feat(auth): the recovery key never reaches the hub

Ticking "also e-mail it to me" at registration sent the recovery key R in
the register body, and the hub appended it to the verification e-mail: the
hub saw R in clear on its way out, and the resend door — no captcha — let
anyone who knew a pending username and address have the hub mail a
"recovery key" of their choosing.

The box is gone. The recovery screen offers "E-mail it to myself", a mailto:
link that opens the person's own mail application with the key filled in;
the desktop shell hands mailto: to the system (http, https and mailto only)
and the Android shell to a mail application (ACTION_SENDTO). The CLI drops
--email-recovery-key and prints the key, as before. The hub mails the code
alone, and refuses a register that still carries a recovery_key rather than
dropping it, so an older client offering the option cannot tell someone
their key was sent when it was not.

A mailbox holding R remains, with the reset code that reaches the same
mailbox, enough to recover the account's identities; the link says so, and
it is the person's choice.

Checked in Chrome and Firefox (headless, the real page against a stubbed
hub) and by the CLI's end-to-end registration against a local hub. The
Android change was not built here, and the desktop link was not clicked in
the application.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/packages/meshbay-android/app/src/main/kotlin/org/meshbay/client/MainActivity.kt b/packages/meshbay-android/app/src/main/kotlin/org/meshbay/client/MainActivity.kt
index 6bd2a3f..d523da7 100644
--- a/packages/meshbay-android/app/src/main/kotlin/org/meshbay/client/MainActivity.kt
+++ b/packages/meshbay-android/app/src/main/kotlin/org/meshbay/client/MainActivity.kt
@@ -210,6 +210,9 @@ class MainActivity : Activity() {
                 // The hub must never become the document origin. A link out
                 // opens in the person's browser, not in a window holding keys.
                 if (request.isForMainFrame && (url.scheme == "https" || url.scheme == "http")) openExternally(url)
+                // The recovery screen's "e-mail it to myself" (docs/MESHBAY_DESIGN.md
+                // §3.6): the person's own mail application sends it, never the hub.
+                if (request.isForMainFrame && url.scheme == "mailto") openMail(url)
                 return true
             }
         }
@@ -391,6 +394,11 @@ class MainActivity : Activity() {
 
     private fun refused() = WebResourceResponse("text/plain", "utf-8", 403, "Forbidden", emptyMap(), "".byteInputStream())
 
+    private fun openMail(url: Uri) {
+        try { startActivity(Intent(Intent.ACTION_SENDTO, url)) }
+        catch (e: android.content.ActivityNotFoundException) { Log.w(Bridge.TAG, "no mail application") }
+    }
+
     private fun openExternally(url: Uri) {
         try { startActivity(Intent(Intent.ACTION_VIEW, url).addCategory(Intent.CATEGORY_BROWSABLE)) }
         catch (e: android.content.ActivityNotFoundException) { Log.w(Bridge.TAG, "no browser for $url") }