peter
3ac3d382e7
Two independent bugs made an email+password registration unrecoverable in prod. The verification link did nothing. urlWithParams/clearParams rebuilt the URL as pathname+query and dropped the fragment — but the one-time auth tokens ride the fragment (#verify=/#reset=, SB3), and the providers that mirror nav params (useUrlMirror in FeedFilters/Playlists/Plex/Channels) sit ABOVE the lazily-loaded <App> in main.tsx. Their mount effect replaceState'd the token away before the auth card's chunk had loaded, so the card read an empty hash: the link opened a bare sign-in page, no request, no banner. Both helpers now carry the fragment over. The account was then locked out for good. SEC-10 nulls password_hash when an unverified account is attested (here: admin approval landing before the user could verify — which the bug above made impossible). That is indistinguishable from a Google-only account, and reset eligibility keyed off password_hash alone, so no reset link was ever issued: no password to sign in with, and no way to get one. users.password_revoked_at records the revocation, reset eligibility honours it, and setting a password again (reset-confirm or set-password) clears it. An account that never had a password stays ineligible on purpose — its owner adds one from Settings. /auth/verify now also answers password_reset_required so the card can say why the registered password stopped working, instead of leaving the user at the uniform "Invalid email or password". Telling the holder of a valid verify token leaks nothing: they have already proved they own the mailbox. The 0078 migration backfills the stamp for rows carrying the exact lockout signature (local, non-demo, no password, unverified), so existing victims recover unaided.
51 lines
2.1 KiB
Python
51 lines
2.1 KiB
Python
"""users.password_revoked_at — remember that SEC-10 dropped a preset password
|
|
|
|
Revision ID: 0078_password_revoked_at
|
|
Revises: 0077_plex_playback_class
|
|
Create Date: 2026-09-02
|
|
|
|
SEC-10 (`auth.revoke_preset_password_if_unverified`) nulls `password_hash` when an account whose email
|
|
was never verified is attested (Google adoption, or admin approval). That left NO trace, and
|
|
password-reset eligibility keyed off `password_hash IS NOT NULL` — so such an account could neither
|
|
sign in (no password) nor request a reset link (not "eligible"): a permanent lockout with a silent,
|
|
uniform response at every step.
|
|
|
|
This column is that trace. A row with `password_revoked_at` set is a local account that HAD a password
|
|
and had it revoked, so the reset flow treats it as eligible again. Setting a password (reset-confirm or
|
|
/auth/set-password) clears the stamp. A Google-only account that never had a password keeps it NULL and
|
|
stays reset-ineligible by design — its owner adds a password from Settings while signed in.
|
|
|
|
Backfill: the pre-existing victims of the lockout can't be identified with certainty, but the signature
|
|
is exact and narrow — a local (google_sub IS NULL), non-demo account with no password whose email is
|
|
still unverified could ONLY have got there through the revoke, since registration always sets a hash.
|
|
Stamp those with the current time so they become recoverable without operator intervention.
|
|
"""
|
|
|
|
from typing import Sequence, Union
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
revision: str = "0078_password_revoked_at"
|
|
down_revision: Union[str, None] = "0077_plex_playback_class"
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.add_column(
|
|
"users",
|
|
sa.Column("password_revoked_at", sa.DateTime(timezone=True), nullable=True),
|
|
)
|
|
op.execute(
|
|
"UPDATE users SET password_revoked_at = now() "
|
|
"WHERE password_hash IS NULL "
|
|
"AND google_sub IS NULL "
|
|
"AND is_demo = false "
|
|
"AND email_verified = false"
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_column("users", "password_revoked_at")
|