Ullrich Schäfer f22bec5a13 fix(journal/auth): atomic magic-token consume to close TOCTOU ... verifyLoginCode, verifyMagicToken, and verifyEmailChange previously did SELECT WHERE used_at IS NULL → UPDATE … SET used_at = now. Two concurrent verifications could both pass the SELECT and both succeed, accepting the same single-use token twice. Collapsed each to a single UPDATE … WHERE … RETURNING * statement. Postgres serializes row-level locks within an UPDATE, so exactly one concurrent caller observes a returned row; the rest see an empty array and get \"Invalid or expired\". The token is also marked used as part of the same statement — no second write needed. verifyEmailChange's tertiary email-availability check now runs *after* the consume; we keep the original semantics where the token is burned on a clash (the previous code explicitly did the same with a separate UPDATE). No behavior change on the happy path. Closes a credential-reuse window that mattered most for the 6-digit login codes (small search space, more likely to race). Full repo: pnpm typecheck, pnpm lint, pnpm test all green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-24 12:17:42 +02:00
..
auth	fix(journal): fail loud in production when secrets are unset	2026-05-24 11:37:20 +02:00
connected-services	fix(journal/wahoo): paginate importOne instead of giving up after page 1	2026-05-24 12:11:33 +02:00
notifications	Merge /follows/requests into /notifications as a tabbed inbox	2026-04-26 08:24:59 +02:00
sync	Deepen three architectural seams: FIT consolidation, host election extraction, injectable db	2026-05-10 15:52:31 +02:00
activities.server.ts	fix(journal): remove ineffective dynamic imports	2026-05-24 12:05:08 +02:00
actor-iri.ts	fix(journal): architectural audit omnibus	2026-05-24 10:28:33 +02:00
api-guard.server.test.ts	fix: enforce Terms gate on bearer-token API requests	2026-05-08 01:59:28 +02:00
api-guard.server.ts	fix: enforce Terms gate on bearer-token API requests	2026-05-08 01:59:28 +02:00
auth.server.ts	fix(journal/auth): atomic magic-token consume to close TOCTOU	2026-05-24 12:17:42 +02:00
boss.server.ts	fix(journal): remove ineffective dynamic imports	2026-05-24 12:05:08 +02:00
canView.test.ts	Apply public-content-visibility: visibility flag + public profile	2026-04-19 09:11:39 +02:00
config.server.test.ts	fix(journal): fail loud in production when secrets are unset	2026-05-24 11:37:20 +02:00
config.server.ts	fix: add E2E opt-out for fail-loud secret/DB-URL guards	2026-05-24 11:45:09 +02:00
crypto.server.test.ts	Add Komoot import with public (bio verification) and authenticated modes	2026-05-23 10:18:46 +02:00
crypto.server.ts	Add Komoot import with public (bio verification) and authenticated modes	2026-05-23 10:18:46 +02:00
db.ts	Deepen three architectural seams: FIT consolidation, host election extraction, injectable db	2026-05-10 15:52:31 +02:00
demo-bot.integration.test.ts	Apply configurable-demo-persona: per-instance demo identity + voice	2026-04-19 10:30:32 +02:00
demo-bot.server.ts	Atomic GPX save: validate + persist row + geometry in one transaction	2026-05-10 15:02:56 +02:00
demo-bot.test.ts	Apply configurable-demo-persona: per-instance demo identity + voice	2026-04-19 10:30:32 +02:00
email.server.test.ts	Add observability: health endpoints, structured logging, metrics, Grafana stack	2026-03-26 22:59:44 +01:00
email.server.ts	Add 6-digit login code for mobile authentication	2026-04-15 20:56:42 +02:00
events.server.ts	Implement notifications + supporting fixes	2026-04-26 01:28:55 +02:00
explore.integration.test.ts	Include the demo persona on /explore so users can follow it	2026-04-26 11:43:24 +02:00
explore.server.ts	Include the demo persona on /explore so users can follow it	2026-04-26 11:43:24 +02:00
follow.integration.test.ts	Locked-account profiles: private = stub + Pending follow flow	2026-04-25 23:38:26 +02:00
follow.server.ts	Merge /follows/requests into /notifications as a tabbed inbox	2026-04-26 08:24:59 +02:00
gpx-save.server.test.ts	Atomic GPX save: validate + persist row + geometry in one transaction	2026-05-10 15:02:56 +02:00
gpx-save.server.ts	Atomic GPX save: validate + persist row + geometry in one transaction	2026-05-10 15:02:56 +02:00
http.server.test.ts	fix(journal): architectural audit omnibus	2026-05-24 10:28:33 +02:00
http.server.ts	fix(journal): architectural audit omnibus	2026-05-24 10:28:33 +02:00
jwt.server.ts	fix(journal): fail loud in production when secrets are unset	2026-05-24 11:37:20 +02:00
komoot-bulk-import.server.ts	Add background bulk import for Komoot	2026-05-23 18:19:10 +02:00
komoot.server.test.ts	Add Komoot import with public (bio verification) and authenticated modes	2026-05-23 10:18:46 +02:00
komoot.server.ts	fix(journal): architectural audit omnibus	2026-05-24 10:28:33 +02:00
legal.ts	Apply public-content-visibility: visibility flag + public profile	2026-04-19 09:11:39 +02:00
logger.server.ts	Add observability: health endpoints, structured logging, metrics, Grafana stack	2026-03-26 22:59:44 +01:00
metrics.server.ts	Fix prom-client double-registration on prod	2026-04-19 10:44:57 +02:00
notifications.integration.test.ts	Cursor-based pagination for /notifications	2026-04-26 01:42:32 +02:00
notifications.server.ts	Cursor-based pagination for /notifications	2026-04-26 01:42:32 +02:00
oauth.server.test.ts	Implement OAuth2 PKCE auth, discovery, and mobile API client	2026-04-13 00:41:40 +02:00
oauth.server.ts	Drop auth.server.ts re-exports + rename to .server.ts convention (task 5.2)	2026-05-08 03:01:30 +02:00
operator.ts	Add legal pages, ToS acceptance, and alpha banner	2026-04-18 00:08:48 +02:00
rate-limit.server.test.ts	fix(journal): rate-limit auth endpoints	2026-05-24 11:51:43 +02:00
rate-limit.server.ts	fix: bypass rate limiter when E2E=true	2026-05-24 11:57:01 +02:00
routes.server.ts	fix(journal): architectural audit omnibus	2026-05-24 10:28:33 +02:00
sentry.client.ts	Stop Sentry on logout; fix E2E + Dockerfile for merged consolidation	2026-04-18 00:40:36 +02:00