mirror of
https://github.com/profullstack/agentbbs.git
synced 2026-10-01 19:43:49 +00:00
Anthony Ettinger
078937109c
provisionGit returned early when the Forgejo account already existed, so
EnsureKey only ever ran during first provisioning. A member who deleted their
key on git.profullstack.com never got it back: every later BBS login hit the
`if !created { return }` and skipped key registration entirely. The comment on
the web verify path ("key is added on next BBS login") was describing behaviour
that could not happen.
Key registration now runs on every provisionGit call that carries a session
key. EnsureKey was already idempotent — it GETs the account's keys and compares
key material ignoring the comment — so re-running it is free when nothing
changed, and it re-adds a removed key, picks up a rotated one, and backfills
members who joined before AgentGit captured keys. The welcome email stays gated
on `created`, since the one-time password is only meaningful for a new account.
Two things that would have made this unreliable in the new every-login path:
- The key title was the constant "agentbbs". Forgejo rejects a duplicate title
with 422, so a member who rotated their BBS key would have had the new one
silently dropped. The title now carries a short fingerprint, so distinct keys
coexist and the same key stays stable across logins.
- EnsureKey mapped *every* 422 to "already exists" and returned nil. That hid
genuine rejections forever, which matters far more now the call is on the hot
path. Only "has been used" bodies are swallowed; a rejected key surfaces with
Forgejo's own reason so it lands in the logs.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| forgejo.go | ||
| forgejo_test.go | ||
| key422_test.go | ||