[tellaho]

Overview

Category: improvement
User Impact: Users can authorize an external application's identity in Settings → Buzz → Security, alongside paired command-line tools.

Problem: External identity authorization sits among personal key and sign-in settings, making Identity busier and separating related security controls.

Solution: Move the existing form into Security. Preserve its native-identity requirement, warning, explicit confirmation, signing behavior, and reset when the owner changes.

Context: The form was introduced in #2685 to let applications such as Nexus get an explicit ownership proof. This move keeps that purpose and its safeguards and only changes where it lives.

Changes

File changes

src/app/IdentitySettings.tsx
Remove the external authorization section.

src/app/SecuritySettings.tsx
Show the existing form below paired command-line tools and describe both security controls in the introduction.

src/app/Settings.tsx
Pass the current viewer to Security only when a native identity is available.

src/app/ExternalIdentityAuthorization.tsx
Point the identity-change recovery message to Security.

src/app/ExternalIdentityAuthorization.test.tsx
Exercise owner changes in Security and cancellation when leaving Security to sign out in Identity.

src/app/SecuritySettings.test.tsx
Assert that the authorization section is absent without a native viewer.

docs/buzz-help.md
Update the user-facing settings path.

docs/identity.md
Update the external identity authorization documentation.

Reproduction steps

1. Open Settings → Buzz → Identity in a native desktop build. External identity authorization is absent.
2. Open Security. Find “Authorize external identity” below “Paired command-line tools,” including when no tools are paired.
3. Enter an application's public key and choose “Authorize identity.” Check the exact identity and unchanged warning; Cancel must create no proof.
4. Choose “Authorize this key” to generate the ownership proof. Confirm copying and editing the application key still behave as before.

Validation

• At 57434713d: pre-commit formatting/lint/icons and secret scan passed; pre-push TypeScript, related Vitest tests, and design checks passed. git diff --check passed on the clean committed tree. Native layout was checked in dark mode at 1280×795, with no paired tools. Signing and confirmation keyboard behavior were not exercised during capture.
• Changed lines (additions + deletions): 22 tests; 27 non-test (23 source, 4 documentation). Tests are 44.9% of the diff.
• No browser journeys added or removed.
• Independent review passed at this head. Populated paired tools, confirmation focus/Escape, light/narrow/enlarged-text checks, and human acceptance remain pending.

Screenshots

Real native macOS app. Before uses the UI files from base 5b7df025f; after uses 57434713d. Account and workspace details are cropped out. The private key remains masked by the app. The PR source was restored and the working tree verified clean after capture.

Before — Identity, scrolled to the form	After — Security

[tellaho]

🤖 Review round 1

Posted by Princess Donut, an AI review agent, on Taylor's behalf. Reviewed commit eb9a45b56 against main at 5b7df025f.

Verdict: nothing blocks this. Change the one Medium copy issue before marking it ready.

Checked and unchanged from main

• Form, warning, confirmation and signing. The component itself is unchanged except for one error message, which now says "Reopen Security settings". The form still signs nothing when it opens or when the key changes. It still rejects your own key and malformed keys, and the confirmation still shows the exact npub with Cancel focused. The owner check after signing and the aborted request on unmount are unchanged too.
• Native-identity gate. Main showed the form only when both a native identity and a viewer key existed. Security now receives the viewer key only when a native identity exists, and shows the form only when that key is present, so the condition is the same. Security itself appears only in the desktop app.
• Reset when the viewer key changes. The form is still keyed by the viewer key, so a different owner gets a fresh, empty form and any signing in progress is cancelled. Security itself no longer resets on owner change, but nothing else there needs it. The moved test covers this.
• Identity, including during sign-out. Identity no longer mounts the form. Sign-out is started only from Identity, and Settings mounts Security only while that section is selected. So the form is unmounted and its signing request cancelled before sign-out can begin, and the old guard has nothing left to protect. The rewritten test switches from Security to Identity while signing is in progress, signs out, and confirms the late result is thrown away.
• Escape and focus. Settings is still the parent dialog and the confirmation is unchanged. No Escape or focus handling specific to Security was added.
• Help docs. Both references now point to Security. I found no other reference to the old location in the docs or app source.
• The three affected test files pass locally: 56 tests.

Findings

1. Medium (copy on a security screen): the new Security subtitle promises more than the page can do. "Manage tools and applications that can act as you" suggests you can review or revoke the external applications you authorized. You can't: the page creates an ownership proof but never lists or revokes one, and the proof has no time or event-kind limits. Someone who comes back to undo an authorization will find nothing to manage. The new subtitle also drops "on this device", which told people that paired tools belong to this device. Suggested subtitle: "Tools paired on this device, and applications you authorize to act as you."
2. Low (test coverage): the native-identity gate in Security has no test. No test confirms that Security without a native identity omits the form; the existing Security tests render it that way but never check. One assertion would keep the form from leaking onto that page.

Still pending (not covered by this review)

• A real native-app check of the layout below "Paired command-line tools", both with tools listed and when the list is empty, plus the confirmation's focus and Escape. The code shows no reason for these to regress, but I haven't seen them in the running app.

[tellaho]

🤖 Review round 2

Posted by Princess Donut, an AI review agent, on Taylor's behalf. I reviewed only the fix commit 57434713d (compared with eb9a45b56).

Verdict: both round 1 findings are fixed, and the fix introduces no new issues.

• Medium (Security subtitle): fixed. It now reads "Tools paired on this device, and applications you authorize to act as you." The wording no longer suggests you can revoke authorizations, and "on this device" is back for paired tools. The old wording isn't left anywhere in the app source or docs.
• Low (missing test): fixed. The existing test renders Security without a native identity and now also checks that the "Authorize external identity" heading is absent. That heading text matches the form's real title exactly. So if the form's own check were removed, the form would render and the test would fail. The Settings line that passes in the viewer only when a native identity exists is still untested. That's a one-line condition and doesn't block anything.
• The commit changes only those two lines. The Security and external identity test files pass locally (16 tests).

Still pending: the real-app checks from round 1, which cover the layout under "Paired command-line tools", and focus and Escape in the confirmation.