s.esmaeiliandClaude Opus 5
4efe543d62
Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.
Customer JWT, separate from the admin one (T1):
- new src/modules/customer-auth/ with its own passport strategy,
CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
- signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
which the strategy verifies; both checks are present deliberately
- customer state re-read per request, so deactivating takes effect at once
- mirrors the reference's own split: auth:api vs auth('api-customer')
Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
- new CustomerOtp table, additive migration, nothing existing touched
- parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
normalisation on both number and code, rejection on mismatch
- approved improvements over the reference: bcrypt-hashed code, 2-minute
expiry, 5 attempts then lockout, single use, send throttle (60s per
number, 5/number and 20/IP per 10 min), and no number enumeration
Routes removed, replaced by token-derived equivalents:
GET customers, customers/:id, /:id/orders, /:id/ledger-entries
-> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).
Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.
Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.
[ref: henza_server ApiMobileController.php:39-78]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
64 lines
1.9 KiB
TypeScript
64 lines
1.9 KiB
TypeScript
import { Injectable, NotFoundException } from '@nestjs/common';
|
|
import { Prisma } from '@prisma/client';
|
|
import { PrismaService } from '../../prisma/prisma.service';
|
|
|
|
// passwordHash must never leave the API — every customer read goes through this.
|
|
const PUBLIC_CUSTOMER_SELECT = {
|
|
id: true,
|
|
fullName: true,
|
|
mobile: true,
|
|
nationalCode: true,
|
|
cityId: true,
|
|
referredByAgentId: true,
|
|
goldCreditLimitGrams: true,
|
|
goldDebtGrams: true,
|
|
fiatDebtRial: true,
|
|
verificationStep: true,
|
|
nationalIdImageUrl: true,
|
|
businessLicenseUrl: true,
|
|
shopImageUrl: true,
|
|
isActive: true,
|
|
isArchived: true,
|
|
createdAt: true,
|
|
updatedAt: true,
|
|
} satisfies Prisma.CustomerSelect;
|
|
|
|
/**
|
|
* Every method here is reached only through CustomerAuthController's
|
|
* token-derived /customer/me* routes, which pass the id from the JWT.
|
|
*
|
|
* There used to be a `list()` returning every active customer, because the two
|
|
* apps' login screens downloaded it and matched the phone number in the
|
|
* browser. It is gone: the login lookup now happens server-side inside
|
|
* CustomerAuthService.requestOtp, which is what the reference did
|
|
* (henza_server ApiMobileController.php:39-49). See SEC-08.
|
|
*/
|
|
@Injectable()
|
|
export class CustomersService {
|
|
constructor(private readonly prisma: PrismaService) {}
|
|
|
|
async getOrThrow(customerId: string) {
|
|
const customer = await this.prisma.customer.findUnique({
|
|
where: { id: customerId },
|
|
select: PUBLIC_CUSTOMER_SELECT,
|
|
});
|
|
if (!customer) throw new NotFoundException(`Customer ${customerId} not found`);
|
|
return customer;
|
|
}
|
|
|
|
getOrders(customerId: string) {
|
|
return this.prisma.order.findMany({
|
|
where: { customerId },
|
|
include: { items: true },
|
|
orderBy: { createdAt: 'desc' },
|
|
});
|
|
}
|
|
|
|
getLedgerEntries(customerId: string) {
|
|
return this.prisma.ledgerEntry.findMany({
|
|
where: { customerId },
|
|
orderBy: { createdAt: 'desc' },
|
|
});
|
|
}
|
|
}
|