engineering/zebra-report
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

zebra-spaces: log-out confirm spells out the irrecoverable consequences

Browse source 
The pubkey IS the user's identity: host claims, room reservations,
cohost grants, meeting-life blocks all key off it. Without a vault
backup, logging out is one-way. The old confirm() prompt was a single
line that didn't convey 'you cannot be you again' clearly enough.

New prompt:
- prints the full pubkey hex so the user can copy it before clicking OK
  (panic-safety net)
- enumerates exactly what they lose
- ends with the recovery path ('backup / restore')

Wording chosen to nudge a backup BEFORE confirm, not to scare-off
intentional log-outs.
This commit is contained in:
Russell Ballestrini 2026-06-02 17:51:55 -04:00
parent 68dd6e333c
commit cd98bc6603
No known key found for this signature in database
1 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

21
web/zebra-spaces.html
View file

@ -1383,8 +1383,21 @@ $('btn-vault').addEventListener('click', () => $('vault-panel').classList.toggle
* otherwise the page would refuse to enter any space (no identity). */
$('btn-logout').addEventListener('click', async () => {
if (ws){ setStatus('leave the space first','err'); return; }
if (!confirm('Log out wipes your identity key from this browser. ' +
'If you haven’t backed it up you cannot recover it. Continue?')) return;
/* destructive + permanent: the pubkey IS the user — it's how host
* claims, room reservations, cohost grants, blocks, and meeting-life
* blocklists key off you. Without a vault backup there's no way to
* be 'you' again from any device. Spell that out in plain language
* with the hex so the user can copy it if they panic mid-prompt. */
const msg =
'Log out will permanently destroy this identity in this browser.\n\n' +
'pubkey ' + (myKeys ? myKeys.pubHex : '(none)') + '\n\n' +
'After this:\n' +
' • You cannot reclaim host on any space you opened with this key\n' +
' • Cohost / speaker grants tied to this key are gone\n' +
' • The only way back is "backup / restore" — if you have not made a\n' +
' backup, this is one-way.\n\n' +
'Continue?';
if (!confirm(msg)) return;
try { localStorage.removeItem(ID_KEY); localStorage.removeItem(HANDLE_KEY); } catch(_){}
myHandle = ''; $('handle').value = '';
myKeys = await generateIdentity();
@ -3681,8 +3694,8 @@ logLine('', 'ready — pick a handle, type a rendezvous code, enter the space');
<footer style="margin:2.2rem auto 0;font-size:0.65rem;color:#999;line-height:1.7;word-break:break-all;font-family:monospace">
<span id="pi-seal" style="color:#777;cursor:default;user-select:none" title="">page integrity</span> &nbsp;·&nbsp; built <span class="stamp-date">2026-06-02</span><br>
md5 <span class="stamp-md5">9f65113f0454c4ad54c5eb4cd4ac2f97</span><br>
sha256 <span class="stamp-sha">fc19fc5385205fe18c0fb7536539c158043201154957f5370a0d96de24484b7c</span><br>
md5 <span class="stamp-md5">63f35884338ba5c1389831260fef410b</span><br>
sha256 <span class="stamp-sha">f33c271a0e657fa05c70df9fe6b37b1cd20a4dc7e6e0950a6a50822bd7c8f164</span><br>
<span style="color:#bbb">hashes are of this page with these two fields zeroed — to verify, blank them and re-hash</span><br>
<span style="color:#bbb">one self-contained file — <strong>save a copy</strong> and verify against these hashes; point at your own servers with ?signal= and ?turncred=, or <a href="host-your-own.html" style="color:#999">host your own community</a></span>
</footer>