marty/rm-circle-team-router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Post-join sign-in actually works: live position lookup for a cold index, ordered calls, redirect no longer races the signature

Browse Source 
#787 registered at 18:35 CT, 22 minutes after the first join-flow fix, and still had no profile. Two
causes, both fixed:

1. messages.verifyChallenge resolved the wallet through chain.memberIdByAccount, which reads the
   CACHED index. Seconds after a registration that wallet is not in it, so the signature was rejected
   with "No RM Circle position is registered to this wallet". It now accepts an idHint (the position
   id from the member's own registration receipt) and, on a cache miss, reads that id live from the
   contract via chain.verifyMember, minting only when the contract says this exact wallet owns it.
   That is a stronger proof than the cache, not a weaker one. Now async; the single call site awaits.

2. join-now.js fired the sign-in and a 4.5s redirect in parallel, so the page could navigate away
   while the wallet was still showing the signature prompt, and it did not wait for submit-id (which
   runs the live verifyMember server-side that seeds the index). It now awaits the report, passes the
   receipt id, and redirects only once the signature settles, with a 120s bailout.

qa/signin-fallback.mjs (7 assertions) proves the cold-index path with real secp256k1 signatures and
covers the abuse cases: a hint for a position the wallet does not own is refused, and a signature from
another wallet is refused. Existing suites still pass: profiles-unit 28, gate-e2e 47.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
martbost
2026-09-16 18:49:33 -05:00
parent 6f1c9ff8ca
commit 49a0778a53
4 changed files with 124 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
messages.js
+17 -2
View File
@@ -74,7 +74,13 @@ function makeChallenge(address) {
challenges.set(a, { message, exp: Date.now() + CHALLENGE_TTL });
return message;
}
function verifyChallenge(address, signature) {
// idHint: the position id a brand-new member just got from their registration
// receipt. memberIdByAccount reads the CACHED index, which the indexer has not
// refreshed yet seconds after a join (#787, 2026-09-16: signed in 22 minutes after
// the join-flow fix shipped and was still rejected with "no position registered").
// On a cache miss we read that id straight off the chain and accept it only when
// the contract says this exact wallet owns it, so the proof is stronger, not weaker.
async function verifyChallenge(address, signature, idHint) {
const a = address.toLowerCase();
const ch = challenges.get(a);
if (!ch || ch.exp < Date.now()) return { error: 'Challenge expired - tap sign-in again.' };
@@ -85,7 +91,16 @@ function verifyChallenge(address, signature) {
+ rec.slice(0, 6) + '…' + rec.slice(-4) + '. Switch your wallet to the account that owns this '
+ 'position, reload the page, then tap sign-in again.', signer: rec, expected: a };
challenges.delete(a);
const id = chain.memberIdByAccount(a);
let id = chain.memberIdByAccount(a);
if (!id && idHint) {
const hint = Number(idHint);
if (Number.isInteger(hint) && hint > 0) {
try {
const m = await chain.verifyMember(hint); // live contract read; also seeds the index
if (m && m.registered && String(m.account || '').toLowerCase() === a) id = hint;
} catch (e) { console.error('verifyChallenge live lookup', e.message); }
}
}
if (!id) return { error: 'No RM Circle position is registered to this wallet.' };
const token = crypto.randomBytes(32).toString('hex');
sessions.set(token, { address: a, id, expires: Date.now() + SESSION_TTL });