ident

3.2 KB

1. # Mission 008 (old 032) — ident: the sign-in page remembers the code step (ident#20)
3. Ticket: https://tickets.worldapi.org/projects/ident.worldapi.org/20 — the creator is blocked by this right now.
5. ## The bug
6. `components/home.hl`: after "Send me a code" (`on ask` → POST /api/code) the step lives only in client memory
7. (`askCode = true`, `sentTo`). Any reload — a phone reloading the tab while the user reads the mail, a second tab, a
8. socket reconnect that re-seeds — shows the email form again; the code cannot be entered. Same on `/` and `/signin/<rid>`.
10. ## Build (properly — no shortcut)
11. - The server remembers the pending sign-in **in the browser's session** (the webex session): the address a code was
12. sent to. The page's seed then starts on the code step (`askCode` true, `sentTo` = that address) while a code for it
13. is waiting and unused and not expired — on `/` and on `/signin/<rid>` (the rid stays in the URL, keep the app flow).
14. - /api/code is a plain HTTP route and our vendored webex gives function routes NO session (hybriel#11, fixed only on
15. Anton's branch — do not re-vendor). So after a successful POST, record it through a face that has the session
16. (e.g. `emit server rememberPending(email)`), and the server must only accept it when a code for that address is
17. really waiting (never a way to show a code step for an arbitrary address without a sent code — it holds no secret,
18. but keep it honest). Use `realSession()` as the other faces do (hybriel#16 workaround).
19. - Cleared on: successful sign-in, "Other address" (back), expiry. A wrong code keeps the step.
20. - Keep the look; the only visible change: the code step survives reloads.
22. ## Where and how
23. - Workspace: `loreana:/media/STORAGE/projects/ident.worldapi.org` (ssh loreana, user mre). Read its README.md,
24. STATUS.md, CONCEPT.md, DECISIONS.md first. No git (not a repo). Never read or print `.env`.
25. - Hybriel pitfalls: `/CONTAINERS/projects/antcolony/docs/hybriel-for-app-workers.md` and
26. `/CONTAINERS/projects/antcolony/missions/TEMPLATE-hybriel-block.md` — read both.
27. - Never trigger an OTP on the live port or the dev server :8351 (it mails for real). Tests start their own servers
28. (see README "Test"); use ports 8740-8749 for anything new.
29. - Gates: all existing gates (README "Test") must still pass. Add a real-browser check to the gate that fits
30. (`tests/browser.mjs` uses Chrome via cdp.mjs): request a code → RELOAD the page → the code field is there with the
31. address → enter the code (read it from the test server's store/outbox as the gate does) → signed in. Also: reload
32. after "Other address" → email form; `/signin/<rid>` + reload → code step, and the app flow still completes.
33. - Do NOT deploy. Update ident README (test section) and STATUS.md, append a line to ident LOG.md if it has one.
35. ## Report back
36. What you changed (files), the gate results with counts, the exact new checks, anything you could not do.
38. ## CHANGE (creator, 06:45): a real /code page
39. Creator: "just make a /code where it checks a pending code". After "Send me a code" the browser goes to `/code`
40. (app login: `/signin/<rid>/code`). The page checks the session for a pending, unused, unexpired code → code form with
41. the address; none → back to the email form (`/` or `/signin/<rid>`). Reload of /code keeps the code form.