dsh-auth-lock

Usage

Login and lock

• First visit: create a 4–16 character password.
• Later visits: enter the password to log in.
• The DSH Settings panel contains a standalone Access Lock section for timeout and password management.
• The right-edge control rail keeps only the immediate lock action.
• After login the page reloads automatically; if authentication started from another protected HTML page, the browser returns to that page.

Change the password

Open Settings → Access Lock and enter:

1. the current password;
2. the new password;
3. the new password again;
4. Save.

The Host creates a new salt and verifier, revokes all old sessions, and issues a fresh cookie to the current browser.

Forgotten password

The verifier is irreversible, so the original password cannot be recovered. Reset Auth Lock on the computer running DSH.

Stop dsh web, then run:

dsh plugin --profile web exec dsh-auth-lock-reset -- --yes

Restart DSH:

dsh web

The next visit starts first-run password setup again.

For a custom state path:

dsh plugin --profile web exec dsh-auth-lock-reset -- \
  --path /absolute/path/auth-lock.json \
  --yes

The command deletes only the Auth Lock state file. It does not remove the DSH Profile, sessions, credentials, projects, or other plugin data. It refuses to run without --yes.

Configuration

The bundle inserts this Cordis row:

- id: auth-lock
  name: dsh-auth-lock

Override it in the Profile cordis.patch.yml:

- id: auth-lock
  config:
    # Custom Host state file
    path: /absolute/path/auth-lock.json
    # Force Secure cookies when TLS terminates at a reverse proxy
    secureCookie: true

The default state file is:

$DSH_HOME/auth-lock.json

Without DSH_HOME, the default is:

~/.dsh/auth-lock.json

First-run setup accepts loopback requests only. A deployment that cannot use a Host-local browser may temporarily enable remote setup for one bootstrap run:

DSH_AUTH_LOCK_ALLOW_REMOTE_SETUP=1 dsh web

Stop that process immediately after setup and restart without the variable. Do not leave remote setup enabled in a long-running deployment.