Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.
Customer JWT, separate from the admin one (T1):
- new src/modules/customer-auth/ with its own passport strategy,
CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
- signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
which the strategy verifies; both checks are present deliberately
- customer state re-read per request, so deactivating takes effect at once
- mirrors the reference's own split: auth:api vs auth('api-customer')
Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
- new CustomerOtp table, additive migration, nothing existing touched
- parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
normalisation on both number and code, rejection on mismatch
- approved improvements over the reference: bcrypt-hashed code, 2-minute
expiry, 5 attempts then lockout, single use, send throttle (60s per
number, 5/number and 20/IP per 10 min), and no number enumeration
Routes removed, replaced by token-derived equivalents:
GET customers, customers/:id, /:id/orders, /:id/ledger-entries
-> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).
Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.
Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.
[ref: henza_server ApiMobileController.php:39-78]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
103 lines
4.9 KiB
TypeScript
103 lines
4.9 KiB
TypeScript
import { createRouter, createWebHistory } from 'vue-router';
|
|
import { useSessionStore } from '../stores/session';
|
|
import { useNavStore } from '../stores/navStore';
|
|
import { useTransitionStore } from '../stores/transitionStore';
|
|
|
|
// Legacy lazy-loaded every route component (`component: () => import(...)`) so
|
|
// the initial bundle only carries the entry route. Matched here.
|
|
export const router = createRouter({
|
|
history: createWebHistory(),
|
|
// Ported from legacy router/index.ts:225-237 — restore saved scroll on
|
|
// back/forward, otherwise jump to top on every navigation.
|
|
scrollBehavior(_to, _from, savedPosition) {
|
|
if (savedPosition) return savedPosition;
|
|
return { top: 0 };
|
|
},
|
|
routes: [
|
|
// legacy's actual home route is /home (name: 'home'), not '/' — matched here.
|
|
{ path: '/home', name: 'home', component: () => import('../views/HomeView.vue') },
|
|
{
|
|
path: '/product/:id',
|
|
name: 'singleProduct',
|
|
component: () => import('../components/product/SingleProduct.vue'),
|
|
props: true,
|
|
meta: { layout: 'FullPage' },
|
|
},
|
|
{ path: '/newest', name: 'newestProduct', component: () => import('../views/NewestView.vue'), meta: { layout: 'FullPage' } },
|
|
{ path: '/cart', name: 'cart', component: () => import('../views/CartView.vue') },
|
|
{ path: '/login', name: 'login', component: () => import('../views/user/LoginRegisterView.vue'), meta: { layout: 'FullPage' } },
|
|
{ path: '/user', name: 'userPage::hasSubRoute', component: () => import('../views/user/DashboardView.vue') },
|
|
{ path: '/orders', name: 'ordersList', component: () => import('../views/user/OrdersView.vue'), meta: { requiresAuth: true } },
|
|
{
|
|
path: '/transactions',
|
|
name: 'transactionsList',
|
|
component: () => import('../views/user/TransactionsView.vue'),
|
|
meta: { requiresAuth: true },
|
|
},
|
|
{ path: '/profile', name: 'profileData', component: () => import('../views/user/ProfileView.vue'), meta: { requiresAuth: true } },
|
|
{ path: '/favorites', name: 'favoritesList', component: () => import('../views/user/FavoritesView.vue'), meta: { requiresAuth: true } },
|
|
{ path: '/notifications', name: 'notifications', component: () => import('../views/user/NotificationsView.vue') },
|
|
{ path: '/search', name: 'search', component: () => import('../views/search/SearchView.vue') },
|
|
{ path: '/collection/:id?', name: 'collection', component: () => import('../views/search/CollectionView.vue') },
|
|
// legacy redirects any unmatched path (including '/') to the home route by name.
|
|
{ path: '/', redirect: { name: 'home' } },
|
|
{ path: '/:pathMatch(.*)*', redirect: { name: 'home' } },
|
|
],
|
|
});
|
|
|
|
// Ported from legacy's main router guard: redirects an already-logged-in
|
|
// user away from /login, and blocks unauthenticated access to routes that
|
|
// require a session (legacy blocked ordersList/transactionsList/profileData/
|
|
// favoritesList/completeProfile the same way).
|
|
router.beforeEach((to) => {
|
|
const session = useSessionStore();
|
|
const nav = useNavStore();
|
|
|
|
if (to.name === 'login' && session.isLoggedIn) {
|
|
return { name: 'home' };
|
|
}
|
|
if (to.meta.requiresAuth && !session.isLoggedIn) {
|
|
return { name: 'login', query: { redirect: to.fullPath } };
|
|
}
|
|
|
|
// legacy router/index.ts:268-270 — the product page slides down into view.
|
|
if (to.name === 'singleProduct') nav.setPgaTransition('slideDown');
|
|
else nav.setPgaTransition(undefined);
|
|
});
|
|
|
|
// Ported from legacy router/index.ts:273-286.
|
|
//
|
|
// setActiveLink moves the bottom-nav GSAP notch + bubble to the current tab,
|
|
// and this hook is its ONLY caller in the whole app — that part is live.
|
|
//
|
|
// The transitionFlag cycling below used to replay AppHeader's "shutter" enter
|
|
// animation. AppHeader was deleted when every screen moved to the redesigned
|
|
// components/ui/PageBar.vue, and nothing reads transitionFlag any more, so
|
|
// that half is currently inert. It is left in place rather than ripped out
|
|
// because transitionStore is still the shared home for this kind of
|
|
// page-transition state; flagged here so the next reader doesn't assume it
|
|
// still drives a visible animation.
|
|
router.afterEach((to) => {
|
|
const nav = useNavStore();
|
|
const transition = useTransitionStore();
|
|
|
|
transition.setTransitionFlag(false);
|
|
transition.setTransitionEnded(false);
|
|
setTimeout(() => {
|
|
transition.setTransitionFlag(true);
|
|
}, 100);
|
|
|
|
// Unconditional on both branches: this hook is the single source of truth for
|
|
// tab-bar visibility. A screen may hide the bar for its own reasons while it
|
|
// is open (SearchView does, for its filter sheet), and this is what clears
|
|
// that override on the way out — the old `if (!nav.showNav)` guard made the
|
|
// same write, just phrased as if something else might own the flag.
|
|
const route = nav.navBarRoutes.find((x) => to.name === x.name);
|
|
if (route) {
|
|
nav.setActiveLink(route.index);
|
|
nav.setNavVisibility(true);
|
|
} else {
|
|
nav.setNavVisibility(false);
|
|
}
|
|
});
|