b4c64a40e7
After Phase A (#442) moved the journal callback token off the browser, the token was still replayable on the wire until \`exp\` (7 days). This PR makes each token strictly single-use. Changes: - **\`journal.consumed_jwt_jti\` table** — \`jti TEXT PRIMARY KEY, consumed_at TIMESTAMPTZ, expires_at TIMESTAMPTZ\`. Picked up by drizzle-kit push on deploy. - **\`createRouteToken\` now sets a \`jti\` claim** (\`randomUUID()\`). - **\`verifyRouteToken\` atomically consumes the jti** via \`INSERT … ON CONFLICT DO NOTHING RETURNING jti\`. Postgres serializes the insert, so exactly one concurrent caller wins; the rest see an empty result and throw \`TokenAlreadyConsumedError\`. Tokens without a \`jti\` claim (i.e. minted before this PR) are also rejected — the right call: any in-flight legacy token sitting in a planner session is replayable, and we'd rather fail-loud than silently grandfather them in. - **\`consumed-jti-sweep\` job** — daily 03:45 UTC cron that \`DELETE WHERE expires_at < now()\`. Keeps the table tiny; offset from the other purge jobs to spread load. - **e2e replay test** — \`integration.test.ts\` now exercises a same-token double-submit and asserts the second returns 401 with \`/consumed|already/i\`. UX implication worth flagging: a user who clicks \"Save\" twice (or whose network retries a failed POST) sees an error on the second attempt. They go back to the journal for a fresh \"Edit in Planner\" link. Full repo: pnpm typecheck / lint / test all green (177 + 31 integration). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| api | ||
| db | ||
| fit | ||
| gpx | ||
| i18n | ||
| jobs | ||
| map | ||
| map-core | ||
| sentry-config | ||
| types | ||
| ui | ||