admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
281 lines
11 KiB
TypeScript
281 lines
11 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { ensureInitialized } from '@/lib/init'
|
|
import { createLogger } from '@/lib/logger'
|
|
import { getEmailService } from '@/lib/email/service'
|
|
import { getBranding } from '@/lib/branding/service'
|
|
import { resolveBrandResultByHost } from '@/lib/branding/resolve'
|
|
import { getSenderForBrand } from '@/lib/email/brand-sender'
|
|
import { buildAuthEmail } from '@/lib/email/auth-templates'
|
|
import { verifyStandardWebhookSignature } from '@/lib/email/standard-webhook'
|
|
import {
|
|
BrandLookupFailedError,
|
|
getCanonicalAppOrigin,
|
|
resolveTrustedAppOrigin,
|
|
} from '@/lib/domains/trusted-app-origin'
|
|
|
|
// Loads the email extension so getEmailService() returns the Resend
|
|
// implementation instead of the noop default.
|
|
ensureInitialized()
|
|
|
|
const log = createLogger('auth-email-hook')
|
|
|
|
/**
|
|
* POST /api/auth/email-hook: Supabase Auth "Send Email" hook (WL-05, WL-13).
|
|
*
|
|
* When enabled in Supabase (Auth > Hooks > Send Email, pointing at this URL
|
|
* with the shared secret in SUPABASE_SEND_EMAIL_HOOK_SECRET), Supabase stops
|
|
* sending auth mail itself and this endpoint sends every auth mail (signup
|
|
* confirmation, recovery, magic link, invite, email change, reauthentication)
|
|
* through the platform email service, branded per the requesting host: the
|
|
* brand is resolved from the trusted redirect_to origin, so a
|
|
* reset requested on app.partner.se is sent in the partner's brand and links
|
|
* back to app.partner.se. Unknown hosts get canonical platform mail.
|
|
*
|
|
* Unauthenticated by design (server-to-server): authenticity comes from the
|
|
* Standard Webhooks signature, not a session, exactly like the Stripe and
|
|
* Resend webhook routes. The raw body is verified byte-for-byte before
|
|
* parsing. The signature proves WHO sent the payload, not that every
|
|
* destination in it should be followed: redirect_to is GoTrue's already
|
|
* allowlisted referrer, but that allowlist is a glob configured by hand, so
|
|
* the origin is resolved here again through lib/domains/trusted-app-origin
|
|
* (canonical, this deployment's own Vercel hosts, or a registered brand
|
|
* domain). Anything else gets a canonical link, and the token never rides
|
|
* to a host this deployment does not serve. This endpoint is
|
|
* availability-critical once the hook is enabled:
|
|
* any internal failure returns 500 so Supabase retries (up to 3 times within
|
|
* a 5 second budget); success returns 200 {} fast.
|
|
*
|
|
* Until the hook is switched on in Supabase this route is dormant and auth
|
|
* mail keeps flowing from Supabase unchanged.
|
|
*/
|
|
|
|
// verifyOtp types our /auth/callback confirm route accepts. Unknown action
|
|
// types fall back to the generic 'email' type rather than dropping the mail.
|
|
const VERIFY_TYPES = new Set([
|
|
'signup',
|
|
'recovery',
|
|
'magiclink',
|
|
'invite',
|
|
'email_change',
|
|
'email',
|
|
])
|
|
|
|
interface SendEmailHookPayload {
|
|
user?: {
|
|
email?: string | null
|
|
new_email?: string | null
|
|
email_new?: string | null
|
|
} | null
|
|
email_data?: {
|
|
token?: string
|
|
token_hash?: string
|
|
token_new?: string
|
|
token_hash_new?: string
|
|
redirect_to?: string
|
|
email_action_type?: string
|
|
site_url?: string
|
|
} | null
|
|
}
|
|
|
|
/**
|
|
* Build the verify URL on the ORIGINATING host using the token_hash +
|
|
* verifyOtp pattern (browser- and host-independent, per the WL-05 research):
|
|
* /auth/callback consumes token_hash + type server-side and then honors the
|
|
* `next` path. If redirect_to already points at /auth/callback (our client
|
|
* flows do), its query (e.g. next=/reset-password) is preserved.
|
|
*
|
|
* `origin` is the already-trusted application origin; `redirectUrl` is the
|
|
* requested redirect_to only when it sits on that origin, else null (the
|
|
* link then lands on the origin's /auth/callback with no `next`).
|
|
*/
|
|
function buildActionUrl(
|
|
origin: string,
|
|
redirectUrl: URL | null,
|
|
tokenHash: string,
|
|
actionType: string,
|
|
): string {
|
|
const verifyType = VERIFY_TYPES.has(actionType) ? actionType : 'email'
|
|
let url: URL
|
|
if (redirectUrl && redirectUrl.pathname === '/auth/callback') {
|
|
url = new URL(redirectUrl.toString())
|
|
} else {
|
|
url = new URL('/auth/callback', origin)
|
|
if (redirectUrl) {
|
|
const next = redirectUrl.pathname + redirectUrl.search
|
|
if (next && next !== '/') url.searchParams.set('next', next)
|
|
}
|
|
}
|
|
url.searchParams.set('token_hash', tokenHash)
|
|
url.searchParams.set('type', verifyType)
|
|
return url.toString()
|
|
}
|
|
|
|
/**
|
|
* The requested redirect_to, kept only when its origin is one this
|
|
* deployment serves. The comparison is on the resolved origin, so an http
|
|
* link to a hosted domain, a lookalike host, a non-default port or a
|
|
* credential-bearing URL all collapse to the canonical /auth/callback.
|
|
* Throws BrandLookupFailedError when the brands table cannot be read.
|
|
*/
|
|
async function resolveRedirect(
|
|
requested: string | undefined,
|
|
): Promise<{ origin: string; redirectUrl: URL | null }> {
|
|
let requestedUrl: URL | null = null
|
|
if (requested) {
|
|
try {
|
|
requestedUrl = new URL(requested)
|
|
} catch {
|
|
requestedUrl = null
|
|
}
|
|
}
|
|
// URL.origin drops userinfo, so a credential-bearing redirect on a served
|
|
// host would pass the origin comparison and be cloned into the link with
|
|
// the credentials still in it. No flow of ours ever sends one: treat it as
|
|
// untrusted outright (canonical link, no next), never as a served host.
|
|
if (requestedUrl && (requestedUrl.username || requestedUrl.password)) {
|
|
log.warn('redirect_to carries credentials; linking to the canonical origin', {
|
|
host: requestedUrl.hostname,
|
|
})
|
|
requestedUrl = null
|
|
}
|
|
const origin = await resolveTrustedAppOrigin(requestedUrl?.origin ?? null)
|
|
if (requestedUrl && requestedUrl.origin === origin) {
|
|
return { origin, redirectUrl: requestedUrl }
|
|
}
|
|
if (requestedUrl) {
|
|
// Hostname only: the URL may carry a query, never log the token side.
|
|
log.warn('redirect_to origin is not a served host; linking to the canonical origin', {
|
|
host: requestedUrl.hostname,
|
|
})
|
|
}
|
|
return { origin, redirectUrl: null }
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
const secret = process.env.SUPABASE_SEND_EMAIL_HOOK_SECRET
|
|
if (!secret) {
|
|
log.error('SUPABASE_SEND_EMAIL_HOOK_SECRET is not configured', undefined)
|
|
return NextResponse.json({ error: 'Hook not configured' }, { status: 500 })
|
|
}
|
|
|
|
const rawBody = await request.text()
|
|
const verified = verifyStandardWebhookSignature({
|
|
secret,
|
|
payload: rawBody,
|
|
id: request.headers.get('webhook-id'),
|
|
timestamp: request.headers.get('webhook-timestamp'),
|
|
signature: request.headers.get('webhook-signature'),
|
|
})
|
|
if (!verified) {
|
|
return NextResponse.json({ error: 'Invalid signature' }, { status: 401 })
|
|
}
|
|
|
|
let payload: SendEmailHookPayload
|
|
try {
|
|
payload = JSON.parse(rawBody) as SendEmailHookPayload
|
|
} catch {
|
|
return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
|
|
}
|
|
|
|
const emailData = payload.email_data ?? {}
|
|
const actionType = emailData.email_action_type || ''
|
|
const recipient = payload.user?.email || null
|
|
if (!recipient) {
|
|
return NextResponse.json({ error: 'Missing recipient' }, { status: 400 })
|
|
}
|
|
|
|
// Brand from the RESOLVED host: redirect_to carries the tenant origin, and
|
|
// the sender identity must match the host the link lands on. A lookup
|
|
// failure is a 500 so Supabase retries rather than sending a mail whose
|
|
// link would land on the wrong domain.
|
|
let resolved: Awaited<ReturnType<typeof resolveRedirect>>
|
|
try {
|
|
resolved = await resolveRedirect(emailData.redirect_to)
|
|
} catch (err) {
|
|
if (!(err instanceof BrandLookupFailedError)) throw err
|
|
log.error('brand lookup failed while resolving redirect_to', err, { host: err.host })
|
|
return NextResponse.json({ error: 'Origin lookup failed' }, { status: 500 })
|
|
}
|
|
const { origin, redirectUrl } = resolved
|
|
// A brand host whose row cannot be read right now (a second registry read
|
|
// can fail after the first succeeded) must not get platform-branded mail
|
|
// carrying a brand link: 500, Supabase retries. On the canonical origin a
|
|
// failed read is the platform sender either way, so it does not block.
|
|
const brandResult = await resolveBrandResultByHost(new URL(origin).hostname)
|
|
if (brandResult.lookupFailed && origin !== getCanonicalAppOrigin()) {
|
|
log.error('brand lookup failed for the resolved origin', undefined, { origin })
|
|
return NextResponse.json({ error: 'Origin lookup failed' }, { status: 500 })
|
|
}
|
|
const brand = brandResult.brand
|
|
const sender = getSenderForBrand(brand)
|
|
const appName = brand?.appName ?? getBranding().appName
|
|
|
|
// Compose the mail(s) for this hook invocation.
|
|
const mails: Array<{ to: string; actionType: string; actionUrl?: string; otpCode?: string }> = []
|
|
|
|
if (actionType === 'reauthentication') {
|
|
if (!emailData.token) {
|
|
return NextResponse.json({ error: 'Missing token' }, { status: 400 })
|
|
}
|
|
mails.push({ to: recipient, actionType, otpCode: emailData.token })
|
|
} else if (actionType === 'email_change') {
|
|
// Secure email change sends TWO mails from one invocation. Documented
|
|
// reversal: token_hash confirms at the NEW address, token_hash_new at
|
|
// the CURRENT one.
|
|
if (!emailData.token_hash) {
|
|
return NextResponse.json({ error: 'Missing token_hash' }, { status: 400 })
|
|
}
|
|
const newEmail = payload.user?.new_email || payload.user?.email_new || recipient
|
|
mails.push({
|
|
to: newEmail,
|
|
actionType: 'email_change',
|
|
actionUrl: buildActionUrl(origin, redirectUrl, emailData.token_hash, 'email_change'),
|
|
})
|
|
if (emailData.token_hash_new) {
|
|
mails.push({
|
|
to: recipient,
|
|
actionType: 'email_change_current',
|
|
actionUrl: buildActionUrl(origin, redirectUrl, emailData.token_hash_new, 'email_change'),
|
|
})
|
|
}
|
|
} else {
|
|
if (!emailData.token_hash) {
|
|
return NextResponse.json({ error: 'Missing token_hash' }, { status: 400 })
|
|
}
|
|
mails.push({
|
|
to: recipient,
|
|
actionType,
|
|
actionUrl: buildActionUrl(origin, redirectUrl, emailData.token_hash, actionType),
|
|
})
|
|
}
|
|
|
|
const emailService = getEmailService()
|
|
for (const mail of mails) {
|
|
const built = buildAuthEmail({
|
|
actionType: mail.actionType,
|
|
appName,
|
|
actionUrl: mail.actionUrl,
|
|
otpCode: mail.otpCode,
|
|
})
|
|
const result = await emailService.sendEmail({
|
|
to: mail.to,
|
|
subject: built.subject,
|
|
html: built.html,
|
|
text: built.text,
|
|
fromName: sender.fromName ?? undefined,
|
|
fromAddress: sender.fromAddress ?? undefined,
|
|
replyTo: sender.replyTo ?? undefined,
|
|
})
|
|
if (!result.success) {
|
|
// Non-2xx makes Supabase retry, which is the recovery we want: auth
|
|
// mail must not be silently dropped.
|
|
log.error('auth mail send failed', new Error(result.error ?? 'unknown'), {
|
|
actionType: mail.actionType,
|
|
})
|
|
return NextResponse.json({ error: 'Send failed' }, { status: 500 })
|
|
}
|
|
}
|
|
|
|
return NextResponse.json({})
|
|
}
|