Protect locally stored Acount Code on disk with system api by Mabeeck · Pull Request #3508 · PixelGuys/Cubyz

Mabeeck · 2026-08-11T19:59:14Z

This PR adds the main.protect.protect and main.protect.unprotect functions and integrates them into the PasswordEncodedAccountCode class.

protect Takes an allocator and a slice of bytes as arguments. The function returns a different slice of bytes that has been allocated with the provided allocator and can be passed to unprotect to get back the original slice of bytes. The function can fail, if the platform Cubyz is currently running on does not have an implementation yet (in which case the error will be error.Unsupported) or the syscall fails for some undisclosed reason (Windows), in which case the error will be error.syserr.
unprotect Takes an allocator and a slice of bytes that has been previously generated by protect as arguments. The function returns a different slice of bytes that has been allocated with the provided allocator and is equivalent in value to the slice of bytes that was passed to protect in order to produce the provided slice. The function can return error.Invalid if the provided input was protected on a different device; can no longer be unprotected for some reason; the current platform does not have an implementation. If something unexpected happened the function will fail with error.syserr.
canProtect Takes no arguments and returns a boolean indicating weather the protection functions have an implementation on the current platform.

Currently the protection functions only support Windows. They can later be easily expanded to support Linux as well.

Adds a protected attribute to PasswordEncodedAccountCode that indicates weather a call to unprotect is needed, before the AccountCode can be decrypted.
Functions to initialize PasswordEncodedAccountCode now take a shouldProtect boolean argument that when set to true will protect the function with the native system api, if available. Setting it to false will prevent usage of the protection api.

Contributes to #2551

Mabeeck · 2026-08-17T11:02:14Z

Done

Mabeeck · 2026-08-23T12:49:11Z

Done

Mabeeck · 2026-08-24T17:41:39Z

Done

IntegratedQuantum

Please also include a screenshot (since I cannot test this locally), also please adjust the window height to avoid a scrollbar.

IntegratedQuantum · 2026-08-30T13:04:18Z

 	list.add(Label.init(.{0, 0}, width, "Your Account Code will be stored in your settings to allow you to stay logged in. Please decide how we should store it:", .left));
 	innerList = VerticalList.init(.{0, 0}, 100, 16);
+	if (main.network.authentication.protection.canProtect) {
+		protectCheckbox = CheckBox.init(.{0, 0}, width, "Protect from theft (recommended)\nForces re-authentication when device changes", protectAccountCode, &protectAccountCodeCallback);


I think this is too generic. Protection from theft can mean a lot of things.

I'd suggest to find a non-dev on the discord server to work together on this. Or maybe @ikabod-kee could help here.

Does this work? Or maybe "Prevent loading on different devices"? I have also asked on discord. Will change once I have further improvement ideas.

Due to line 411 in authentication.zig and some other reasons I have decided to rework this implementation to make use of a `protected` boolean attribute instead of creating tons of extra EncodingTypes.

Obey linter and migrate to protected attribute. protect() and unprotect() now error on unsupported platforms. I felt that it would be bad, if someone assumed that a call to unprotect would always error on bad input or that a call to protect would always encrypt the data. These previously false assumptions are now true.

Yes, I blame microslop for using an uppercase in their docs.

Apparently errorcode 13 is for strings too short and errorcode 87 is for otherwise gibberish. The real reason I made this commit is that some github service was down when my last test ran and the only way to rerun it is to make another commit.

Consistency. Oh, and better to be safe than sorry.

Must test on linux

If error. Unsupported is raised, then a programmer is using the API incorrectly. Errors like these warrant a panic and do not need to be recoverable.

As I see it, this is the simplest way to have the defer directly below the recource creation. That makes one more allocation than necessary when shouldProtect is false, but if it improves readability, then that should be fine, since this is not performance critical code.

Mabeeck changed the title ~~Add a protect() function~~ Protect locally stored Acount Code on disk with system api Aug 12, 2026

Mabeeck force-pushed the windows-CryptProtectData branch 2 times, most recently from 60f2598 to 92890da Compare August 12, 2026 19:19

Mabeeck marked this pull request as ready for review August 12, 2026 19:56

Wunka added this to PRs to review Aug 14, 2026

Wunka moved this to High Priority in PRs to review Aug 14, 2026

Wunka suggested changes Aug 14, 2026

View reviewed changes

Comment thread src/protect.zig Outdated

Comment thread src/protect.zig Outdated

IntegratedQuantum requested changes Aug 16, 2026

View reviewed changes

IntegratedQuantum moved this from High Priority to In review in PRs to review Aug 16, 2026

IntegratedQuantum mentioned this pull request Aug 20, 2026

Run the tests in the CI both on Windows and on Linux #3535

Open

IntegratedQuantum requested changes Aug 20, 2026

View reviewed changes

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/authentication.zig Outdated

Wunka approved these changes Aug 20, 2026

View reviewed changes

Mabeeck force-pushed the windows-CryptProtectData branch from 026d0ee to 419ec15 Compare August 23, 2026 12:28

IntegratedQuantum requested changes Aug 23, 2026

View reviewed changes

Comment thread src/gui/windows/authentication/encrypt_with_password.zig Outdated

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/authentication.zig Outdated

Comment thread src/network/protection.zig

Mabeeck requested a review from IntegratedQuantum August 28, 2026 14:44

IntegratedQuantum requested changes Aug 30, 2026

View reviewed changes

Mabeeck added 11 commits August 30, 2026 15:12

Add a Cubyz protection api and integrate it

355794b

Due to line 411 in authentication.zig and some other reasons I have decided to rework this implementation to make use of a `protected` boolean attribute instead of creating tons of extra EncodingTypes.

Format

5e6f73c

All hail The Linter!

5201c5c

Microslop

c47ab58

Yes, I blame microslop for using an uppercase in their docs.

Add tests and improve unprotect error detection

9185e3e

Improve Tests and errordetection

8fc9cc6

Apparently errorcode 13 is for strings too short and errorcode 87 is for otherwise gibberish. The real reason I made this commit is that some github service was down when my last test ran and the only way to rerun it is to make another commit.

Improve based on received criticism

a1b7390

Format

acbe6a6

Move protect struct into authentication.zig

9a2d5e5

Use Impl structs

c0e64ea

Mabeeck added 18 commits August 30, 2026 15:12

Couple simple changes

549329d

Get rid of constCast in tests

2542404

Change Test

2cc59af

Consistency. Oh, and better to be safe than sorry.

No more quiet fallback on abnormal failure

872f803

Use allocator.dupe instead of @memcpy

4125aad

Get rid of complex defers in decryptFromPassword

3efe858

Initialize blob directly

bb85a85

Add checkbox

aec7238

Must test on linux

Move protections struct to separate file

7b6f395

Make canProtect a const bool

b129ee7

Change names to fit naming convention

f4e4036

Get rid of unnecessary pub

a9cb849

Update authentication.zig

ba419a5

Update authentication.zig

6d245a9

Update encrypt_with_password.zig

b0f5648

Remove error.Unsupported

354ea9e

If error. Unsupported is raised, then a programmer is using the API incorrectly. Errors like these warrant a panic and do not need to be recoverable.

Mini naming change

3717831

Remove "Please report to maintainers" notice

728c5a7

Mabeeck force-pushed the windows-CryptProtectData branch from 9646ce5 to 728c5a7 Compare August 30, 2026 14:41

Mabeeck added 2 commits August 30, 2026 17:51

Increase window hight

fd469e5

Move defer

b01321c

As I see it, this is the simplest way to have the defer directly below the recource creation. That makes one more allocation than necessary when shouldProtect is false, but if it improves readability, then that should be fine, since this is not performance critical code.

Uh oh!

Uh oh!

Conversation

Mabeeck commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mabeeck commented Aug 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mabeeck commented Aug 23, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mabeeck commented Aug 24, 2026

Uh oh!

IntegratedQuantum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

IntegratedQuantum Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

Mabeeck Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mabeeck commented Aug 11, 2026 •

edited

Loading

Mabeeck Aug 30, 2026 •

edited

Loading