v2.4.0: key stored credentials by certificate fingerprint

9 files changed, 307 insertions, 49 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 3f96b7b..2a70ba2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,6 +74,12 @@
 ## TLS / TOFU
 - See `src/tofu.rs` for the trust model. The fingerprint is over the
   certificate's SPKI, not the whole certificate.
+- Credentials are keyed by the SPKI fingerprint, not by address: one login
+  covers every address that presents the same key. Never look credentials up
+  by host.
+- `forget_host` removes one address. Drop the credential only when no address
+  with that fingerprint remains, or two addresses for one server would stop
+  sharing a login.
 - `save_host` must not wipe the fingerprint column. Use `ON CONFLICT ...
   DO UPDATE SET last_used` — never `INSERT OR REPLACE`.
 
diff --git a/Cargo.toml b/Cargo.toml
index c064cc3..e0e17a7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "zagan-bet"
-version = "2.3.2"
+version = "2.4.0"
 edition = "2024"
 
 [dependencies]
diff --git a/docs/SERVER_SETUP.md b/docs/SERVER_SETUP.md
index 62d1a9c..37d55b1 100644
--- a/docs/SERVER_SETUP.md
+++ b/docs/SERVER_SETUP.md
@@ -69,11 +69,19 @@ On first contact the client prints the SPKI fingerprint and pins it. If you
 regenerate the server identity, the client will reject the new key; run
 `forget-host` in the client if the change is intentional.
 
+Credentials are stored against the pinned fingerprint, not the address. Log in
+once through `127.0.0.1:11525` and connecting through the machine's LAN address
+will authenticate automatically, because both addresses present the same key.
+`forget-host` removes one address; the stored login is only dropped when the
+last address for that key is forgotten.
+
 ## Database
 
 The server creates `server.db` in the current directory on first use. It holds
 users, balances, and the per-game `plays` audit. The client keeps its own
-`client.db` for host fingerprints and stored credentials.
+`client.db` for host fingerprints and stored credentials. Databases from before
+the fingerprint-keyed credentials are migrated on startup; rows whose host was
+already forgotten cannot be re-keyed and require one fresh login.
 
 During development, delete both files to reset users, balances, history, and
 trust:
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 15b060c..fe302a9 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -124,6 +124,20 @@ Use an 80-column terminal because several output lines are width-sensitive.
    one row with `winnings = 0`, `details.result = "abandoned"` and
    `details.reason = "server_restart"`.
 
+## Manual identity / credential checklist
+
+1. Connect through one address, `register` and `login`. `hosts` shows the
+   fingerprint.
+2. `disconnect`, then `connect` through another address that reaches the same
+   server (for example `10.0.0.100` when you first used `127.0.0.1`). The client
+   must print `Authenticated as <user>` without asking for a password.
+3. `hosts` must list both addresses on one line under one fingerprint.
+4. `forget-host <first address>` must say the credentials were kept and name
+   the remaining address. Connecting through the remaining address still
+   authenticates automatically.
+5. `forget-host <last address>` must say trust and credentials were cleared.
+   The next connect is a first contact and does not authenticate.
+
 ## Manual server checks
 
 - Register, log out, log in again (bcrypt path).
diff --git a/src/bin/client/connection.rs b/src/bin/client/connection.rs
index 44cfea9..ec5642c 100644
--- a/src/bin/client/connection.rs
+++ b/src/bin/client/connection.rs
@@ -56,10 +56,10 @@ pub fn connect(
 
     // TOFU: persist the fingerprint on first contact.
     if !unsafe_mode {
-        if let Some(fp) = observed {
+        if let Some(fp) = observed.as_deref() {
             if database::get_fingerprint(conn, addr).is_none() {
-                database::save_fingerprint(conn, addr, &fp)?;
-                for line in first_contact_lines(addr, &fp) {
+                database::save_fingerprint(conn, addr, fp)?;
+                for line in first_contact_lines(addr, fp) {
                     println!("{}", line);
                 }
             }
@@ -80,21 +80,25 @@ pub fn connect(
         elapsed.as_secs_f64() * 1000.0
     );
 
-    if let Some((username, password)) = database::get_credentials(conn, addr) {
-        let auth_msg = format!("AUTH {} {}", username, password);
-        tls.write_line(&auth_msg)?;
-        let mut auth_response = String::new();
-        tls.read_line(&mut auth_response)?;
-        if auth_response.trim().starts_with("OK") {
-            println!("Authenticated as {}", username);
-            Ok((tls, Some(username)))
-        } else {
+    // Credentials are stored per server identity, so any address presenting
+    // this certificate key can log in with the same stored account.
+    let identity = observed
+        .clone()
+        .or_else(|| database::get_fingerprint(conn, addr));
+    if let Some(identity) = identity {
+        if let Some((username, password)) = database::get_credentials(conn, &identity) {
+            let auth_msg = format!("AUTH {} {}", username, password);
+            tls.write_line(&auth_msg)?;
+            let mut auth_response = String::new();
+            tls.read_line(&mut auth_response)?;
+            if auth_response.trim().starts_with("OK") {
+                println!("Authenticated as {}", username);
+                return Ok((tls, Some(username)));
+            }
             println!("Authentication failed: {}", auth_response.trim());
-            Ok((tls, None))
         }
-    } else {
-        Ok((tls, None))
     }
+    Ok((tls, None))
 }
 
 /// Wrapper so TLS handshake failures surface as errors with their message
diff --git a/src/bin/client/repl.rs b/src/bin/client/repl.rs
index 9af4ea9..d973596 100644
--- a/src/bin/client/repl.rs
+++ b/src/bin/client/repl.rs
@@ -245,7 +245,19 @@ impl ClientState {
                 Effect::ForgetHost(target) => {
                     self.commit_prompt_line();
                     match database::forget_host(&self.conn, &target) {
-                        Ok(_) => println!("Cleared trust and stored credentials for {}.", target),
+                        Ok(outcome) if outcome.credentials_removed => println!(
+                            "Cleared trust and stored credentials for {}.",
+                            target
+                        ),
+                        Ok(outcome) => {
+                            println!("Cleared trust for {}.", target);
+                            if !outcome.siblings.is_empty() {
+                                println!(
+                                    "Stored credentials kept: this server is still reachable as {}.",
+                                    outcome.siblings.join(", ")
+                                );
+                            }
+                        }
                         Err(error) => println!("Failed to forget host: {}", error),
                     }
                 }
@@ -506,12 +518,17 @@ impl ClientState {
             let response = response.trim();
 
             if response.starts_with("OK") {
-                if let Some(addr) = &self.addr {
-                    if let Err(error) =
-                        database::save_credentials(&self.conn, addr, &username, &hashed)
-                    {
-                        println!("Failed to save credentials: {}", error);
+                match self.trusted_identity() {
+                    Some(identity) => {
+                        if let Err(error) =
+                            database::save_credentials(&self.conn, &identity, &username, &hashed)
+                        {
+                            println!("Failed to save credentials: {}", error);
+                        }
                     }
+                    None => println!(
+                        "Credentials not saved: no verified certificate identity for this host."
+                    ),
                 }
                 self.core.set_logged_in(Some(username.clone()));
                 println!("Logged in as {}", username);
@@ -567,14 +584,27 @@ impl ClientState {
             return;
         }
         let hashed = format!("{:x}", Sha256::digest(password.as_bytes()));
-        if let Some(addr) = &self.addr {
-            match database::save_credentials(&self.conn, addr, &username, &hashed) {
-                Ok(_) => println!("Credentials saved for {}", addr),
-                Err(error) => println!("Failed to save credentials: {}", error),
-            }
+        let Some(identity) = self.trusted_identity() else {
+            println!(
+                "No verified certificate for this host. Connect first so its key can be trusted."
+            );
+            return;
+        };
+        match database::save_credentials(&self.conn, &identity, &username, &hashed) {
+            Ok(_) => println!(
+                "Credentials saved for server {} (every address with this key).",
+                short_fingerprint(&identity)
+            ),
+            Err(error) => println!("Failed to save credentials: {}", error),
         }
     }
 
+    /// Certificate identity of the current address, once it has been verified.
+    fn trusted_identity(&self) -> Option<String> {
+        let addr = self.addr.as_deref()?;
+        database::get_fingerprint(&self.conn, addr)
+    }
+
     fn list_hosts(&mut self) {
         let hosts = database::get_all_hosts(&self.conn);
         for line in host_lines(&hosts) {
@@ -583,6 +613,11 @@ impl ClientState {
     }
 }
 
+/// First few hex characters of a fingerprint, enough to tell servers apart.
+fn short_fingerprint(fingerprint: &str) -> String {
+    fingerprint.chars().take(16).collect()
+}
+
 fn style_roulette_number(text: &str, number: u8) -> String {
     match roulette_color(number) {
         "red" => text.red().to_string(),
diff --git a/src/client/database.rs b/src/client/database.rs
index e1cedaf..04a271a 100644
--- a/src/client/database.rs
+++ b/src/client/database.rs
@@ -1,5 +1,15 @@
 use rusqlite::Connection;
 
+/// What `forget_host` did with the stored credential.
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct ForgetOutcome {
+    /// Addresses that still present the same certificate key.
+    pub siblings: Vec<String>,
+    /// True when no address for that server remained, so the credential was
+    /// dropped with it.
+    pub credentials_removed: bool,
+}
+
 pub fn init_db(conn: &Connection) {
     conn.execute(
         "CREATE TABLE IF NOT EXISTS hosts (
@@ -12,9 +22,15 @@ pub fn init_db(conn: &Connection) {
     .unwrap();
     // Migration for databases created before TOFU trust.
     let _ = conn.execute("ALTER TABLE hosts ADD COLUMN fingerprint TEXT", []);
+
+    // Credentials belong to a server identity (the certificate key), not to a
+    // single address, so every address that presents the same key shares them.
+    if has_column(conn, "credentials", "host") {
+        migrate_credentials_to_fingerprints(conn);
+    }
     conn.execute(
         "CREATE TABLE IF NOT EXISTS credentials (
-            host TEXT PRIMARY KEY,
+            fingerprint TEXT PRIMARY KEY,
             username TEXT NOT NULL,
             password TEXT NOT NULL
         )",
@@ -23,6 +39,42 @@ pub fn init_db(conn: &Connection) {
     .unwrap();
 }
 
+fn has_column(conn: &Connection, table: &str, column: &str) -> bool {
+    let Ok(mut statement) = conn.prepare(&format!("PRAGMA table_info({table})")) else {
+        return false;
+    };
+    let Ok(rows) = statement.query_map([], |row| row.get::<_, String>(1)) else {
+        return false;
+    };
+    rows.flatten().any(|name| name == column)
+}
+
+/// Re-key host-bound credentials by the fingerprint of their host.
+///
+/// Rows whose host was already forgotten have no identity to attach to and are
+/// dropped; those addresses have to re-authenticate once.
+fn migrate_credentials_to_fingerprints(conn: &Connection) {
+    let tx = conn.unchecked_transaction().unwrap();
+    tx.execute_batch(
+        "DROP TABLE IF EXISTS credentials_by_identity;
+         CREATE TABLE credentials_by_identity (
+             fingerprint TEXT PRIMARY KEY,
+             username TEXT NOT NULL,
+             password TEXT NOT NULL
+         );
+         INSERT OR REPLACE INTO credentials_by_identity (fingerprint, username, password)
+             SELECT h.fingerprint, c.username, c.password
+             FROM credentials c
+             JOIN hosts h ON h.host = c.host
+             WHERE h.fingerprint IS NOT NULL
+             ORDER BY h.last_used ASC, h.host ASC;
+         DROP TABLE credentials;
+         ALTER TABLE credentials_by_identity RENAME TO credentials;",
+    )
+    .unwrap();
+    tx.commit().unwrap();
+}
+
 pub fn get_last_host(conn: &Connection) -> Option<String> {
     let mut stmt = conn
         .prepare("SELECT host FROM hosts ORDER BY last_used DESC LIMIT 1")
@@ -44,24 +96,27 @@ pub fn save_host(conn: &Connection, host: &str) {
     .unwrap();
 }
 
+/// Store credentials for a server identity (certificate fingerprint).
 pub fn save_credentials(
     conn: &Connection,
-    host: &str,
+    fingerprint: &str,
     username: &str,
     password: &str,
 ) -> Result<(), Box<dyn std::error::Error>> {
     conn.execute(
-        "INSERT OR REPLACE INTO credentials (host, username, password) VALUES (?1, ?2, ?3)",
-        (host, username, password),
+        "INSERT OR REPLACE INTO credentials (fingerprint, username, password)
+         VALUES (?1, ?2, ?3)",
+        (fingerprint, username, password),
     )?;
     Ok(())
 }
 
-pub fn get_credentials(conn: &Connection, host: &str) -> Option<(String, String)> {
+/// Credentials for a server identity, regardless of which address reached it.
+pub fn get_credentials(conn: &Connection, fingerprint: &str) -> Option<(String, String)> {
     let mut stmt = conn
-        .prepare("SELECT username, password FROM credentials WHERE host = ?1")
+        .prepare("SELECT username, password FROM credentials WHERE fingerprint = ?1")
         .unwrap();
-    let mut rows = stmt.query([host]).unwrap();
+    let mut rows = stmt.query([fingerprint]).unwrap();
     if let Ok(Some(row)) = rows.next() {
         let username: String = row.get(0).unwrap();
         let password: String = row.get(1).unwrap();
@@ -98,11 +153,43 @@ pub fn save_fingerprint(
     Ok(())
 }
 
-/// Remove all trust and credentials for a host ("forget this host").
-pub fn forget_host(conn: &Connection, host: &str) -> Result<(), rusqlite::Error> {
+/// Addresses that present `fingerprint`, most recently used first.
+pub fn hosts_with_fingerprint(conn: &Connection, fingerprint: &str) -> Vec<String> {
+    let mut stmt = conn
+        .prepare("SELECT host FROM hosts WHERE fingerprint = ?1 ORDER BY last_used DESC")
+        .unwrap();
+    let rows = stmt.query_map([fingerprint], |row| row.get::<_, String>(0)).unwrap();
+    rows.filter_map(|row| row.ok()).collect()
+}
+
+/// Remove trust for one address ("forget this host").
+///
+/// Credentials are shared by every address with the same certificate key, so
+/// they are only dropped once the last such address is forgotten.
+pub fn forget_host(conn: &Connection, host: &str) -> Result<ForgetOutcome, rusqlite::Error> {
+    let fingerprint = get_fingerprint(conn, host);
     conn.execute("DELETE FROM hosts WHERE host = ?1", [host])?;
-    conn.execute("DELETE FROM credentials WHERE host = ?1", [host])?;
-    Ok(())
+
+    let Some(fingerprint) = fingerprint else {
+        return Ok(ForgetOutcome::default());
+    };
+
+    let siblings = hosts_with_fingerprint(conn, &fingerprint);
+    if siblings.is_empty() {
+        conn.execute(
+            "DELETE FROM credentials WHERE fingerprint = ?1",
+            [&fingerprint],
+        )?;
+        return Ok(ForgetOutcome {
+            siblings,
+            credentials_removed: true,
+        });
+    }
+
+    Ok(ForgetOutcome {
+        siblings,
+        credentials_removed: false,
+    })
 }
 
 /// List all remembered hosts with their fingerprints.
@@ -110,8 +197,9 @@ pub fn get_all_hosts(conn: &Connection) -> Vec<(String, Option<String>)> {
     let mut stmt = conn
         .prepare("SELECT host, fingerprint FROM hosts ORDER BY last_used DESC")
         .unwrap();
-    let rows = stmt
-        .query_map([], |row| Ok((row.get(0)?, row.get(1)?)))
-        .unwrap();
+    let rows = stmt.query_map([], |row| {
+        Ok((row.get(0)?, row.get(1)?))
+    })
+    .unwrap();
     rows.filter_map(|r| r.ok()).collect()
 }
diff --git a/src/client/ui.rs b/src/client/ui.rs
index 4ab0759..9d65087 100644
--- a/src/client/ui.rs
+++ b/src/client/ui.rs
@@ -43,7 +43,7 @@ const COMMANDS: &[CommandHelp] = &[
     CommandHelp {
         name: "setcred",
         usage: "setcred",
-        description: "set credentials for a host",
+        description: "set credentials for the server's certificate key",
     },
     CommandHelp {
         name: "logout",
@@ -73,7 +73,7 @@ const COMMANDS: &[CommandHelp] = &[
     CommandHelp {
         name: "forget-host",
         usage: "forget-host [ip:port]",
-        description: "clear saved trust fingerprint and credentials",
+        description: "clear trust for one address (credentials stay while the key is in use)",
     },
     CommandHelp {
         name: "hosts",
diff --git a/tests/storage.rs b/tests/storage.rs
index b6e1369..19936c2 100644
--- a/tests/storage.rs
+++ b/tests/storage.rs
@@ -20,21 +20,124 @@ fn client_credentials_roundtrip() {
     let (_, conn) = tmp_db("creds");
     client_database::init_db(&conn);
 
-    assert_eq!(client_database::get_credentials(&conn, "h1"), None);
-    client_database::save_credentials(&conn, "h1", "alice", "pw").unwrap();
+    let identity = "5a15c712230831cb";
+    assert_eq!(client_database::get_credentials(&conn, identity), None);
+    client_database::save_credentials(&conn, identity, "alice", "pw").unwrap();
     assert_eq!(
-        client_database::get_credentials(&conn, "h1"),
+        client_database::get_credentials(&conn, identity),
         Some(("alice".to_string(), "pw".to_string()))
     );
     // Overwrite works.
-    client_database::save_credentials(&conn, "h1", "alice", "pw2").unwrap();
+    client_database::save_credentials(&conn, identity, "alice", "pw2").unwrap();
     assert_eq!(
-        client_database::get_credentials(&conn, "h1"),
+        client_database::get_credentials(&conn, identity),
         Some(("alice".to_string(), "pw2".to_string()))
     );
 }
 
 #[test]
+fn credentials_belong_to_the_certificate_not_the_address() {
+    let (_, conn) = tmp_db("creds-identity");
+    client_database::init_db(&conn);
+
+    // Two addresses for one server, one address for another.
+    client_database::save_host(&conn, "10.0.0.100:11525");
+    client_database::save_host(&conn, "127.0.0.1:11525");
+    client_database::save_host(&conn, "other.example:11525");
+    client_database::save_fingerprint(&conn, "10.0.0.100:11525", "server-a").unwrap();
+    client_database::save_fingerprint(&conn, "127.0.0.1:11525", "server-a").unwrap();
+    client_database::save_fingerprint(&conn, "other.example:11525", "server-b").unwrap();
+
+    client_database::save_credentials(&conn, "server-a", "alice", "pw").unwrap();
+
+    assert_eq!(
+        client_database::get_credentials(&conn, "server-a"),
+        Some(("alice".to_string(), "pw".to_string())),
+        "one login covers every address with the same key"
+    );
+    assert_eq!(
+        client_database::get_credentials(&conn, "server-b"),
+        None,
+        "a different key must not inherit the credentials"
+    );
+}
+
+#[test]
+fn forgetting_one_address_keeps_the_shared_credentials() {
+    let (_, conn) = tmp_db("creds-forget");
+    client_database::init_db(&conn);
+
+    client_database::save_host(&conn, "10.0.0.100:11525");
+    client_database::save_host(&conn, "127.0.0.1:11525");
+    client_database::save_fingerprint(&conn, "10.0.0.100:11525", "server-a").unwrap();
+    client_database::save_fingerprint(&conn, "127.0.0.1:11525", "server-a").unwrap();
+    client_database::save_credentials(&conn, "server-a", "alice", "pw").unwrap();
+
+    let outcome = client_database::forget_host(&conn, "10.0.0.100:11525").unwrap();
+    assert!(!outcome.credentials_removed);
+    assert_eq!(outcome.siblings, vec!["127.0.0.1:11525".to_string()]);
+    assert_eq!(
+        client_database::get_credentials(&conn, "server-a"),
+        Some(("alice".to_string(), "pw".to_string())),
+        "the server is still reachable, so the login is still useful"
+    );
+
+    let outcome = client_database::forget_host(&conn, "127.0.0.1:11525").unwrap();
+    assert!(outcome.credentials_removed);
+    assert!(outcome.siblings.is_empty());
+    assert_eq!(client_database::get_credentials(&conn, "server-a"), None);
+}
+
+#[test]
+fn legacy_host_keyed_credentials_are_rekeyed_by_fingerprint() {
+    let (_, conn) = tmp_db("creds-migrate");
+    conn.execute_batch(
+        "CREATE TABLE hosts (
+             host TEXT PRIMARY KEY,
+             last_used DATETIME DEFAULT CURRENT_TIMESTAMP,
+             fingerprint TEXT
+         );
+         CREATE TABLE credentials (
+             host TEXT PRIMARY KEY,
+             username TEXT NOT NULL,
+             password TEXT NOT NULL
+         );
+         INSERT INTO hosts (host, last_used, fingerprint)
+             VALUES ('a:1', '2020-01-01 00:00:00', 'server-a');
+         INSERT INTO hosts (host, last_used, fingerprint)
+             VALUES ('b:2', '2021-01-01 00:00:00', 'server-a');
+         INSERT INTO hosts (host, last_used, fingerprint)
+             VALUES ('c:3', '2022-01-01 00:00:00', NULL);
+         INSERT INTO credentials VALUES ('a:1', 'alice', 'old');
+         INSERT INTO credentials VALUES ('b:2', 'alice', 'recent');
+         INSERT INTO credentials VALUES ('c:3', 'carol', 'untrusted');",
+    )
+    .unwrap();
+
+    client_database::init_db(&conn);
+
+    assert_eq!(
+        client_database::get_credentials(&conn, "server-a"),
+        Some(("alice".to_string(), "recent".to_string())),
+        "the most recently used address wins when legacy rows disagree"
+    );
+    assert_eq!(
+        client_database::get_credentials(&conn, "carol"),
+        None,
+        "a host with no trusted key cannot be re-keyed"
+    );
+
+    // The old table is gone: the column set is the fingerprint schema.
+    let mut statement = conn.prepare("PRAGMA table_info(credentials)").unwrap();
+    let columns: Vec<String> = statement
+        .query_map([], |row| row.get(1))
+        .unwrap()
+        .filter_map(|row| row.ok())
+        .collect();
+    assert_eq!(columns, vec!["fingerprint", "username", "password"]);
+}
+
+#[test]
 fn client_last_host_tracking() {
     let (_, conn) = tmp_db("hosts");
     client_database::init_db(&conn);