the new recovery wrap and auth key, atomically replaces `wrappedMkRecovery` and `recoveryHash`, and revokes all sessions (issuing a fresh one). 5. The new recovery key is shown once in a modal for the user to store safely. The master key never changes — no data re-encryption is needed. The old recovery key stops working immediately. ## Security model - Same zero-knowledge pattern as password change: the raw password never leaves the browser; only the derived authKey is sent. - Server-side validation: password verification, E2EE scheme-2 check, `isValidAuthKey`, `isValidEnvelope`. - `replaceUserSessions` revokes all existing sessions and issues one fresh session. - CSRF and Origin guards apply automatically through the router. ## Changes - `src/server/services/auth-http-service.js` — `handleRotateRecovery` - `src/server/routes/definitions/core-routes.js` — `/api/session/rotate-recovery` and `/api/auth/rotate-recovery` - `public/js/core/e2ee-session.js` — `e2eeRotateRecovery` - `public/app.js` — UI wiring, recovery key modal - `src/ui/partials/settings.html` — Recovery key settings card - `i18n/en.json`, `i18n/de.json` — 9 new keys each - `CHANGELOG.md` — Unreleased entry - `tests/auth-http-service.test.mjs` — 3 tests (success, wrong password, non-scheme-2) ## Checks All safe local checks pass: - `npm run lint` (architecture + i18n) - `npm run test:docs` - `npm run test:unit` — 760 tests, 0 failures - `npm run test:ui` — desktop + mobile + boot

LHa added 4 commits

2026-08-11 22:13:08 +00:00