mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-14 19:01:08 +02:00
Two interlocking fixes driven by a production lockout incident. ## Bug that motivated this A fresh schema-drift column (auth.users.onboarding_completed_at) made every Better Auth query crash with Postgres 42703. The /login wrapper swallowed the non-2xx and mapped it onto a generic "401 Invalid credentials" AND bumped the password lockout counter — so 5 legit login attempts against a broken DB would have locked every real user out of their own account. Same wrapper pattern on /register, /refresh, /reset-password etc. The 30-minute hunt ended in a one-off repro script that finally surfaced the real Postgres error. The user-facing passkey button additionally returned generic 404s on every login-page mount because the route wasn't registered (the DB schema existed, the Better Auth plugin wasn't wired). ## Phase 1 — Error classification (services/mana-auth/src/lib/auth-errors) - 19-code AuthErrorCode taxonomy (INVALID_CREDENTIALS, EMAIL_NOT_VERIFIED, ACCOUNT_LOCKED, SERVICE_UNAVAILABLE, PASSKEY_VERIFICATION_FAILED, …) - classifyFromResponse/classifyFromError handle: Better Auth APIError (duck-typed on `name === 'APIError'`), Postgres errors (23505 unique, 42703/08xxx → infra), ZodError, fetch/ECONNREFUSED network errors, bare Error, unknown. - respondWithError routes the structured response, logs at the right level, fires the correct security event, and CRITICALLY only bumps the lockout counter for actual credential failures — SERVICE_UNAVAILABLE and INTERNAL never touch lockout. - All 12 endpoints in routes/auth.ts refactored (/login, /register, /logout, /session-to-token, /refresh, /validate, /forgot-password, /reset-password, /resend-verification, /profile GET+POST, /change-email, /change-password, /account DELETE). - Fixed pre-existing auth.api.forgetPassword typo (→ requestPasswordReset). - shared-logger + requestLogger middleware wired in index.ts; all console.* calls in the service removed. ## Phase 2 — Passkey end-to-end (@better-auth/passkey 1.6+) - sql/007_passkey_bootstrap.sql: idempotent schema alignment — friendly_name→name, +aaguid, transports jsonb→text, +method column on login_attempts. - better-auth.config.ts: passkey plugin wired with rpID/rpName/origin from new webauthn config section. rpID defaults to mana.how in prod (from COOKIE_DOMAIN), localhost in dev. - routes/passkeys.ts: 7 wrapper endpoints (capability probe, register/options+verify, authenticate/options+verify with JWT mint, list, delete, rename). Each routes errors through the classifier; authenticate/verify promotes generic INVALID_CREDENTIALS to PASSKEY_VERIFICATION_FAILED. - PasskeyRateLimitService: in-memory per-IP (options: 20/min) and per-credential (verify: 10 failures/min → 5 min cooldown) buckets. Deliberately separate from the password lockout — different factor, different blast radius. - Client: authService.getPasskeyCapability() async probe, memoised per session. authStore.passkeyAvailable reactive state. LoginPage gates on === true so a slow probe doesn't flash the button in. - AuthResult grew a code: AuthErrorCode field; handleAuthError in shared-auth prefers the server envelope over the legacy message heuristics. ## Tests - 30 unit tests for the classifier covering every branch (including the exact Postgres 42703 shape that started this). - 9 unit tests for the rate limiter. - 14 integration tests for the auth routes — the regression test explicitly asserts "upstream 500 → 503 + zero lockout bumps". - 101 tests pass, 0 fail, 30 pre-existing skips unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
91 lines
2.6 KiB
TypeScript
91 lines
2.6 KiB
TypeScript
/**
|
|
* Email sending via mana-notify service.
|
|
* All emails are routed through the central notification service
|
|
* which handles SMTP, retries, and queuing.
|
|
*/
|
|
|
|
import { logger } from '@mana/shared-hono';
|
|
|
|
const NOTIFY_URL = process.env.MANA_NOTIFY_URL || 'http://localhost:3013';
|
|
const SERVICE_KEY = process.env.MANA_SERVICE_KEY || 'dev-service-key';
|
|
|
|
async function send(to: string, subject: string, html: string): Promise<boolean> {
|
|
try {
|
|
const res = await fetch(`${NOTIFY_URL}/api/v1/notifications/send`, {
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
'X-Service-Key': SERVICE_KEY,
|
|
},
|
|
body: JSON.stringify({
|
|
channel: 'email',
|
|
appId: 'mana-auth',
|
|
recipient: to,
|
|
subject,
|
|
body: html,
|
|
}),
|
|
});
|
|
if (!res.ok) {
|
|
logger.error('mana-notify returned non-ok', {
|
|
status: res.status,
|
|
body: await res.text(),
|
|
recipient: to,
|
|
subject,
|
|
});
|
|
return false;
|
|
}
|
|
return true;
|
|
} catch (error) {
|
|
logger.error('mana-notify fetch failed', {
|
|
error: error instanceof Error ? { message: error.message, stack: error.stack } : error,
|
|
recipient: to,
|
|
subject,
|
|
});
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export async function sendVerificationEmail(email: string, url: string, name?: string) {
|
|
return send(
|
|
email,
|
|
'E-Mail bestätigen — Mana',
|
|
`<p>Hallo ${name || ''},</p><p>Bitte bestätige deine E-Mail-Adresse:</p><p><a href="${url}">E-Mail bestätigen</a></p><p>Oder kopiere diesen Link: ${url}</p>`
|
|
);
|
|
}
|
|
|
|
export async function sendPasswordResetEmail(email: string, url: string, name?: string) {
|
|
return send(
|
|
email,
|
|
'Passwort zurücksetzen — Mana',
|
|
`<p>Hallo ${name || ''},</p><p>Klicke hier um dein Passwort zurückzusetzen:</p><p><a href="${url}">Passwort zurücksetzen</a></p><p>Der Link ist 1 Stunde gültig.</p>`
|
|
);
|
|
}
|
|
|
|
export async function sendInvitationEmail(
|
|
email: string,
|
|
orgName: string,
|
|
inviterName: string,
|
|
url: string
|
|
) {
|
|
return send(
|
|
email,
|
|
`Einladung: ${orgName} — Mana`,
|
|
`<p>${inviterName} hat dich zu <strong>${orgName}</strong> eingeladen.</p><p><a href="${url}">Einladung annehmen</a></p>`
|
|
);
|
|
}
|
|
|
|
export async function sendMagicLinkEmail(email: string, url: string) {
|
|
return send(
|
|
email,
|
|
'Login-Link — Mana',
|
|
`<p>Klicke hier um dich anzumelden:</p><p><a href="${url}">Jetzt anmelden</a></p><p>Der Link ist 10 Minuten gültig.</p>`
|
|
);
|
|
}
|
|
|
|
export async function sendAccountDeletionEmail(email: string, name?: string) {
|
|
return send(
|
|
email,
|
|
'Konto gelöscht — Mana',
|
|
`<p>Hallo ${name || ''},</p><p>Dein Mana-Konto wurde erfolgreich gelöscht. Alle deine Daten wurden entfernt.</p>`
|
|
);
|
|
}
|