fix(auth): resolve BankID confirmation and email-hook link hosts through the trusted-origin registry (#2380)
* fix(auth): resolve BankID confirmation and email-hook link hosts through the trusted-origin registry The BankID confirmation mail built its /auth/callback link from the raw forwarded host and protocol; it is the one auth link GoTrue's redirect allowlist never sees, since the link is minted here and sent through Resend. The Send Email hook followed GoTrue's redirect_to verbatim: the webhook signature proves who sent the payload, not that every destination in it should be followed, and the GoTrue allowlist is a hand-configured glob. Both now resolve the destination through lib/domains/trusted-app-origin like every other auth link (canonical, this deployment's own Vercel hosts, or a registered brands.domain). Unknown, lookalike, credential-bearing, non-default-port and malformed destinations collapse to the canonical /auth/callback with no next path; a registered brand host over http is upgraded to https. Brand sender identity is taken from the RESOLVED host, so mail branding and link destination always agree. A brands-table read failure refuses instead of mailing a wrong-host link: the BankID helper returns step resolve_origin (signup rolls back, login re-send logs), the hook answers 500 so Supabase retries. Drops the proto parameter from the BankID helper; the resolver owns the scheme. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0189cGB2YxptqVxBLJ2RkB5T * fix(auth): read the sender brand once, failure-aware, before minting or sending auth mail CodeRabbit: resolveTrustedAppOrigin could classify a brand host, then the separate resolveBrandByHost read for the sender could fail and return null, so a brand link went out with the platform sender; the BankID helper had already minted the magic link by then. Both sites now read the brand with resolveBrandResultByHost on the resolved host and refuse on a failed read for any non-canonical origin (BankID: step resolve_origin before generateLink; hook: 500 so Supabase retries). On the canonical origin a failed read is the platform sender either way, so mail still goes out. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0189cGB2YxptqVxBLJ2RkB5T * fix(auth): treat a credential-bearing redirect_to as untrusted in the email hook Superagent P2: URL.origin drops userinfo, so a redirect_to with credentials on a served host passed the origin comparison and was cloned into the auth link with the credentials still in it. No flow of ours sends one; the hook now rejects any redirect_to carrying username or password outright and links to the canonical /auth/callback with no next path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0189cGB2YxptqVxBLJ2RkB5T --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5.1
Claude Fable 5.1
parent
e0244b95a7
commit
cb962fae88
@@ -10,13 +10,20 @@ import type { Brand } from '@/lib/branding/resolve'
|
||||
|
||||
vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
|
||||
|
||||
const resolveBrandByHostMock = vi.hoisted(() => vi.fn())
|
||||
const resolveBrandResultByHostMock = vi.hoisted(() => vi.fn())
|
||||
vi.mock('@/lib/branding/resolve', () => ({
|
||||
resolveBrandByHost: resolveBrandByHostMock,
|
||||
resolveBrandByHost: vi.fn(),
|
||||
// The one registry read: the trusted-origin resolver classifies the
|
||||
// redirect_to host through it, and the hook reads the sender brand from it.
|
||||
resolveBrandResultByHost: (...args: unknown[]) => resolveBrandResultByHostMock(...args),
|
||||
// Imported by lib/email/brand-sender (not called on the hook path).
|
||||
resolveBrandForCompany: vi.fn(),
|
||||
}))
|
||||
|
||||
const CANONICAL = 'https://app.gnubok.se'
|
||||
/** The one registered brand host in these tests; everything else is unknown. */
|
||||
const BRAND_HOST = 'app.siffra.se'
|
||||
|
||||
vi.mock('@/lib/branding/service', () => ({
|
||||
getBranding: () => ({ appName: 'Accounted', appUrl: 'https://app.gnubok.se' }),
|
||||
}))
|
||||
@@ -87,15 +94,23 @@ function hookPayload(overrides?: {
|
||||
})
|
||||
}
|
||||
|
||||
const ORIGINAL_APP_URL = process.env.NEXT_PUBLIC_APP_URL
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET = SECRET
|
||||
resolveBrandByHostMock.mockResolvedValue(null)
|
||||
process.env.NEXT_PUBLIC_APP_URL = CANONICAL
|
||||
resolveBrandResultByHostMock.mockImplementation(async (host: string) => ({
|
||||
brand: host === BRAND_HOST ? makeBrand() : null,
|
||||
lookupFailed: false,
|
||||
}))
|
||||
sendEmailMock.mockResolvedValue({ success: true, messageId: 'msg-1' })
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
delete process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET
|
||||
if (ORIGINAL_APP_URL === undefined) delete process.env.NEXT_PUBLIC_APP_URL
|
||||
else process.env.NEXT_PUBLIC_APP_URL = ORIGINAL_APP_URL
|
||||
})
|
||||
|
||||
describe('POST /api/auth/email-hook', () => {
|
||||
@@ -138,7 +153,6 @@ describe('POST /api/auth/email-hook', () => {
|
||||
})
|
||||
|
||||
it('brands the mail from the redirect_to host and rides the verified brand sender', async () => {
|
||||
resolveBrandByHostMock.mockResolvedValue(makeBrand())
|
||||
const res = await POST(
|
||||
signedRequest(
|
||||
hookPayload({
|
||||
@@ -150,7 +164,7 @@ describe('POST /api/auth/email-hook', () => {
|
||||
),
|
||||
)
|
||||
expect(res.status).toBe(200)
|
||||
expect(resolveBrandByHostMock).toHaveBeenCalledWith('app.siffra.se')
|
||||
expect(resolveBrandResultByHostMock).toHaveBeenCalledWith('app.siffra.se')
|
||||
|
||||
const options = sendEmailMock.mock.calls[0][0]
|
||||
expect(options.fromName).toBe('Siffra')
|
||||
@@ -163,7 +177,10 @@ describe('POST /api/auth/email-hook', () => {
|
||||
})
|
||||
|
||||
it('uses the via-fallback for a brand without a verified sender domain', async () => {
|
||||
resolveBrandByHostMock.mockResolvedValue(makeBrand({ senderDomainStatus: 'pending' }))
|
||||
resolveBrandResultByHostMock.mockResolvedValue({
|
||||
brand: makeBrand({ senderDomainStatus: 'pending' }),
|
||||
lookupFailed: false,
|
||||
})
|
||||
await POST(
|
||||
signedRequest(
|
||||
hookPayload({
|
||||
@@ -238,4 +255,106 @@ describe('POST /api/auth/email-hook', () => {
|
||||
const res = await POST(signedRequest(hookPayload()))
|
||||
expect(res.status).toBe(500)
|
||||
})
|
||||
|
||||
describe('redirect_to destinations (signature proves the sender, not the destination)', () => {
|
||||
it.each([
|
||||
['an unknown host', 'https://evil.example/auth/callback?next=/reset-password'],
|
||||
['a lookalike of a registered host', 'https://app.siffra.se.evil.example/auth/callback'],
|
||||
['a registered host on a non-default port', 'https://app.siffra.se:8443/auth/callback'],
|
||||
['a credential-bearing URL', 'https://app.siffra.se@evil.example/auth/callback'],
|
||||
// URL.origin drops userinfo: the host alone would pass as trusted.
|
||||
['credentials on a registered host', 'https://evil.example@app.siffra.se/auth/callback?next=/x'],
|
||||
['credentials on the canonical host', 'https://user:pw@app.gnubok.se/auth/callback?next=/x'],
|
||||
['a malformed value', 'not a url'],
|
||||
])('links %s to the canonical callback without the requested path', async (_label, redirectTo) => {
|
||||
const res = await POST(
|
||||
signedRequest(hookPayload({ email_data: { redirect_to: redirectTo } })),
|
||||
)
|
||||
expect(res.status).toBe(200)
|
||||
|
||||
const options = sendEmailMock.mock.calls[0][0]
|
||||
expect(options.text).toContain(
|
||||
'https://app.gnubok.se/auth/callback?token_hash=hash-1&type=recovery',
|
||||
)
|
||||
expect(options.text).not.toContain('evil.example')
|
||||
expect(options.text).not.toContain(':8443')
|
||||
expect(options.text).not.toContain('next=')
|
||||
// Canonical link means canonical sender: brand and destination agree.
|
||||
expect(options.fromName).toBeUndefined()
|
||||
expect(options.fromAddress).toBeUndefined()
|
||||
})
|
||||
|
||||
it('upgrades http on a registered brand host to https and drops the requested path', async () => {
|
||||
await POST(
|
||||
signedRequest(
|
||||
hookPayload({
|
||||
email_data: { redirect_to: 'http://app.siffra.se/auth/callback?next=/settings' },
|
||||
}),
|
||||
),
|
||||
)
|
||||
const options = sendEmailMock.mock.calls[0][0]
|
||||
expect(options.text).toContain(
|
||||
'https://app.siffra.se/auth/callback?token_hash=hash-1&type=recovery',
|
||||
)
|
||||
expect(options.text).not.toContain('http://')
|
||||
expect(options.text).not.toContain('next=')
|
||||
expect(options.fromName).toBe('Siffra')
|
||||
})
|
||||
|
||||
it('keeps the requested path on a registered brand host', async () => {
|
||||
await POST(
|
||||
signedRequest(
|
||||
hookPayload({
|
||||
email_data: { redirect_to: 'https://app.siffra.se/auth/callback?next=%2Freset-password' },
|
||||
}),
|
||||
),
|
||||
)
|
||||
const options = sendEmailMock.mock.calls[0][0]
|
||||
expect(options.text).toContain(
|
||||
'https://app.siffra.se/auth/callback?next=%2Freset-password&token_hash=hash-1',
|
||||
)
|
||||
expect(options.fromName).toBe('Siffra')
|
||||
})
|
||||
|
||||
it('falls back to the canonical callback when redirect_to is missing', async () => {
|
||||
await POST(signedRequest(hookPayload({ email_data: { redirect_to: undefined } })))
|
||||
const options = sendEmailMock.mock.calls[0][0]
|
||||
expect(options.text).toContain('https://app.gnubok.se/auth/callback?token_hash=hash-1')
|
||||
})
|
||||
|
||||
it('returns 500 without sending when the brand read fails after the origin resolved', async () => {
|
||||
// First read (origin classification) succeeds, second (sender) fails:
|
||||
// never platform-branded mail carrying a brand link.
|
||||
resolveBrandResultByHostMock
|
||||
.mockResolvedValueOnce({ brand: makeBrand(), lookupFailed: false })
|
||||
.mockResolvedValueOnce({ brand: null, lookupFailed: true })
|
||||
const res = await POST(
|
||||
signedRequest(
|
||||
hookPayload({ email_data: { redirect_to: 'https://app.siffra.se/auth/callback' } }),
|
||||
),
|
||||
)
|
||||
expect(res.status).toBe(500)
|
||||
expect(sendEmailMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('still sends canonical mail when the brand read fails on the canonical origin', async () => {
|
||||
resolveBrandResultByHostMock.mockResolvedValue({ brand: null, lookupFailed: true })
|
||||
const res = await POST(signedRequest(hookPayload()))
|
||||
expect(res.status).toBe(200)
|
||||
const options = sendEmailMock.mock.calls[0][0]
|
||||
expect(options.text).toContain('https://app.gnubok.se/auth/callback?next=%2Freset-password')
|
||||
expect(options.fromName).toBeUndefined()
|
||||
})
|
||||
|
||||
it('returns 500 without sending when the brand registry cannot be read', async () => {
|
||||
resolveBrandResultByHostMock.mockResolvedValue({ brand: null, lookupFailed: true })
|
||||
const res = await POST(
|
||||
signedRequest(
|
||||
hookPayload({ email_data: { redirect_to: 'https://app.siffra.se/auth/callback' } }),
|
||||
),
|
||||
)
|
||||
expect(res.status).toBe(500)
|
||||
expect(sendEmailMock).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user