Removed devices: reset the device key and id in place, then set up again

DeviceKey implements kv-ffi's DeviceSigner.reset(): it deletes the key material
(TPM key, DPAPI file, Secret Service / keychain entry, or key file) and the
device-id and store files, then creates a new key with a new id in the best
store available. The core calls it on device_revoked and retries a setup code's
ticket once, so a fresh Add-a-device code signs a removed computer straight in.
DeviceRevoked explains how to set it up again; the fingerprint shown refreshes.
Removing a device warns that it must be set up again as a new one.

Test: end to end through kv-sync's test server (new dev-dependency).
The Windows TPM/DPAPI paths could not be compiled here (no Windows SDK for ring).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This commit is contained in:

sami

2026-10-20 22:35:13 +09:00

co-authored by

Claude Opus 5.5

parent c4a677fc3d

commit 86c21f3bff

5 changed files with 289 additions and 40 deletions

									
										src-tauri/Cargo.toml
									
		+1
		
												View File
												
				@@ -77,6 +77,7 @@ core-foundation = "0.10"

				[dev-dependencies]

				tempfile = "3"

				kv-sync = { path = "../../kestrove-core/crates/kv-sync", features = ["test-server"] }

				tokio = { version = "1", features = ["rt-multi-thread", "macros"] }

				[profile.release]