Move away from Autopass for AlmaLInux Compatibility

shared/crypto-auth.js

@@ -316,8 +316,7 @@ export function safeEqual(a, b) {
 
 /**
  * Peardock share-string envelope (pd1.<base64url JSON>).
- * Embeds publicKey + HMAC capability so clients do not depend on Autopass
- * HyperDB package sync (which can return stale spent grants).
+ * Embeds publicKey + HMAC capability so invites work without any vault/DB.
  */
 export const PEARDOCK_INVITE_PREFIX = 'pd1.'
 
@@ -334,8 +333,6 @@ export function encodePeardockInvite(pkg) {
     jti: pkg.jti || null,
     alias: pkg.alias || null,
     expiresAt: pkg.expiresAt ?? null,
-    // Optional raw Autopass z32 (not required for auth)
-    autopass: pkg.autopass || pkg.invite || null,
   }
   if (!/^[0-9a-f]{64}$/.test(body.publicKeyHex)) {
     throw new Error('encodePeardockInvite: invalid publicKeyHex')
@@ -360,7 +357,6 @@ export function encodePeardockInvite(pkg) {
  *   jti: string|null,
  *   alias: string|null,
  *   expiresAt: string|null,
- *   autopass: string|null,
  * }|null}
  */
 export function decodePeardockInvite(input) {
@@ -385,7 +381,6 @@ export function decodePeardockInvite(input) {
       jti: pkg.jti || null,
       alias: pkg.alias || null,
       expiresAt: pkg.expiresAt ?? null,
-      autopass: pkg.autopass || null,
     }
   } catch {
     return null
@@ -395,7 +390,7 @@ export function decodePeardockInvite(input) {
 /**
  * Classify a connection paste string.
  * @param {string} input
- * @returns {'publicKey' | 'peardockInvite' | 'autopassInvite' | 'legacyInvite' | 'unknown'}
+ * @returns {'publicKey' | 'peardockInvite' | 'legacyAutopassInvite' | 'legacyInvite' | 'unknown'}
  */
 export function classifyConnectionInput(input) {
   const t = String(input || '').trim()
@@ -406,12 +401,11 @@ export function classifyConnectionInput(input) {
   if (collapsed.toLowerCase().startsWith(PEARDOCK_INVITE_PREFIX) && decodePeardockInvite(collapsed)) {
     return 'peardockInvite'
   }
-  // z32 alphabet is lowercase + digits excluding ilou; invites are longer than 64
+  // Legacy Autopass z32 invites (unsupported) — detect so the UI can show a clear error
   if (collapsed.length >= 80 && /^[0-9a-z]+$/i.test(collapsed) && !/^[0-9a-f]+$/i.test(collapsed)) {
-    return 'autopassInvite'
+    return 'legacyAutopassInvite'
   }
-  // pure z32 can be all-hex-looking rarely; try length heuristic
-  if (collapsed.length >= 80 && /^[0-9a-z]+$/i.test(collapsed)) return 'autopassInvite'
+  if (collapsed.length >= 80 && /^[0-9a-z]+$/i.test(collapsed)) return 'legacyAutopassInvite'
   return 'unknown'
 }
 

shared/schema.js

@@ -103,7 +103,7 @@ export const MethodSchemas = Object.freeze({
   handshake: {
     clientName: { type: 'string', required: false, maxLen: 64 },
     clientVersion: { type: 'string', required: false, maxLen: 32 },
-    /** @deprecated Prefer capability (HMAC grant) or AutoPass package */
+    /** @deprecated Prefer capability (HMAC grant) or pd1. invite */
     inviteToken: { type: 'string', required: false, maxLen: 512 },
     /** HMAC capability grant (base64url.body.mac) */
     capability: { type: 'string', required: false, maxLen: 1024 },