Mobile password rotation

Protocol documentation Web harness (extension) In-browser mobile UI

What you will run

App	Path	Role
Yada Password	`clients/password-manager/apps/password-native`	Authenticator (vault, inception, Approve)
Yada Auth Demo	`clients/password-manager/apps/demo-native`	Relying party (register / sign-in buttons)
This node	YadaCoin HTTP	Identity KEL + off-chain site branch

Deep links: demo opens yadapass://auth?action=register|signin&site=yadademo://app&callback=yadademo://result&nonce=…. After Approve, the password app returns to yadademo://result with ok, password, and nextPasswordHash.

Read the full protocol: Password Rotation Protocol.

Node

In config.json set serve_host to 0.0.0.0 (not 127.0.0.1) so the phone can connect.
Note serve_port (often 8001 or a custom port such as 8111).
Restart the node after pulling CORS changes. Preflight from the Android WebView sends Origin: http://localhost; the node must echo that origin (not * together with Allow-Credentials: true).

curl -D - -o /dev/null \
  -H "Origin: http://localhost" -X OPTIONS \
  http://127.0.0.1:PORT/password-rotation/offchain

Expect Access-Control-Allow-Origin: http://localhost.

Build the apps

From clients/password-manager:

./scripts/build.sh core          # password-core
./scripts/build.sh extension     # browser extension dist/
./scripts/build.sh android       # password-native JS + cap sync + assembleDebug
./scripts/build.sh ios           # optional
./scripts/build.sh all           # JS packages (not a full APK)

Or install on a device without uninstalling (keeps the vault):

cd clients/password-manager/apps/password-native
npx cap run android

cd ../demo-native
npx cap run android

After JS-only changes, node ./scripts/build.mjs && npx cap sync android then Run from Android Studio is enough. Uninstall only if you want a clean vault.

Browser extension: Chrome → chrome://extensions → Load unpacked → clients/password-manager/apps/extension/dist. Reload the extension and hard-refresh the harness tab after every rebuild so the content script updates.

Node URL from the device

Where the app runs	Node URL
Android emulator	`http://10.0.2.2:PORT` (host loopback)
Physical phone	`http://LAN-IP:PORT` (same Wi‑Fi; not 127.0.0.1)
Extension on the same machine	`http://127.0.0.1:PORT`

Yada Password remaps localhost / 127.0.0.1 to 10.0.2.2 on Android. On a physical device you must enter the computer’s LAN IP (e.g. http://10.157.230.98:8111).

Test the apps together

Password app → Vault: node URL, username, master password, generate seed, Save vault, Broadcast inception. If the node already has that KEL, the app treats “Duplicate KEL inception” as success.
Demo app: set the same node URL, tap Register. Password app opens on Request → Approve. Demo stores nextPasswordHash locally.
Demo → Sign in & rotate: Approve again. Demo checks verifyPassword(password, stored next hash) and saves the new next hash. Node branch counter increments.
Home → Resync rotations if mempool tips were wiped; then Register the demo site again if the site was dropped.

Parallel web path: open /password-rotation with the extension, Register, then Sign in. Same protocol; site id is the page origin.

Troubleshooting

Symptom	Fix
Failed to fetch	LAN IP + port; node on 0.0.0.0; restart node for CORS; same Wi‑Fi
vault not incepted	Set Node URL to the node origin (e.g. `https://yadacoin.io`, not `/password-rotation`). Save vault in the popup to grant host access. Resync or broadcast inception (duplicate on-chain is OK).
expected counter N	Register resets the branch; reload apps after that change
RP hash mismatch	PHC salt is deterministic; re-register after updating apps
extension did not respond	Reload the extension, then hard-refresh the harness tab
Custom scheme stolen	Demo-only; production should use verified App Links