feat(accounts): re-enable adding & switching multiple Farcaster accounts - #16
Merged
Merged
Conversation
Supercast's multi-account control was ~80% intact in the fork (data model, isAuthorized/asFid, the account switcher, sharing/delegation) but the "Add account" button was a hard stub (alert) wired to the retired super-auth redirect, and the SIWN handler reassigned the primary fid instead of attaching a sibling. - New POST /api/account/add-account: additive Sign-in-with-Neynar handler that attaches an additional owned account (upsert FarcasterAccount + create ConnectedAccount) and NEVER touches supercastPrivyUser.fid. Blocks attaching an account another Castora user already owns/shares (409), so the signer upsert only ever touches the user's own account. - New /add-account page + AddAccountForm (mirrors the proven onboarding SIWN pattern; invalidates user state, then switches into the new account). - Re-point the ProfileBar + MobileSidebar "Add account" buttons at it and remove the dead super-auth create-connection / AUTH_URL redirect code. Switching, acting-as (feed/notifications/cast via asFid), and sharing (delegate-access) already worked and are unchanged. Verified: typecheck + build green; adversarial review of data-mutation safety + end-to-end flow (collision guard tightened, redirect-during-load and switch-before-refetch fixed).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-enables Supercast's multi-account control. An investigation (current fork vs. the original Supercast dump) found ~80% was already intact — the
ConnectedAccount/SharedAccountdata model,isAuthorized+asFid(a real trust boundary), the account switcher, acting-as on feed/notifications/cast, and the full sharing/delegation flow. The only real gap was the "Add account" button, a hardalert()stub wired to the retired super-auth redirect — and the SIWN handler reassigned the primary fid instead of attaching a sibling account.Changes
POST /api/account/add-account(new) — additive Sign-in-with-Neynar handler. Upserts theSupercastFarcasterAccountand creates aConnectedAccountfor the current user, and never writessupercastPrivyUser.fid(the bug insiwn'ssetupUserSigner)./add-accountpage +AddAccountForm(new) — mirrors the proven onboarding SIWN pattern; invalidates user state, then switches into the new account.ProfileBar+MobileSidebar"Add account" buttons; removed the deadcreate-connection/AUTH_URLredirect code.Switching, acting-as, and sharing already worked and are unchanged.
Verification
npm run typecheck✅,npm run build✅ (/add-account+/api/account/add-accountcompile).isReconnecting()/hasLoadError()so a legit user isn't bounced to onboarding while user/state loads).Security notes (unchanged behavior, but more reachable now)
MANY_ACCOUNTSpremium label exists but isn't enforced) — easy to add later.Follow-ups (not in this PR)
create-connection, the 410create-signer/verify-farcasterroutes,AccountConnectionSessionmodel +signer.tshelpers) — needs a careful Prisma migration, kept separate.