v2.4.0: key stored credentials by certificate fingerprint

2 files changed, 23 insertions, 1 deletions

diff --git a/docs/SERVER_SETUP.md b/docs/SERVER_SETUP.md
index 62d1a9c..37d55b1 100644
--- a/docs/SERVER_SETUP.md
+++ b/docs/SERVER_SETUP.md
@@ -69,11 +69,19 @@ On first contact the client prints the SPKI fingerprint and pins it. If you
 regenerate the server identity, the client will reject the new key; run
 `forget-host` in the client if the change is intentional.
 
+Credentials are stored against the pinned fingerprint, not the address. Log in
+once through `127.0.0.1:11525` and connecting through the machine's LAN address
+will authenticate automatically, because both addresses present the same key.
+`forget-host` removes one address; the stored login is only dropped when the
+last address for that key is forgotten.
+
 ## Database
 
 The server creates `server.db` in the current directory on first use. It holds
 users, balances, and the per-game `plays` audit. The client keeps its own
-`client.db` for host fingerprints and stored credentials.
+`client.db` for host fingerprints and stored credentials. Databases from before
+the fingerprint-keyed credentials are migrated on startup; rows whose host was
+already forgotten cannot be re-keyed and require one fresh login.
 
 During development, delete both files to reset users, balances, history, and
 trust:
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 15b060c..fe302a9 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -124,6 +124,20 @@ Use an 80-column terminal because several output lines are width-sensitive.
    one row with `winnings = 0`, `details.result = "abandoned"` and
    `details.reason = "server_restart"`.
 
+## Manual identity / credential checklist
+
+1. Connect through one address, `register` and `login`. `hosts` shows the
+   fingerprint.
+2. `disconnect`, then `connect` through another address that reaches the same
+   server (for example `10.0.0.100` when you first used `127.0.0.1`). The client
+   must print `Authenticated as <user>` without asking for a password.
+3. `hosts` must list both addresses on one line under one fingerprint.
+4. `forget-host <first address>` must say the credentials were kept and name
+   the remaining address. Connecting through the remaining address still
+   authenticates automatically.
+5. `forget-host <last address>` must say trust and credentials were cleared.
+   The next connect is a first contact and does not authenticate.
+
 ## Manual server checks
 
 - Register, log out, log in again (bcrypt path).