Cockatrice/servatrice
BruebachL 933db4edd2
[Server] Recursive alt search with match evidence (#7510)
* [Server] Recursive alt search with match evidence

getUserAlts() now walks a breadth-first graph to the requested depth (clamped 1-3): each level expands frontier accounts over registration email, current client id, recent session IPs (6-month window), and historic session client ids, so identifier changes no longer hide older alts. Every row carries match_reason (email / clientid:<id> / ip:<addr>), depth, and shared_count fan-out so moderators can distinguish real alts from VPN/shared-network overlap. Command_GetUserAlts depth is plumbed through; unset depth defaults to 1, preserving previous single-hop behavior for old clients.

* [Server] Fix alt search review findings

- Seed the BFS with the stored user name so the searched account is not
  re-listed as its own alt at depth 1.
- Normalise emails to lower case for the membership and fan-out checks;
  SQL compares them case-insensitively.
- Widen the per-level row limit by the visited count so level 2+ cannot
  return only already-known accounts.
- Prepare dynamic IN-list queries locally instead of through the shared
  prepared-statement cache, whose keys are query texts.
- Count historic client-id fan-out from _sessions, not from the current
  _users ids.
- Order capped identifiers by relevance (current email/client id first,
  then most recent session IPs) instead of alphabetically.

* Apply suggestion from @ZeldaZach

Co-authored-by: Zach H <zahalpern+github@gmail.com>

* Apply suggestion from @ZeldaZach

Co-authored-by: Zach H <zahalpern+github@gmail.com>

---------

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
Co-authored-by: Zach H <zahalpern+github@gmail.com>
2026-11-08 08:14:03 +01:00
..
docker Docker-compose setup for Servatrice (#3887) 2020-03-16 21:40:58 -04:00
migrations [Security] Add challenge-response auth with scrypt verifiers and stop storing plaintext passwords (#7193) 2026-10-16 22:52:26 +02:00
mysql-storage Docker-Compose support for Windows (#3974) 2020-05-08 15:22:39 -04:00
resources Update macOS Monterey app icon (#4805) 2023-08-06 17:46:03 -04:00
scripts Add Discord account registration monitor (#7013) 2026-06-21 01:09:57 -04:00
src [Server] Recursive alt search with match evidence (#7510) 2026-11-08 08:14:03 +01:00
check_schema_version.sh [Build] Clean up CMake compiler flags and CI build script (#7219) 2026-11-07 18:37:09 +01:00
CMakeLists.txt [Build] Use versionless Qt CMake commands (#7639) 2026-10-31 18:53:00 +01:00
servatrice.desktop Servatrice: open in a terminal window when started from the menu 2014-10-11 13:38:07 +02:00
servatrice.ini.example [Server] Store a scrypt verifier when an admin resets a password (#7679) 2026-11-02 07:00:48 +01:00
servatrice.qrc Renamed resources 2014-10-07 16:49:40 +02:00
servatrice.rc Servatrice logo 2014-10-06 21:04:37 +02:00
servatrice.sql [Security] Add challenge-response auth with scrypt verifiers and stop storing plaintext passwords (#7193) 2026-10-16 22:52:26 +02:00