peter
3ac3d382e7
Two independent bugs made an email+password registration unrecoverable in prod. The verification link did nothing. urlWithParams/clearParams rebuilt the URL as pathname+query and dropped the fragment — but the one-time auth tokens ride the fragment (#verify=/#reset=, SB3), and the providers that mirror nav params (useUrlMirror in FeedFilters/Playlists/Plex/Channels) sit ABOVE the lazily-loaded <App> in main.tsx. Their mount effect replaceState'd the token away before the auth card's chunk had loaded, so the card read an empty hash: the link opened a bare sign-in page, no request, no banner. Both helpers now carry the fragment over. The account was then locked out for good. SEC-10 nulls password_hash when an unverified account is attested (here: admin approval landing before the user could verify — which the bug above made impossible). That is indistinguishable from a Google-only account, and reset eligibility keyed off password_hash alone, so no reset link was ever issued: no password to sign in with, and no way to get one. users.password_revoked_at records the revocation, reset eligibility honours it, and setting a password again (reset-confirm or set-password) clears it. An account that never had a password stays ineligible on purpose — its owner adds one from Settings. /auth/verify now also answers password_reset_required so the card can say why the registered password stopped working, instead of leaving the user at the uniform "Invalid email or password". Telling the holder of a valid verify token leaks nothing: they have already proved they own the mailbox. The 0078 migration backfills the stamp for rows carrying the exact lockout signature (local, non-demo, no password, unverified), so existing victims recover unaided.
62 lines
2.7 KiB
TypeScript
62 lines
2.7 KiB
TypeScript
// @vitest-environment jsdom
|
|
//
|
|
// useUrlMirror: mirror a set of nav params onto the CURRENT history entry (replaceState) whenever they
|
|
// change. Backfills the E4 deep-review's deferred coverage — the effect keys on the SERIALIZED updates
|
|
// so an inline object literal (new identity every render) only fires when a param actually changes; a
|
|
// null value clears a key; and every other param on the URL is preserved.
|
|
import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
|
|
import { renderHook } from "@testing-library/react";
|
|
import { useUrlMirror } from "./useUrlMirror";
|
|
|
|
const setUrl = (search: string) => window.history.replaceState(null, "", search || "/");
|
|
let spy: ReturnType<typeof vi.spyOn>;
|
|
|
|
beforeEach(() => {
|
|
setUrl("/");
|
|
spy = vi.spyOn(window.history, "replaceState");
|
|
});
|
|
afterEach(() => spy.mockRestore());
|
|
|
|
describe("useUrlMirror", () => {
|
|
it("writes the param onto the current entry on mount", () => {
|
|
renderHook(() => useUrlMirror({ pl: "5" }));
|
|
expect(window.location.search).toBe("?pl=5");
|
|
expect(spy).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
it("does not re-fire when the serialized updates are unchanged (stable dep)", () => {
|
|
const { rerender } = renderHook((p: Record<string, string | null>) => useUrlMirror(p), {
|
|
initialProps: { pl: "5" } as Record<string, string | null>,
|
|
});
|
|
expect(spy).toHaveBeenCalledTimes(1);
|
|
rerender({ pl: "5" }); // new object identity, same serialized value
|
|
expect(spy).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
it("clears a key when its value turns null", () => {
|
|
const { rerender } = renderHook((p: Record<string, string | null>) => useUrlMirror(p), {
|
|
initialProps: { pl: "5" } as Record<string, string | null>,
|
|
});
|
|
expect(window.location.search).toBe("?pl=5");
|
|
rerender({ pl: null });
|
|
expect(window.location.search).toBe("");
|
|
expect(spy).toHaveBeenCalledTimes(2);
|
|
});
|
|
|
|
it("preserves other params already on the URL", () => {
|
|
setUrl("?page=playlists");
|
|
renderHook(() => useUrlMirror({ pl: "5" }));
|
|
expect(window.location.search).toBe("?page=playlists&pl=5");
|
|
});
|
|
|
|
it("leaves an unconsumed auth token in the fragment alone", () => {
|
|
// This hook's mount effect is what ran before <App> (and therefore before the auth card) had even
|
|
// loaded, so whatever it writes to the address bar is what the card later reads. It must not eat
|
|
// the #verify=/#reset= token that the emailed link carries.
|
|
window.history.replaceState(null, "", "/?page=playlists#verify=tok123");
|
|
renderHook(() => useUrlMirror({ pl: "5" }));
|
|
expect(window.location.hash).toBe("#verify=tok123");
|
|
expect(window.location.search).toBe("?page=playlists&pl=5");
|
|
});
|
|
});
|