fix(#178): make the hosted gate presentable — and the docs true - #179
fix(#178): make the hosted gate presentable — and the docs true#179TheBlackBit wants to merge 2 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Presenting a credential to the demo draws a red wallet warning: "The website requesting this data is unknown." Two things caused it. The app deployed at credentagent-demo.vercel.app (examples/quickstart) self-signed a throwaway reader certificate on every request, so no trust list a tester imported could ever match. It now presents a reader identity when one is configured via CREDENTAGENT_READER_KEY / CREDENTAGENT_READER_CERT; unset, behaviour is unchanged, so deploying before configuring is safe. No version bump needed — the pinned 0.3.1 already carries readerIdentity. And two documents still described that capability as unbuilt: the RICAL row in the trusted-demo-credentials guide, and the "Pending code hook" callout in the demo-pki README, which called it "documented intent, not a working knob". Both now state what actually clears the warning — the wallet importing the reader trust list AND the gate signing with the matching reader key — with the config snippet and the origin-binding constraint. testing-on-device.md already had this right; the other two now agree with it. Also documented: the committed reader certificate has no committed private key (keys/ is gitignored), so a fresh clone always self-signs and the shipped trust list matches a reader nobody can present. run-gate.mjs now names that half-state instead of printing only "reader identity : none". Verified by running the deployed app configured as the deployment: its payment request carried the demo reader certificate in x5c under both origins the certificate covers, and that certificate is named on the trust list. No changes under packages/. Signed-off-by: Ever Morales <solisever777@gmail.com> Signed-off-by: Ever Morales <ever.morales@koombea.com>
13c2c52 to
b340770
Compare
TheBlackBit
changed the title
dzuluaga
left a comment
dzuluaga
left a comment
There was a problem hiding this comment.
Approve — with two minor doc nits (non-blocking).
Verified the load-bearing claim independently: the quickstart pins @openmobilehub/credentagent-gate@^0.3.1, which resolves to exactly 0.3.1, and I unpacked the published 0.3.1 tarball — readerIdentity is fully implemented there (dist/client.js reads it, SAN-checks it, and threads it through mountCeremony → buildDcPaymentRequest to present a stable reader cert in x5c). So this works on the deployed version, not just the un-published 0.4.0 source. The change is backward-compatible (env unset → readerIdentity undefined → byte-identical to before), and the trust boundary is right: only the reader key/cert land on the gate, so a popped gate can impersonate this one demo reader and nothing else.
Nit 1 (worth fixing) — the new "check it without a phone" line fails on a fresh clone. tools/demo-pki/README.md advertises node tools/demo-pki/verify-reader-trust.mjs, but that script (a) imports packages/credentagent-gate/dist/..., and dist/ is not committed → needs npm run build first; and (b) reads keys/reader-key.pem, which is gitignored. On a fresh clone it hits exactly the "you don't have the private key" failure the rest of this PR explains. Suggest stating the prereqs inline, e.g. "(after ./gen-pki.sh and building the gate package)".
Nit 2 (optional) — SAN caveat. The deployed walletOrigin comes from VERCEL_PROJECT_PRODUCTION_URL; the cert SAN covers credentagent-demo.vercel.app + localhost. warnOnReaderSanMismatch only console.warns (doesn't throw), so if the gate is ever served from a custom production domain or a preview hostname, the warning silently won't clear. A one-line note in the Vercel setup section would save a debugging session.
Neither blocks merge.
Addresses two review nits on the reader-identity docs (both doc-only). - "Check it without a phone": verify-reader-trust.mjs needs the reader private key (from ./gen-pki.sh; gitignored) AND the built gate dist/ (not committed), so a bare clone can't run it. Lead with both prereqs instead of implying the command runs anywhere. - Step-5 SAN paragraph: on Vercel the gate's walletOrigin is VERCEL_PROJECT_PRODUCTION_URL, and the shipped cert's SAN covers only credentagent-demo.vercel.app + localhost. A custom production domain is off-SAN and only console.warns (never fails), so the "unknown verifier" warning silently won't clear; a preview URL keeps the production walletOrigin, so it mismatches with no log at all. Call out both traps. No code or version change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019EYBmPdD3LXNo3aJcScTxH Signed-off-by: Diego Zuluaga <dfzuluaga@gmail.com>
2 participants
Closes #178.
What this fixes
Presenting a credential to the demo shows a red wallet warning: "The website requesting
this data is unknown." The gate never identified itself, and two docs said that couldn't
be fixed yet. It can.
Changes
examples/quickstart/server.mjs— the app deployed atcredentagent-demo.vercel.appnow presents a reader identity when one is configured. Unset, behaviour is unchanged,
so merging and deploying before the setup below is safe.
readerIdentityoption asunbuilt. Corrected.
run-gate.mjs— says why no identity was found instead of just "none".No changes under
packages/. No version bump: the pinned0.3.1already has the option.Reviewer setup — needed for the warning to actually clear
1. Vercel →
credentagent-demoproject → Environment Variables, each holding the fullfile contents. Then redeploy.
CREDENTAGENT_READER_CERTreader-cert.pemCREDENTAGENT_READER_KEYreader-key.pem2. Download site — the
utopia.ricalat https://credentagent.vercel.app names a readerwhose private key was never published, so importing it does nothing. Replace it with
this one:
drop it into
tools/demo-pki/out/and re-runbuild_site.py. The credentials and theVICAL on that page are fine — leave those.
All three files are from one PKI generation and only work together. The certificate covers
localhostandcredentagent-demo.vercel.app. Drive is interim; these belong on the site.Verified
Ran the deployed app configured as the deployment. Its payment request carried the demo
reader certificate in
x5c, and that certificate is named on the trust list, under bothorigins: