feat(auth): the recovery key never reaches the hub

Ticking "also e-mail it to me" at registration sent the recovery key R in
the register body, and the hub appended it to the verification e-mail: the
hub saw R in clear on its way out, and the resend door — no captcha — let
anyone who knew a pending username and address have the hub mail a
"recovery key" of their choosing.

The box is gone. The recovery screen offers "E-mail it to myself", a mailto:
link that opens the person's own mail application with the key filled in;
the desktop shell hands mailto: to the system (http, https and mailto only)
and the Android shell to a mail application (ACTION_SENDTO). The CLI drops
--email-recovery-key and prints the key, as before. The hub mails the code
alone, and refuses a register that still carries a recovery_key rather than
dropping it, so an older client offering the option cannot tell someone
their key was sent when it was not.

A mailbox holding R remains, with the reset code that reaches the same
mailbox, enough to recover the account's identities; the link says so, and
it is the person's choice.

Checked in Chrome and Firefox (headless, the real page against a stubbed
hub) and by the CLI's end-to-end registration against a local hub. The
Android change was not built here, and the desktop link was not clicked in
the application.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 16 insertions, 8 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py
index eb053b7..2d4e3cb 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/users.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py
@@ -131,9 +131,9 @@ class RegisterRequest(BaseModel):
     email:           str
     password:        str | None = None    # deprecated — legacy native clients
     auth_key:        str | None = None    # PBKDF2-derived, new clients
-    # Client-generated account recovery key (docs/MESHBAY_DESIGN.md §3.6). Pure
-    # pass-through: appended to the verification e-mail so the user's mailbox
-    # backs it up, then dropped. Never written to any table, never logged.
+    # Refused when present (see `register`): the hub no longer mails the
+    # recovery key. Kept as a field only so an older client that still sends it
+    # is told so, rather than having it silently dropped.
     recovery_key:    str | None = None
     captcha_token:   str | None = None
 
@@ -193,6 +193,16 @@ async def register(
     db: AsyncSession = Depends(get_db),
 ):
     """Create an account. It stays inactive until its e-mail address is verified."""
+    # The recovery key never reaches the hub (docs/MESHBAY_DESIGN.md §3.6): the
+    # person mails it to themselves from their own mail application. An older
+    # client still offers "e-mail it to me" and would tell them it was sent;
+    # dropping the field quietly would leave them believing that, so the
+    # registration is refused with the reason instead.
+    if body.recovery_key:
+        raise HTTPException(
+            status_code=400,
+            detail="This hub no longer e-mails the recovery key. Update the "
+                   "application, or untick the option to e-mail it.")
     eh = hash_email_blind(body.email)
 
     # Unique regardless of case: invitations and member management name people
@@ -229,8 +239,7 @@ async def register(
                     - timedelta(seconds=resend_cooldown),
                 ))
             if not recent.first():
-                await _create_and_send_verification(
-                    db, found, body.email, eh, body.recovery_key)
+                await _create_and_send_verification(db, found, body.email, eh)
                 await db.commit()
             return {"user_id": found.id, "email_verification_required": True}
         raise HTTPException(status_code=409, detail="Username already taken")
@@ -275,7 +284,7 @@ async def register(
         detail=body.username,
     ))
 
-    await _create_and_send_verification(db, user, body.email, eh, body.recovery_key)
+    await _create_and_send_verification(db, user, body.email, eh)
     await db.commit()
 
     return {"user_id": user.id, "email_verification_required": True}
@@ -283,7 +292,6 @@ async def register(
 
 async def _create_and_send_verification(
     db: AsyncSession, user: User, email: str, eh: str,
-    recovery_key: str | None = None,
 ) -> None:
     user.status = "pending"
     # Invalidate any previous pending verification for this user
@@ -307,7 +315,7 @@ async def _create_and_send_verification(
     await db.flush()
     await mail.send_off_loop(
         db, mail.send_verification_code, email, code,
-        purpose="registration", recovery_key=recovery_key)
+        purpose="registration")
 
 
 class VerifyEmailRequest(BaseModel):