Repository navigation
Conversation
7 tasks
Deploying puls3 with
|
| Latest commit: |
3bcf562
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://340da2a7.puls3-4lw.pages.dev |
| Branch Preview URL: | https://feat-136-wallet-sessions-02.puls3-4lw.pages.dev |
Contributor
Author
|
Closing this draft. #176 replaces the rebase. main already has the app half of #136 through #149: WalletPort.signChallenge, WalletSession, readAuthConfig, and sign-in before createHire. Rebasing these commits would land a second implementation (Sep10ChallengeCheck, AuthConfig, another wallet session). assets/config.json also pins a server key and domains the live server does not use (GDVEU3… / puls3.app / auth.puls3.app against GBEELN… / puls3-hub-on-stellar.api.serverpod.space). #176 pins those live SEP-10 checks on the existing path, including the Pages build. |
moises-cisneros
pushed a commit
that referenced
this pull request
Oct 14, 2026
…ore the wallet prompt (#136) (#176) Ports what the #174 draft added over main's sign-in (#149), onto main's WalletPort.signChallenge(SignInChallenge): - assertSep10Challenge now also requires a web_auth_domain operation from the server, checks its value when the app knows it, and verifies the server's own signature (the transaction source, on Testnet) before Freighter is prompted. Before, a challenge with no server signature was signed. - SignInChallenge, WalletSession and readAuthConfig carry webAuthDomain. readAuthConfig takes build-time pins (PULS3_AUTH_SERVER_SIGNING_KEY, PULS3_AUTH_HOME_DOMAIN, PULS3_AUTH_WEB_AUTH_DOMAIN) that win over config.json, because the static Pages build has no server-published auth block, so today it pins nothing. - cloudflare-pages-build.sh passes the pins as dart-defines, fails when PULS3_HIRE=server is missing any of them, and refuses a server key that is not a public G... address without echoing it. - README (Deploy) and .env.example list the three Pages variables and the values of the deployed server. The #174 config.json pinned GDVEU3..., puls3.app and auth.puls3.app; the live server signs with GBEEL... and uses puls3-hub-on-stellar.api.serverpod.space for both domains, so those pins would refuse every real challenge. They are not carried over. Tests: signed challenge with the pinned web_auth_domain; refused without web_auth_domain, with another web_auth_domain, unsigned, and signed by another key; pins over config.json; Pages build pins and fail-closed cases. Refs #136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #136
Summary
Local Flutter work for the wallet session: load the SEP-10 auth config, check the challenge before the Freighter prompt, and keep the session across hire calls. The server half of #136 is already on main and live.
Acceptance criteria
Verification evidence
Not rebased.
git rebase origin/mainstops on commit5de25acwith conflicts in:puls3_flutter/lib/src/wallet/wallet_port.dartpuls3_flutter/lib/src/wallet/mock_wallet.dartpuls3_flutter/test/screens/hire_sheet_test.dartmain already has
WalletPort.signChallenge(SignInChallenge). This branch addssignChallenge(String challengeXdr, ChallengeExpectations). Keep main's signature and portSep10ChallengeCheckonto it.Notes for reviewers
Draft on purpose. Do not merge. Four commits, tip
3bcf562, 33 commits behind main. See the issue comment for the handoff.Made with Cursor