Document the portable guest identity (GRYT-273) - #24
Merged
Conversation
The identity page described guest mode as a key per device that dies with your site data and comes back only from a file. Gryt-chat/client#148 replaces that with one backup, shown as 24 words, that every server's key is worked out from — so it covers servers joined after it was saved, and moving to a second device is pasting the words rather than exporting and importing. Rewrote the two sections that were built around the file, and the row in the comparison table that said an identity survives a lost device "only if the key was saved to a file". The file is still there and still what "Authorise this device" reads, so it keeps a section — a shorter one, below the thing most people want. Added the phone case as its own three steps, because that is the question people actually arrive with, and a note that an identity now follows the server rather than the address it answers on. Also documented the ordering rule GRYT-267 introduces on GRYT_TRUSTED_CERT_ISSUERS. The first issuer in the list owns the plain ids, so adding one to the front — or reordering an existing list — turns every account identity on the server into a different user. Adding to the end is safe and changes nothing. Written where the variable is documented rather than only in the code. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pairs with Gryt-chat/client#148 and Gryt-chat/server#47. Merge this after those — it describes behaviour that doesn't exist yet.
What was wrong
The identity page described guest mode as it was: a key per device, dies with your site data, comes back only from a file. After #148 that's a backup of 24 words that every server's key is worked out from — so it covers servers joined after you saved it, and the second-device flow is pasting words rather than exporting and importing a file.
The comparison table had a row saying a local identity survives a lost device "only if the key was saved to a file". That's the row most likely to be read and believed.
What changed
The config bit
GRYT_TRUSTED_CERT_ISSUERSwas already documented — I was wrong when I said it wasn't. What's new is the ordering rule from GRYT-267: the first issuer in the list owns the plain ids, so putting one at the front, or reordering an existing list, silently turns every account identity on the server into a different user. Adding to the end is safe.That's a footgun with no runtime guard, only a comment in the code, so it's stated where the variable is documented and where a self-hoster editing their env will actually be looking.
Verified
yarn buildclean, 36+ pages prerendered.Deliberately says nothing about federation. #47 makes it safe to trust a second CA, it doesn't make joining another operator's server possible, and documenting it as though it does would be worse than saying nothing.
🤖 Generated with Claude Code