From 2dbff20818d171242a15e3567e14292c0d63aea2 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:24:35 +0200 Subject: fix(hub): a phone's poll secret ends with the account's sessions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The secret a phone polls /v1/push/poll with is a credential of its own, outside any session, and it outlived the ones that should have ended it: "sign out everywhere" — what someone who lost a phone presses — a passphrase change and an admin revocation left every push row in place, so the lost phone went on reading "X posted in " lines. Each now deletes the account's rows, as a reset and an erasure already did, and the poll refuses a revoked or deleted account whatever deleted the row or not. A suspended one still reads: the line telling it so is one of them. A phone still in hand is not affected for long: a refused poll makes it forget the row, and the page registers it again at its next start. Co-Authored-By: Claude Opus 5.5 --- docs/MESHBAY_DESIGN.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'docs/MESHBAY_DESIGN.md') diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 750484a..c7356c0 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -4085,7 +4085,12 @@ narrow bridge — and Android has all three: which Android stretches under Doze. The secret is the only credential the background holds and it reads notification lines and nothing else — not a session, so nothing renewing in the background can collide with the page's - rotating refresh token, and a sign-out, which deletes the row, ends it. **When + rotating refresh token. It is a credential of its own, so whatever ends the + account's sessions ends it too: turning it off, signing out everywhere (what + someone who lost a phone presses), a passphrase change or reset, a revocation + and an erasure all delete the row, and a revoked or deleted account's poll is + refused regardless. A suspended one still reads, the line saying so being one + of its notifications. **When a UnifiedPush distributor is already installed** (ntfy, or an application carrying one), the row also gets its endpoint and P-256 key and each notification is sent there at once as one RFC 8291 record, so the push server -- cgit v1.2.3