@usequark/quark-create-app 1.25.9 → 1.25.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.9",
+  "version": "1.25.11",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/templates/base-project/apps/web/src/app/api/auth/google/route.js

@@ -6,6 +6,7 @@ import { validateBody } from "@usequark/quark-core/core";
 import { user } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { isEmailVerified } from "../../../../lib/email-verified";
 import { issueTokenPair } from "../../../../lib/jwt";
 import { handleError } from "../../error-handler";
 
@@ -15,26 +16,6 @@ const googleAuthSchema = z.object({
 
 const GOOGLE_TOKENINFO_URL = "https://oauth2.googleapis.com/tokeninfo";
 
-/**
- * Whether Google's `email_verified` claim says the address is confirmed.
- *
- * `tokeninfo` returns the claim as the *string* `"true"` or `"false"`, not a
- * boolean, so a plain truthiness check would do the exact opposite of the
- * obvious thing: reject every real sign-in (`"false"` is truthy) while waving
- * through the one case that matters. Only an explicit confirmation counts.
- * Anything else — a missing claim, a number, a null — is unverified, because
- * the failure modes here are asymmetric: a wrong refusal costs one unlucky
- * sign-in, and a wrong acceptance hands an unconfirmed address a session.
- *
- * @param {unknown} value
- * @returns {boolean}
- */
-function isEmailVerified(value) {
-	if (typeof value === "boolean") return value;
-	if (typeof value !== "string") return false;
-	return value.trim().toLowerCase() === "true";
-}
-
 /**
  * POST /api/auth/google
  * Verify Google ID token and issue a custom JWT.

package/templates/base-project/apps/web/src/app/api/health/route.js

@@ -18,12 +18,7 @@
  */
 
 import { createLogger } from "@usequark/quark-core/core";
-import {
-	checkQueues,
-	checkStorage,
-	runHealthChecks,
-} from "@usequark/quark-core/health";
-import { getRegisteredQueues } from "@usequark/quark-core/queue";
+import { checkStorage, runHealthChecks } from "@usequark/quark-core/health";
 import { pingRedis } from "@usequark/quark-core/redis";
 import { pingDatabase } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
@@ -35,12 +30,21 @@ export async function GET() {
 		// `pingDatabase` is passed in rather than imported by the core module:
 		// `@usequark/quark-db` depends on `@usequark/quark-core`, so core cannot
 		// import it back without a cycle.
+		//
+		// There is deliberately no `queues` probe. `getRegisteredQueues()` reads a
+		// Map that only queues created *in this process* are registered in, and
+		// the web service creates none: the worker owns every long-lived queue.
+		// So the probe reported `null` on every request here — while its
+		// `getRegisteredQueues` import pulled all of BullMQ into this route.
+		// This endpoint is polled by the platform healthcheck and by
+		// `<HealthIndicator />` on every page view, making it the worst possible
+		// place to load a queue library for a result that is always empty.
+		// Queue depth is the worker's to publish, via `job_queue_depth`.
 		const result = await runHealthChecks({
 			probes: {
 				database: pingDatabase,
 				redis: pingRedis,
 				storage: checkStorage,
-				queues: () => checkQueues(getRegisteredQueues),
 			},
 		});
 

package/templates/base-project/apps/web/src/lib/auth.js

@@ -1,11 +1,13 @@
 import { PrismaAdapter } from "@auth/prisma-adapter";
 import { createAuthConfig, verifyPassword } from "@usequark/quark-core/auth";
 import { createLogger } from "@usequark/quark-core/core";
+import { AppError } from "@usequark/quark-core/errors";
 import { Prisma, prisma, user } from "@usequark/quark-db";
 import NextAuth from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import GithubProvider from "next-auth/providers/github";
 import GoogleProvider from "next-auth/providers/google";
+import { isEmailVerified } from "./email-verified";
 
 const logger = createLogger({ name: "auth" });
 const STALE_SESSION_PATTERN = /jwtsessionerror|no matching decryption secret/i;
@@ -125,6 +127,31 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
 		GoogleProvider({
 			clientId: process.env.GOOGLE_CLIENT_ID,
 			clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+			// The web sign-in creates its account on first sight through the
+			// Prisma adapter, so an unconfirmed address here means the same thing it
+			// does on the mobile route: the confirmation that is supposed to
+			// establish ownership of the address never happened. Google does issue
+			// tokens for unconfirmed addresses.
+			//
+			// The refusal is thrown rather than returned, and that is deliberate.
+			// Auth.js has no "null means refuse" contract: `getUserAndAccount` reads
+			// `profile.email` straight off whatever the mapper hands back, so a null
+			// denial works only because it trips a TypeError that is caught and
+			// logged as `OAuthProfileParseError` — indistinguishable, in the log, from
+			// a malformed provider response or a user who cancelled. Throwing says
+			// why in the one place an operator can read it, and lands in the same
+			// catch: no session, no user row, redirect back to the sign-in page.
+			profile: (profile) => {
+				if (!isEmailVerified(profile.email_verified)) {
+					throw new AppError(
+						"Google sign-in refused: the account's email address is not verified",
+						401,
+						"OAUTH_EMAIL_NOT_VERIFIED",
+					);
+				}
+
+				return profile;
+			},
 		}),
 	);
 }

package/templates/base-project/apps/web/src/lib/email-verified.js

@@ -0,0 +1,28 @@
+/**
+ * Whether a provider's `email_verified` claim says the address is confirmed.
+ *
+ * Providers disagree on the wire format. Google's `tokeninfo` endpoint reports
+ * the claim as the *string* `"true"` or `"false"`; the OIDC userinfo that
+ * reaches a NextAuth profile mapper carries the same string. The id token's own
+ * claim is a boolean. A plain truthiness check would therefore do the exact
+ * opposite of the obvious thing: accept `"false"` while refusing every real
+ * sign-in. Both spellings mean the same thing and both are accepted; nothing
+ * else is.
+ *
+ * Everything else — a missing claim, a null, a number, `"yes"` — reads as
+ * unverified, because the failure modes are asymmetric. A wrong refusal costs
+ * one unlucky sign-in. A wrong acceptance hands an unconfirmed address a
+ * session on a route or a provider that creates the account on first sight.
+ *
+ * Shared by both Google sign-in paths — the hand-written `POST /api/auth/google`
+ * the mobile app posts to, and the NextAuth provider the web button uses — so
+ * there is one definition of "confirmed" rather than two that can drift.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isEmailVerified(value) {
+	if (typeof value === "boolean") return value;
+	if (typeof value !== "string") return false;
+	return value.trim().toLowerCase() === "true";
+}

package/templates/worker/src/index.js

@@ -12,7 +12,7 @@ import {
 	createWorker,
 	updateQueueDepths,
 } from "@usequark/quark-core/queue";
-import { getRedisEndpoint, getRedisUrl } from "@usequark/quark-core/redis";
+import { getRedisEndpoint } from "@usequark/quark-core/redis";
 import { job, prisma } from "@usequark/quark-db";
 import { JOB_NAMES, JOB_QUEUES } from "@usequark/quark-jobs";
 import { jobHandlers } from "./handlers/index.js";