Registration takes an invitation code
Creating an account refuses without a key, and has done on the server since 10 September. As of half past midnight this morning, all three apps ask for one.
Two kinds of key
One admits you to Ridgeback, the other to a house
A platform key admits its bearer to Ridgeback and to no household. A household invitation admits them to that household, on the seat the person who invited them described.
Joining a second household later runs through the same function as registering, because the two differ in exactly one respect — the second does not ask for a key or a date of birth again. Two copies of everything after that point would eventually disagree.
Refusals
Every bad key gets the same sentence
Whatever was actually wrong with a code, the answer is one status and one literal. Telling somebody their code has expired confirms that a code they guessed was once real. Telling them it has been used confirms which household it belonged to by implication. From where the person presenting it stands, the cases are the same fact.
The account is created on the same database connection that spends the key, inside one transaction. An account that survived a failed redemption would be an account that got in without a key.
In the apps
One box, and a toggle for which credential it holds
A person holds an invitation code or the distribution password used for admin and developer builds, and never both, so the form has one box and a toggle rather than guessing from the shape of what was typed. Switching empties the box: a code carried across would be spent against the wrong gate and counted against its rate limit.
This is also a bug report. Registration was broken in every app and had been since the form was built. Every client sent an email address, a password, a name and a device; the server had required a key and a record of what was accepted since those two pieces landed. It answered every attempt with a refusal naming the two missing fields. Signing in worked, so the form looked fine to anybody who already had an account — which was everybody who tested it.
Where it runs
- Server
- Yes, 10 September
- iPhone, Android, desktop
- Yes, 11 September