From 28c77b7648b2a44a18be64ec44344d91cccfd742 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:25:00 +0200 Subject: feat(auth): the recovery key never reaches the hub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ticking "also e-mail it to me" at registration sent the recovery key R in the register body, and the hub appended it to the verification e-mail: the hub saw R in clear on its way out, and the resend door — no captcha — let anyone who knew a pending username and address have the hub mail a "recovery key" of their choosing. The box is gone. The recovery screen offers "E-mail it to myself", a mailto: link that opens the person's own mail application with the key filled in; the desktop shell hands mailto: to the system (http, https and mailto only) and the Android shell to a mail application (ACTION_SENDTO). The CLI drops --email-recovery-key and prints the key, as before. The hub mails the code alone, and refuses a register that still carries a recovery_key rather than dropping it, so an older client offering the option cannot tell someone their key was sent when it was not. A mailbox holding R remains, with the reset code that reaches the same mailbox, enough to recover the account's identities; the link says so, and it is the person's choice. Checked in Chrome and Firefox (headless, the real page against a stubbed hub) and by the CLI's end-to-end registration against a local hub. The Android change was not built here, and the desktop link was not clicked in the application. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/tests/test_android_shell.py | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'packages/meshbay-hub/tests/test_android_shell.py') diff --git a/packages/meshbay-hub/tests/test_android_shell.py b/packages/meshbay-hub/tests/test_android_shell.py index 1049a5f..c68234d 100644 --- a/packages/meshbay-hub/tests/test_android_shell.py +++ b/packages/meshbay-hub/tests/test_android_shell.py @@ -62,6 +62,10 @@ def test_the_webview_loads_the_package_and_nothing_else(): assert "loadDataWithBaseURL" not in activity and "loadData(" not in activity # The hub never becomes the document origin; a link out leaves the app. assert "shouldOverrideUrlLoading" in activity and "openExternally" in activity + # The recovery screen's "e-mail it to myself" (§3.6) goes to a mail + # application, and only as a mail address: SENDTO, not a VIEW of anything. + assert 'url.scheme == "mailto") openMail(url)' in activity + assert "Intent(Intent.ACTION_SENDTO, url)" in activity def test_the_policy_is_the_desktop_policy_sent_as_a_header(): -- cgit v1.2.3