Repository navigation
Let users delete their account and turn off enclave recovery - #49
Merged
Merged
Conversation
useCavos() gains deleteAccount(), disableEnclaveRecovery() and enableEnclaveRecovery(). Each is confirmed in a sheet the vault draws and signed with the wallet's spend key over a challenge from the Cavos backend, so the embedding app cannot act for the user. Deleting also removes this browser's keys and wraps. A user who turned recovery off is not re-enrolled on sign-in, and a new device gets a clear error instead of a failed recovery. The vault refuses to sign a consent message as a Solana transaction.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
deleteAccount(),disableEnclaveRecovery()andenableEnclaveRecovery()touseCavos(), released as 0.5.1. Needs the backend in cavos-labs/cavos (/api/end-users/me/*).consentanderase.consentreads which action the server challenge names, shows a sheet the embedding page cannot draw or skip (deleting asks the user to typedelete; same arming and visibility guard as transaction review), then signsCavos Consent:\n<len>\n<challenge>with the connected chain's spend key derived from the DEK. It returnsnullwhen this browser holds no key.signMessagealready signs onlyCavos Signed Message:-prefixed bytes, Stellar signs only hashes, and Starknet consent signsstarknetKeccakof the text. The one raw-bytes path,signSolanaTransaction, now refuses bytes starting with the consent prefix.eraseLocalAccountremoves the wrap, the device unwrap key and the Solana/Stellar control keys for the user in the vault's scope.deleteAccountcalls it, thenlogout().enrollDekmapsrecovery_revokedto{ kind: "opted-out" }, so the background re-seal on sign-in ends silently. A new device of an opted-out user gets "recovery by sign-in is turned off for this wallet" instead of a failed recovery.enableEnclaveRecoverylifts the opt-out; the record is sealed at the next sign-in, through the existing path.Test plan
npm test: 521 pass (new:src/account/consent.test.ts, vault consent and guard tests inhost.test.ts, opt-out tests inEnclaveDekPort.test.tsandDeviceSecret.test.ts).npx tsc --noEmitandnpm run buildclean.signConsentverified by the cavos-web verifier on all three chains (one-off cross-repo test).mainpublishes 0.5.1).