Registration: sign-up form with proof-of-work and a no-JS time-lock fallback #56

Merged

heimdall merged 5 commits from heimdall/registration-form into main 2026-11-11 11:17:25 +00:00

Conversation 0 Commits 5 Files changed 16 +1674 -121

heimdall commented 2026-11-11 10:31:42 +00:00

Member

Copy link

Follow-up reg-form-and-fallback. GET /auth/bifrost/register (server-rendered, no external assets, no cookies) and POST /auth/bifrost/register/form, both through one shared registration core with the JSON endpoint. With JS the page solves the proof of work; without JS a 30 s time-lock plus a stricter per-address budget (3/hour) is the fallback. Tradeoff stated in docs/registration-gates.md. Also records the steward decision to keep a verified address as sign-in recovery (privacy handling in the doc; nothing built, needs a mail relay from ops).

Not deployed.

🤖 Generated with Claude Code

Follow-up reg-form-and-fallback. `GET /auth/bifrost/register` (server-rendered, no external assets, no cookies) and `POST /auth/bifrost/register/form`, both through one shared registration core with the JSON endpoint. With JS the page solves the proof of work; without JS a 30 s time-lock plus a stricter per-address budget (3/hour) is the fallback. Tradeoff stated in `docs/registration-gates.md`. Also records the steward decision to keep a verified address as sign-in recovery (privacy handling in the doc; nothing built, needs a mail relay from ops). Not deployed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

heimdall added 2 commits 2026-11-11 10:31:42 +00:00

Registration: server-rendered sign-up form with script solver and time-lock fallback ... 9c4ab5646a

GET /auth/bifrost/register renders the form (notice in full, unchecked consent box);
POST /auth/bifrost/register/form and the JSON endpoint share NativeRegistration.
Challenge payload gains issued-at; waited path needs FallbackWaitSeconds and a
stricter per-address FallbackPermits budget.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Docs: sign-up form, no-JS time-lock fallback and its tradeoff; steward keeps a verified address for sign-in recovery ... 185cfcd0e7

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall added 1 commit 2026-11-11 10:56:18 +00:00

Registration form: origin guard, skip button, identity checks before spending, caps and error links ... d47f1d5e9d

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall added 2 commits 2026-11-11 11:17:25 +00:00

Registration form: text browsers without fetch metadata pass when sessionless; keep a challenge only while live ... 7bd26e9239

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Docs: origin guard, skip button, identity checks before spend, body cap, difficulty range ... 8ce0e68fe2

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall merged commit 028bc2fdf6 into main 2026-11-11 11:17:25 +00:00

heimdall deleted branch heimdall/registration-form 2026-11-11 11:17:26 +00:00

heimdall referenced this pull request from a commit 2026-11-11 11:17:26 +00:00

Registration: sign-up form with proof-of-work and a no-JS time-lock fallback (#56)

heimdall referenced this pull request 2026-11-11 17:54:00 +00:00

Desk: bearer credential (OpenIddict validation, desk.read/desk.answer, audience bifrost-desk) and answerer masking #71

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GameCult/Bifrost!56

No description provided.