Redesign Quick Connect workflow

app/__init__.py

@@ -16,6 +16,7 @@
 from .storage_errors import StorageCorruptionError
 from .tailscale_ssh import user_can_use_tailscale_ssh
 from .runtime_lifecycle import RuntimeLifecycle
+from .browser_identity import connection_history_scope
 
 socketio = SocketIO(
     async_mode=config.SOCKETIO_ASYNC_MODE,
@@ -327,6 +328,10 @@ def index():
             'index.html',
             username=current_user.username,
             theme=theme,
+            connection_history_scope=connection_history_scope(
+                current_user,
+                app.config['SECRET_KEY'],
+            ),
             confirm_session_close=settings.get('confirm_session_close', True),
             max_editor_file_size=config.MAX_EDITOR_FILE_SIZE,
         )

app/browser_identity.py

@@ -0,0 +1,24 @@
+"""Opaque browser-storage namespaces for authenticated users."""
+
+import hashlib
+import hmac
+
+
+def connection_history_scope(user, secret_key):
+    """Return an instance-bound namespace for one generation of an account."""
+    created_at = getattr(user, 'created_at', None)
+    if created_at is not None:
+        generation = created_at.isoformat()
+    else:
+        # Older imported databases can contain a null creation timestamp. The
+        # salted password hash still prevents a reused numeric id from inheriting
+        # browser history. A password change safely starts a fresh history.
+        generation = getattr(user, 'password_hash', '')
+    material = '\0'.join((
+        'webssh-connection-history-v1',
+        str(user.id),
+        str(getattr(user, 'username', '')),
+        generation,
+    )).encode('utf-8')
+    key = secret_key if isinstance(secret_key, bytes) else str(secret_key).encode('utf-8')
+    return hmac.new(key, material, hashlib.sha256).hexdigest()