Repository navigation
feat(reputation): move a binding to a new identity - #934
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 24 minutes. View limit detailsLimit details: You’ve used all 2 included reviews currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (15)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (16)
🚧 Files skipped from review as they are similar to previous changes (10)
Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review. WalkthroughThe reputation module now builds signed reputation attestations and supports export, identity binding, and rebinding by users or admins. Bot initialization configures the handlers. The change adds localized messages and tests for validation, routing, confirmation, concurrency, and sunset-mode behavior. ChangesReputation export and identity rebinding
Priority: ➖ Normal Estimated code review effort: 4 (Complex) | ~40 minutes Merge Risk: ⚪ Minimal · up to This change adds reputation export and identity rebinding for account owners and admins. Moving a binding requires a signed authorization and a confirmation, and the move succeeds only if the account is still bound to the original identity. No concrete defect is outstanding, so the change looks ready to merge after normal checks. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 5 files. (11 skipped: 11 unsupported.) ✨ Finishing Touches 💡 2📝 Generate docstrings 💡
⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit signs a note at dawn, Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ba4326ef7a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ba4326e to
50750bf
Compare
50750bf to
e61e498
Compare
Phase 6, PR 6.3 of the Mostro reputation portability plan. A user whose reputation is bound to one Mostro identity can move it to another by pasting a rebind authorisation into the chat: an event of kind 38388 with z = reputation-rebind, signed by the bound identity, naming this bot's issuer key, at most an hour long. The bot verifies it, asks to confirm the new identity, moves the binding with a compare-and-set conditioned on the old identity (so a replay is a no-op), and issues an attestation to the new identity. /reputation_rebind <account> <npub or hex> <reason> lets an admin move a binding for a user who lost the bound identity; it is logged with both identities and the reason. Texts in every locale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UrKanPgEfEBiEo3snHz4WZ
/reputation_rebind runs ahead of the admin middleware that sets the stored language, so after a restart it answered in the Telegram or default language. Set the admin's stored locale once the admin record is loaded, before any reply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E4t8avpoStb19ERrS77V2m
Per the protocol update (protocol#74, #75), a rebind authorisation must name the destination of the request it comes with. The request here is the /start rep_<identity> link the bound account opened, so remember that identity and refuse an authorisation whose p differs, or one pasted with no such request. Authorisations dated more than 300 s ahead were already refused. Update the fixture to the protocol#76 vectors (405fcb4), which add rebind.context.destination and the future_created_at and other_destination cases, and run the rebind vectors against the full check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E4t8avpoStb19ERrS77V2m
Driving the rebind through initialize() in sunset mode showed two faults. Telegraf's session middleware leaves ctx.session unset until something writes to it, and in sunset mode nothing does, so the pasted authorisation and the requested identity were never kept; start the session when the flow needs it. The rebind confirm button was also dropped by the rate limiter when pressed within a second of the paste; it now shares the export button's own bucket. Tests cover the paste, confirm and admin command in sunset mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E4t8avpoStb19ERrS77V2m
The rebase onto main dropped the best-effort reputation_unavailable reply from the confirm buttons' catch block. Restore it, private chats only, and cover the rebind button too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RGDTGJM1ZbtMMbx1ptWysv
e61e498 to
75de0b7
Compare
1 participant
What changes and why
This is phase 6, PR 6.3 of the Mostro reputation portability plan, and the last bot PR. It is stacked on #933 (6.2). The protocol side is MostroP2P/protocol#74, "Rebinding".
The owner's rebind.
parseRebindverifies the event: id and signature, kind 38388,z = reputation-rebind, each tag once and well formed, an hour at most, and the 300-second skew. An authorisation dated more than 300 s in the future is refused.rebindMatchesthen checks the parts that depend on context:issueris this bot's key;pis the destination of the request it comes with (protocol#74 and Reactivate order after a user take it but didn't do anything #75). Here the request is the/start rep_<identity>link the bound account opened, which the bot remembers in the session. An authorisation for another identity, or one pasted without such a request, is refused.findOneAndUpdateconditioned on the account still being bound to X, and issues an attestation to Y.The admin rebind.
/reputation_rebind <telegram id or account id> <npub or hex> <reason>is for a user who lost X and cannot sign.Only an admin (
user.admin) can run it; anyone else is ignored.It requires a reason.
It moves the binding with the same compare-and-set, or binds an account that has none.
It is logged with the admin, the account, both identities and the reason.
It replies in the admin's stored language. It runs ahead of the admin middleware that would otherwise set that language.
Sunset mode. The paste, its confirm button and the admin command are registered ahead of the sunset catch-all, like the export (#933).
As the protocol states, a rebind revokes nothing already issued. X keeps what it imported, and any attestation issued to X stays valid until it expires.
Texts. Five new keys, in all ten locales.
Tests
The fixture is updated to the protocol#76 vectors (405fcb4), which add
rebind.context.destinationand thefuture_created_atandother_destinationcases.rebind.context;rebindMatches;future_created_atis refused by the parser, andother_destinationby the destination check;tests/bot/sunset.spec.ts, throughinitialize()):/start rep_<new>on a bound account, the paste and the button move the binding and issue to the new identity;🤖 Generated with Claude Code
https://claude.ai/code/session_01UrKanPgEfEBiEo3snHz4WZ
Summary by CodeRabbit