From 28c77b7648b2a44a18be64ec44344d91cccfd742 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:25:00 +0200 Subject: feat(auth): the recovery key never reaches the hub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ticking "also e-mail it to me" at registration sent the recovery key R in the register body, and the hub appended it to the verification e-mail: the hub saw R in clear on its way out, and the resend door — no captcha — let anyone who knew a pending username and address have the hub mail a "recovery key" of their choosing. The box is gone. The recovery screen offers "E-mail it to myself", a mailto: link that opens the person's own mail application with the key filled in; the desktop shell hands mailto: to the system (http, https and mailto only) and the Android shell to a mail application (ACTION_SENDTO). The CLI drops --email-recovery-key and prints the key, as before. The hub mails the code alone, and refuses a register that still carries a recovery_key rather than dropping it, so an older client offering the option cannot tell someone their key was sent when it was not. A mailbox holding R remains, with the reset code that reaches the same mailbox, enough to recover the account's identities; the link says so, and it is the person's choice. Checked in Chrome and Firefox (headless, the real page against a stubbed hub) and by the CLI's end-to-end registration against a local hub. The Android change was not built here, and the desktop link was not clicked in the application. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/mail.py | 27 +++++---------------------- 1 file changed, 5 insertions(+), 22 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/mail.py') diff --git a/packages/meshbay-hub/src/meshbay_hub/mail.py b/packages/meshbay-hub/src/meshbay_hub/mail.py index 6980da9..768b0d9 100644 --- a/packages/meshbay-hub/src/meshbay_hub/mail.py +++ b/packages/meshbay-hub/src/meshbay_hub/mail.py @@ -344,33 +344,17 @@ async def send_off_loop(db, fn, *args, purpose: str, sender: str = "", **kwargs) return True -def send_verification_code(to: str, code: str, recovery_key: str | None = None) -> None: +def send_verification_code(to: str, code: str) -> None: """ - Registration verification e-mail. When `recovery_key` is given it is - appended to the body so the recipient's mailbox becomes the backup for it - (docs/MESHBAY_DESIGN.md §3.6). - - `recovery_key` is a **pass-through**: it is generated on the client, never - stored anywhere on the hub, and never logged — only whether one was present. + Registration verification e-mail: the code and nothing else. The recovery + key is never in it — the hub does not see that key (docs/MESHBAY_DESIGN.md + §3.6); the person mails it to themselves from their own application. """ body = ( f"Your verification code is: {code}\n" "\n" "Enter this code to verify your email address.\n" "This code expires in 24 hours.\n" - ) - if recovery_key: - body += ( - "\n" - "---- Account recovery key ----\n" - "\n" - "Keep this message. If you ever forget your passphrase, this key is\n" - "what restores your access to your groups. It is not stored on the\n" - f"server and nobody at {_hub_domain} can recover it for you.\n" - "\n" - f" {recovery_key}\n" - ) - body += ( "\n" "If you did not create a MeshBay account, ignore this email.\n" "\n" @@ -382,8 +366,7 @@ def send_verification_code(to: str, code: str, recovery_key: str | None = None) msg["Subject"] = f"MeshBay — Your verification code: {code}" msg.set_content(body) _send(msg, purpose="registration") - log.info("Verification code sent to %s (recovery_key=%s)", - _mask_email(to), bool(recovery_key)) + log.info("Verification code sent to %s", _mask_email(to)) def send_email_change_code(to: str, code: str) -> None: -- cgit v1.2.3