fix(ghostkey): link the vault, and stop warning it loses keys - #106
Open
sanity wants to merge 1 commit into
Open
fix(ghostkey): link the vault, and stop warning it loses keys#106sanity wants to merge 1 commit into
sanity wants to merge 1 commit into
Conversation
**The vault was reachable from nowhere.** Its contract id appeared in exactly one place on the whole site -- the import button's JavaScript -- while the prose named "the Ghostkey Vault" six times without ever linking it. So the only route in was to complete a purchase and click Import, and anyone who already had Ghost Keys had no route at all. Adds a link on /ghostkey/ in the section already about storage, and names the address on the success page. Both say plainly that it needs a Freenet node on the same computer and will not resolve otherwise, since the address is the user's own machine rather than a website. **The pre-purchase warning was wrong.** /ghostkey/create/ told people, immediately before paying, that the vault "can currently lose keys", citing freenet/ghostkeys#3 -- which is closed and fixed. That is inaccurate friction at the exact moment someone is deciding to spend money, and my earlier staleness sweep missed it because I checked /ghostkey/_index.md and not the create page's own copy. Replaced with what is actually true and more useful: the key is created in the browser on the next page and signed once, that page is the only copy, and the donation cannot be reissued -- so download or import before closing the tab. Same fact the success page now warns about (#102), stated before the money is spent rather than after. Verified in a browser against a real build: 6/6.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things, both spotted by @sanity noticing the vault isn't linked from anywhere.
The vault was reachable from nowhere
Its contract id appeared in exactly one place on the entire site — the import button's JavaScript. Meanwhile the prose names "the Ghostkey Vault" six times without ever linking it.
So the only way in was to complete a purchase and click Import. Anyone who already held Ghost Keys had no route at all, and anyone who closed that tab afterwards had no way back.
Adds a link on
/ghostkey/in the section already about storage and backup, and names the address on the success page. Both state plainly that it needs a Freenet node on the same computer and won't resolve otherwise — the address is the user's own machine, not a website, which isn't obvious from a link on a public site.The pre-purchase warning was wrong
/ghostkey/create/told people, in a blockquote immediately before paying:ghostkeys#3 is closed and fixed. That's inaccurate friction at the exact moment someone is deciding whether to spend money — telling them the thing they're buying might vanish.
My earlier staleness sweep missed it because I checked
/ghostkey/_index.mdand never opened the create page's own copy. Owning that: the sweep was less thorough than I reported it as.Replaced with what's actually true and more useful — the key is created in the browser on the next page and signed once, that page is the only copy, and the donation cannot be reissued, so download or import before closing the tab. Same fact #102 warns about after payment, now stated before the money is spent.
Verification
Driven in a browser against a real build: link renders and points at the local node, the caveat is present, the stale claim is gone, the new warning explains the one-shot page, and the success page names the address. 6/6.
One check initially failed and was my error, not the page's — it grabbed
.gk-cta-notewith.last(), which picked the existing donate CTA rather than the vault one.[AI-assisted - Claude]