Devices

Devices (/admin/devices) lists every client that has registered with this server, for every user. It is the operator’s view of the pairing model described in End-to-end encryption: a device holds key material, so removing one is a security action, not housekeeping.

Devices belonging to soft-deleted users are hidden.

Status

Status	Means
Pending	Registered but not yet approved by an existing device. It cannot decrypt anything
Active	Approved, holding a wrapped copy of the user’s master key
Revoked	Cut off — its wrapped key has been removed

The cards along the top count each status plus the number of distinct users with at least one device.

Columns

Column	Reads
User	Owner’s email
Device	Name the client reported at registration
Device ID	The client-generated id used in pairing and in sync cursors
OS / App	Versions reported at registration — useful for spotting a client that never updated
Created	When the device registered
Activated	When an existing device approved it; blank while pending
Last Seen	Last request from this device

Search matches the user, the device name, or the device id. The Refresh control above the grid re-reads both this table and the sync cursors below it, and can be put on a 30-second or 5-minute interval.

Revoke vs delete

Revoke marks the device revoked, stamps the time, and deletes its wrapped master key. The device can no longer decrypt anything, nor approve another device. The row stays, so the history of the machine is still visible. This is the action for a lost or stolen laptop.

Delete removes the device row, its wrapped key, and its sync cursor. Nothing is left behind — including the record that the device ever existed.

Both ask for confirmation and are written to the server log with the acting administrator’s address.

Revoking every device locks the user out of encrypted data

Wrapped keys live on devices. A user whose last active device is revoked can only get back to their encrypted records with their recovery code — no administrator can decrypt on their behalf. Check that the user still has another active device, or a recovery code, before revoking their only one.

Sync cursors

Below the devices, one row per (user, device) that has ever pulled: the device id and the timestamp of its last sync. The table only appears once at least one cursor exists.

A cursor is server-side bookkeeping — the resume point for incremental pulls. Delete discards it; the device’s next pull simply starts from the beginning and re-reads everything it is entitled to. Nothing the user owns is touched. It is the safe first thing to try when one device is stuck on stale data.

Deleting a device takes its cursor with it, because the cursor has no foreign key to the device and would otherwise survive as a resume point for a machine that no longer exists.