add support for auth (via email) #19

andrewkmin · 2023-11-20T17:38:16Z

$title

This will require dns updates to have this hosted at a Turnkey subdomain.

r-n-o · 2023-11-27T16:39:50Z

@andrewkmin do you think we can consolidate recovery and auth under the same iframe? Conceptually they do the same thing?

spin up a key pair on first load
accept a bundle (we can have different events for different bundle types, if these are different -- but I think in this case both recovery and auth bundles are the same, they contain an encrypted P256 private key)
sign / stamp payloads

Are there specific aspects of auth that require a separate iframe? Otherwise we can have a common domain for both.

andrewkmin · 2023-11-28T05:15:46Z

@andrewkmin do you think we can consolidate recovery and auth under the same iframe? Conceptually they do the same thing?

spin up a key pair on first load

accept a bundle (we can have different events for different bundle types, if these are different -- but I think in this case both recovery and auth bundles are the same, they contain an encrypted P256 private key)

sign / stamp payloads

Are there specific aspects of auth that require a separate iframe? Otherwise we can have a common domain for both.

This absolutely makes sense. Arguably the trickiest part in all this is naming 😄 between the two, I feel like both fall under the auth umbrella more so than the recover umbrella, but I'm open to entries here. injector would be too general; secure entry... hmmm. Whichever term/domain name we land on, reminder to self: update docs.turnkey.com, demo-passkey-wallet, and anywhere else it's used/referenced!

r-n-o · 2023-11-28T15:39:45Z

auth/index.html

      window.addEventListener("message", async function(event) {
-        if (event.data && event.data["type"] == "INJECT_RECOVERY_BUNDLE") {
+        if (event.data && event.data["type"] == "INJECT_CREDENTIAL_BUNDLE") {


I don't think we can break compatibility. Let's support both INJECT_RECOVERY_BUNDLE and INJECT_CREDENTIAL_BUNDLE? Old versions of our SDK will keep sending INJECT_RECOVERY_BUNDLE for a while, and it doesn't cost us much to keep supporting this.

r-n-o · 2023-11-28T15:41:08Z

Dockerfile

+COPY auth /usr/share/nginx/auth
 COPY export /usr/share/nginx/export


I think we need to keep supporting recovery.turnkey.com. So let's "cheat":

COPY auth /usr/share/nginx/recovery

:)

r-n-o · 2023-11-28T15:41:59Z

README.md

@@ -1,17 +1,22 @@
 # Frames

-This repository contains code for the recovery and export components of Turnkey. These components can be embedded as iframes by users to support end-users in recovery and export.
+This repository contains code for the recovery, export, and auth components of Turnkey. These components can be embedded as iframes by users to support end-users.

 ## Email Recovery


Update the title to "Auth and Recovery"? (and delete the specific "auth" section)

We'll want to keep recovery.turnkey.com for compatibility but we should recommend people set auth.turnkey.com in both email recovery and auth flows.

r-n-o · 2023-11-28T15:45:57Z

Arguably the trickiest part in all this is naming 😄 between the two, I feel like both fall under the auth umbrella more so than the recover umbrella, but I'm open to entries here

Yeah I'm with you there! I'd say recovery falls under the auth umbrella 👍

r-n-o · 2023-11-28T20:01:49Z

auth/index.html

@@ -863,7 +864,7 @@ <h2>Message log</h2>
      // TODO: find a way to filter messages and ensure they're coming from the parent window?
      // We do not want to arbitrarily receive messages from all origins.
      window.addEventListener("message", async function(event) {
-        if (event.data && event.data["type"] == "INJECT_RECOVERY_BUNDLE") {
+        if (event.data && (event.data["type"] == "INJECT_CREDENTIAL_BUNDLE" || event.data["type"] == "INJECT_RECOVERY_BUNDLE")) {


r-n-o · 2023-11-28T20:03:14Z

auth/favicon.svg

We might need a different color than usual! Red? Purple?

Doesn't really matter in the end, not many people will visit these iframe as a standalone page.

r-n-o · 2023-11-28T20:03:59Z

.github/workflows/deploy.yml

+      - name: Publish Auth
        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca #v1.5.0
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          projectName: recovery
-          directory: recovery
+          projectName: auth
+          directory: auth
          gitHubToken: ${{ secrets.GITHUB_TOKEN }}


~~Note: this will fail on the cloudflare side, I'll need to edit the project to be named "auth".~~ done!

oliviathet

wooooh 🎉 this looks great. love seeing recovery -> auth.

andrewkmin marked this pull request as draft November 20, 2023 17:38

add email auth frame

252d565

andrewkmin force-pushed the andrew/email-auth branch from 5c0f157 to 252d565 Compare November 22, 2023 18:47

andrewkmin mentioned this pull request Nov 22, 2023

update iframestamper and add an example for email auth tkhq/sdk#169

Merged

andrewkmin changed the title ~~email auth~~ add support for auth (via email) Nov 22, 2023

andrewkmin marked this pull request as ready for review November 22, 2023 18:49

andrewkmin force-pushed the andrew/email-auth branch from 9c19728 to a4c1043 Compare November 27, 2023 15:48

plumbing

f394a91

andrewkmin force-pushed the andrew/email-auth branch from a4c1043 to f394a91 Compare November 27, 2023 16:00

andrewkmin requested review from r-n-o and oliviathet November 27, 2023 16:00

andrewkmin force-pushed the andrew/email-auth branch from fc5fcb4 to 8e72eb3 Compare November 28, 2023 05:14

consolidate

120c81a

andrewkmin force-pushed the andrew/email-auth branch from 8e72eb3 to 120c81a Compare November 28, 2023 05:17

r-n-o reviewed Nov 28, 2023

View reviewed changes

feedback

1f63a8e

andrewkmin force-pushed the andrew/email-auth branch from 538749b to 1f63a8e Compare November 28, 2023 19:26

r-n-o approved these changes Nov 28, 2023

View reviewed changes

maintain auth and recovery ports separately

c0c1476

r-n-o approved these changes Dec 1, 2023

View reviewed changes

oliviathet approved these changes Dec 1, 2023

View reviewed changes

andrewkmin merged commit 876c1c1 into main Dec 1, 2023
5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add support for auth (via email) #19

add support for auth (via email) #19

andrewkmin commented Nov 20, 2023 •

edited

Loading

r-n-o commented Nov 27, 2023

andrewkmin commented Nov 28, 2023 •

edited

Loading

r-n-o Nov 28, 2023

r-n-o Nov 28, 2023

r-n-o Nov 28, 2023 •

edited

Loading

r-n-o commented Nov 28, 2023

r-n-o Nov 28, 2023

r-n-o Nov 28, 2023

r-n-o Nov 28, 2023 •

edited

Loading

oliviathet left a comment

		COPY auth /usr/share/nginx/auth
		COPY export /usr/share/nginx/export

add support for auth (via email) #19

add support for auth (via email) #19

Conversation

andrewkmin commented Nov 20, 2023 • edited Loading

r-n-o commented Nov 27, 2023

andrewkmin commented Nov 28, 2023 • edited Loading

r-n-o Nov 28, 2023

Choose a reason for hiding this comment

r-n-o Nov 28, 2023

Choose a reason for hiding this comment

r-n-o Nov 28, 2023 • edited Loading

Choose a reason for hiding this comment

r-n-o commented Nov 28, 2023

r-n-o Nov 28, 2023

Choose a reason for hiding this comment

r-n-o Nov 28, 2023

Choose a reason for hiding this comment

r-n-o Nov 28, 2023 • edited Loading

Choose a reason for hiding this comment

oliviathet left a comment

Choose a reason for hiding this comment

andrewkmin commented Nov 20, 2023 •

edited

Loading

andrewkmin commented Nov 28, 2023 •

edited

Loading

r-n-o Nov 28, 2023 •

edited

Loading

r-n-o Nov 28, 2023 •

edited

Loading