From 28c77b7648b2a44a18be64ec44344d91cccfd742 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:25:00 +0200 Subject: feat(auth): the recovery key never reaches the hub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ticking "also e-mail it to me" at registration sent the recovery key R in the register body, and the hub appended it to the verification e-mail: the hub saw R in clear on its way out, and the resend door — no captcha — let anyone who knew a pending username and address have the hub mail a "recovery key" of their choosing. The box is gone. The recovery screen offers "E-mail it to myself", a mailto: link that opens the person's own mail application with the key filled in; the desktop shell hands mailto: to the system (http, https and mailto only) and the Android shell to a mail application (ACTION_SENDTO). The CLI drops --email-recovery-key and prints the key, as before. The hub mails the code alone, and refuses a register that still carries a recovery_key rather than dropping it, so an older client offering the option cannot tell someone their key was sent when it was not. A mailbox holding R remains, with the reset code that reaches the same mailbox, enough to recover the account's identities; the link says so, and it is the person's choice. Checked in Chrome and Firefox (headless, the real page against a stubbed hub) and by the CLI's end-to-end registration against a local hub. The Android change was not built here, and the desktop link was not clicked in the application. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/tests/test_recovery_email.py | 99 ++++++++++------------- 1 file changed, 42 insertions(+), 57 deletions(-) (limited to 'packages/meshbay-hub/tests/test_recovery_email.py') diff --git a/packages/meshbay-hub/tests/test_recovery_email.py b/packages/meshbay-hub/tests/test_recovery_email.py index 96dde5d..0e19be9 100644 --- a/packages/meshbay-hub/tests/test_recovery_email.py +++ b/packages/meshbay-hub/tests/test_recovery_email.py @@ -1,10 +1,12 @@ """ -The recovery key in the registration e-mail (docs/MESHBAY_DESIGN.md §3.6). - -When the client sends `recovery_key`, the hub appends it to the verification -e-mail and stores it nowhere. When it does not, the e-mail carries only the -code. `recovery_key` is a pass-through — no column, no log line beyond a -boolean. +The recovery key never reaches the hub (docs/MESHBAY_DESIGN.md §3.6). + +It used to: a client that ticked "e-mail it to me" sent it in the register body +and the hub appended it to the verification e-mail, so the hub saw it in clear +and so did anyone who could make the hub mail one (the resend door). The person +now mails it to themselves from their own application. The hub refuses the +field rather than dropping it, so an older client that still offers the option +cannot tell somebody their key was sent when it was not. """ import base64 @@ -12,7 +14,7 @@ import hashlib import pytest from meshbay_hub import mail -from meshbay_hub.db.models import EmailVerification, User +from meshbay_hub.db.models import User from sqlalchemy import select RECOVERY = "ABCD EFGH JKLM NPQR STUV WXYZ 2345 6789 ABCD EFGH JKLM NPQR STUV" @@ -31,74 +33,57 @@ def _skip_email_verification(monkeypatch): run so the e-mail is actually built. Capture it instead of sending. """ sent = [] - # `**_` swallows the `purpose` keyword `_send` now requires — the gate - # that keeps this hub off the open-relay list. What this module is - # about is the body of the message, so the gate is stubbed away with - # the socket; `test_mail_is_not_a_relay.py` is where it is exercised. + # `**_` swallows the `purpose` keyword `_send` requires — the gate that + # keeps this hub off the open-relay list, exercised in + # `test_mail_is_not_a_relay.py`. What this module is about is the body. monkeypatch.setattr("meshbay_hub.mail._send", lambda msg, **_: sent.append(msg) or True) return sent @pytest.mark.asyncio -async def test_register_appends_the_recovery_key_to_the_email( - client, _skip_email_verification): +async def test_a_register_carrying_the_recovery_key_is_refused( + client, db_session, _skip_email_verification): r = await client.post("/v1/users/register", json={ "username": "rk1_test", "email": "rk1@example.com", "auth_key": _auth_key("a-long-enough-passphrase", "rk1_test"), "recovery_key": RECOVERY, }) - assert r.status_code in (200, 201), r.text - assert len(_skip_email_verification) == 1 - body = _skip_email_verification[0].get_content() - assert RECOVERY in body - assert "recovery key" in body.lower() + assert r.status_code == 400, r.text + assert "recovery key" in r.json()["detail"] + assert _skip_email_verification == [], "nothing was mailed" + assert (await db_session.execute( + select(User).where(User.username == "rk1_test"))).scalar_one_or_none() is None @pytest.mark.asyncio -async def test_register_without_recovery_key_sends_only_the_code( +async def test_a_resend_carrying_the_recovery_key_is_refused( client, _skip_email_verification): - r = await client.post("/v1/users/register", json={ - "username": "rk2_test", "email": "rk2@example.com", - "auth_key": _auth_key("a-long-enough-passphrase", "rk2_test"), - }) - assert r.status_code in (200, 201), r.text - body = _skip_email_verification[0].get_content() - assert "recovery key" not in body.lower() - assert "verification code is" in body.lower() + # The resend door has no captcha: it was how a stranger who knew a pending + # username and address could have the hub mail a "recovery key" of theirs. + body = {"username": "rk2_test", "email": "rk2@example.com", + "auth_key": _auth_key("a-long-enough-passphrase", "rk2_test")} + assert (await client.post("/v1/users/register", json=body)).status_code == 201 + r = await client.post("/v1/users/register", json={**body, "recovery_key": RECOVERY}) + assert r.status_code == 400, r.text + for msg in _skip_email_verification: + assert RECOVERY not in msg.get_content() @pytest.mark.asyncio -async def test_the_recovery_key_is_not_persisted( - client, db_session, _skip_email_verification): - await client.post("/v1/users/register", json={ +async def test_the_verification_mail_carries_only_the_code( + client, _skip_email_verification): + r = await client.post("/v1/users/register", json={ "username": "rk3_test", "email": "rk3@example.com", "auth_key": _auth_key("a-long-enough-passphrase", "rk3_test"), - "recovery_key": RECOVERY, }) - rows = (await db_session.execute(select(EmailVerification))).scalars().all() - assert rows - for row in rows: - assert RECOVERY not in (row.code or "") - assert RECOVERY not in (row.email_encrypted or "") - user = (await db_session.execute( - select(User).where(User.username == "rk3_test"))).scalar_one() - assert RECOVERY not in repr(vars(user)) - - -def test_mail_body_with_and_without_the_key(monkeypatch): - captured = [] - monkeypatch.setattr("meshbay_hub.mail._send", - lambda msg, **_: captured.append(msg) or True) - - mail.send_verification_code("x@example.com", "123456", - recovery_key="MY-RECOVERY-KEY") - body = captured[-1].get_content() - assert "123456" in body - assert "MY-RECOVERY-KEY" in body - assert "recovery key" in body.lower() - - mail.send_verification_code("x@example.com", "123456") - body = captured[-1].get_content() - assert "123456" in body - assert "recovery key" not in body.lower() + assert r.status_code == 201, r.text + (msg,) = _skip_email_verification + body = msg.get_content() + assert "verification code is" in body.lower() + assert "recovery" not in body.lower() + + +def test_the_mail_function_takes_no_recovery_key(): + with pytest.raises(TypeError): + mail.send_verification_code("x@example.com", "123456", recovery_key=RECOVERY) -- cgit v1.2.3