s.esmaeiliandClaude Opus 5
4efe543d62
Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.
Customer JWT, separate from the admin one (T1):
- new src/modules/customer-auth/ with its own passport strategy,
CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
- signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
which the strategy verifies; both checks are present deliberately
- customer state re-read per request, so deactivating takes effect at once
- mirrors the reference's own split: auth:api vs auth('api-customer')
Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
- new CustomerOtp table, additive migration, nothing existing touched
- parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
normalisation on both number and code, rejection on mismatch
- approved improvements over the reference: bcrypt-hashed code, 2-minute
expiry, 5 attempts then lockout, single use, send throttle (60s per
number, 5/number and 20/IP per 10 min), and no number enumeration
Routes removed, replaced by token-derived equivalents:
GET customers, customers/:id, /:id/orders, /:id/ledger-entries
-> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).
Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.
Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.
[ref: henza_server ApiMobileController.php:39-78]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53 lines
1.5 KiB
JSON
53 lines
1.5 KiB
JSON
{
|
|
"name": "api",
|
|
"version": "0.0.1",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "nest start --watch",
|
|
"build": "nest build",
|
|
"build:release": "pnpm exec prisma generate && node scripts/clean-dist.cjs && nest build && node scripts/bundle-release.cjs",
|
|
"lint": "eslint \"src/**/*.ts\"",
|
|
"test": "jest",
|
|
"prisma:push": "prisma db push",
|
|
"prisma:migrate": "prisma migrate dev",
|
|
"prisma:seed": "prisma db seed",
|
|
"prisma:studio": "prisma studio"
|
|
},
|
|
"prisma": {
|
|
"seed": "ts-node --transpile-only prisma/seed.ts"
|
|
},
|
|
"dependencies": {
|
|
"@gold-bank/shared-types": "workspace:*",
|
|
"@nestjs/common": "^10.4.0",
|
|
"@nestjs/core": "^10.4.0",
|
|
"@nestjs/jwt": "^12.0.1",
|
|
"@nestjs/passport": "^10.0.3",
|
|
"@nestjs/platform-express": "^10.4.0",
|
|
"@prisma/client": "^5.19.0",
|
|
"bcryptjs": "^3.0.3",
|
|
"class-transformer": "^0.5.1",
|
|
"class-validator": "^0.14.1",
|
|
"passport": "^0.7.0",
|
|
"passport-jwt": "^4.0.1",
|
|
"reflect-metadata": "^0.2.2",
|
|
"rxjs": "^7.8.1"
|
|
},
|
|
"devDependencies": {
|
|
"@nestjs/cli": "^10.4.5",
|
|
"@nestjs/testing": "^10.4.22",
|
|
"@types/bcryptjs": "^3.0.0",
|
|
"@types/express": "^4.17.21",
|
|
"@types/jest": "^30.0.0",
|
|
"@types/node": "^20.14.0",
|
|
"@types/passport-jwt": "^4.0.1",
|
|
"@types/supertest": "^7.2.1",
|
|
"esbuild": "^0.25.0",
|
|
"jest": "^30.5.2",
|
|
"prisma": "^5.19.0",
|
|
"supertest": "^7.2.2",
|
|
"ts-jest": "^29.4.12",
|
|
"ts-node": "^10.9.2",
|
|
"typescript": "^5.5.0"
|
|
}
|
|
}
|