Sync the relay from flamenet-messenger-ios 5bc7258 #64

2026-08-25T19:35:02Z

paulhitt commented

2026-08-25 19:35:02 +00:00

(Migrated from gitlab.com)

This mirror had one commit, from 2026-08-21, while flamenet-messenger-ios moved four days without it. Everything since — federation, discovery, home relays, password reset and the mailer, the account identity split, the on-page donation flow on FlameNet's connected account, and the three generated doc pages — was missing here. A stale public mirror is worse than none, because it reads as current.

This is server/ from flamenet-messenger-ios@5bc7258, wholesale.

The three files kept from this repo

A naive copy would have destroyed all three:

README.md — not stale but ahead. It describes the relay as its own identity provider, true since the WordPress removal, while upstream's still opens with "It is not an identity provider" and contradicts itself in the next clause. It also carries the sibling-repo table, which only makes sense in a repo somebody arrives at cold. Kept; the one row it lacked (FN_FEDERATION) was added.
LICENSE — MIT, kept at the source repo's root rather than in server/.
Scripts/secret-sweep.sh — the gate for exactly this operation.

docker-compose.prod.yml stays excluded as it was at mirror creation: it names production routers.

The sweep, and one narrowing it needed

It flagged let token = "\(selector).\(secret)" in PasswordReset.swift as an assigned password — a value computed at run time, not a literal. The probe already skipped ${...} for shell and JavaScript; it now skips Swift's \(...) the same way. Mutation-verified: a planted let password = "hunter2hunter2" is still caught, and the interpolation is not. Clean over all 75 files afterwards.

Worth knowing: the sweep only reads git-tracked files. An untracked file is invisible to it, so git add before trusting a clean run — my first canary passed only because it wasn't staged.

Known gap, to fix upstream

docs/CONFIGURATION.md documents FN_DONATE_PROVIDER and FN_DONATE_SECRET but not FN_DONATE_ACCOUNT or FN_DONATE_PUBLISHABLE_KEY, which the donate flow now requires. That belongs in flamenet-messenger-ios — fixing it here would be overwritten by the next sync — and will arrive in this repo with it.

Generated with Claude Code

This mirror had **one commit, from 2026-08-21**, while `flamenet-messenger-ios` moved four days without it. Everything since — federation, discovery, home relays, password reset and the mailer, the account identity split, the on-page donation flow on FlameNet's connected account, and the three generated doc pages — was missing here. A stale public mirror is worse than none, because it reads as current. This is `server/` from `flamenet-messenger-ios@5bc7258`, wholesale. ### The three files kept from this repo A naive copy would have destroyed all three: - **`README.md`** — not stale but *ahead*. It describes the relay as its own identity provider, true since the WordPress removal, while upstream's still opens with "It is **not** an identity provider" and contradicts itself in the next clause. It also carries the sibling-repo table, which only makes sense in a repo somebody arrives at cold. Kept; the one row it lacked (`FN_FEDERATION`) was added. - **`LICENSE`** — MIT, kept at the source repo's root rather than in `server/`. - **`Scripts/secret-sweep.sh`** — the gate for exactly this operation. `docker-compose.prod.yml` stays excluded as it was at mirror creation: it names production routers. ### The sweep, and one narrowing it needed It flagged `let token = "\(selector).\(secret)"` in `PasswordReset.swift` as an assigned password — a value computed at run time, not a literal. The probe already skipped `${...}` for shell and JavaScript; it now skips Swift's `\(...)` the same way. **Mutation-verified**: a planted `let password = "hunter2hunter2"` is still caught, and the interpolation is not. Clean over all 75 files afterwards. Worth knowing: **the sweep only reads git-tracked files.** An untracked file is invisible to it, so `git add` before trusting a clean run — my first canary passed only because it wasn't staged. ### Known gap, to fix upstream `docs/CONFIGURATION.md` documents `FN_DONATE_PROVIDER` and `FN_DONATE_SECRET` but not `FN_DONATE_ACCOUNT` or `FN_DONATE_PUBLISHABLE_KEY`, which the donate flow now requires. That belongs in `flamenet-messenger-ios` — fixing it here would be overwritten by the next sync — and will arrive in this repo with it. Generated with [Claude Code](https://claude.com/claude-code)

paulhitt (Migrated from gitlab.com) merged commit 4a54a620f4 into main

2026-08-25 19:35:15 +00:00

paulhitt commented

2026-08-25 19:35:16 +00:00

(Migrated from gitlab.com)

mentioned in commit 4a54a620f4

mentioned in commit 4a54a620f477780003b3305692ad35ff5f9c4133

paulhitt commented

2026-08-25 19:43:31 +00:00

(Migrated from gitlab.com)

mentioned in merge request !2

paulhitt commented

2026-09-09 18:59:29 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#64