ConductionNL · github-actions · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026 · Sep 10, 2026
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
@@ -172,7 +172,14 @@ jobs:
       # which reads as an auth problem rather than a typo. Six fleet repos hit
       # this; in pipelinq it killed all four PHPUnit legs and the E2E job at the
       # clone step, so those gates had never executed a single test.
-      additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"}]'
+      #
+      # integriq is here because the Integrations page reads integriq's
+      # `app_connection` rows (adopt-connection-registry). Without it the page
+      # shows the missing-dependency screen and
+      # `tests/e2e/workflows/integrations-page.spec.ts` fails on every run.
+      # `app` is `integriq`, verified in its appinfo/info.xml on `development`
+      # on 2026-09-15.
+      additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"},{"repo":"ConductionNL/integriq","app":"integriq","ref":"development"}]'
       enable-sbom: true
 
       # ── Licensing ────────────────────────────────────────────────────────

diff --git a/appinfo/info.xml b/appinfo/info.xml
@@ -36,7 +36,7 @@ Vrij en open source onder de EUPL-1.2-licentie.
 
 **Ondersteuning:** Voor ondersteuning, neem contact op via support@conduction.nl.
     ]]></description>
-    <version>0.3.2-unstable.20260910105221</version>
+    <version>0.3.4-unstable.20260912202807</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Keepiq</namespace>

diff --git a/appinfo/routes.php b/appinfo/routes.php
@@ -37,8 +37,10 @@
     ['name' => 'encryptionSuite#create',            'url' => '/api/v1/suites',                          'verb' => 'POST'],
     ['name' => 'encryptionSuite#updatePrivateKey',  'url' => '/api/v1/suites/{id}/private-key',         'verb' => 'PUT'],
     ['name' => 'encryptionSuite#revoke',            'url' => '/api/v1/suites/{id}/revoke',              'verb' => 'POST'],
+    ['name' => 'encryptionSuite#forceRevoke',       'url' => '/api/v1/suites/{id}/force-revoke',        'verb' => 'POST'],
     ['name' => 'encryptionSuite#reinstate',         'url' => '/api/v1/suites/{id}/reinstate',           'verb' => 'POST'],
     ['name' => 'encryptionSuite#compromiseRecovery','url' => '/api/v1/suites/compromise-recovery',      'verb' => 'POST'],
+    ['name' => 'encryptionSuite#proofChallenge',    'url' => '/api/v1/suites/{id}/proof-challenge',     'verb' => 'GET'],
 
     // CA management (admin-only).
     ['name' => 'cACertificate#getStatus',          'url' => '/api/v1/ca/status',                      'verb' => 'GET'],
@@ -49,6 +51,7 @@
     // Migration tracking.
     ['name' => 'migration#getStatus',                'url' => '/api/v1/migrations/status',               'verb' => 'GET'],
     ['name' => 'migration#complete',                 'url' => '/api/v1/migrations/{id}/complete',        'verb' => 'POST'],
+    ['name' => 'migration#abort',                    'url' => '/api/v1/migrations/{id}/abort',           'verb' => 'POST'],
 
     // Compromise-recovery migration work loop. One record per request: the
     // browser decrypts with the old private key, re-encrypts under the new one,
@@ -59,6 +62,10 @@
     ['name' => 'migration#reEncryptSecret',          'url' => '/api/v1/migrations/{id}/secrets/{secretId}', 'verb' => 'POST'],
     ['name' => 'migration#reEncryptVersion',         'url' => '/api/v1/migrations/{id}/versions/{versionId}', 'verb' => 'POST'],
     ['name' => 'migration#reEncryptAttachmentGrant', 'url' => '/api/v1/migrations/{id}/attachment-grants/{grantId}', 'verb' => 'POST'],
+    // Emergency contacts migrate too, but off the gate: the browser mints a fresh
+    // envelope escrowing the new key and re-points the contact here. A contact it
+    // cannot carry is left for the completion sweep to invalidate.
+    ['name' => 'migration#reEnvelopeEmergencyContact', 'url' => '/api/v1/migrations/{id}/emergency-contacts/{contactId}', 'verb' => 'POST'],
 
     // Key generator endpoint (stateless, authenticated).
     ['name' => 'keyGenerator#generate', 'url' => '/api/v1/generate-key', 'verb' => 'POST'],

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -344,6 +344,32 @@ Tracks compromise recovery migrations.
 | `started_at` | datetime | — |
 | `completed_at` | datetime | Null while in progress |
 
+**Emergency-access recovery envelopes are a migrated store, not a casualty.**
+A compromise-recovery rotation re-encrypts every suite-bound store under the new
+key; emergency contacts are the one store not produced by decrypt-then-re-encrypt.
+The rotating owner holds the new private key and can fetch each grantee's current
+certificate, so the browser mints a *fresh* recovery envelope escrowing the new
+key (`buildRecoveryEnvelope` — a build, never a re-wrap of the old envelope) and
+re-points the contact to the new suite, keeping it `granted`
+(`MigrationController::reEnvelopeEmergencyContact` →
+`EmergencyEnvelopeInvalidationService::reEnvelopeForRotation`). The server cannot
+open the envelope (only the grantee can), so it shape-checks it and asserts the
+declared grantee suite is the grantee's *current* active suite rather than
+round-tripping it. Emergency contacts are deliberately **outside** the completion
+gate: a grantee with no reachable certificate can never be re-enveloped, and
+gating on one would wedge the vault, so such a contact is left on the old suite.
+
+`EmergencyEnvelopeInvalidationService::invalidateForGrantorRotation`, fired by
+`EmergencyAccessSuiteRotationListener` on `SuiteMigrationCompletedEvent`, is now a
+**residual sweep**, not a blanket invalidation: the re-enveloped contacts have
+already left the old suite, so the sweep finds only the residual (unreachable
+grantees), invalidates exactly those, and the client surfaces them for the owner
+to re-establish. Revocation still clears the envelopes outright — it produces no
+new key to migrate to — but `EncryptionSuiteController::revoke` now refuses while
+a usable emergency contact exists unless `acceptEmergencyLoss` is given, and the
+refusal surfaces the count (never the identities) so the destruction is a knowing
+choice.
+
 ### 3.3 Encryption Flow Summary
 
 ```
@@ -585,6 +611,67 @@ All limits are keyed anonymously (per-IP) by Nextcloud's rate-limiter
 middleware, which is available since NC 24; Keepiq's `info.xml` floor
 (NC 31) already satisfies this.
 
+### 4.2 Vault-key proofs on destructive operations
+
+The always-E2E model (ADR-003) makes *reading* the vault cryptographically
+gated on the master password, but leaves *writing* gated only by the Nextcloud
+session, because writing a secret needs only the owner's public key. For the
+operations that can render vault contents or key material **permanently
+unreadable**, a session is not enough: those carry a **vault-key proof** — a
+signature, made with the owner's suite private key, over a server-issued
+challenge bound to the operation's own parameters. Because that private key is
+recoverable only by decrypting its envelope with the master password, a verified
+proof is a server-verifiable proof of the master password. This closes the
+session-only lockout (issue #395): a stolen cookie, leaked app password, or XSS
+in an unlocked tab can no longer destroy a vault.
+
+Enforced declaratively by `#[VaultKeyProofRequired(binds, subject, purpose)]`
+(`lib/Attribute/`) + `VaultKeyProofMiddleware`, with the crypto in
+`VaultKeyProofService`. The guarded routes:
+
+| Controller::method | `subject` | `binds` | `purpose` |
+|---|---|---|---|
+| `EncryptionSuiteController::compromiseRecovery` | `active` (old suite) | `publicKey`, `encryptedPrivateKey` | `compromise-recovery` |
+| `EncryptionSuiteController::updatePrivateKey` | `routeParam:id` | `encryptedPrivateKey` | `update-private-key` |
+| `EncryptionSuiteController::revoke` | `routeParam:id` | `reason` | `revoke-suite` |
+| `MigrationController::complete` | `migrationOldSuite` | `id`, `hasErrors`, `acceptUnrecoverable` | `complete-migration` |
+| `EmergencyAccessController::destroy` | `active` | `id` | `emergency-access-destroy` |
+
+Load-bearing design points — change these only deliberately:
+
+- **Sign, never decrypt.** The proof is a *signature*. A decrypt challenge would
+  be satisfiable by the session `CryptoKey`, which is imported non-extractable
+  and `['decrypt']`-only — so an unlocked tab (and thus injected script) could
+  answer it. Signing needs the raw private key, re-imported with `['sign']` from
+  bytes that exist only while the freshly entered master password is in hand.
+- **The attribute carries the binding.** The middleware cannot read the request
+  body (the framework decodes JSON and drops the raw bytes), so the proof
+  commits to *named* request parameters, each hashed and concatenated in
+  declared order. No JSON-canonicalisation agreement between JS and PHP is
+  needed; cross-language interop is pinned by `VaultKeyProofCrossImplTest`.
+- **Stateless, expiring challenges.** The nonce is HMAC-authenticated with the
+  instance secret over its random part, the caller, the purpose and an expiry —
+  no server-side store. Deliberately **not** `ICacheFactory`: a null cache on a
+  default install would break the flow. Single-use enforcement is unnecessary
+  because the signature commits to the operation's parameters, so a replay only
+  ever re-authorises the byte-identical operation.
+- **Not waived for any session type.** The middleware consults no auth backend
+  and no token scope, so it behaves identically on SSO, app-password and
+  ordinary sessions — its authority is key material, not the login method.
+- **`complete` proves the OLD key** (`migrationOldSuite`), not the new one: at
+  completion both suites are active so `active` is ambiguous, and the old key is
+  the one both the initiate and resume clients already hold the password for.
+- **Abort is deliberately unguarded.** `MigrationController::abort` is
+  restorative (it returns the vault to the still-active old suite), so requiring
+  a proof would leave a vault wedged by an unauthorised rotation wedged.
+
+**A new route that can irreversibly destroy vault data MUST be added to
+`tests/Unit/Controller/VaultKeyProofAttributesTest.php`.** A declarative guard
+fails *open* when it is omitted — nothing errors, the attribute is just absent —
+so that reflection test enumerates the guarded routes and fails the build if one
+loses its attribute or has its binding/subject/purpose loosened. The test also
+carries a documented exclusion list (`proofChallenge`, `abort`).
+
 ## 5. Open Research Questions
 
 1. **Application API authentication** — RFC 7523 (JWT Bearer / Private Key JWT) is the lean for how approved applications authenticate to retrieve secrets. Uses existing RSA key infrastructure, short-lived tokens, no new credential. Needs team discussion before finalizing. See [application-mgmt spec](../openspec/specs/application-mgmt/spec.md).

diff --git a/l10n/be.js b/l10n/be.js
@@ -1,6 +1,19 @@
 OC.L10N.register(
     "keepiq",
     {
+        "Emergency access for %n contact could not be carried across and was removed. Re-establish it so they can still recover your vault.": "Emergency access for %n contact could not be carried across and was removed. Re-establish it so they can still recover your vault.",
+        "Emergency access for %n contacts could not be carried across and was removed. Re-establish them so they can still recover your vault.": "Emergency access for %n contacts could not be carried across and was removed. Re-establish them so they can still recover your vault.",
+        "Revoke and delete emergency access": "Revoke and delete emergency access",
+        "This also permanently deletes emergency access for %n contact. If an emergency accessor exists, they must retrieve the secrets first, while this suite is still active.": "This also permanently deletes emergency access for %n contact. If an emergency accessor exists, they must retrieve the secrets first, while this suite is still active.",
+        "This also permanently deletes emergency access for %n contacts. If an emergency accessor exists, they must retrieve the secrets first, while this suite is still active.": "This also permanently deletes emergency access for %n contacts. If an emergency accessor exists, they must retrieve the secrets first, while this suite is still active.",
+        "Abort and keep my old key": "Abort and keep my old key",
+        "Aborting…": "Aborting…",
+        "Could not abort the rotation.": "Could not abort the rotation.",
+        "Could not revoke. Check your master password.": "Could not revoke. Check your master password.",
+        "Discards the new key and unlocks your vault under the old one. Only possible while nothing has been re-encrypted yet.": "Discards the new key and unlocks your vault under the old one. Only possible while nothing has been re-encrypted yet.",
+        "Re-enter your previous master password to finish": "Re-enter your previous master password to finish",
+        "Revoke emergency access": "Revoke emergency access",
+        "This deletes the recovery envelope for this contact. They will no longer be able to break glass unless you re-establish them.": "This deletes the recovery envelope for this contact. They will no longer be able to break glass unless you re-establish them.",
         "Take over as vault administrator": "Перабраць як адміністратар сховішча",
         "Select {name}": "Выбраць {name}",
         "Could not load the password policy.": "Не ўдалося загрузіць палітыку пароляў.",
@@ -1133,7 +1146,29 @@ OC.L10N.register(
         "Added {ok} of {total} secrets to the team folder": "Дадана {ok} з {total} сакрэтаў у камандную папку",
         "The Keepiq browser extension autofills your logins, provides passkeys, and shows TOTP codes — without your secrets ever leaving your device.": "Пашырэнне Keepiq для браўзера аўтаматычна запаўняе вашы лагіны, дае ключы доступу і паказвае коды TOTP — і вашы сакрэты ніколі не пакідаюць вашу прыладу.",
         "A placeholder is created and stays empty until the recipient fills it in — you never have to invent a value.": "Ствараецца запаўняльнік, які застаецца пустым, пакуль атрымальнік яго не запоўніць — вам ніколі не трэба выдумляць значэнне.",
-        "Could not reach the directory": "Не ўдалося звязацца з каталогам"
+        "Could not reach the directory": "Не ўдалося звязацца з каталогам",
+        "Integrations": "Інтэграцыі",
+        "Connection": "Злучэнне",
+        "Status message": "Паведамленне пра стан",
+        "Last checked": "Апошняя праверка",
+        "All connections": "Усе злучэнні",
+        "Add integration": "Дадаць інтэграцыю",
+        "Open settings": "Адкрыць налады",
+        "Configured": "Наладжана",
+        "Limited": "Абмежавана",
+        "Simulated": "Імітавана",
+        "Not available": "Недаступна",
+        "Error": "Памылка",
+        "e.g. Offboarding, device lost, key compromised": "напр. звальненне, страта прылады, кампраметацыя ключа",
+        "Encryption suites": "Наборы шыфравання",
+        "Failed to force-revoke suite": "Не ўдалося прымусова адклікаць набор",
+        "Failed to reinstate suite": "Не ўдалося аднавіць набор",
+        "Force-revoke a user- or application-owned encryption suite by id when its owner cannot (a forgotten master password, a de-authorised departure, or a compromise), and reinstate a revoked one. Force-revocation asks you to re-confirm your own password and permanently clears the suite's emergency access.": "Прымусова адклікаць набор шыфравання, які належыць карыстальніку або дадатку, па id, калі яго ўладальнік не можа (забыты галоўны пароль, адкліканы доступ або кампраметацыя), і аднавіць адкліканы. Прымусовае адкліканне просіць паўторна пацвердзіць ваш уласны пароль і назаўжды выдаляе аварыйны доступ набору.",
+        "Force-revoke suite": "Прымусова адклікаць набор",
+        "Reinstate suite": "Аднавіць набор",
+        "Revoking this suite deleted %n emergency-access contact.": "Адкліканне гэтага набору выдаліла %n кантакт аварыйнага доступу.",
+        "Revoking this suite deleted %n emergency-access contacts.": "Адкліканне гэтага набору выдаліла %n кантактаў аварыйнага доступу.",
+        "Treat the suite's secrets as compromised (flag for rotation and notify owners)": "Лічыць сакрэты набору скампраметаванымі (пазначыць для ратацыі і апавясціць уладальнікаў)"
     },
     "nplurals=2; plural=(n != 1);"
 )