Get paid: keep Lock Server Step 1 connected after the browser token expires - #114
Merged
BitcoinErrorLog merged 4 commits intoSep 24, 2026
Merged
Conversation
…n is gone Step 1 read its status only through the 24-hour Lock Server frontend session kept in this browser. Expiry, sign-out cleanup, or another browser dropped it to Not set up while the Lock Server still held the seller's creator authority (#55). Without a live session the hook now asks the Lock Server's creator-keyed status for the signed-in account. A Lock Server that does not serve that route, or cannot be reached, gets a plain note under Step 1 that explains the fresh approval and that it does not reset setup.
Linux chromium and firefox baselines only.
…set up A 5xx or unanswered authority-status check, on either the authenticated or the creator-keyed route, now leaves Step 1 on a plain note that the check could not run and to reload, with the card at Needs attention. The stored Lock Server sign-in is kept for the retry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes pubky-marketplace#55: Get paid Step 1 looked “Not set up” after the Lock Server connection was still valid on the server.
Cause: Step 1 trusted only a Lock Server frontend session token in this browser’s
localStorage(pubky.marketplace.locks-frontend-session.v1). That token expires 24 hours after connect, is cleared on Shop sign-out / failed restore, and is absent in other browsers. When it is missing or rejected, the Shop showed Open Locks connect without checking whether the Lock Server still holds the seller’s authority.Change: If there is no live frontend token, Step 1 calls the Lock Server public route
GET /creators/{creator}/authority-status(yes/no only:{ creator, authorized }) for the signed-in pubky. Whenauthorizedis true, Step 1 stays Connected — no reconnect required for carry-over.Before locks ships: Production Lock Server still returns 404 for that route. In that case (or if the route is unreachable), Step 1 shows a plain note: approve once more, why a fresh approval may be needed, and that doing so does not reset setup.
Dependency: Requires BitcoinErrorLog/locks#2 on the Lock Server. Until both are deployed, carry-over from authority alone is not live in production.
Evidence: ROOT-CAUSE.md. Head:
e2e3e156oncursor/locks-status-carryover-27ae.