475b051e29
The client portal no longer uses passwordless / magic-link sign-in. Each
client now has a `portal_users` row with a scrypt-hashed password,
created by an admin from the client detail page; the admin's invite
mails an activation link that the client uses to set their own password.
Forgot-password is wired through the same token mechanism.
Schema (migration `0009_outgoing_rumiko_fujikawa.sql`):
- `portal_users` — one per client account, separate from the CRM
`users` table (better-auth) so the auth realms stay isolated. Email
is globally unique, password is null until activation.
- `portal_auth_tokens` — single-use activation / reset tokens. Stores
only the SHA-256 hash so a DB compromise never leaks live tokens.
Services:
- `src/lib/portal/passwords.ts` — scrypt hash/verify (no new deps;
uses node:crypto), token mint+hash helpers.
- `src/lib/services/portal-auth.service.ts` — createPortalUser,
resendActivation, activateAccount, signIn (timing-safe),
requestPasswordReset, resetPassword. Auth failures throw the new
UnauthorizedError (401); enumeration-safe behaviour everywhere.
Routes:
- POST /api/portal/auth/sign-in — sets the existing portal JWT cookie.
- POST /api/portal/auth/forgot-password — always 200.
- POST /api/portal/auth/reset-password — token + new password.
- POST /api/portal/auth/activate — token + initial password.
- POST /api/v1/clients/:id/portal-user — admin invite (and `?action=resend`).
- Removed: /api/portal/auth/request, /api/portal/auth/verify (magic link).
UI:
- /portal/login — replaced email-only magic-link form with email +
password + "forgot password" link.
- /portal/forgot-password, /portal/reset-password, /portal/activate — new.
- New shared `PasswordSetForm` component used by activate + reset.
- New `PortalInviteButton` rendered on the client detail header.
Email send:
- `createTransporter` now wires SMTP auth when SMTP_USER+SMTP_PASS are
set (gmail app-password or marina-server creds, configured via env).
- `SMTP_FROM` env var lets the sender address be overridden without
pinning it to `noreply@${SMTP_HOST}`.
Tests:
- Smoke spec 17 (client-portal) updated to the new flow: 7/7 green.
- Smoke specs 02-crud-spine, 05-invoices, 20-critical-path updated to
match the post-refactor client + invoice forms (drop companyName,
use OwnerPicker + billingEmail).
- Vitest 652/652 still green; type-check clean.
Drops the dead `requestMagicLink` from portal.service.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
61 lines
2.0 KiB
TypeScript
61 lines
2.0 KiB
TypeScript
import { randomBytes, scrypt as scryptCb, timingSafeEqual, createHash } from 'node:crypto';
|
|
import { promisify } from 'node:util';
|
|
|
|
const scrypt = promisify(scryptCb) as (
|
|
password: string,
|
|
salt: Buffer,
|
|
keyLen: number,
|
|
) => Promise<Buffer>;
|
|
|
|
const KEY_LENGTH = 64;
|
|
const SALT_LENGTH = 16;
|
|
|
|
/**
|
|
* Hash a password with a fresh random salt. Stored format is
|
|
* `salt:keyHex` (both as hex strings) so verification can re-derive without
|
|
* a separate salt column.
|
|
*/
|
|
export async function hashPassword(password: string): Promise<string> {
|
|
const salt = randomBytes(SALT_LENGTH);
|
|
const key = await scrypt(password, salt, KEY_LENGTH);
|
|
return `${salt.toString('hex')}:${key.toString('hex')}`;
|
|
}
|
|
|
|
/**
|
|
* Constant-time check of a candidate password against a stored
|
|
* `salt:keyHex` hash. Returns false on any malformed input rather than
|
|
* throwing — callers should treat false uniformly.
|
|
*/
|
|
export async function verifyPassword(password: string, stored: string): Promise<boolean> {
|
|
const parts = stored.split(':');
|
|
if (parts.length !== 2) return false;
|
|
const [saltHex, keyHex] = parts;
|
|
if (!saltHex || !keyHex) return false;
|
|
let salt: Buffer;
|
|
let expected: Buffer;
|
|
try {
|
|
salt = Buffer.from(saltHex, 'hex');
|
|
expected = Buffer.from(keyHex, 'hex');
|
|
} catch {
|
|
return false;
|
|
}
|
|
if (expected.length !== KEY_LENGTH) return false;
|
|
const candidate = await scrypt(password, salt, KEY_LENGTH);
|
|
return timingSafeEqual(candidate, expected);
|
|
}
|
|
|
|
/**
|
|
* Mint a fresh raw token (returned to the caller) and its SHA-256 hash
|
|
* (stored in the DB). The raw token is meant to be embedded in a one-shot
|
|
* URL; only the hash persists.
|
|
*/
|
|
export function mintToken(byteLength = 32): { raw: string; hash: string } {
|
|
const raw = randomBytes(byteLength).toString('base64url');
|
|
const hash = createHash('sha256').update(raw).digest('hex');
|
|
return { raw, hash };
|
|
}
|
|
|
|
export function hashToken(raw: string): string {
|
|
return createHash('sha256').update(raw).digest('hex');
|
|
}
|