MattssonandClaude Fable 5
341d61131a
* fix(auth): email-change recovery re-send and confirmation feedback A half-completed secure email change was a dead end: the pending-address short-circuit in /api/account/email swallowed every retry without re-sending mails, so once the confirmation links expired the user could never recover, and confirmation clicks landed on the dashboard with no feedback at all. - /api/account/email: only short-circuit a repeat request while the pending mails are fresh (30 min); a stale pending change falls through to GoTrue, which restarts the change and re-sends both mails - /auth/callback: type=email_change now redirects to a status page (/auth/email-change) that says whether one click remains, the change is complete, or the link was dead, instead of landing silently - auth mail templates: both email-change mails explain that two mails are sent and both links must be clicked - settings: the save button re-enables for the pending address as Skicka igen, so users can trigger the re-send themselves Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p * fix(auth): exempt email-change confirmations from the authenticated /auth bounce (skeptic findings) - middleware: let /auth/email-change and /auth/callback?type=email_change through for authenticated users; the bounce to / swallowed confirmation clicks before verifyOtp ran (pre-existing since #2017) - email-change done page resolves the WL-14 landing destination for the CTA - /api/account/email returns resent flag; settings toast says mails were already sent instead of claiming a fresh send Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
95 lines
3.1 KiB
TypeScript
95 lines
3.1 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import { buildAuthEmail } from '../auth-templates'
|
|
|
|
const URL_EXAMPLE = 'https://app.siffra.se/auth/callback?token_hash=abc&type=recovery'
|
|
// In HTML the URL lands in an attribute and is entity-escaped.
|
|
const URL_EXAMPLE_HTML = URL_EXAMPLE.replace(/&/g, '&')
|
|
|
|
describe('buildAuthEmail', () => {
|
|
it.each([
|
|
['signup', 'Bekräfta din e-postadress'],
|
|
['recovery', 'Återställ ditt lösenord'],
|
|
['magiclink', 'Din inloggningslänk'],
|
|
['invite', 'Du har blivit inbjuden'],
|
|
['email_change', 'Bekräfta din nya e-postadress'],
|
|
['email_change_current', 'Godkänn ändrad e-postadress'],
|
|
] as const)('renders %s with the brand app name and action link', (actionType, subject) => {
|
|
const mail = buildAuthEmail({
|
|
actionType,
|
|
appName: 'Siffra',
|
|
actionUrl: URL_EXAMPLE,
|
|
})
|
|
expect(mail.subject).toBe(subject)
|
|
expect(mail.html).toContain('Siffra')
|
|
expect(mail.html).toContain(URL_EXAMPLE_HTML)
|
|
expect(mail.html).not.toMatch(/accounted/i)
|
|
expect(mail.text).toContain(URL_EXAMPLE)
|
|
expect(mail.text).not.toMatch(/accounted/i)
|
|
})
|
|
|
|
it('renders the platform default without a brand', () => {
|
|
const mail = buildAuthEmail({
|
|
actionType: 'recovery',
|
|
appName: 'Accounted',
|
|
actionUrl: 'https://app.gnubok.se/auth/callback?token_hash=abc&type=recovery',
|
|
})
|
|
expect(mail.html).toContain('ACCOUNTED')
|
|
expect(mail.html).toContain('https://app.gnubok.se/auth/callback')
|
|
expect(mail.html).toMatchSnapshot()
|
|
expect(mail.text).toMatchSnapshot()
|
|
})
|
|
|
|
it('renders the branded recovery mail (snapshot)', () => {
|
|
const mail = buildAuthEmail({
|
|
actionType: 'recovery',
|
|
appName: 'Siffra',
|
|
actionUrl: URL_EXAMPLE,
|
|
})
|
|
expect(mail.html).toMatchSnapshot()
|
|
expect(mail.text).toMatchSnapshot()
|
|
})
|
|
|
|
it('tells the user both mails must be clicked for an email change', () => {
|
|
for (const actionType of ['email_change', 'email_change_current'] as const) {
|
|
const mail = buildAuthEmail({
|
|
actionType,
|
|
appName: 'Siffra',
|
|
actionUrl: URL_EXAMPLE,
|
|
})
|
|
expect(mail.text).toContain('två mail')
|
|
expect(mail.text).toContain('länken i båda')
|
|
}
|
|
})
|
|
|
|
it('renders the reauthentication code without a link', () => {
|
|
const mail = buildAuthEmail({
|
|
actionType: 'reauthentication',
|
|
appName: 'Siffra',
|
|
otpCode: '123456',
|
|
})
|
|
expect(mail.subject).toBe('Din verifieringskod')
|
|
expect(mail.html).toContain('123456')
|
|
expect(mail.html).not.toContain('<a href')
|
|
expect(mail.text).toContain('Kod: 123456')
|
|
})
|
|
|
|
it('falls back to a generic mail for unknown action types', () => {
|
|
const mail = buildAuthEmail({
|
|
actionType: 'some_future_type',
|
|
appName: 'Siffra',
|
|
actionUrl: URL_EXAMPLE,
|
|
})
|
|
expect(mail.subject).toBe('Bekräfta din åtgärd')
|
|
expect(mail.html).toContain(URL_EXAMPLE_HTML)
|
|
})
|
|
|
|
it('escapes HTML in the app name', () => {
|
|
const mail = buildAuthEmail({
|
|
actionType: 'recovery',
|
|
appName: '<script>x</script>',
|
|
actionUrl: URL_EXAMPLE,
|
|
})
|
|
expect(mail.html).not.toContain('<script>')
|
|
})
|
|
})
|