Tell somebody their address needs confirming, and let them do it #37

2026-09-02T01:06:43Z

paulhitt commented

2026-09-02 01:06:43 +00:00

(Migrated from gitlab.com)

Android client half of flamenet-relay!13.

Without this the refusal is indistinguishable from a broken password. An unverified
account arrives as a bare 403; RelayAuth logs "minting failed" and falls back to Basic,
which the e2e routes refuse. The person sees calls that do not work and an inbox that does
nothing — and nothing says the remedy is a code in their inbox.

The status alone is not enough. 403 is also "that device belongs to another
account". Telling somebody to check their email for that sends them looking for a message
that was never sent — so the relay's code decides, not the number. A 403 with no code, an
unparseable body, and the same code on a 500 all stay generic; three tests hold that.

RelayAccounts.verifyEmail spends the code, unauthenticated on purpose — the code IS the
proof, and requiring a session would mean somebody kept out because they are unverified
could never get in.

Kotlin nests block comments. A slash-star inside a KDoc opened a comment that never
closed and produced 90 unrelated errors, none near the real line. Note left in the file.

Tests: 5 new, proven able to fail — removing the code check turns 3 red. All three
suites pass. Not merged, not deployed.

Android client half of flamenet-relay!13. **Without this the refusal is indistinguishable from a broken password.** An unverified account arrives as a bare 403; `RelayAuth` logs "minting failed" and falls back to Basic, which the e2e routes refuse. The person sees calls that do not work and an inbox that does nothing — and nothing says the remedy is a code in their inbox. **The status alone is not enough.** 403 is also "that device belongs to another account". Telling somebody to check their email for *that* sends them looking for a message that was never sent — so the relay's `code` decides, not the number. A 403 with no code, an unparseable body, and the same code on a 500 all stay generic; three tests hold that. `RelayAccounts.verifyEmail` spends the code, unauthenticated on purpose — the code IS the proof, and requiring a session would mean somebody kept out *because* they are unverified could never get in. **Kotlin nests block comments.** A slash-star inside a KDoc opened a comment that never closed and produced 90 unrelated errors, none near the real line. Note left in the file. **Tests:** 5 new, proven able to fail — removing the code check turns 3 red. All three suites pass. Not merged, not deployed.

paulhitt commented

2026-09-02 19:47:09 +00:00

(Migrated from gitlab.com)

added 3 commits

1ad47193...7958ebd8 - 2 commits from branch main
90850aa6 - Tell somebody their address needs confirming, and let them do it

Compare with previous version

added 3 commits <ul><li>1ad47193...7958ebd8 - 2 commits from branch <code>main</code></li><li>90850aa6 - Tell somebody their address needs confirming, and let them do it</li></ul> [Compare with previous version](/paulhitt/flamenet-messenger-android/-/merge_requests/10/diffs?diff_id=2000732593&start_sha=1ad4719337a3d46961e047fe508063dfeb1805d2)

paulhitt (Migrated from gitlab.com) merged commit 0271c15ab3 into main

2026-09-02 19:47:20 +00:00

paulhitt commented

2026-09-02 19:47:21 +00:00

(Migrated from gitlab.com)

mentioned in commit 0271c15ab3

mentioned in commit 0271c15ab30c878609c127de2938d4e92a6b2f54

paulhitt commented

2026-09-09 19:01:56 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-messenger-android#37