Improve static pairing-secret provisioning - #132
Merged
maximmaxim345 merged 2 commits intoAug 5, 2026
Conversation
maximmaxim345
approved these changes
Aug 5, 2026
maximmaxim345
added a commit
to Sendspin/aiosendspin
that referenced
this pull request
Aug 10, 2026
Add PIN language and secret locations hints. Implements Sendspin/spec#131 and Sendspin/spec#132 for server side. --------- Co-authored-by: Maxim Raznatovski <nda.mr43@gmail.com>
maximmaxim345
added a commit
to Sendspin/sendspin-js
that referenced
this pull request
Aug 11, 2026
Aligns the client with the new pairing spec changes and moves the E2E dependency to aiosendspin 9.0.0. On the Spec side, this PR implements: - Sendspin/spec#129 - Sendspin/spec#130 - Sendspin/spec#131 - Sendspin/spec#132. ## Pairing `server/activate` now carries a `pairing` object (`method`, `pin_length`, `languages`) in place of `selected_pair_method`, and `pin_length` moved out of `server/pair-init` so the client validates it before an attempt starts. Terminal lockout is gone: a single dynamic-PIN failure counter escalates the method to gesture-gating at ten failures and de-escalates on the next verified round, so repeated wrong PINs can no longer leave a device permanently unpairable. A gesture-gated attempt signals `client/pair-pending` and waits for `openPairingWindow()` rather than closing the connection after five minutes, and a window opened before the server asks now survives a reconnect instead of being silently discarded. Clients can advertise where the operator finds each static secret through `locations`, and which channels convey the dynamic PIN through `out_channels`. A server's spoken-PIN language preference reaches the app as a second argument to `onPairingPin`; the sample player uses it to read the PIN aloud in the operator's language. ## Breaking changes `isPairingLockedOut()` and `clearPairingLockout()` are removed in favour of `isDynamicPinEscalated()`, since escalation has no operator exit other than a successful round. `onPairing` gained a `pending` event and `onPairingPin` a second `languages` argument. New optional config: `pinOutChannels`, `staticPinLocations` and `pairingPskLocations`, all omitted from `client/hello` when unset.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Improve static pairing-secret provisioning.
Consolidate the static pairing-secret provisioning rules into per-method lifecycle paragraphs, and help the operator find the secrets.