chadtmiller.com/knotless

Switch repository

Loading…

What changes

The app signs in. It takes a handle, or makes an account, and opens a browser at /oauth/app-login with a PKCE pair. It trades the code it comes back with for the session, keeps that in the keychain on this device only, and sends it as the pages' cookie. Home, Inbox and Profile show a sign-in form when no one is signed in, Explore stays public, and Profile has Sign out, which logs out on the server too.

The goat service tokens are now debug-build only, and the handle a person typed to read as is gone.

Why

Other people's inboxes and every write need an account. This is the app's half of the session the pull below hands over.

How it was checked

Signed in on a real iPhone through the browser, approving at the PDS, with a development build whose association names ?mode=developer. Force-quit and reopened, it stayed signed in, and the Inbox showed real notifications and a private repository's pull. ios/check-models.sh passes.

Not yet run: signing out, cancelling the browser and refusing at the PDS.

Not yet possible: a build without ?mode=developer. Apple's CDN doesn't yet hold the association's webcredentials, so an ordinary build can't open sign-in until it does. The app isn't distributed yet, so nothing waits on this.

Shortcomings

An offline start keeps the token but shows the sign-in form, as no account is known until getViewer answers.

🤖 Generated with Claude Code

This adds browser sign-in to the iOS app. It starts with a PKCE pair at /oauth/app-login, trades the code at /oauth/app-token, and keeps the token in a this-device-only keychain item. It sends that token as the knotless_session cookie through a session with no cookie storage. Home, Inbox and Profile show a sign-in form when nobody is signed in, and Sign out calls /oauth/logout. The goat service tokens now sit behind #if DEBUG.

I read every changed file and found nothing that must change.

• The server side checks out: /oauth/app-token is routed and documented in serve.md and api.md, and logout accepts a request with no Origin header, which is what a URLSession call sends.
• No change file or Shots line is needed, since the change is under ios/ only.
• Removing DevAccount.actor leaves no other reader of it in the pull. The remaining ActorKey uses are in the HomeView and ProfileView code this pull replaces.

Two non-blocking notes:

• loadViewer keeps the token on any error, including a 401 for a revoked or expired session. The user then sees the sign-in form with an error, and signing in again overwrites the token. That works, but you could clear the token on a 401 and keep it only for network errors.
• Sign-out, cancelling the browser and refusing at the PDS are untested, as the body says. These are the three paths I would run before distributing the app.