diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-10-15 14:24:35 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-10-15 14:24:35 +0200 |
| commit | 2dbff20818d171242a15e3567e14292c0d63aea2 (patch) | |
| tree | dcfe9607809c95ff15435ec684f0954a2d777798 /docs/MESHBAY_DESIGN.md | |
| parent | 5949532e6450d1aebc681caa8db2192a43b11f12 (diff) | |
| download | meshbay-2dbff20818d171242a15e3567e14292c0d63aea2.tar.gz | |
fix(hub): a phone's poll secret ends with the account's sessions
The secret a phone polls /v1/push/poll with is a credential of its own,
outside any session, and it outlived the ones that should have ended it:
"sign out everywhere" — what someone who lost a phone presses — a
passphrase change and an admin revocation left every push row in place, so
the lost phone went on reading "X posted in <group>" lines. Each now deletes
the account's rows, as a reset and an erasure already did, and the poll
refuses a revoked or deleted account whatever deleted the row or not. A
suspended one still reads: the line telling it so is one of them.
A phone still in hand is not affected for long: a refused poll makes it
forget the row, and the page registers it again at its next start.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 750484a..c7356c0 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -4085,7 +4085,12 @@ narrow bridge — and Android has all three: which Android stretches under Doze. The secret is the only credential the background holds and it reads notification lines and nothing else — not a session, so nothing renewing in the background can collide with the page's - rotating refresh token, and a sign-out, which deletes the row, ends it. **When + rotating refresh token. It is a credential of its own, so whatever ends the + account's sessions ends it too: turning it off, signing out everywhere (what + someone who lost a phone presses), a passphrase change or reset, a revocation + and an erasure all delete the row, and a revoked or deleted account's poll is + refused regardless. A suspended one still reads, the line saying so being one + of its notifications. **When a UnifiedPush distributor is already installed** (ntfy, or an application carrying one), the row also gets its endpoint and P-256 key and each notification is sent there at once as one RFC 8291 record, so the push server |