feat: let Sapwood invite a phone instead of reading its code - #146
Merged
Merged
Conversation
Sapwood now shows a QR ("Scan this with Cambium") that the phone reads
and answers over the relay with the same enrolment code as today,
reversing the old scan/paste step for a desktop with no camera. The
paste/scan path stays as a secondary disclosure for older Cambium
builds. First valid reply wins; a second, different reply aborts the
attempt rather than guessing which phone the owner meant.
Adds enrol-invite.ts (invite creation, URI parsing, reply verification,
and a small state reducer for the collector) with a shared JSON test
vector at test/fixtures/enrol-invite-v1.json for parity with Cambium.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverses the optical step of phone-unlock enrolment. The old flow needed Sapwood to read the phone's QR, which a desktop with no camera cannot do.
heartwood-unlock:invite?v=1&k=<one-off pubkey>&r=<rendezvous>&x=<expiry>&relay=…. The secret half stays in page memory and is zeroed on confirm, cancel, expiry or teardown. The invite lives for 10 minutes.hand NIP-40expirationonly;enrolPhonepath unchanged: board button, words on the board's card, hand-off, check code.Someone who saw the QR could send their own key. The words check on the phone and on the board, plus the two-replies abort, catch that. It is the same trust as the existing words check. A relay observer cannot encrypt to the invite key, because it only travels optically.
The paste/scan-the-phone path stays behind a disclosure for older Cambium builds. The shared vector
test/fixtures/enrol-invite-v1.jsonis byte-identical to Cambium's copy. Firmware is unchanged.Not yet bench-tested end to end; do not merge before a round trip on hardware.