Hub suggests to register device, App shows "Access denied"

[infeo]

Please agree to the following

• I have searched existing issues for duplicates
• I agree to follow this project's Code of Conduct

Summary

App unlock with a different user than the device register user, Hub says to register device, but is impossible in app.

System Setup

- Hub: 96582145661fb0a29ac36791e33e4bf02386593e
- Keycloak: 19.0.2
- Cryptomator (Desktop/Android/iOS): Desktop 1.6.15

Steps to Reproduce

1. Create two users A and B
2. Register device with user A (during unlock)
3. logout A
4. unlock any other hub vault, login with B

Expected Behavior

Message shown: Device registered for different user

Actual Behavior

Opened webpage says to register device in app, app says "Access denied"

Reproducibility

Always

Relevant Log Output

No response

Anything else?

[infeo]

The only easy fix is addding additional text to the screens.

The problem is, the current authorized user cannot determine if the used device is not registered at all or "only" already registered for another user. This would be important for the frontend to display the correct information.
The app would either need an additional backend request, because the locally existing certifiacte does not contain a user id. Or the user id is stored along side the cert in the key chain, which require a good amount of changes: Currently the cert is eagerly created and the user id should only be stored if the unlock is successful/device not registered.

But, this is also an edge case. We assume, that a device (...user account) is normally only used by one user.

[tobihagemann]

I'm pretty sure this can be determined on the backend without an additional HTTP request. When unlocking the vault, we know which user is trying to unlock the vault:

hub/backend/src/main/java/org/cryptomator/hub/api/VaultResource.java

Line 240 in dbabef3

var access = AccessToken.unlock(vaultId, deviceId, jwt.getSubject());

This database call can be changed so that the method can fail for different reasons (like "not existing at all" or "belongs to different user"):

hub/backend/src/main/java/org/cryptomator/hub/entities/AccessToken.java

Lines 50 to 56 in dbabef3

	public static AccessToken unlock(String vaultId, String deviceId, String userId) {
	try {
	return find("#AccessToken.get", Parameters.with("deviceId", deviceId).and("vaultId", vaultId).and("userId", userId)).firstResult();
	} catch (NoResultException e) {
	return null;
	}
	}