From a11450ccd4b6fc8e4b5870c6a1621b2ec2236216 Mon Sep 17 00:00:00 2001 From: Gabriel Date: Wed, 19 Aug 2026 16:59:22 -0300 Subject: [PATCH] chore(auth): remove the Apple review test account and its posting key The app is approved and live, which is the point AGENTS.md said to delete this. It shipped a HIVE posting key for @skatethread in plaintext in a public repo, along with the short password that swapped itself for the key at login. The gotcha telling us to remove it goes too, since it now describes something that is not there. The key should be treated as compromised and rotated on chain: it has been public for the life of the repo, so deleting the source is only half of it. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01UwrZ8CynFPrFHUE9fJwfCz --- AGENTS.md | 15 ++++----------- lib/auth-provider.tsx | 37 ------------------------------------- 2 files changed, 4 insertions(+), 48 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index dfdfd23..2f60a3e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -121,25 +121,18 @@ QueryClientProvider source of truth — `ios/` is regenerated from it by prebuild, so do not edit the Podfile value directly. -4. **Test account in auth-provider:** Hardcoded credentials in `lib/auth-provider.tsx` - let Apple reviewers log in with a simple password instead of a HIVE posting key. - Remove immediately after Apple approves the app: - - Delete the "APPLE REVIEW TEST ACCOUNT CONFIGURATION" block (`TEST_USERNAME`, - `TEST_POSTING_KEY`, `TEST_SIMPLE_PASSWORD` constants). - - Delete the "APPLE REVIEW TEST ACCOUNT LOGIC" block inside the login function. +4. **HIVE RPC nodes:** Multiple fallback nodes configured in `hive-utils.ts`. If one fails, the client retries on the next. Don't hardcode a single node. -5. **HIVE RPC nodes:** Multiple fallback nodes configured in `hive-utils.ts`. If one fails, the client retries on the next. Don't hardcode a single node. +5. **Video autoplay:** Uses viewport tracking (`lib/ViewportTracker.tsx`). Videos auto-play when 60%+ visible, pause when scrolled away. -6. **Video autoplay:** Uses viewport tracking (`lib/ViewportTracker.tsx`). Videos auto-play when 60%+ visible, pause when scrolled away. - -7. **Double padding on PostCard:** `components/Feed/PostCard.tsx` has its own +6. **Double padding on PostCard:** `components/Feed/PostCard.tsx` has its own `paddingHorizontal: theme.spacing.md`, and the screens rendering it add theirs: feed, profile and conversation each apply 16, while the conversation drawer applies none. The card is therefore not inset the same everywhere. When changing card padding, check all four call sites instead of assuming the value is global. -8. **No test suite:** There are no automated tests in the project currently. The `scripts/` directory is empty. +7. **No test suite:** There are no automated tests in the project currently. The `scripts/` directory is empty. ## Environment Setup diff --git a/lib/auth-provider.tsx b/lib/auth-provider.tsx index f2566da..dbd8893 100644 --- a/lib/auth-provider.tsx +++ b/lib/auth-provider.tsx @@ -42,29 +42,6 @@ import { clearActiveSession, } from './active-session'; -// ============================================================================ -// APPLE REVIEW TEST ACCOUNT CONFIGURATION -// ============================================================================ -// This is a temporary solution for Apple App Store review process. -// Apple reviewers need a simple password, but HIVE posting keys are too long. -// -// INSTRUCTIONS: -// 1. Fill in the TEST_USERNAME with the account username -// 2. Fill in the TEST_POSTING_KEY with the actual HIVE posting key -// 3. Fill in the TEST_SIMPLE_PASSWORD with a simple password for Apple reviewers -// -// HOW IT WORKS: -// - When someone logs in with TEST_USERNAME and TEST_SIMPLE_PASSWORD, -// the app will internally use TEST_POSTING_KEY for all blockchain operations -// - The reviewer only needs to remember the simple password -// ============================================================================ - -const TEST_USERNAME: string = 'skatethread'; -const TEST_POSTING_KEY: string = '5KPCy8wGKukimMDSu64dA3gUB5Utj5Qm3Vm3yueCzm1MG4Lk3XB'; // posting key is exposed intentionally and will be changed later -const TEST_SIMPLE_PASSWORD: string = '8wGKukim'; - -// ============================================================================ - // Custom error types for authentication export class AuthError extends Error { constructor(message: string) { @@ -332,20 +309,6 @@ export function AuthProvider({ children }: { children: React.ReactNode }) { throw new AuthError('Username and posting key are required'); } - // ============================================================================ - // APPLE REVIEW TEST ACCOUNT LOGIC - // ============================================================================ - // Check if this is the Apple test account - if (TEST_USERNAME && normalizedUsername === TEST_USERNAME.toLowerCase()) { - // If they're using the simple password, replace it with the real posting key - if (TEST_SIMPLE_PASSWORD && postingKey === TEST_SIMPLE_PASSWORD) { - postingKey = TEST_POSTING_KEY; - } - // If they're using the posting key directly, that's fine too - // Continue with normal validation using the posting key - } - // ============================================================================ - await validate_posting_key(normalizedUsername, postingKey); // Encrypt the key