Revue account in a browser

On Revue's own server the pages are at revue.cleangame.dev/account; a self-hosted server has them at /account too, when it hosts Revue accounts. In the app, Settings → Accounts → Revue account → Manage in browser opens them. They come in English and Czech (the link at the top switches).

The pages manage the account and its connected services: the sign-ins to GitHub, Bitbucket, Forgejo, Jira and Slack that the account keeps for your computers. They stay end-to-end encrypted: the browser opens them with your password, as the app does. Your settings and favourites stay closed, and there's no way to review pull requests there. For that, use the Revue app.

Your password stays in your browser#

The browser makes your keys itself, with the same code as the Revue app (compiled to WebAssembly and served by the server). Your password, your account's vault key and your recovery key never leave the browser: the server gets the same scrambled login key and wrapped keys the app would send.

Making the keys takes a few seconds on purpose (it's what makes guessing a password slow): the page says Deriving your keys… meanwhile.

Create an account#

1. Open Create an account (from the sign-in page).
2. Type your email and a password of 12 characters or more; the hint under it says how strong it looks. Choose the language of the account's mails. A server that takes new accounts by invitation only asks for your invitation code.
3. Click Create account.
4. Your recovery key appears: RVK1- and 14 groups of letters and digits. Copy it or Download as a text file, keep it somewhere safe away from this computer, tick I've saved it somewhere safe and click Continue.
5. A 6-digit code arrives by mail. Type it and click Verify (Send again if it doesn't come; a wrong address: Start again).

Then sign in to the same account in the Revue app to bring your sign-ins into it.

Sign in#

Type your email and password and click Sign in. With two-step sign-in on, type the code from your authenticator app, or one of your backup codes. With a passkey added (in the app), Use a passkey instead stands in for the code: your browser asks for the passkey right on the page.

The browser stays signed in until you click Sign out, for at most 8 hours, and 15 minutes after you last used the pages. Tick Keep me signed in on this browser before signing in to stay signed in for 30 days instead (not on a shared computer). Your connected services still close after 15 minutes, and changing your password or email still asks for it again. It shows in the app's list of computers as a Web browser (under Computers and browsers here, marked kept signed in when ticked), so you can sign it out from there too.

Sign Revue in from the browser#

When you click Sign in with browser in the app, this browser opens a page asking Sign in to Revue on your computer?, with the computer's name as the app gave it. Signed out, it asks you to sign in first, then comes back to it. Approve only if you just asked for it in Revue on that computer:

1. Type your password (and your authenticator code, with two-step sign-in on) and click Approve.
2. The page opens your accounts with the password, here in the browser, and hands their key to Revue encrypted for that sign-in only: the server sees neither the password nor the key.
3. The browser goes back to Revue, which signs in by itself. You can close the page.

Cancel tells Revue no. The request lasts 5 minutes and works once, only in the browser that opened it, and only while that browser stays signed in. The computer then shows under Computers like any other: remove it there to sign it out.

Manage your account#

Signed in, the page shows your account in sections, picked from the menu beside it (a row of tabs on a phone): Connected services, Security (password, two-step sign-in, recovery key, passkeys), Computers, Email and mails, and Activity and data. Each has its own address (/account#security, …), so the browser's back button and bookmarks work.

• Email: a new address gets a code to confirm it; the old one is told.
• Language of mails: English or Czech.
• Password: type the current and the new one. Your other computers are signed out and ask for the new password; nothing in the account changes.
• Recovery key: Make a new recovery key shows a new one; the old one stops working.
• Two-step sign-in: Turn on shows a QR code and the key to type into your authenticator app, then asks for a code from it and shows 10 backup codes (each works once). Later: New backup codes, or Turn off.
• Computers and browsers: everything signed in to your account. Rename one, or Remove it to sign it out at once (a lost laptop, say).
• Passkeys (when the server takes them): rename or remove a passkey. Passkeys are added in the app.
• Activity: sign-ins and security changes of the last 90 days, with where they came from.
• Your data: Download my data saves everything the server keeps about your account as a file; your sign-ins stay encrypted in it.
• Delete the account: deletes it and everything in it at once. Each computer signed in then offers to keep its accounts on that computer only.

Changes to your security (password, email, recovery key, two-step sign-in, passkeys, deletion) ask for your password again, and your authenticator code when two-step sign-in is on.

Connected services#

The sign-ins your account keeps: every computer signed in to the account uses them. Add one here, say on a new computer before installing Revue, and the app has it on its next sync; remove one, and it's gone from every computer.

1. Click Show my connected services and type your password (and your authenticator code, with two-step sign-in on). The browser opens the account's vault with it, as the app does; it stays open for 15 minutes, or until you click Close the vault or leave the page.
2. The list shows each sign-in: the service, whose account it is and on which server or site. Remove deletes it from the account, so from every computer at its next sync. It doesn't revoke the token on the service's side: do that there if you want it gone for good. Reconnect signs in to it again (a token that expired or was revoked, or one with new scopes): the form below opens for that service, with its server or site and email filled in. Sign in as the same account, by either way, and its sign-in is replaced in place on every computer at its next sync (Bitbucket keeps its workspaces unless you type new ones). Signing in as another account says so and changes nothing; Cancel goes back to adding.
3. Add a service: pick the service and how: Sign in with the service where the account server offers it (picked first), else Paste a token.

Paste a token works for every service. Make the token on the service with the scopes the page lists under the field:

The page checks the token with the service and finds whose it is, then encrypts it in the browser and uploads it. Jira, and Forgejo servers that don't let web pages in, can't be checked from a browser: the sign-in is added as it is, and the Revue app checks it when it next starts (one that doesn't work then shows up as a sign-in to redo).

Sign in with the service is there when the account server offers it (on a self-hosted server, once its operator sets that service's OAuth app). A window opens at the service; approve Revue there, and the page adds the sign-in by itself (Open it again if the window was blocked or closed). Forgejo: a server this account server lists signs in at once. For any other one, the page shows how to make an OAuth app for Revue on it (Settings → Applications, the redirect address to paste, Confidential client unticked) and asks for its Client ID; one your Revue account already knows (from the app, or a sign-in there) is filled in. The account server reaches only public https servers. GitHub asks which of your accounts to use; the other services sign in the account this browser is signed in to there, so to add another one, switch to it on the service (or sign out there) first. Signing in as an account that's connected already says so. This sign-in goes through the account server: it swaps the service's code for the token and hands the token to your browser, which encrypts it. For that moment the server sees the token. It never stores or logs it, and only the browser that started the sign-in, signed in to your account, can take it, once, within 10 minutes. Pasting a token keeps it end-to-end.

The web version at /app#

Revue's web version at /app of the same server (revue.cleangame.dev/app on Revue's own) signs in with your Revue account instead of asking for each service's token again:

• Signed in to your account in this browser (on these pages): the welcome screen says Signed in as … and asks only for your Revue account password (and your authenticator code, with two-step sign-in on). Click Bring my sign-ins. Sign in to a service instead shows the services' own sign-ins.
• Not signed in: click Sign in with your Revue account and type your email and password (and the code when it asks). This signs the browser in to the account pages too.

The browser then opens your connected services itself, as these pages do (it shows Deriving your keys… for a few seconds), and hands each GitHub, Bitbucket, Forgejo, Jira and Slack sign-in to the web version as if you'd pasted its token. The page reloads with your pull requests.

Why the password, even signed in: your sign-ins are end-to-end encrypted, and the browser's session can't open them. Only your password, your recovery key or a computer signed in to the account can. The password stays in the browser, and so does your account's key: kept split (below) to renew your OAuth sign-ins.

• What comes along: sign-ins to the services and servers the web version connects to, Slack's too (its replies and announcements then work in the web version), and your favourites. Your settings stay out. One the web version already has is skipped; open Settings → Accounts later and click Bring my sign-ins again for sign-ins added to your account since.
• Favourites (starred pull requests, repositories and projects) follow both ways while the web version holds your account's key (below), as on a computer with favourites sync on: your account's are added to the web version's when it opens and whenever you come back to its tab, an unstar on a computer takes one out, and starring or unstarring in the web version goes to your account, encrypted in the browser, so your computers show it too. Stars the web version had of its own go to your account the first time. Like the rest of the web version's settings, its favourites are kept with its session on its server.
• Slack: a rotating Slack token (an app with token rotation on) isn't renewed by the web version: it leaves when it runs out, until a computer renewed it and you bring it again.
• OAuth sign-ins (made with Sign in with …) are renewed by the web version itself, a few minutes before their access token runs out (about an hour for Forgejo, Jira and Bitbucket, 8 hours for GitHub), in turn with your computers: like a computer, it first looks whether one of them renewed already and takes its new tokens, else holds the sign-in's item for a moment, renews it with the app it was made with (on the web version's server), and saves the new tokens back to your account, encrypted in the browser. Your computers then take them from the account, so none of you is signed out. One that has already run out in your account when you bring it stays behind: open Revue on a computer to renew it, then bring it again. Personal and API tokens stay until you sign out.
• Your account's key, split in two, is what lets the web version renew after a reload: the browser keeps the key encrypted under a random key of its own in its storage, and gives that random key to the web version's server, which keeps it encrypted with the session. Neither half opens anything alone. Sign out of Revue account drops both; Sign out everywhere, or the session ending, drops the server's. Without both halves (another browser, cleared storage), the web version stops renewing: its OAuth sign-ins leave when they run out, and bringing them again asks for your password. See Privacy and security for what that trade means.
• The browser's session at your account stays in use while the web version is open with sign-ins to renew (for at most 8 hours, or 30 days when you ticked Keep me signed in on this browser on these pages). It may then list your encrypted items, lease one and write it over its version (what saving a renewal or your favourites takes), and add one (your favourites, when your account has none yet), but not remove one without your password. Once it ends, renewals stop as above.
• Signing out: Settings → Accounts → Sign out of Revue account signs this browser out of your account, drops both halves of your account's key, and takes the sign-ins it brought out of the web version. Your account keeps them, and your computers aren't signed out.
• Signing in to a service in the web version keeps that sign-in in the web version only: it doesn't go to your account.

Forgot your password?#

1. On the sign-in page, click Forgot your password?, type your email and click Send the code.
2. Type the 6-digit code from the mail (and your authenticator code, if two-step sign-in is on).
3. Then either:
   • With your recovery key: type it and a new password. Everything in your account stays.
   • Without it, start over: type a new password and tick the box. The account is emptied, and a new recovery key is shown; sign in to each service in the app once more. Computers still signed in can put their copy back.

Every computer and browser is signed out afterwards: sign in again with the new password. A computer still signed in to the Revue app can also change the password there, keeping everything, without the recovery key.

Safety#

• The pages run only the server's own scripts, can't be shown inside another site, and are never cached.
• The browser's session is a cookie only the server can read; the page's script never sees it.
• Your connected services are opened, checked and encrypted in a background worker, out of the page's reach; the page itself never holds a token.
• The web version at /app is a page of the same server: it uses this browser's session to open your sign-ins in the browser, and passes them on to the web version's own session, as pasted tokens (an OAuth one with its refresh token, to renew it). The session's cookie never reaches the web version. It asks for renewals when it opens the vault or signs in: for the rest of that session, this browser may then lease an item and write it over its version with the lease (what saving a renewal or the favourites takes), add an item (the favourites, when the account has none), besides listing the items; removing still needs the password within 15 minutes.
• Like the app's passkey page, these pages are code your account server sends. Use them with a server you trust: on Revue's own, that's the project's. Signing in through the Revue app doesn't depend on any page of the server.

See also: Revue account in the app, and Self-hosting the server.