stop storing guest passwords, mint sessions server side

The old flow encrypted the guest password on disk next to its own key,
then sent it to the guest in the bootstrap HTML anyway. Now redemption
mints the session with ISessionManager.AuthenticateDirect and the page
only ever carries the session token. The guest account still gets a
random password nobody knows, so blank login stays impossible, but no
password is stored or sent anywhere anymore. Cleanup now defaults to
every 30 minutes instead of daily at 4am so expired guests die fast.
Cette révision appartient à :
Franciskid
2026-07-08 00:50:20 +02:00
Parent 2f3c4a8213
révision f2b523be97
5 fichiers modifiés avec 41 ajouts et 122 suppressions
-3
Voir le fichier
@@ -56,9 +56,6 @@ public sealed class ShareLinkRecord
/// <summary>Gets or sets a value indicating whether the link may be used once only.</summary>
public bool OneUse { get; set; } = true;
/// <summary>Gets or sets the encrypted guest password, if one has been generated.</summary>
public string? GuestPasswordEncrypted { get; set; }
/// <summary>Gets or sets a value indicating whether metadata was touched during cleanup.</summary>
public bool MetadataTouched { get; set; }