9c4c3d6444
Reviewer's follow-up: it's not enough to record when a user accepted the Terms; we also need to record which version of the text they saw. Changes: - journal.users gains a nullable `terms_version` text column (nullable so the three pre-existing users without a version are kept as-is). - New apps/journal/app/lib/legal.ts exports TERMS_VERSION as a single source of truth, reused by the legal pages' "Last updated" header and by the registration flow as the value to send/store. - Registration form posts `termsVersion` alongside `termsAccepted` on all three relevant steps (start, finish, register-magic-link). - API route validates that `termsVersion` is a non-empty string on any step that requires terms, and forwards it to the auth server. - auth.server finishRegistration and registerWithMagicLink now take `termsVersion` and persist it on the users row. - journal-auth spec gets a new scenario for version storage and a rejection scenario for missing version. PRIVACY_LAST_UPDATED is also exported from the same module and used by the Privacy page header, keeping both pages on a single legal.ts source of truth for "last updated" labels. Privacy is not per-user stored — it's informational, not contract. Existing users have NULL terms_version; if we ever prompt them to re-accept updated Terms, we can backfill with the version they re-accept at that point. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
64 lines
2.7 KiB
TypeScript
64 lines
2.7 KiB
TypeScript
import { data } from "react-router";
|
|
import type { Route } from "./+types/api.auth.register";
|
|
import { startRegistration, finishRegistration, createSession, addPasskeyStart, addPasskeyFinish, registerWithMagicLink } from "~/lib/auth.server";
|
|
import { sendWelcome, sendMagicLink } from "~/lib/email.server";
|
|
import { logger } from "~/lib/logger.server";
|
|
|
|
export async function action({ request }: Route.ActionArgs) {
|
|
const body = await request.json();
|
|
const { step, email, username, response, challenge, userId, termsAccepted, termsVersion } = body;
|
|
const origin = process.env.ORIGIN ?? `http://localhost:3000`;
|
|
|
|
// Registration steps require terms acceptance + the version the client
|
|
// agreed to (stored for audit so we can tell which text the user saw).
|
|
const requiresTerms = step === "start" || step === "finish" || step === "register-magic-link";
|
|
if (requiresTerms && !termsAccepted) {
|
|
return data({ error: "Terms of Service must be accepted" }, { status: 400 });
|
|
}
|
|
if (requiresTerms && (typeof termsVersion !== "string" || termsVersion.length === 0)) {
|
|
return data({ error: "Terms of Service version missing" }, { status: 400 });
|
|
}
|
|
|
|
try {
|
|
if (step === "start") {
|
|
const result = await startRegistration(email, username);
|
|
return data({ step: "challenge", options: result.options, userId: result.userId });
|
|
}
|
|
|
|
if (step === "finish") {
|
|
const newUserId = await finishRegistration(userId, email, username, response, challenge, termsVersion);
|
|
const cookie = await createSession(newUserId, request);
|
|
sendWelcome(email, username).catch((err) =>
|
|
logger.error({ err }, "Failed to send welcome email"),
|
|
);
|
|
return data({ step: "done" }, { headers: { "Set-Cookie": cookie } });
|
|
}
|
|
|
|
if (step === "register-magic-link") {
|
|
const token = await registerWithMagicLink(email, username, termsVersion);
|
|
const link = `${origin}/auth/verify?token=${token}`;
|
|
if (process.env.NODE_ENV !== "production") {
|
|
return data({ step: "magic-link-sent", devLink: link });
|
|
}
|
|
await sendMagicLink(email, link);
|
|
sendWelcome(email, username).catch((err) =>
|
|
logger.error({ err }, "Failed to send welcome email"),
|
|
);
|
|
return data({ step: "magic-link-sent" });
|
|
}
|
|
|
|
if (step === "add-passkey") {
|
|
const options = await addPasskeyStart(userId);
|
|
return data({ step: "challenge", options });
|
|
}
|
|
|
|
if (step === "finish-add-passkey") {
|
|
await addPasskeyFinish(userId, response, challenge);
|
|
return data({ step: "done" });
|
|
}
|
|
|
|
return data({ error: "Invalid step" }, { status: 400 });
|
|
} catch (e) {
|
|
return data({ error: (e as Error).message }, { status: 400 });
|
|
}
|
|
}
|