From 489d83254610b1c289cf47ff6f55d7e7f9cfca54 Mon Sep 17 00:00:00 2001 From: martbost Date: Wed, 23 Sep 2026 05:50:34 -0500 Subject: [PATCH] Sign-in: stop telling a fast returning member off for being fast The email-code endpoint refuses a request that arrives within two seconds of the page loading, because a script fills a form instantly and a person does not. A member whose email is already filled in by the browser has nothing to type, taps straight away, and gets "Give the page a second, then tap again." The page now waits out the remainder itself and sends when the window has passed, so the person sees the normal sending state instead of an error. The server check is untouched, so anything posting at the endpoint without a page behind it still fails exactly as before. Co-Authored-By: Claude Opus 5 --- public/admin.html | 2 +- public/assets/common.js | 12 ++++++++++++ public/contract.html | 2 +- public/disclaimer.html | 2 +- public/earning.html | 2 +- public/index.html | 2 +- public/join.html | 2 +- public/launch.html | 2 +- public/ledger.html | 2 +- public/my.html | 2 +- public/partners.html | 2 +- public/plays.html | 2 +- public/privacy.html | 2 +- public/terms.html | 2 +- public/tx.html | 2 +- public/wall.html | 2 +- public/wallets.html | 2 +- 17 files changed, 28 insertions(+), 16 deletions(-) diff --git a/public/admin.html b/public/admin.html index 65e8a8e..8791194 100644 --- a/public/admin.html +++ b/public/admin.html @@ -492,7 +492,7 @@ - + diff --git a/public/assets/common.js b/public/assets/common.js index e76fdbf..b5c1adb 100644 --- a/public/assets/common.js +++ b/public/assets/common.js @@ -172,9 +172,21 @@ window.IAP = (function () { } armHoneypots(); document.addEventListener('DOMContentLoaded', armHoneypots); const hpValue = el => (el && el.dataset.touched === '1') ? (el.value || '') : ''; + // The server refuses a code request that arrives within a couple of seconds of the page loading, + // because a script fills a form instantly and a person does not. A returning member whose email + // is already autofilled has nothing to type, taps straight away, and gets told off for being + // quick (Marty, 2026-09-23). So the page waits out the remainder itself: the person sees the + // normal sending state, and anything posting at the endpoint without a page behind it still + // fails the same check. + const MIN_FORM_MS = 2400; // the server wants 2000; leave headroom for clock skew in transit + function formSettled() { + const left = MIN_FORM_MS - (Date.now() - FORM_TS); + return left > 0 ? new Promise(r => setTimeout(r, left)) : Promise.resolve(); + } async function requestCode(email, opts) { const o = opts || {}; let pick = null; + await formSettled(); for (let i = 0; i < 4; i++) { const r = await (await fetch('/api/auth/email/start', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ email, fts: FORM_TS, hp_field_x9: hpValue(o.honeypot), pick }) })).json(); diff --git a/public/contract.html b/public/contract.html index 523f5fb..b72fa27 100644 --- a/public/contract.html +++ b/public/contract.html @@ -141,7 +141,7 @@
Advertising services with a performance referral program. Not an investment product; no income guarantees. Crypto transactions are irreversible. Never spend what you cannot afford.
- + diff --git a/public/disclaimer.html b/public/disclaimer.html index 306b097..5a40e71 100644 --- a/public/disclaimer.html +++ b/public/disclaimer.html @@ -26,7 +26,7 @@

You decide whether, and how much, to spend. Never spend more than you can afford to lose.

- + diff --git a/public/earning.html b/public/earning.html index 86c4900..2b298db 100644 --- a/public/earning.html +++ b/public/earning.html @@ -83,6 +83,6 @@
Advertising services with a performance referral program. Not an investment product; no income guarantees.
- + diff --git a/public/index.html b/public/index.html index 46025c8..c12f826 100644 --- a/public/index.html +++ b/public/index.html @@ -495,7 +495,7 @@ - + diff --git a/public/join.html b/public/join.html index 26c1b14..a69099b 100644 --- a/public/join.html +++ b/public/join.html @@ -157,7 +157,7 @@ InstantAdPay · Contract · Terms · Privacy · Disclaimer - + diff --git a/public/launch.html b/public/launch.html index 66a34b0..b485cc1 100644 --- a/public/launch.html +++ b/public/launch.html @@ -104,7 +104,7 @@
Advertising services with a performance referral program. Not an investment product; no income guarantees.
- + diff --git a/public/ledger.html b/public/ledger.html index ae78b3e..00b0586 100644 --- a/public/ledger.html +++ b/public/ledger.html @@ -39,7 +39,7 @@
InstantAdPay · how it works · contract source ↗
- + diff --git a/public/my.html b/public/my.html index c9e9246..3867b1e 100644 --- a/public/my.html +++ b/public/my.html @@ -1067,7 +1067,7 @@ - + diff --git a/public/partners.html b/public/partners.html index 30458e2..5f122e1 100644 --- a/public/partners.html +++ b/public/partners.html @@ -128,7 +128,7 @@
Advertising services with a performance referral program. Not an investment product; no income guarantees. Crypto transactions are irreversible. Never spend what you cannot afford to lose.
- + diff --git a/public/plays.html b/public/plays.html index 4fef21a..2d0ea8b 100644 --- a/public/plays.html +++ b/public/plays.html @@ -192,7 +192,7 @@
Advertising services with a performance referral program. Not an investment product; no income guarantees. Crypto transactions are irreversible. Never spend what you cannot afford.
- + diff --git a/public/privacy.html b/public/privacy.html index 9cfae54..6eedc32 100644 --- a/public/privacy.html +++ b/public/privacy.html @@ -29,7 +29,7 @@

We use reasonable safeguards, but no system is perfectly secure. Protect your email and your wallet.

- + diff --git a/public/terms.html b/public/terms.html index e37488a..15b5c01 100644 --- a/public/terms.html +++ b/public/terms.html @@ -37,7 +37,7 @@

See also the Disclaimer and Privacy Policy.

- + diff --git a/public/tx.html b/public/tx.html index a3b0003..e15c485 100644 --- a/public/tx.html +++ b/public/tx.html @@ -34,7 +34,7 @@

← Back to the live ledger · Read the contract review

- + diff --git a/public/wall.html b/public/wall.html index be248be..675d2a9 100644 --- a/public/wall.html +++ b/public/wall.html @@ -47,7 +47,7 @@ - + diff --git a/public/wallets.html b/public/wallets.html index f9fe701..5838076 100644 --- a/public/wallets.html +++ b/public/wallets.html @@ -121,7 +121,7 @@
Advertising services with a performance referral program. Not an investment product; no income guarantees. Crypto transactions are irreversible. Never share your recovery phrase.
- +