From 28c77b7648b2a44a18be64ec44344d91cccfd742 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:25:00 +0200 Subject: feat(auth): the recovery key never reaches the hub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ticking "also e-mail it to me" at registration sent the recovery key R in the register body, and the hub appended it to the verification e-mail: the hub saw R in clear on its way out, and the resend door — no captcha — let anyone who knew a pending username and address have the hub mail a "recovery key" of their choosing. The box is gone. The recovery screen offers "E-mail it to myself", a mailto: link that opens the person's own mail application with the key filled in; the desktop shell hands mailto: to the system (http, https and mailto only) and the Android shell to a mail application (ACTION_SENDTO). The CLI drops --email-recovery-key and prints the key, as before. The hub mails the code alone, and refuses a register that still carries a recovery_key rather than dropping it, so an older client offering the option cannot tell someone their key was sent when it was not. A mailbox holding R remains, with the reset code that reaches the same mailbox, enough to recover the account's identities; the link says so, and it is the person's choice. Checked in Chrome and Firefox (headless, the real page against a stubbed hub) and by the CLI's end-to-end registration against a local hub. The Android change was not built here, and the desktop link was not clicked in the application. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/api/users.py | 24 +++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/api') diff --git a/packages/meshbay-hub/src/meshbay_hub/api/users.py b/packages/meshbay-hub/src/meshbay_hub/api/users.py index eb053b7..2d4e3cb 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/users.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/users.py @@ -131,9 +131,9 @@ class RegisterRequest(BaseModel): email: str password: str | None = None # deprecated — legacy native clients auth_key: str | None = None # PBKDF2-derived, new clients - # Client-generated account recovery key (docs/MESHBAY_DESIGN.md §3.6). Pure - # pass-through: appended to the verification e-mail so the user's mailbox - # backs it up, then dropped. Never written to any table, never logged. + # Refused when present (see `register`): the hub no longer mails the + # recovery key. Kept as a field only so an older client that still sends it + # is told so, rather than having it silently dropped. recovery_key: str | None = None captcha_token: str | None = None @@ -193,6 +193,16 @@ async def register( db: AsyncSession = Depends(get_db), ): """Create an account. It stays inactive until its e-mail address is verified.""" + # The recovery key never reaches the hub (docs/MESHBAY_DESIGN.md §3.6): the + # person mails it to themselves from their own mail application. An older + # client still offers "e-mail it to me" and would tell them it was sent; + # dropping the field quietly would leave them believing that, so the + # registration is refused with the reason instead. + if body.recovery_key: + raise HTTPException( + status_code=400, + detail="This hub no longer e-mails the recovery key. Update the " + "application, or untick the option to e-mail it.") eh = hash_email_blind(body.email) # Unique regardless of case: invitations and member management name people @@ -229,8 +239,7 @@ async def register( - timedelta(seconds=resend_cooldown), )) if not recent.first(): - await _create_and_send_verification( - db, found, body.email, eh, body.recovery_key) + await _create_and_send_verification(db, found, body.email, eh) await db.commit() return {"user_id": found.id, "email_verification_required": True} raise HTTPException(status_code=409, detail="Username already taken") @@ -275,7 +284,7 @@ async def register( detail=body.username, )) - await _create_and_send_verification(db, user, body.email, eh, body.recovery_key) + await _create_and_send_verification(db, user, body.email, eh) await db.commit() return {"user_id": user.id, "email_verification_required": True} @@ -283,7 +292,6 @@ async def register( async def _create_and_send_verification( db: AsyncSession, user: User, email: str, eh: str, - recovery_key: str | None = None, ) -> None: user.status = "pending" # Invalidate any previous pending verification for this user @@ -307,7 +315,7 @@ async def _create_and_send_verification( await db.flush() await mail.send_off_loop( db, mail.send_verification_code, email, code, - purpose="registration", recovery_key=recovery_key) + purpose="registration") class VerifyEmailRequest(BaseModel): -- cgit v1.2.3