feat: remove stych, add prelude client (#3312)

Author: Salazareo

package-lock.json

@@ -137,9 +137,8 @@ export type EventMap = {
          * the request for log / support correlation.
          */
         trail_id?: string;
-        /** Device signals forwarded verbatim from the signup request body. */
+        /** Device signal forwarded verbatim from the signup request body. */
         fingerprint?: string | null;
-        dfp_telemetry_id?: string | null;
         /** Set by the abuse harness — require SMS phone verification post-signup. */
         requires_phone_verification?: boolean;
         /** Set by the abuse harness — require card verification post-signup. */

src/backend/clients/event/types.ts

@@ -115,6 +115,32 @@ describe('PreludeClient', () => {
         );
     });
 
+    it('forwards dispatch_id as a top-level field, not inside signals', async () => {
+        fetchMock.mockResolvedValue(okJson({ id: 'v', status: 'success' }));
+        const client = makeClient('sk_test');
+
+        await client.createVerification('+14155550123', {
+            ip: '203.0.113.7',
+            dispatch_id: 'd1f5e9a0-0000-4000-8000-000000000000',
+        });
+
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body.dispatch_id).toBe('d1f5e9a0-0000-4000-8000-000000000000');
+        expect(body.signals).toEqual({ ip: '203.0.113.7' });
+        expect(body.signals).not.toHaveProperty('dispatch_id');
+    });
+
+    it('omits dispatch_id when not supplied', async () => {
+        fetchMock.mockResolvedValue(okJson({ id: 'v', status: 'success' }));
+        const client = makeClient('sk_test');
+
+        await client.createVerification('+14155550123', { ip: '203.0.113.7' });
+
+        expect(JSON.parse(fetchMock.mock.calls[0][1].body)).not.toHaveProperty(
+            'dispatch_id',
+        );
+    });
+
     it('includes a configured template_id + sender_id + preferred channel', async () => {
         fetchMock.mockResolvedValue(okJson({ id: 'v', status: 'success' }));
         const client = new PreludeClient({

src/backend/clients/prelude/PreludeClient.test.ts

@@ -125,15 +125,17 @@ export class PreludeClient extends PuterClient {
      *   device + platform are the highest-value). We pass what the backend
      *   already has: the request `ip`, the client `device_id` (ThumbmarkJS
      *   hash), and the `user_agent` (Prelude infers platform/model/OS from it).
-     *   Richer client-collected signals require Prelude's frontend SDK, which
-     *   produces a `dispatch_id` the backend would forward here.
+     *   `dispatch_id` carries the richer browser signals gathered by Prelude's
+     *   frontend JS Signals SDK; it's a top-level field in the request, not part
+     *   of the `signals` object, so it's pulled out below.
      */
     async createVerification(
         target: string,
         signals: {
             ip?: string;
             device_id?: string;
             user_agent?: string;
+            dispatch_id?: string;
         } = {},
     ): Promise<{ id?: string; status: PreludeCreateStatus }> {
         // Match the 6-box code UI (UIWindowPhoneVerificationRequired). Without
@@ -164,6 +166,8 @@ export class PreludeClient extends PuterClient {
         if (signals.device_id) sig.device_id = signals.device_id;
         if (signals.user_agent) sig.user_agent = signals.user_agent;
         if (Object.keys(sig).length > 0) body.signals = sig;
+        // dispatch_id is a top-level field, not a member of `signals`.
+        if (signals.dispatch_id) body.dispatch_id = signals.dispatch_id;
         return this.#post('/verification', body) as Promise<{
             id?: string;
             status: PreludeCreateStatus;

src/backend/clients/prelude/PreludeClient.ts

@@ -609,7 +609,7 @@ describe('AuthController.handleSignup', () => {
     });
 });
 
-// -- Signup device signals (fingerprint + dfp_telemetry_id) --
+// -- Signup device signal (fingerprint) --
 
 describe('AuthController.handleSignup device signals', () => {
     const uniq = () => Math.random().toString(36).slice(2, 10);
@@ -631,11 +631,10 @@ describe('AuthController.handleSignup device signals', () => {
                 (evt) => (evt as { username?: string }).username === username,
             );
 
-    it('forwards fingerprint and dfp_telemetry_id verbatim to validate and success events', async () => {
+    it('forwards fingerprint verbatim to validate and success events', async () => {
         const username = `fp_${uniq()}`;
         const baseline = heardSignupSuccess.length;
         const fingerprint = 'Fp_abc.123-XYZ';
-        const dfpTelemetryId = 'tel_id-456';
 
         const seen = await captureValidateEvents(async () => {
             const res = makeRes();
@@ -645,7 +644,6 @@ describe('AuthController.handleSignup device signals', () => {
                     email: `${username}@test.local`,
                     password: 'correct-horse-battery',
                     fingerprint,
-                    dfp_telemetry_id: dfpTelemetryId,
                 }),
                 res,
             );
@@ -654,15 +652,14 @@ describe('AuthController.handleSignup device signals', () => {
 
         expect(seen).toHaveLength(1);
         expect(seen[0].fingerprint).toBe(fingerprint);
-        expect(seen[0].dfp_telemetry_id).toBe(dfpTelemetryId);
 
         const successes = successEventsFor(baseline, username);
         expect(successes).toHaveLength(1);
         expect(successes[0].fingerprint).toBe(fingerprint);
         expect(successes[0].is_temp).toBe(false);
     });
 
-    it('accepts boundary-length values (128-char fingerprint, 64-char dfp_telemetry_id)', async () => {
+    it('accepts a boundary-length 128-char fingerprint', async () => {
         const username = `fp_${uniq()}`;
         const res = makeRes();
         await controller.handleSignup(
@@ -671,14 +668,13 @@ describe('AuthController.handleSignup device signals', () => {
                 email: `${username}@test.local`,
                 password: 'correct-horse-battery',
                 fingerprint: 'f'.repeat(128),
-                dfp_telemetry_id: 'd'.repeat(64),
             }),
             res,
         );
         expect(isCompleteLoginResponse(res.body)).toBe(true);
     });
 
-    it('defaults both fields to null on the validate event when absent', async () => {
+    it('defaults the fingerprint to null on the validate event when absent', async () => {
         const username = `fp_${uniq()}`;
         const baseline = heardSignupSuccess.length;
 
@@ -699,15 +695,14 @@ describe('AuthController.handleSignup device signals', () => {
 
         expect(seen).toHaveLength(1);
         expect(seen[0].fingerprint).toBeNull();
-        expect(seen[0].dfp_telemetry_id).toBeNull();
 
         const successes = successEventsFor(baseline, username);
         expect(successes).toHaveLength(1);
         expect(successes[0].fingerprint).toBeNull();
         expect(successes[0].is_temp).toBe(false);
     });
 
-    it('treats empty-string fingerprint and dfp_telemetry_id as absent', async () => {
+    it('treats an empty-string fingerprint as absent', async () => {
         const username = `fp_${uniq()}`;
 
         const seen = await captureValidateEvents(async () => {
@@ -718,7 +713,6 @@ describe('AuthController.handleSignup device signals', () => {
                     email: `${username}@test.local`,
                     password: 'correct-horse-battery',
                     fingerprint: '',
-                    dfp_telemetry_id: '',
                 }),
                 res,
             );
@@ -728,7 +722,6 @@ describe('AuthController.handleSignup device signals', () => {
 
         expect(seen).toHaveLength(1);
         expect(seen[0].fingerprint).toBeNull();
-        expect(seen[0].dfp_telemetry_id).toBeNull();
     });
 
     it('rejects a non-string fingerprint with 400 and fires no success event', async () => {
@@ -770,37 +763,6 @@ describe('AuthController.handleSignup device signals', () => {
         expect(heardSignupSuccess.length).toBe(baseline);
     });
 
-    it('rejects a dfp_telemetry_id longer than 64 characters with 400 and fires no success event', async () => {
-        const username = `fp_${uniq()}`;
-        const baseline = heardSignupSuccess.length;
-        await expect(
-            controller.handleSignup(
-                makeReq({
-                    username,
-                    email: `${username}@test.local`,
-                    password: 'correct-horse-battery',
-                    dfp_telemetry_id: 'd'.repeat(65),
-                }),
-                makeRes(),
-            ),
-        ).rejects.toMatchObject({ statusCode: 400 });
-        expect(heardSignupSuccess.length).toBe(baseline);
-    });
-
-    it('rejects a non-string dfp_telemetry_id with 400', async () => {
-        await expect(
-            controller.handleSignup(
-                makeReq({
-                    username: `fp_${uniq()}`,
-                    email: `${uniq()}@test.local`,
-                    password: 'correct-horse-battery',
-                    dfp_telemetry_id: { nested: true },
-                }),
-                makeRes(),
-            ),
-        ).rejects.toMatchObject({ statusCode: 400 });
-    });
-
     it('temp-user signup reports is_temp true and carries the fingerprint on the success event', async () => {
         const baseline = heardSignupSuccess.length;
         const res = makeRes();