From 8218fd584e4053848738a310258893e14c4ee10e Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Mon, 24 Aug 2026 15:27:06 +0200
Subject: TOFU host trust: SPKI fingerprint pinning, tests, forget-host

---
 src/bin/client/repl.rs | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

(limited to 'src/bin/client/repl.rs')

diff --git a/src/bin/client/repl.rs b/src/bin/client/repl.rs
index 194860b..91fd10e 100644
--- a/src/bin/client/repl.rs
+++ b/src/bin/client/repl.rs
@@ -31,7 +31,11 @@ pub struct ClientState {
 
 impl ClientState {
     pub fn new() -> Self {
-        let conn = database::init_db();
+        let conn = rusqlite::Connection::open(
+            std::env::var("CLIENT_DB").unwrap_or_else(|_| "client.db".to_string()),
+        )
+        .unwrap();
+        database::init_db(&conn);
         let default_ip = "127.0.0.1".to_string();
         let default_port = 11525;
         let last_host = database::get_last_host(&conn);
@@ -559,6 +563,25 @@ impl ClientState {
                                                 break 'outer;
                                             }
                                         }
+                                        "forget-host" => {
+                                            let target = if parts.len() > 1 {
+                                                parts[1].to_string()
+                                            } else if let Some(addr) = &self.addr {
+                                                addr.clone()
+                                            } else {
+                                                println!(
+                                                    "\nUsage: forget-host <ip>:<port> (or connect first)"
+                                                );
+                                                continue 'outer;
+                                            };
+                                            match database::forget_host(&self.conn, &target) {
+                                                Ok(_) => println!(
+                                                    "\nCleared trust and stored credentials for {}.",
+                                                    target
+                                                ),
+                                                Err(e) => println!("\nFailed to forget host: {}", e),
+                                            }
+                                        }
                                         _ => help(),
                                     }
                                     break;
@@ -713,6 +736,7 @@ fn get_commands() -> Vec<String> {
         "play".to_string(),
         "help".to_string(),
         "quit".to_string(),
+        "forget-host".to_string(),
     ]
 }
 
@@ -730,6 +754,7 @@ fn help() {
         info - show login info\r
         play <game> [bet] - start a game (e.g., play slots 50)\r
         help - show this message\r
+        forget-host [ip:port] - clear saved trust fingerprint and credentials\r
         quit - quit the program"
     );
 }
-- 
cgit v1.2.3