create-ailk 0.17.0 → 0.19.0

package/templates/apps/web/app/api/auth/hub/continue/[ref]/__tests__/route.test.ts

@@ -0,0 +1,188 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * Tests for the hub's continue step (#8146, spec
+ * docs/specs/8146-email-link-sign-in-from-spec.md D4; AC-1(c), AC-3(b)).
+ *
+ * `auth.ts` (the Better Auth singleton: `resolveSecret`, the session read) and
+ * `@working-theory/api-client`'s `hubSignIn` are the external boundaries; both
+ * are mocked, exactly as the authorize suite does. The route's own decisions
+ * are under test: where a ref sends the visitor, and what it never does.
+ */
+
+// --- Mocks set up BEFORE imports ---
+
+const mockGetSession = jest.fn();
+const mockSecret = "k".repeat(43);
+// eslint-disable-next-line no-restricted-syntax -- auth.ts is the Better Auth singleton (its adapter needs a live database); this stand-in for the secret and the session read is the repo-standard double for that boundary (see the authorize suite beside this one).
+jest.mock("../../../../../../../auth", () => ({
+  __esModule: true,
+  auth: {
+    api: { getSession: (...args: unknown[]) => mockGetSession(...args) },
+  },
+  resolveSecret: () => mockSecret,
+}));
+
+const mockCreateCode = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  hubSignIn: { createCode: (...args: unknown[]) => mockCreateCode(...args) },
+}));
+
+import { seal } from "../../../../../../../lib/hub-session/seal";
+import { GET as authorize } from "../../../authorize/route";
+import { mintContinuation } from "../../../continuation";
+import { GET } from "../route";
+
+const HUB = "https://hub.example.com";
+const SPOKE_CALLBACK = "https://spoke.example.com/api/hub-session/callback";
+const STATE = "s".repeat(43);
+const CODE = "k".repeat(43);
+
+const ORIGINAL_ENV = process.env;
+
+const QUERY = new URLSearchParams({
+  response_type: "code",
+  client_id: "spoke_abc",
+  redirect_uri: SPOKE_CALLBACK,
+  state: STATE,
+  code_challenge: "c".repeat(43),
+  code_challenge_method: "S256",
+}).toString();
+
+function continueTo(ref: string): Promise<Response> {
+  return GET(new Request(`${HUB}/api/auth/hub/continue/${ref}`), {
+    params: Promise.resolve({ ref }),
+  });
+}
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  process.env = { ...ORIGINAL_ENV, BETTER_AUTH_URL: HUB };
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+describe("AC-1(c) — a valid ref returns the visitor to the authorize step", () => {
+  it("answers 303 to /api/auth/hub/authorize with the same six-key query", async () => {
+    const res = await continueTo(mintContinuation(QUERY, mockSecret));
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe(
+      `/api/auth/hub/authorize?${QUERY}`,
+    );
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+  });
+
+  it("chained into the authorize step with a session: 303 to the registered spoke URI with the code and the original state", async () => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    const step = await continueTo(mintContinuation(QUERY, mockSecret));
+    const res = await authorize(
+      new Request(`${HUB}${step.headers.get("location")}`, {
+        headers: { cookie: "better-auth.session_token=tok" },
+      }),
+    );
+
+    expect(res.status).toBe(303);
+    const target = new URL(res.headers.get("location") ?? "");
+    expect(`${target.origin}${target.pathname}`).toBe(SPOKE_CALLBACK);
+    expect(target.searchParams.get("code")).toBe(CODE);
+    expect(target.searchParams.get("state")).toBe(STATE);
+  });
+
+  it("reads no session itself: the authorize step decides every code", async () => {
+    await continueTo(mintContinuation(QUERY, mockSecret));
+    expect(mockGetSession).not.toHaveBeenCalled();
+    expect(mockCreateCode).not.toHaveBeenCalled();
+  });
+});
+
+describe("AC-3(b) — any other ref answers 303 /account", () => {
+  const good = mintContinuation(QUERY, mockSecret);
+  const T = Date.now();
+
+  it.each([
+    [
+      "the first character flipped",
+      (good[0] === "A" ? "B" : "A") + good.slice(1),
+    ],
+    [
+      "sealed under another secret",
+      mintContinuation(QUERY, "x".repeat(43)),
+    ],
+    [
+      'a valid payload sealed with purpose "flow" and the SAME name',
+      seal(
+        { v: 1, q: QUERY, exp: T + 600_000 },
+        mockSecret,
+        "flow",
+        "hub-continue",
+      ),
+    ],
+    ["exp in the past", mintContinuation(QUERY, mockSecret, T - 601_000)],
+    ["4097 characters", "A".repeat(4097)],
+    ["a character outside base64url", `${good}%2Fevil`],
+    [
+      "plain base64url JSON, unsealed",
+      Buffer.from(
+        JSON.stringify({ v: 1, q: QUERY, exp: T + 600_000 }),
+      ).toString("base64url"),
+    ],
+    ["an empty-looking ref", "-"],
+  ])("%s", async (_name, ref) => {
+    const res = await continueTo(ref);
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe("/account");
+    expect(res.headers.get("cache-control")).toBe("no-store");
+  });
+
+  it("a ref sealed under the test secret whose q holds CR/LF answers 303 without throwing, with no CR or LF in Location", async () => {
+    const ref = seal(
+      { v: 1, q: "a=1\r\nX-Injected: 1", exp: T + 600_000 },
+      mockSecret,
+      "continue",
+      "hub-continue",
+    );
+
+    const res = await continueTo(ref);
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).not.toMatch(/[\r\n]/);
+    expect(res.headers.get("x-injected")).toBeNull();
+  });
+
+  it("every Location is /account or starts with /api/auth/hub/authorize? — never `//` or a scheme", async () => {
+    const refs = [
+      good,
+      "garbage",
+      mintContinuation("redirect_uri=https://evil.example/x", mockSecret),
+      mintContinuation("//evil.example/x", mockSecret),
+      seal(
+        { v: 1, q: "https://evil.example/x", exp: T + 600_000 },
+        mockSecret,
+        "continue",
+        "hub-continue",
+      ),
+    ];
+    for (const ref of refs) {
+      const location = (await continueTo(ref)).headers.get("location") ?? "";
+      expect(
+        location === "/account" ||
+          location.startsWith("/api/auth/hub/authorize?"),
+      ).toBe(true);
+      expect(location.startsWith("//")).toBe(false);
+      expect(location).not.toMatch(/^[a-z][a-z0-9+.-]*:/i);
+    }
+  });
+});

package/templates/apps/web/app/api/auth/hub/continue/[ref]/route.ts

@@ -0,0 +1,53 @@
+/**
+ * The hub's sign-in continuation (#8146, spec
+ * docs/specs/8146-email-link-sign-in-from-spec.md D4).
+ *
+ *   GET /api/auth/hub/continue/<ref>
+ *
+ * The authorize step, for a signed-out visitor, seals the validated authorize
+ * query into `<ref>` and sends the visitor to sign in with THIS path as the
+ * destination (Better Auth decodes a callback twice, so the path must hold
+ * nothing a decode can change). After sign-in — by the emailed link or by
+ * Google — the visitor lands here, and this route sends them back to the
+ * authorize step with the original query.
+ *
+ *   - a valid, unexpired ref: 303 to `/api/auth/hub/authorize?<the query>`;
+ *   - any other ref (forged, expired, replayed past its life, unreadable): 303
+ *     to the hub's own `/account`. By then the spoke's flow cookie (600 s) has
+ *     expired too, so returning to the spoke could not finish.
+ *
+ * Both targets are fixed relative paths: this route redirects nowhere else,
+ * and never to a URL carried in the ref. It reads no session — the authorize
+ * step does that and mints the code, so every decision about a code stays in
+ * one place. It logs nothing.
+ */
+import { resolveSecret } from "../../../../../../auth";
+import { openContinuation } from "../../continuation";
+
+/** Where an unreadable ref goes: the destination the hub's own sign-in uses. */
+const FALLBACK_PATH = "/account";
+
+const AUTHORIZE_PATH = "/api/auth/hub/authorize";
+
+/** A 303 to a fixed same-origin path. */
+function see(location: string): Response {
+  return new Response(null, {
+    status: 303,
+    headers: {
+      Location: location,
+      "Cache-Control": "no-store",
+      // The authorize query rides this URL; no page may leak it through a Referer.
+      "Referrer-Policy": "no-referrer",
+    },
+  });
+}
+
+// platform-decisions-waiver: api-versioning — sign-in redirect step, not a versioned API contract (spec 8146 §7)
+export async function GET(
+  _request: Request,
+  { params }: { params: Promise<{ ref: string }> },
+): Promise<Response> {
+  const { ref } = await params;
+  const query = openContinuation(ref, resolveSecret());
+  return see(query === null ? FALLBACK_PATH : `${AUTHORIZE_PATH}?${query}`);
+}

package/templates/apps/web/app/robots.txt/route.ts

@@ -6,6 +6,9 @@
  *   - Sitemap location declared
  *   - Optional path disallow via AILK_ROBOTS_DISALLOW env var
  *     (comma-separated paths, e.g. "/admin/,/private/")
+ *   - STEALTH=true disallows every path for every crawler — layer 1 of the
+ *     three-layer stealth posture (#884, #7374); it subsumes any
+ *     AILK_ROBOTS_DISALLOW paths
  */
 
 import { resolveBaseUrl } from "../../src/lib/routes";
@@ -14,10 +17,13 @@ export function GET(): Response {
   const baseUrl = resolveBaseUrl();
   const disallowEnv = process.env["AILK_ROBOTS_DISALLOW"] ?? "";
 
-  const disallowPaths = disallowEnv
-    .split(",")
-    .map((p) => p.trim())
-    .filter((p) => p.length > 0);
+  const disallowPaths =
+    process.env["STEALTH"] === "true"
+      ? ["/"]
+      : disallowEnv
+          .split(",")
+          .map((p) => p.trim())
+          .filter((p) => p.length > 0);
 
   const lines = [
     "User-agent: *",

package/templates/apps/web/auth.ts

@@ -194,8 +194,12 @@ function buildSocialProviders(): SocialProviders {
  * "up" — and `apps/web/.env.example` has always documented the variable as
  * REQUIRED in production. The change makes the file honest rather than adding
  * a requirement.
+ *
+ * Exported (#8146 D5) so the hub's sign-in continuation seals its ref under the
+ * same resolved secret instead of re-reading the variable: the second consumer
+ * after `betterAuth({ secret })`.
  */
-function resolveSecret(): string {
+export function resolveSecret(): string {
   const configured = process.env.BETTER_AUTH_SECRET;
   if (configured) return configured;