The comment on Auth.client_id in auth.proto says:
Not a UUID — the Hub generates it once per installation.
That last clause is wrong. The Hub does not generate client IDs; the clients do, locally, and the Hub just stores whatever id the caller sends.
ios/APNCommon/LegalPrincipal.swift — LegalPrincipal.init() builds a 9-char string from ABCDEFGHIJKLMNPQRSTUVWXYZ123456789 using SystemRandomNumberGenerator.
android/src/main/java/tech/apn/common/Principal.kt — Principal() does the same with kotlin.random.Random and the same alphabet, and SystemTunnels.kt persists it to prefs the first time.
hub/objects/hub/clients.rb — Hub::Clients#auth(id, ...) just INSERT ... ON CONFLICT DO NOTHING with the id passed in; nothing on the Hub generates one.
hub/front/front_auth.rb — POST /auth takes params[:uid] verbatim (only upcases it and rejects 000000000), so even the auth route accepts a caller-supplied id rather than minting one.
Suggested fix: change the last sentence of the client_id comment to something like "Not a UUID — the client generates it once per installation and persists it across launches."
The comment on
Auth.client_idinauth.protosays:That last clause is wrong. The Hub does not generate client IDs; the clients do, locally, and the Hub just stores whatever id the caller sends.
ios/APNCommon/LegalPrincipal.swift—LegalPrincipal.init()builds a 9-char string fromABCDEFGHIJKLMNPQRSTUVWXYZ123456789usingSystemRandomNumberGenerator.android/src/main/java/tech/apn/common/Principal.kt—Principal()does the same withkotlin.random.Randomand the same alphabet, andSystemTunnels.ktpersists it to prefs the first time.hub/objects/hub/clients.rb—Hub::Clients#auth(id, ...)justINSERT ... ON CONFLICT DO NOTHINGwith the id passed in; nothing on the Hub generates one.hub/front/front_auth.rb—POST /authtakesparams[:uid]verbatim (only upcases it and rejects000000000), so even the auth route accepts a caller-supplied id rather than minting one.Suggested fix: change the last sentence of the
client_idcomment to something like "Not a UUID — the client generates it once per installation and persists it across launches."