docs: add AUTHENTICATION.md - v1 reference spec - #19
Merged
Conversation
added 2 commits
March 24, 2026 13:00
![MostronatorCoder[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Detailed documentation of mostro-mobile v1 authentication system: - Hierarchical deterministic key system (BIP-39, BIP-32, NIP-06) - Authentication flow (first run, walkthrough, master key generation) - Key management screen (view mnemonic, privacy modes, import/export) - Session management (per-order sessions, shared keys, expiration) - Restore flow (import mnemonic, fetch orders from Mostro, rebuild state) - Key derivation paths and privacy mode considerations - Security model and comparison v1 vs v2 Based on actual code analysis of: - lib/features/key_manager/ - lib/features/walkthrough/ - lib/features/restore/ - lib/shared/notifiers/session_notifier.dart - lib/data/models/session.dart
…ON.md ACCOUNT_SCREEN.md: - Added 'Related Documentation' section pointing to AUTHENTICATION.md for technical details - Added protocol references (restore flow, gift wrap, NIP-06) AUTHENTICATION.md: - Added 'Related Documentation' section pointing to ACCOUNT_SCREEN.md for UI specs
Member
|
@coderabbitai review |
Contributor
✅ Actions performedReview triggered.
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughDocumentation expansion for Mostro Mobile v1 authentication system. ACCOUNT_SCREEN.md now references a new AUTHENTICATION.md file that comprehensively documents HD key derivation (BIP-39/BIP-32), first-run and restore flows, key management screens, and security architecture. No code modifications. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.specify/v1-reference/ACCOUNT_SCREEN.md:
- Line 204: Update the restore action label in the documentation: replace the
incorrect reference `Action::restore` with the correct protocol label
`Action::restore-session` so it matches the protocol naming (see the existing
reference line that currently reads "**[Restore Flow](...)** —
`Action::restore`" and change the symbol to `Action::restore-session`).
In @.specify/v1-reference/AUTHENTICATION.md:
- Line 52: The document defines index 1 twice (once as "first trade key" and
again as a "restore-only temp key"), causing a role conflict; update the
AUTHENTICATION.md entries so each key role uses a unique index—e.g., keep "first
trade key = index 1" in the trade key section and change the restore-only temp
key's index in the restore/session derivation section (lines referencing index 1
in the restore-only temp key paragraph) to a distinct index (such as index 2),
and update any wording to clearly state the intended role for the renamed index.
- Around line 68-69: Replace the non-canonical action name "restore" with the
protocol-defined canonical action "restore-session" wherever the Mostro protocol
action is referenced in the document (e.g., the Nostr/send-restore example and
any other protocol examples), ensuring examples, diagrams, and any JSON/Nostr
action fields use "restore-session" instead of "restore"; leave CLI-specific
mentions of the shorthand "restore" only in CLI usage sections if present and
update any surrounding explanatory text to note that the protocol action name is
"restore-session" while the CLI uses the shorthand.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4d326fbb-b31d-4b2a-aa20-51cbb86d4067
📒 Files selected for processing (2)
.specify/v1-reference/ACCOUNT_SCREEN.md.specify/v1-reference/AUTHENTICATION.md
…nflict - ACCOUNT_SCREEN.md: Action::restore → Action::restore-session (protocol canonical name) - AUTHENTICATION.md: - KEY GENERATION: first trade key index 1 → 2 (index 1 reserved for temp restore key) - Restore flow: 'Restore request' → 'restore-session request' (protocol action) - KEY DERIVATION: clarify index 1 is ephemeral (restore temp), indices 2+ for orders - Stage 1: Action::restore → Action::restore-session - Note: explain first trade = index 2 after init, lastTradeIndex+1 after restore Fixes CodeRabbit inline comments on PR #19
This was referenced Mar 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Detailed documentation of mostro-mobile v1 authentication system based on actual code analysis.
Contents
Authentication Flow
Key Management Screen
Session Management
Restore Flow
Key Derivation
m/44/1237/0(NIP-06 compliant)Security Model
Protocol References
This spec relates to the following Mostro protocol documentation:
Files Analyzed
lib/features/key_manager/key_manager.dartlib/features/key_manager/key_derivator.dartlib/features/key_manager/key_storage.dartlib/features/key_manager/key_management_screen.dartlib/features/walkthrough/screens/walkthrough_screen.dartlib/features/restore/restore_manager.dartlib/shared/notifiers/session_notifier.dartlib/data/models/session.dartRelated Specs
.specify/v1-reference/NYM_IDENTITY.md- Anonymous identity concept.specify/v1-reference/SESSION_AND_KEY_MANAGEMENT.md- Existing session docsSummary by CodeRabbit
Documentation