TigerPASS: require a signed VALID verdict to activate + lean key modal - #95
Merged
Conversation
Security: activatePass previously refused only a definitive `lapsed` and accepted `unknown` (the ongoing nag-never-disable fail-open), so a well-formed but unprovable key could unlock the premium shelf. Activation is now strict — only a reached-home, signature-verified `valid` unlocks; `unknown`/`lapsed` are refused and the key is forgotten. (Fail-open still governs ONGOING operation: an already-active install keeps running through an authority outage — that's renewal, not first activation.) UX: the "Get TigerPASS" modal is now a lean key modal — a "Get My Key →" button that opens the seller's checkout + a paste-key field that activates. The sales pitch/pricing lives on the checkout page, not the modal. Adds regression tests (inject the authority transport): a trusted valid unlocks; a valid=false is refused; an UNSIGNED valid=true with a pinned key is refused (unknown) — the exact hole the always-say-yes stub exposed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Aug 2, 2026
Merged
WebTigers
added a commit
that referenced
this pull request
Aug 2, 2026
…faults (#97) Version bump + CHANGELOG. Ships since 0.47.0-beta: activation now requires a signed VALID verdict (#95, the security fix) + the lean key modal, and the WebTigers production pass authority + pinned public key as core.ini defaults (#96). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixes from live TigerPASS testing.
🔒 Activation requires a positive, signed verdict (the real fix)
activatePassrefused only a definitivelapsedand acceptedunknown— the ongoing nag-never-disable fail-open. So a well-formed but unprovable key (or an authority that can't cryptographically prove entitlement — e.g. the unsigned "always valid" reply the dev stub returned) would unlock the whole premium shelf. Pasting any UUID activated instantly.Now activation is strict: only a reached-home, signature-verified
validunlocks;unknown/lapsedare refused and the key forgotten. This is deliberately stricter than the ongoing gate — fail-open still keeps an already-active install running through an authority outage (renewal ≠ first activation).Verified live: a random UUID against the real authority now scores
lapsed→ refused (was: unlocked).🧾 The "Get TigerPASS" modal is now a lean key modal
Replaced the two-phase sales pitch (plan cards + feature shelf) with one modal: a Get My Key → button that opens the seller's checkout, and a paste-your-key field that activates. Pricing + value prop live on the checkout page, not the modal.
Tests
Three regression cases inject the authority transport: a trusted
validunlocks;valid:falseis refused; an unsignedvalid:truewith a pinned key is refused (unknown) — the exact hole. Newsystem.pass.unverifiedmessage.🤖 Generated with Claude Code