Joystick consent: ask page, consent_refused, receipts, signed-in grants page with revoke #5
2026-11-08
Named revocation-conflict tests on pg-mem, first-create doc line, npm fallback in test-live-pg
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Doc the FK, the cookie and scope bounds, consent_text_missing
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Addendum: per-index predicate check, live second-revocation and missing-table cases, test-live-pg prerequisites
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
WIP t10: inflate cap, consent_text_missing before claim, scope caps, revocation FK
Tests green locally; mutants not yet run; not pushed; PR body not updated. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Consent doc: ask cookie, carried wording, unique revocation, fixed link expiry
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Check the shown text before any code exchange; pin link expiry with a clock
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Consent review fixes: ask-only cookie, fixed-expiry grants links, wording carried to the receipt, one revocation per grant
The ask sets its own cookie and no launch binding; Continue sets the binding and carries the exact text shown into it; the receipt stores that text and its hash. Grants-page form tokens keep the link's expiry. Revocations are unique per grant and revoke reports only what it wrote. access_denied's attempt denial code is pinned for Bifrost and Repixelizer. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Consent flow doc: steward rulings and the built design; pin repeat-revoke
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Joystick consent: the ask, typed refusal, receipts, and a signed-in grants page
Managed custody (callbackMint custody_only) now stops at a Heimdall page before the provider redirect. A decline or a provider access_denied is consent_refused (by viewer|provider), distinct from provider_error. A granted completion writes an append-only consent receipt with the asked and granted scopes and the digest of the wording shown. GET /v1/me/grants lists every grant and receipt of the signed-in account; revoking one strips the credential, so the app's next token request is refused, and writes a revocation receipt. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-06
Draft: Joystick consent flow design and skipped test sketch
Documents what a viewer sees today on the Joystick path and what consent is missing, then drafts a visible ask, typed refusal and auditable receipt. Design only; the test file is a skipped sketch and was not run. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>