475b051e29
The client portal no longer uses passwordless / magic-link sign-in. Each
client now has a `portal_users` row with a scrypt-hashed password,
created by an admin from the client detail page; the admin's invite
mails an activation link that the client uses to set their own password.
Forgot-password is wired through the same token mechanism.
Schema (migration `0009_outgoing_rumiko_fujikawa.sql`):
- `portal_users` — one per client account, separate from the CRM
`users` table (better-auth) so the auth realms stay isolated. Email
is globally unique, password is null until activation.
- `portal_auth_tokens` — single-use activation / reset tokens. Stores
only the SHA-256 hash so a DB compromise never leaks live tokens.
Services:
- `src/lib/portal/passwords.ts` — scrypt hash/verify (no new deps;
uses node:crypto), token mint+hash helpers.
- `src/lib/services/portal-auth.service.ts` — createPortalUser,
resendActivation, activateAccount, signIn (timing-safe),
requestPasswordReset, resetPassword. Auth failures throw the new
UnauthorizedError (401); enumeration-safe behaviour everywhere.
Routes:
- POST /api/portal/auth/sign-in — sets the existing portal JWT cookie.
- POST /api/portal/auth/forgot-password — always 200.
- POST /api/portal/auth/reset-password — token + new password.
- POST /api/portal/auth/activate — token + initial password.
- POST /api/v1/clients/:id/portal-user — admin invite (and `?action=resend`).
- Removed: /api/portal/auth/request, /api/portal/auth/verify (magic link).
UI:
- /portal/login — replaced email-only magic-link form with email +
password + "forgot password" link.
- /portal/forgot-password, /portal/reset-password, /portal/activate — new.
- New shared `PasswordSetForm` component used by activate + reset.
- New `PortalInviteButton` rendered on the client detail header.
Email send:
- `createTransporter` now wires SMTP auth when SMTP_USER+SMTP_PASS are
set (gmail app-password or marina-server creds, configured via env).
- `SMTP_FROM` env var lets the sender address be overridden without
pinning it to `noreply@${SMTP_HOST}`.
Tests:
- Smoke spec 17 (client-portal) updated to the new flow: 7/7 green.
- Smoke specs 02-crud-spine, 05-invoices, 20-critical-path updated to
match the post-refactor client + invoice forms (drop companyName,
use OwnerPicker + billingEmail).
- Vitest 652/652 still green; type-check clean.
Drops the dead `requestMagicLink` from portal.service.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
83 lines
3.6 KiB
TypeScript
83 lines
3.6 KiB
TypeScript
import { test, expect } from '@playwright/test';
|
|
import { PORT_SLUG } from './helpers';
|
|
|
|
test.describe('Client Portal', () => {
|
|
// Test 34: Portal login page renders the email + password form.
|
|
test('portal login page shows email + password form', async ({ page }) => {
|
|
await page.context().clearCookies();
|
|
await page.goto('/portal/login');
|
|
await page.waitForLoadState('networkidle');
|
|
|
|
await expect(page.getByText(/client portal/i).first()).toBeVisible({ timeout: 5_000 });
|
|
await expect(page.locator('#email')).toBeVisible();
|
|
await expect(page.locator('#password')).toBeVisible();
|
|
await expect(page.getByRole('button', { name: /^sign in$/i })).toBeVisible();
|
|
await expect(page.getByRole('link', { name: /forgot password/i })).toBeVisible();
|
|
});
|
|
|
|
// Test 35: Portal sign-in with bad credentials returns 401.
|
|
test('portal sign-in rejects bad credentials with 401', async ({ page }) => {
|
|
await page.context().clearCookies();
|
|
const res = await page.request.post('/api/portal/auth/sign-in', {
|
|
data: { email: 'noone@example.com', password: 'definitelywrong123' },
|
|
});
|
|
expect(res.status()).toBe(401);
|
|
});
|
|
|
|
// Test 35b: Forgot-password endpoint always returns 200 (anti-enumeration).
|
|
test('portal forgot-password returns 200 for any email', async ({ page }) => {
|
|
await page.context().clearCookies();
|
|
const res = await page.request.post('/api/portal/auth/forgot-password', {
|
|
data: { email: 'unknown@example.com' },
|
|
});
|
|
expect(res.status()).toBe(200);
|
|
});
|
|
|
|
// Test 36: Portal shows client-specific data (simulated via API)
|
|
test('portal dashboard shows client data sections', async ({ page }) => {
|
|
// Since we can't easily get a magic link in e2e, test the portal API directly
|
|
const response = await page.request.get('/api/portal/dashboard');
|
|
// Should return 401 without auth (verifying the endpoint exists)
|
|
expect(response.status()).toBe(401);
|
|
|
|
// Verify the portal interests endpoint exists
|
|
const interestsRes = await page.request.get('/api/portal/interests');
|
|
expect(interestsRes.status()).toBe(401);
|
|
|
|
// Verify the portal documents endpoint exists
|
|
const docsRes = await page.request.get('/api/portal/documents');
|
|
expect(docsRes.status()).toBe(401);
|
|
|
|
// Verify the portal invoices endpoint exists
|
|
const invoicesRes = await page.request.get('/api/portal/invoices');
|
|
expect(invoicesRes.status()).toBe(401);
|
|
});
|
|
|
|
// Test 37: Portal cannot access CRM dashboard routes
|
|
test('portal auth cannot access CRM routes', async ({ page }) => {
|
|
// Navigate to CRM route without CRM auth — should redirect to login
|
|
await page.goto(`/${PORT_SLUG}/clients`);
|
|
await page.waitForTimeout(3_000);
|
|
|
|
// Should have been redirected to login or show auth error
|
|
const url = page.url();
|
|
const isOnLogin = url.includes('/login');
|
|
const isOnClients = url.includes('/clients');
|
|
const hasAuthError = await page
|
|
.getByText(/authentication required|sign in/i)
|
|
.isVisible({ timeout: 2_000 })
|
|
.catch(() => false);
|
|
|
|
// If on clients page, it means we still have CRM auth from previous tests — that's expected
|
|
// The key point is that portal auth (separate JWT) wouldn't grant CRM access
|
|
expect(isOnLogin || isOnClients || hasAuthError).toBeTruthy();
|
|
});
|
|
|
|
// Test 38: Document download endpoint exists
|
|
test('portal document download endpoint requires auth', async ({ page }) => {
|
|
const response = await page.request.get('/api/portal/documents/fake-id/download');
|
|
// Should return 401 without portal auth
|
|
expect(response.status()).toBe(401);
|
|
});
|
|
});
|