475b051e29
The client portal no longer uses passwordless / magic-link sign-in. Each
client now has a `portal_users` row with a scrypt-hashed password,
created by an admin from the client detail page; the admin's invite
mails an activation link that the client uses to set their own password.
Forgot-password is wired through the same token mechanism.
Schema (migration `0009_outgoing_rumiko_fujikawa.sql`):
- `portal_users` — one per client account, separate from the CRM
`users` table (better-auth) so the auth realms stay isolated. Email
is globally unique, password is null until activation.
- `portal_auth_tokens` — single-use activation / reset tokens. Stores
only the SHA-256 hash so a DB compromise never leaks live tokens.
Services:
- `src/lib/portal/passwords.ts` — scrypt hash/verify (no new deps;
uses node:crypto), token mint+hash helpers.
- `src/lib/services/portal-auth.service.ts` — createPortalUser,
resendActivation, activateAccount, signIn (timing-safe),
requestPasswordReset, resetPassword. Auth failures throw the new
UnauthorizedError (401); enumeration-safe behaviour everywhere.
Routes:
- POST /api/portal/auth/sign-in — sets the existing portal JWT cookie.
- POST /api/portal/auth/forgot-password — always 200.
- POST /api/portal/auth/reset-password — token + new password.
- POST /api/portal/auth/activate — token + initial password.
- POST /api/v1/clients/:id/portal-user — admin invite (and `?action=resend`).
- Removed: /api/portal/auth/request, /api/portal/auth/verify (magic link).
UI:
- /portal/login — replaced email-only magic-link form with email +
password + "forgot password" link.
- /portal/forgot-password, /portal/reset-password, /portal/activate — new.
- New shared `PasswordSetForm` component used by activate + reset.
- New `PortalInviteButton` rendered on the client detail header.
Email send:
- `createTransporter` now wires SMTP auth when SMTP_USER+SMTP_PASS are
set (gmail app-password or marina-server creds, configured via env).
- `SMTP_FROM` env var lets the sender address be overridden without
pinning it to `noreply@${SMTP_HOST}`.
Tests:
- Smoke spec 17 (client-portal) updated to the new flow: 7/7 green.
- Smoke specs 02-crud-spine, 05-invoices, 20-critical-path updated to
match the post-refactor client + invoice forms (drop companyName,
use OwnerPicker + billingEmail).
- Vitest 652/652 still green; type-check clean.
Drops the dead `requestMagicLink` from portal.service.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
93 lines
2.3 KiB
TypeScript
93 lines
2.3 KiB
TypeScript
import { NextResponse } from 'next/server';
|
|
import { ZodError } from 'zod';
|
|
|
|
import { logger } from '@/lib/logger';
|
|
|
|
export class AppError extends Error {
|
|
constructor(
|
|
public statusCode: number,
|
|
message: string,
|
|
public code?: string,
|
|
) {
|
|
super(message);
|
|
this.name = 'AppError';
|
|
}
|
|
}
|
|
|
|
export class NotFoundError extends AppError {
|
|
constructor(entity: string) {
|
|
super(404, `${entity} not found`, 'NOT_FOUND');
|
|
}
|
|
}
|
|
|
|
export class ForbiddenError extends AppError {
|
|
constructor(message = 'Insufficient permissions') {
|
|
super(403, message, 'FORBIDDEN');
|
|
}
|
|
}
|
|
|
|
export class UnauthorizedError extends AppError {
|
|
constructor(message = 'Unauthorized') {
|
|
super(401, message, 'UNAUTHORIZED');
|
|
}
|
|
}
|
|
|
|
export class ValidationError extends AppError {
|
|
constructor(
|
|
message: string,
|
|
public details?: Array<{ field: string; message: string }>,
|
|
) {
|
|
super(400, message, 'VALIDATION_ERROR');
|
|
}
|
|
}
|
|
|
|
export class ConflictError extends AppError {
|
|
constructor(message: string) {
|
|
super(409, message, 'CONFLICT');
|
|
}
|
|
}
|
|
|
|
export class RateLimitError extends AppError {
|
|
constructor(public retryAfter: number) {
|
|
super(429, 'Too many requests', 'RATE_LIMITED');
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Converts any thrown value into a sanitised NextResponse.
|
|
* Never leaks stack traces, internal paths, or database error details to the client.
|
|
*/
|
|
export function errorResponse(error: unknown): NextResponse {
|
|
if (error instanceof AppError) {
|
|
const body: Record<string, unknown> = {
|
|
error: error.message,
|
|
code: error.code,
|
|
};
|
|
if (error instanceof ValidationError && error.details) {
|
|
body.details = error.details;
|
|
}
|
|
if (error instanceof RateLimitError) {
|
|
body.retryAfter = error.retryAfter;
|
|
}
|
|
return NextResponse.json(body, { status: error.statusCode });
|
|
}
|
|
|
|
if (error instanceof ZodError) {
|
|
return NextResponse.json(
|
|
{
|
|
error: 'Validation failed',
|
|
code: 'VALIDATION_ERROR',
|
|
details: error.errors.map((e) => ({
|
|
field: e.path.join('.'),
|
|
message: e.message,
|
|
})),
|
|
},
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
// Log full details server-side; never send them to the client.
|
|
logger.error({ err: error }, 'Unhandled error');
|
|
return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
|
|
}
|