Repository navigation
fix: drop a saved Zen-era login instead of failing on the first signature - #137
Merged
Merged
Conversation
…ture sso.html, profile.html and the player reloaded the login stored by the old Zen-based page and passed its keys to signData, which threw RangeError (offset is out of bounds). They now check that the private key produces the public one (isValidPair, from fid 5.0.1), remove a legacy session and say so. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FeCp9YZh9dCEHXtRdpVeFe
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
After #136, a browser still holding the login saved by the old Zen-based page (
tunecamp_zen_user) passed those keys tosignData, which threwRangeError: offset is out of bounds. Onsso.htmlthis showed as "Errore durante la generazione crittografica" and the SSO could not complete.profile.htmland the player read the same stored session. My miss in #136: users were told to expect new keys, but the stale session was never handled.Fix
vendor/identity.jsre-vendored from fid 5.0.1: a bad key now fails with a readable error, andisValidPair(pair)checks that the private key really produces the public one.sso.html: a legacy session is removed and the page says so ("la tua identità precedente usava il vecchio sistema Zen SEA… creane una nuova dal Profilo").profile.html: a legacy saved login is removed, with one notice, and the sign-in form shows.components/library-sync.js:readIdentityignores keys with the wrong shape, and newreadValidIdentity(used by the player) also runs the derivation check and removes a stale session.Companion to scobru/fid#6, which does the same for the portal.
Test plan
library-sync.test.jsnow 28 assertions (adds: Zen-shaped session, right-shape-wrong-key, real identity kept), plus library 50, instance-import 36, url-safety 15.sso.htmlshows the message andprofile.htmlshows the notice and the sign-in form, both remove the session, no page errors.tests/player.e2e.cjs: still 54 checks.🤖 Generated with Claude Code
https://claude.ai/code/session_01FeCp9YZh9dCEHXtRdpVeFe
Generated by Claude Code