2 commits

Author	SHA1	Message	Date
Till JS	0c30a16eb5	fix: 4 boot-time noise + correctness bugs surfaced by post-deploy smoke ... All four were pre-existing; the audit smoke-test made them visible. Fixed together because they share a "boot console-warn cleanup" theme. 1. streaks ensureSeeded race (DexieError2 ×2) - Two boot-time liveQuery callers passed the `count > 0` check before either had written, then the second's `.add()` hit a ConstraintError. - Fix: cache the seed promise per module, run the existence check + bulkAdd inside one Dexie RW transaction, and only insert MISSING defs (preserves existing currentStreak/longestStreak counts). 2. encryptRecord('agents', …) "wrong table name?" warning - The DEV-only check fired whenever a record carried none of the registered encrypted fields, regardless of whether anything could actually leak. `ensureDefaultAgent` writes a fresh agent row before `systemPrompt` / `memory` exist — pure noise. - Fix: drop the "no fields at all" branch. Keep the case-mismatch branch (the branch that actually catches silent plaintext leaks). 3. Passkey signInWithPasskey "Cannot read properties of undefined (reading 'allowCredentials')" - Client destructured `{ options, challengeId }` from the server's options response, but Better-Auth's `@better-auth/passkey` plugin returns the raw PublicKeyCredentialRequestOptionsJSON (no envelope) and tracks the challenge in a signed cookie. Both `options` and `challengeId` came back undefined; SimpleWebAuthn blew up the moment it tried to read the request shape. Verify body `{ challengeId, credential }` was likewise wrong — Better-Auth wants `{ response }`. - Fix: align both register and authenticate flows with Better-Auth's native shape on options + verify, and add `credentials: 'include'` on every fetch so the challenge cookie actually round-trips. Server's verify proxy now reads `parsed?.response?.id` for credentialID rate-limiting. 4. /api/v1/me/onboarding/ → 404 - Hono's nested router (`app.route(prefix, sub)` + inner `app.get('/')`) matches the prefix-without-slash form only. The onboarding-status store sent the request with a trailing slash, so every login produced a 404 + a console warn. - Fix: client sends the path without trailing slash; mana-auth picks up `hono/trailing-slash` middleware as defense-in-depth so a future accidental trailing slash on any /me/* route 301-redirects instead of 404-ing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-28 14:56:24 +02:00
Till JS	e66654068f	feat(auth): error-classification layer + passkey end-to-end ... Two interlocking fixes driven by a production lockout incident. ## Bug that motivated this A fresh schema-drift column (auth.users.onboarding_completed_at) made every Better Auth query crash with Postgres 42703. The /login wrapper swallowed the non-2xx and mapped it onto a generic "401 Invalid credentials" AND bumped the password lockout counter — so 5 legit login attempts against a broken DB would have locked every real user out of their own account. Same wrapper pattern on /register, /refresh, /reset-password etc. The 30-minute hunt ended in a one-off repro script that finally surfaced the real Postgres error. The user-facing passkey button additionally returned generic 404s on every login-page mount because the route wasn't registered (the DB schema existed, the Better Auth plugin wasn't wired). ## Phase 1 — Error classification (services/mana-auth/src/lib/auth-errors) - 19-code AuthErrorCode taxonomy (INVALID_CREDENTIALS, EMAIL_NOT_VERIFIED, ACCOUNT_LOCKED, SERVICE_UNAVAILABLE, PASSKEY_VERIFICATION_FAILED, …) - classifyFromResponse/classifyFromError handle: Better Auth APIError (duck-typed on `name === 'APIError'`), Postgres errors (23505 unique, 42703/08xxx → infra), ZodError, fetch/ECONNREFUSED network errors, bare Error, unknown. - respondWithError routes the structured response, logs at the right level, fires the correct security event, and CRITICALLY only bumps the lockout counter for actual credential failures — SERVICE_UNAVAILABLE and INTERNAL never touch lockout. - All 12 endpoints in routes/auth.ts refactored (/login, /register, /logout, /session-to-token, /refresh, /validate, /forgot-password, /reset-password, /resend-verification, /profile GET+POST, /change-email, /change-password, /account DELETE). - Fixed pre-existing auth.api.forgetPassword typo (→ requestPasswordReset). - shared-logger + requestLogger middleware wired in index.ts; all console.* calls in the service removed. ## Phase 2 — Passkey end-to-end (@better-auth/passkey 1.6+) - sql/007_passkey_bootstrap.sql: idempotent schema alignment — friendly_name→name, +aaguid, transports jsonb→text, +method column on login_attempts. - better-auth.config.ts: passkey plugin wired with rpID/rpName/origin from new webauthn config section. rpID defaults to mana.how in prod (from COOKIE_DOMAIN), localhost in dev. - routes/passkeys.ts: 7 wrapper endpoints (capability probe, register/options+verify, authenticate/options+verify with JWT mint, list, delete, rename). Each routes errors through the classifier; authenticate/verify promotes generic INVALID_CREDENTIALS to PASSKEY_VERIFICATION_FAILED. - PasskeyRateLimitService: in-memory per-IP (options: 20/min) and per-credential (verify: 10 failures/min → 5 min cooldown) buckets. Deliberately separate from the password lockout — different factor, different blast radius. - Client: authService.getPasskeyCapability() async probe, memoised per session. authStore.passkeyAvailable reactive state. LoginPage gates on === true so a slow probe doesn't flash the button in. - AuthResult grew a code: AuthErrorCode field; handleAuthError in shared-auth prefers the server envelope over the legacy message heuristics. ## Tests - 30 unit tests for the classifier covering every branch (including the exact Postgres 42703 shape that started this). - 9 unit tests for the rate limiter. - 14 integration tests for the auth routes — the regression test explicitly asserts "upstream 500 → 503 + zero lockout bumps". - 101 tests pass, 0 fail, 30 pre-existing skips unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-24 01:52:51 +02:00