July 18, 2026 — Auth before free license, secure recover, remember-device
Path: _pwa-build/ · July 18, 2026 (site v1.0.27) · SW cache v63
Security: no key from email alone
- Bug: Recover / re-claim with only the correct email returned the license key (thank-you page) on any device.
- Fix:
claim-free-license requires a Supabase user JWT; on existing license returns requiresAuth without key.
- New:
recover-license edge function — returns key only for the signed-in user’s email.
create-checkout no longer returns key when already licensed (sign in to recover).
Free license requires account first
- Acquire flow: email + password (+ confirm for new accounts) before free license claim.
- Claim uses session JWT; email on the license is the authenticated user’s email.
- Legacy email-only licenses: set a password via sign-up on that email, then recover.
Cache clear / new browser
- License gate: manual key still works; or sign in (email + password) to recover and unlock.
- If a Supabase session is still present (cookie / storage), gate rehydrates license via
recover-license.
- Remember this device — optional client cookie dual-write of auth session (see tech debt below).
Help
app/help.htm#license-auth — license cache vs login cookies vs when to re-login; free license needs account; key vs password.
Follow-up / tech debt — Netlify function cookie bridge
- Status (July 19): Implemented — see July 19 session log (HttpOnly edge set/session/logout + client sync on refresh).
- Original need: True HttpOnly auth cookies; JS dual-write was interim only.
Header Help link & version
- App header / tool top bar: Help link via
app-shell.js → help.htm.
- Site version 1.0.27; service worker
phvac-app-v63 (precache auth modules + July 18 log).
Deploy
- Edge functions: redeploy
claim-free-license, create-checkout, deploy new recover-license (deploy-functions.ps1 updated).
- Git push for static app + Netlify; functions deploy is separate.