feat(auth): the recovery key never reaches the hub

Ticking "also e-mail it to me" at registration sent the recovery key R in
the register body, and the hub appended it to the verification e-mail: the
hub saw R in clear on its way out, and the resend door — no captcha — let
anyone who knew a pending username and address have the hub mail a
"recovery key" of their choosing.

The box is gone. The recovery screen offers "E-mail it to myself", a mailto:
link that opens the person's own mail application with the key filled in;
the desktop shell hands mailto: to the system (http, https and mailto only)
and the Android shell to a mail application (ACTION_SENDTO). The CLI drops
--email-recovery-key and prints the key, as before. The hub mails the code
alone, and refuses a register that still carries a recovery_key rather than
dropping it, so an older client offering the option cannot tell someone
their key was sent when it was not.

A mailbox holding R remains, with the reset code that reaches the same
mailbox, enough to recover the account's identities; the link says so, and
it is the person's choice.

Checked in Chrome and Firefox (headless, the real page against a stubbed
hub) and by the CLI's end-to-end registration against a local hub. The
Android change was not built here, and the desktop link was not clicked in
the application.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 70 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_recovery_mailto.py b/packages/meshbay-hub/tests/test_recovery_mailto.py
new file mode 100644
index 0000000..401a69f
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_recovery_mailto.py
@@ -0,0 +1,70 @@
+"""
+"E-mail it to myself" on the recovery screen (docs/MESHBAY_DESIGN.md §3.6).
+
+The recovery key never reaches the hub; a `mailto:` link has the person's own
+mail application send it to their own address. This runs the page's
+`recoveryMailto` under Node, with the English strings, and reads the link back
+the way a mail application would.
+"""
+
+import json
+import shutil
+import subprocess
+from urllib.parse import parse_qs, unquote, urlsplit
+
+import pytest
+from spa_source import STATIC
+
+pytestmark = pytest.mark.skipif(shutil.which("node") is None, reason="no node")
+
+MNEMONIC = "ABCD EFGH JKLM NPQR STUV WXYZ 2345 6789 ABCD EFGH JKLM NPQR STUV"
+
+HARNESS = r"""
+const fs = require('fs');
+const [page, locale, email, user, key] = process.argv.slice(1);
+const src = fs.readFileSync(page, 'utf8');
+const start = src.indexOf('export function recoveryMailto(');
+if (start < 0) throw new Error('recoveryMailto not found');
+const end = src.indexOf('\n}\n', start);
+const fn = src.slice(start, end + 2).replace(/^export /, '');
+(async () => {
+  const strings = (await import(locale)).default;
+  const t = (k, params) => {
+    let s = strings[k];
+    if (s == null) throw new Error('missing string ' + k);
+    for (const [n, v] of Object.entries(params || {})) s = s.split(`{${n}}`).join(v);
+    return s;
+  };
+  const recoveryMailto = new Function('t', fn + '\nreturn recoveryMailto;')(t);
+  process.stdout.write(JSON.stringify(recoveryMailto(email, user, key)));
+})();
+"""
+
+
+def _link(email: str, user: str = "alice_tester") -> str:
+    out = subprocess.run(
+        ["node", "-e", HARNESS, str(STATIC / "auth-page.js"),
+         (STATIC / "locales" / "en.js").as_uri(), email, user, MNEMONIC],
+        capture_output=True, text=True, check=True)
+    return json.loads(out.stdout)
+
+
+def test_the_link_sends_the_key_to_the_person_and_nowhere_else():
+    link = _link("alice+mesh@example.org")
+    parts = urlsplit(link)
+    assert parts.scheme == "mailto"
+    assert unquote(parts.path) == "alice+mesh@example.org"
+    assert "@" in parts.path, "an encoded '@' is not decoded by every mail app"
+    query = parse_qs(parts.query)
+    assert set(query) == {"subject", "body"}, "no cc, no bcc, nothing else"
+    body = query["body"][0]
+    assert MNEMONIC in body and "alice_tester" in body
+    assert "\n\n" in body, "line breaks survive the encoding"
+
+
+def test_an_address_cannot_add_recipients_or_headers():
+    # An address is the person's own, but it is still text put into a URL.
+    link = _link("a@example.org?bcc=x@evil.example&body=")
+    query = parse_qs(urlsplit(link).query)
+    assert set(query) == {"subject", "body"}
+    assert MNEMONIC in query["body"][0]