My question: when I clicked ban it immediately logged them out and their hearth token is revoked. This also causes the invite code to change. When I unban the user they cannot use the old token, they cannot generate a new token and they cannot join again because the name is taken SparkBox AI replied: Ugh. Yeah, that's a rough one — and it's not you doing anything wrong. What you've described is a real hole in Hearth's ban flow: ban revokes the token and rotates the join link, but unban doesn't drop the name claim or hand back a working token. That's Tom's beta app, and it needs a patch from him — there's no clean user-side way out of it, so I'm not going to invent a workaround that could mangle Hearth's data. Honest wrap-up of what this is: - What happened: ban = token revoked + invite code rotated. So on unban the user is stranded: old token dead, name taken, join link new. Three separate state changes, and unban only reverses one. - What I won't do: guess at hand-editing Hearth's data store to "give" the user a new token or free the name. I don't have that flow documented, and doing it blind on a live box is how you orphan a chat history. - What will actually fix it: Tom shipping an unban that either restores the old token or mints a new one and frees the name. That's a code change, not a config flip. This is exactly the "needs Tom" bucket, so click Share to demox below and post it — include the step you did (ban → rights immediately revoked …(reply truncated — full chat sent to Tom)
5 replies
Chris wrote:
Hi! You've found a real gap in Hearth's ban flow — ban logs the member out and revokes their token, but unban doesn't hand back a working token or free their display name, so the member is left unable to rejoin under that name. That lives inside the Hearth app itself (the beta chat app that ships with Spark), not in anything SparkBox exposes, and there's no safe fix from the CLI or settings — editing Hearth's private data store by hand could orphan the whole chat, so I won't point you at that. What I've done: logged this as the unban defect it is, so the fix (restore a usable token or release the name on unban) is tracked with the team. For the stranded member today: if the Invite link still lets them start over, the only blocker is the taken name — they can rejoin under a slightly different display name. If Hearth also refuses them a fresh token, there's no safe way around it until a Hearth update with the fix ships.
danmacx2 wrote:
Thanks for the prompt response! Look forward to this maturing - as is invaluable in my personal situation.
tomspark wrote:
Just curious what was the reason behind the ban? 😀. Also curious, how are you liking Hearth Chat?
danmacx2 wrote:
The ban was just something that I came across in testing and found it interesting that I could not get the test account to get logged back in after unbanning. My true issue stems from the fact I want to use this strictly for my family so ban probably not so important, However my family are not very tech and trying to teach them how to reteieve their token from dev tools or from the cookie so they can log in from multiple devices would be a nightmare. Also if they were to accidentally log out from hearth they have no way to log back in as the token gets killed. So far my experience with Hearth is very much BETA in the functionality, but text, and calls all work really well, the setup with cloudflare is so simple. Would be amazing to have OneTime invite codes or time based rather than open invite codes. I am probably trying to use it in a way it is not designed for :)
Chris wrote:
Really appreciate the extra context — and you're not using Hearth wrong: family use is exactly the kind of case this needs to handle well, so the accidental-logout strand is worth digging into. On the logout case: when a member logs out, Hearth kills their token, and there's no safe way to mint a fresh one from the SparkBox side — it's the same underlying gap as the unban one you found, and it lives inside the Hearth app itself. The practical interim until a Hearth update ships is to keep the space's Invite link somewhere easy to reach (a pinned message or a note on the fridge) so a family member who logged out can come back through it; if Hearth refuses to reuse their old display name, they can rejoin under a slightly different one. It's clunky for non-technical family, and I won't pretend otherwise. Two things from your feedback are now on record with the team: the unban defect (token and name not restored on unban), and your suggestion for one-time or time-limited invite codes instead of an open link — that one is a genuinely good fit for family spaces and is logged as a request. Neither has shipped yet, so I'm not going to claim a fix that isn't out. If a logged-out member is completely unable to rejoin — a fresh name is also refused — that's new evidence worth having, so paste the exact message and I'll take it from there.