stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Recover mobile sign-in from stalled requests #767

New Issue
Closed
opened 2026-08-13 19:49:29 +00:00 by timmy · 0 comments
timmy commented 2026-08-13 19:49:29 +00:00
Owner
Copy Link

Problem

The anonymous token and passkey sign-in requests in frontend/login.js await network responses without a deadline or an in-flight guard. A half-open mobile connection can leave the login UI stuck indefinitely, while repeated taps can create duplicate requests or passkey ceremonies. The authenticated request layer already has bounded recovery, but it is installed only after sign-in.

Vertical slice

  • Bound token submission and both passkey network phases with abortable deadlines.
  • Keep the user-driven WebAuthn ceremony outside the network deadline.
  • Permit only one sign-in attempt at a time and disable both controls while it is active.
  • Restore controls after timeout/failure while preserving rate-limit countdown behavior and shared-capture continuations.
  • Distinguish network timeout guidance from WebAuthn cancellation.

Acceptance tests

  • Stalled token, passkey-options, and passkey-verification requests abort and show retryable timeout guidance.
  • Repeated taps while active create one request/ceremony.
  • Controls recover after timeout or cancellation.
  • Successful shared-capture continuation and rate-limit countdown remain intact.

Discovered against origin/main at 9bd755f; no historical issue title or recent commit implements an anonymous login request deadline or single-flight sign-in.

## Problem The anonymous token and passkey sign-in requests in `frontend/login.js` await network responses without a deadline or an in-flight guard. A half-open mobile connection can leave the login UI stuck indefinitely, while repeated taps can create duplicate requests or passkey ceremonies. The authenticated request layer already has bounded recovery, but it is installed only after sign-in. ## Vertical slice - Bound token submission and both passkey network phases with abortable deadlines. - Keep the user-driven WebAuthn ceremony outside the network deadline. - Permit only one sign-in attempt at a time and disable both controls while it is active. - Restore controls after timeout/failure while preserving rate-limit countdown behavior and shared-capture continuations. - Distinguish network timeout guidance from WebAuthn cancellation. ## Acceptance tests - Stalled token, passkey-options, and passkey-verification requests abort and show retryable timeout guidance. - Repeated taps while active create one request/ceremony. - Controls recover after timeout or cancellation. - Successful shared-capture continuation and rate-limit countdown remain intact. Discovered against `origin/main` at `9bd755f`; no historical issue title or recent commit implements an anonymous login request deadline or single-flight sign-in.
timmy self-assigned this 2026-08-13 19:49:29 +00:00
timmy closed this issue 2026-08-13 19:55:00 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#767
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?