search

cryptomator / hub

Cryptomator Hub helps you manage vaults in large teams
GNU Affero General Public License v3.0
36 stars 8 forks source link

Recovering vaults after resetting my account #237

Closed SailReal closed 7 months ago

SailReal commented 8 months ago

Please agree to the following

Summary

As a owner of a vault, I would like to be able to recover it after resetting my account key

System Setup

- Hub: `commit-148e820af7644132ded9e4297ac0c9589b473343-amd64`

Steps to Reproduce

  1. Create vault asd with user admin
  2. Open another browser and login as admin
  3. Execute Reset my account introduced in https://github.com/cryptomator/hub/issues/208
  4. Open vault details of asd

Expected Behavior

Hub informs me about how can I recover access to the selected vault:

Actual Behavior

Hub looks quiet normal beside the fact that the member list is empty and every change to that vault results in a Unexpected Error: Insufficient rights to access resource

image

Reproducibility

Always

Relevant Log Output

No response

Anything else?

No response

overheadhunter commented 8 months ago

I guess the problem is that the "vault detail view" assumes you have an access token for this vault. However resetting an account will delete those.

So if you have owner privileges but not a token, we might need to prompt for the recovery key before continuing to the vault detail view, right?

SailReal commented 8 months ago

Exactly, that's what I guess as well.

The remaining question is if we should handle one and multiple vault owners with access tokens differently or always show the recover vault dialog like mentioned in the report

Expected Behavior

Hub informs me about how can I recover access to the selected vault:

  • When I'm the only owner, Hub needs to ask for my recovery key to recover this vault
  • When I'm not the only owner, I can enter my recovery key or get the information to wait until an other owner clicks "Update Permission"
overheadhunter commented 8 months ago

To keep it simple, let's start with always prompting for the recovery key. Then re-encrypt the vault key for the user's new private key. All remaining users should remain untouched.

It can be a future refinement to add some "Alternatively, ask Alice" text to said prompt.