Moheeb Zara
f2df287b35
Independent adversarial audit verdict was NOT SAFE; fixed: - P0-1 /auth/confirm no longer trusts the query `type` (pinned to 'email_change'); a public endpoint feeding an attacker-chosen OTP type into verifyOtp was an unintended auth entrypoint. - P0-2 email sync uses the verifyOtp response user, not a follow-up getUser() that may not reflect the just-verified identity; /me now reconciles space_members.email against the authoritative auth email on load, so a missed sync self-heals (no permanent stale email). - P1-1 requestEmailChange builds the confirm origin from NEXT_PUBLIC_APP_URL only, never request headers (forged Host could redirect the confirmation link / capture token_hash). - P2-1 isSecretConfigField also catches password/token/private_key/ *_token/*_password so non-conventionally-named credentials can't be stored in plaintext integrations.config. 521 tests; build clean.
52 lines
2.1 KiB
TypeScript
52 lines
2.1 KiB
TypeScript
// Email-change confirmation landing. Supabase's "Change Email Address"
|
|
// template must point here with ?token_hash={{ .TokenHash }}&type=email_change
|
|
// (NOT the OAuth code flow — that is /auth/callback). With "Secure email
|
|
// change" on (recommended), Supabase emails BOTH the old and new address and
|
|
// the change applies to auth.users only after both links are verified; this
|
|
// route is hit once per link and is idempotent.
|
|
//
|
|
// This route does EXACTLY ONE thing: confirm an email change. The OTP type is
|
|
// pinned to 'email_change' and the query `type` is intentionally ignored — a
|
|
// public endpoint that fed an attacker-chosen type into verifyOtp would be an
|
|
// unintended auth entrypoint (recovery/magiclink/signup tokens minting a
|
|
// session here, bypassing their real flows).
|
|
//
|
|
// The denormalized space_members.email is synced from the verifyOtp response
|
|
// user (NOT a follow-up getUser(), which is not guaranteed to reflect the
|
|
// just-verified identity in this SSR request). /me additionally reconciles on
|
|
// load, so a missed sync here self-heals.
|
|
import { createClient } from '@/lib/supabase/server'
|
|
import { createAdminClient } from '@/lib/supabase/admin'
|
|
import { NextResponse } from 'next/server'
|
|
|
|
export async function GET(request: Request) {
|
|
const { searchParams, origin } = new URL(request.url)
|
|
const tokenHash = searchParams.get('token_hash')
|
|
|
|
if (!tokenHash) {
|
|
return NextResponse.redirect(`${origin}/login?error=email_change`)
|
|
}
|
|
|
|
const supabase = await createClient()
|
|
const { data, error } = await supabase.auth.verifyOtp({
|
|
type: 'email_change',
|
|
token_hash: tokenHash,
|
|
})
|
|
if (error) {
|
|
return NextResponse.redirect(`${origin}/login?error=email_change`)
|
|
}
|
|
|
|
// Use the verifyOtp response user. On the first of two secure-change links
|
|
// auth.users.email is still the old value (no-op sync); the second link's
|
|
// hit carries the new email. Idempotent; /me reconciles any miss.
|
|
const user = data.user
|
|
if (user?.email) {
|
|
await createAdminClient()
|
|
.from('space_members')
|
|
.update({ email: user.email })
|
|
.eq('user_id', user.id)
|
|
}
|
|
|
|
return NextResponse.redirect(`${origin}/me?email=confirmed`)
|
|
}
|