mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00

Files

T

Matt TooheyandClaude Fable 5 bfc0953158 fix(desktop): remove the dead community API token plumbing

applyCommunity sent a `token` arg that the Rust apply_workspace command
stopped declaring when the relay moved to pure Nostr key auth ("Sprout
speaks Nostr. Nothing else.", #475). Tauri silently drops invoke args
the command doesn't declare, so the Community.token collected by the
add/edit dialogs was persisted to localStorage and never applied
anywhere — a secret-shaped field with no consumer. Resolve the arg
mismatch by deleting the plumbing rather than re-accepting the token:

- Stop sending `token` from applyCommunity and align its invoke args
  with the Rust signature (relayUrl, nsec, reposDir).
- Remove the API Token field from the Add/Edit Community dialogs, and
  drop token handling from useCommunities (update-result matrix,
  dup-merge on add, reinit trigger) and the sidebar/switcher prop
  types.
- Retire Community.token to a `@deprecated token?: never` marker and
  strip the stale secret from persisted entries in loadCommunities
  (extending the existing nsec-strip migration), so it cannot leak
  from localStorage into future sessions.
- Regression tests: applyCommunity must send exactly the arg keys
  apply_workspace declares (guards the silent-drop IPC contract), and
  loadCommunities strips token/nsec and persists the cleaned list.

Tested: desktop pnpm test (2941 passed, incl. the 2 new regression
tests), tsc --noEmit, biome check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>

2026-07-16 23:58:10 +10:00