Overview
Signpost is a lightweight web app for signing social posts and sharing them as cryptographically verifiable URLs. Users sign in, claim a public UID, write a post, and get a shareable link at /:uid/:sessionId that anyone can open to view the content and its signature.
The MVP focuses on server-side HMAC-SHA256 signing via a Supabase Edge Function for a fast signing UX. A planned private mode for client-side Ed25519 is sketched in the product brief but disabled in the UI.
The problem
Social posts are easy to copy and hard to prove authorship for. Signpost gives creators a simple path from compose to a permanent, signed share link without running their own crypto infrastructure.
Architecture
A React SPA (Vite) talks to Supabase Auth for email/password sessions and stores claimed UIDs in a profiles table with RLS. On sign, the client hashes post content with SHA-256 (Web Crypto) and POSTs content plus origin_sha to a Deno Edge Function (sign-post). The function authenticates the user, loads or creates a per-user HMAC secret, signs the hash with HMAC-SHA256, inserts a sessions row (content, signature, secret), and returns a sessionId used to build /:uid/:sessionId. Public viewers resolve the UID via profiles, load the matching session, and display content with a server-verified signature badge.
Highlights
- —Shareable signed URLs Each post becomes a clean /:uid/:sessionId link that binds content to a user-scoped cryptographic signature.
- —Serverless HMAC signing A Supabase Edge Function signs content hashes with HMAC-SHA256 using a per-user secret and persists the result in Postgres.
- —Auth and claimed UIDs Supabase Auth plus a profiles table let users claim unique UIDs used in public share links.
- —Public session viewer Anyone with the link can open a verified post view showing author, timestamp, content, and the hex signature.
Screenshots
