s.esmaeiliandClaude Opus 5
4efe543d62
Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.
Customer JWT, separate from the admin one (T1):
- new src/modules/customer-auth/ with its own passport strategy,
CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
- signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
which the strategy verifies; both checks are present deliberately
- customer state re-read per request, so deactivating takes effect at once
- mirrors the reference's own split: auth:api vs auth('api-customer')
Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
- new CustomerOtp table, additive migration, nothing existing touched
- parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
normalisation on both number and code, rejection on mismatch
- approved improvements over the reference: bcrypt-hashed code, 2-minute
expiry, 5 attempts then lockout, single use, send throttle (60s per
number, 5/number and 20/IP per 10 min), and no number enumeration
Routes removed, replaced by token-derived equivalents:
GET customers, customers/:id, /:id/orders, /:id/ledger-entries
-> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).
Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.
Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.
[ref: henza_server ApiMobileController.php:39-78]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
59 lines
2.2 KiB
TypeScript
59 lines
2.2 KiB
TypeScript
import { defineStore } from 'pinia';
|
|
|
|
const TOKEN_KEY = 'gold-bank:token';
|
|
const CUSTOMER_ID_KEY = 'gold-bank:customerId';
|
|
const MOBILE_KEY = 'gold-bank:mobile';
|
|
/** Legacy's isUserLoggedIn() (Mixins/checkAccess.ts) reads this key. */
|
|
const LEGACY_FLAG_KEY = 'appToken';
|
|
|
|
/**
|
|
* The logged-in customer's session.
|
|
*
|
|
* `token` is the credential. It is a real customer JWT issued by
|
|
* POST /api/customer/auth/verify-otp after the SMS code is checked server-side,
|
|
* and it is what every /customer/me* request is authorised with.
|
|
*
|
|
* `customerId` is kept for display and for cart bookkeeping only — it is NOT an
|
|
* identity claim any more. Until the OTP migration, the app sent this id in the
|
|
* URL of /customers/:id and the server trusted it, which meant anyone could
|
|
* read anyone's profile, orders and ledger by changing the value. The API no
|
|
* longer has an id-bearing customer route at all; the server derives the
|
|
* customer from the token. See SEC-08 in docs/parity/ISSUES.md.
|
|
*/
|
|
export const useSessionStore = defineStore('session', {
|
|
state: () => ({
|
|
token: localStorage.getItem(TOKEN_KEY) as string | null,
|
|
customerId: localStorage.getItem(CUSTOMER_ID_KEY) as string | null,
|
|
mobile: localStorage.getItem(MOBILE_KEY) as string | null,
|
|
}),
|
|
getters: {
|
|
/** Authenticated means holding a token, not merely knowing an id. */
|
|
isLoggedIn: (state) => Boolean(state.token),
|
|
},
|
|
actions: {
|
|
login(token: string, customerId: string, mobile: string) {
|
|
this.token = token;
|
|
this.customerId = customerId;
|
|
this.mobile = mobile;
|
|
localStorage.setItem(TOKEN_KEY, token);
|
|
localStorage.setItem(CUSTOMER_ID_KEY, customerId);
|
|
localStorage.setItem(MOBILE_KEY, mobile);
|
|
localStorage.setItem(LEGACY_FLAG_KEY, token);
|
|
},
|
|
/**
|
|
* Clears everything. Called on explicit logout and by the API client when a
|
|
* request comes back 401 — an expired or revoked token must not leave stale
|
|
* personal data on screen.
|
|
*/
|
|
logout() {
|
|
this.token = null;
|
|
this.customerId = null;
|
|
this.mobile = null;
|
|
localStorage.removeItem(TOKEN_KEY);
|
|
localStorage.removeItem(CUSTOMER_ID_KEY);
|
|
localStorage.removeItem(MOBILE_KEY);
|
|
localStorage.removeItem(LEGACY_FLAG_KEY);
|
|
},
|
|
},
|
|
});
|