From 28c77b7648b2a44a18be64ec44344d91cccfd742 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:25:00 +0200 Subject: feat(auth): the recovery key never reaches the hub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ticking "also e-mail it to me" at registration sent the recovery key R in the register body, and the hub appended it to the verification e-mail: the hub saw R in clear on its way out, and the resend door — no captcha — let anyone who knew a pending username and address have the hub mail a "recovery key" of their choosing. The box is gone. The recovery screen offers "E-mail it to myself", a mailto: link that opens the person's own mail application with the key filled in; the desktop shell hands mailto: to the system (http, https and mailto only) and the Android shell to a mail application (ACTION_SENDTO). The CLI drops --email-recovery-key and prints the key, as before. The hub mails the code alone, and refuses a register that still carries a recovery_key rather than dropping it, so an older client offering the option cannot tell someone their key was sent when it was not. A mailbox holding R remains, with the reset code that reaches the same mailbox, enough to recover the account's identities; the link says so, and it is the person's choice. Checked in Chrome and Firefox (headless, the real page against a stubbed hub) and by the CLI's end-to-end registration against a local hub. The Android change was not built here, and the desktop link was not clicked in the application. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/tests/test_recovery_mailto.py | 70 ++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 packages/meshbay-hub/tests/test_recovery_mailto.py (limited to 'packages/meshbay-hub/tests/test_recovery_mailto.py') diff --git a/packages/meshbay-hub/tests/test_recovery_mailto.py b/packages/meshbay-hub/tests/test_recovery_mailto.py new file mode 100644 index 0000000..401a69f --- /dev/null +++ b/packages/meshbay-hub/tests/test_recovery_mailto.py @@ -0,0 +1,70 @@ +""" +"E-mail it to myself" on the recovery screen (docs/MESHBAY_DESIGN.md §3.6). + +The recovery key never reaches the hub; a `mailto:` link has the person's own +mail application send it to their own address. This runs the page's +`recoveryMailto` under Node, with the English strings, and reads the link back +the way a mail application would. +""" + +import json +import shutil +import subprocess +from urllib.parse import parse_qs, unquote, urlsplit + +import pytest +from spa_source import STATIC + +pytestmark = pytest.mark.skipif(shutil.which("node") is None, reason="no node") + +MNEMONIC = "ABCD EFGH JKLM NPQR STUV WXYZ 2345 6789 ABCD EFGH JKLM NPQR STUV" + +HARNESS = r""" +const fs = require('fs'); +const [page, locale, email, user, key] = process.argv.slice(1); +const src = fs.readFileSync(page, 'utf8'); +const start = src.indexOf('export function recoveryMailto('); +if (start < 0) throw new Error('recoveryMailto not found'); +const end = src.indexOf('\n}\n', start); +const fn = src.slice(start, end + 2).replace(/^export /, ''); +(async () => { + const strings = (await import(locale)).default; + const t = (k, params) => { + let s = strings[k]; + if (s == null) throw new Error('missing string ' + k); + for (const [n, v] of Object.entries(params || {})) s = s.split(`{${n}}`).join(v); + return s; + }; + const recoveryMailto = new Function('t', fn + '\nreturn recoveryMailto;')(t); + process.stdout.write(JSON.stringify(recoveryMailto(email, user, key))); +})(); +""" + + +def _link(email: str, user: str = "alice_tester") -> str: + out = subprocess.run( + ["node", "-e", HARNESS, str(STATIC / "auth-page.js"), + (STATIC / "locales" / "en.js").as_uri(), email, user, MNEMONIC], + capture_output=True, text=True, check=True) + return json.loads(out.stdout) + + +def test_the_link_sends_the_key_to_the_person_and_nowhere_else(): + link = _link("alice+mesh@example.org") + parts = urlsplit(link) + assert parts.scheme == "mailto" + assert unquote(parts.path) == "alice+mesh@example.org" + assert "@" in parts.path, "an encoded '@' is not decoded by every mail app" + query = parse_qs(parts.query) + assert set(query) == {"subject", "body"}, "no cc, no bcc, nothing else" + body = query["body"][0] + assert MNEMONIC in body and "alice_tester" in body + assert "\n\n" in body, "line breaks survive the encoding" + + +def test_an_address_cannot_add_recipients_or_headers(): + # An address is the person's own, but it is still text put into a URL. + link = _link("a@example.org?bcc=x@evil.example&body=") + query = parse_qs(urlsplit(link).query) + assert set(query) == {"subject", "body"} + assert MNEMONIC in query["body"][0] -- cgit v1.2.3