fix(auth): Quick Connect poll capability + unlinked KOSync registration#118
Merged
Conversation
Two fixes from the 2026-07-03 auth surface review: - Quick Connect: /initiate now issues a long random poll_token alongside the 6-character code, and polling (now POST /poll) requires the pair. Guessing a code returns the same 410 as an unknown one — the ~30-bit display code can no longer be brute-forced into a login JWT during the authorization window. Startup migration adds the column; pre-existing rows expire unpollable within their 5-minute TTL. - KOSync /v1/users/create (unauthenticated, KOReader's register button) no longer auto-links the new sync credential to a same-named Tome account. Registrations start unlinked; the authenticated Settings path (POST /api/auth/me/kosync) links — and reclaims a squatted username by overwriting its key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bndct-devops
force-pushed
the
fix/auth-hardening
branch
from
July 5, 2026 09:32
f63136e to
5e4caca
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two fixes from the 2026-07-03 auth-surface review.
Fixes
/initiatenow also issues a long randompoll_token, and polling (nowPOST /poll) requires the code + token pair; a guessed code gets the same 410 as an unknown one. The short code is still all you type on the already-signed-in device. Startup migration adds the column; pre-existing rows expire unpollable within their TTL.POST /v1/users/create, KOReader's "Register" button) attached the new credential to whatever Tome account shared the username — so anyone knowing a username could register it first and have their reading land on that account. Registrations now start unlinked; linking is the authenticated Settings path, which also reclaims a squatted name by overwriting its key.Tests
tests/test_auth_hardening.py— 9 new tests (poll-token required / indistinguishable-from-unknown, legacy tokenless rows unpollable, KOSync create stays unlinked, Settings relink reclaims).npm run buildtypechecks clean (LoginPage poll change).Verification
Emulator + endpoint checks performed on a branch-code instance (see the release-prep session notes).