trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/apps/journal/app/lib
History
Ullrich Schäfer d64c47614d
Implement completeAuth chokepoint + caller migration 
Implements all of unify-auth-completion (12/14 tasks done; manual
smoke + archive-time spec sync remain).

Design refinement during implementation: completeAuth supports two
response shapes via a `mode` parameter:
- mode: 'redirect' (loaders / direct browser navigation; auth.verify.tsx)
- mode: 'json' (action handlers called by imperative fetch from
  client forms; api.auth.login, api.auth.register)

Both modes share createSession + safeReturnTo + Set-Cookie. JSON mode
carries `{ ok: true, step: "done", redirectTo }` (the `step` field
preserves the existing client-form check).

Why two modes: passkey ceremonies are inherently imperative
(start → browser WebAuthn API → finish), so action handlers can't
move to <Form>/useFetcher. Picking option (B) from the design grill —
the chokepoint owns destination selection while clients navigate —
required this dual shape. The 3 hardcoded client-side targets
(returnTo ?? "/", "/", "/?add-passkey=1") collapse into 1 server-side
sanitization pass (safeReturnTo) inside completeAuth.

New module:
- apps/journal/app/lib/auth/session.ts: cookie session storage
  (sessionStorage, createSession, getSessionUser, destroySession)
  moved from auth.server.ts. Legacy import path kept via re-exports
  with @deprecated JSDoc.
- apps/journal/app/lib/auth/completion.ts: completeAuth + safeReturnTo.
- apps/journal/app/lib/auth/completion.test.ts: 10 contract tests
  covering both modes, returnTo sanitization (path-relative, protocol-
  relative, absolute-URL, malformed), Set-Cookie attachment, redirect
  status, JSON shape.

Caller migration:
- api.auth.register.ts passkey-finish → completeAuth(json)
- api.auth.login.ts finish-passkey → completeAuth(json)
- api.auth.login.ts verify-code → completeAuth(json)
- auth.verify.tsx magic-link consumer → completeAuth(redirect)

Client form updates:
- auth.login.tsx: pass returnTo in fetch body, read result.redirectTo
  on done.
- auth.register.tsx: pass returnTo: "/?add-passkey=1" for the magic-
  link verify-code path (preserves the post-register passkey prompt
  via the chokepoint's safeReturnTo, instead of hardcoding it
  client-side).

Verified:
- pnpm typecheck && pnpm lint: green across all 15 workspaces.
- pnpm --filter @trails-cool/journal test: 126 passed.
- pnpm test:e2e auth: 4/4 passed without modification — confirms the
  refactor is behaviour-preserving for the user-facing flows that
  matter most (passkey register + login).

Spec delta in openspec/changes/unify-auth-completion/specs/ applies at
/opsx:archive time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-08 02:38:15 +02:00
..
auth Implement completeAuth chokepoint + caller migration 2026-05-08 02:38:15 +02:00
connected-services Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
notifications Merge /follows/requests into /notifications as a tabbed inbox 2026-04-26 08:24:59 +02:00
sync Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
activities.server.ts Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
actor-iri.ts Implement social-feed: local follows + /feed + profile visibility 2026-04-25 22:51:18 +02:00
api-guard.server.test.ts fix: enforce Terms gate on bearer-token API requests 2026-05-08 01:59:28 +02:00
api-guard.server.ts fix: enforce Terms gate on bearer-token API requests 2026-05-08 01:59:28 +02:00
auth.server.ts Implement completeAuth chokepoint + caller migration 2026-05-08 02:38:15 +02:00
boss.server.ts Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
canView.test.ts Apply public-content-visibility: visibility flag + public profile 2026-04-19 09:11:39 +02:00
db.ts Implement Journal auth: passkeys + magic links, no passwords 2026-03-23 17:38:46 +01:00
demo-bot.integration.test.ts Apply configurable-demo-persona: per-instance demo identity + voice 2026-04-19 10:30:32 +02:00
demo-bot.server.ts Expand Bruno's content pools for more variety 2026-04-26 21:53:50 +02:00
demo-bot.test.ts Apply configurable-demo-persona: per-instance demo identity + voice 2026-04-19 10:30:32 +02:00
email.server.test.ts Add observability: health endpoints, structured logging, metrics, Grafana stack 2026-03-26 22:59:44 +01:00
email.server.ts Add 6-digit login code for mobile authentication 2026-04-15 20:56:42 +02:00
events.server.ts Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
explore.integration.test.ts Include the demo persona on /explore so users can follow it 2026-04-26 11:43:24 +02:00
explore.server.ts Include the demo persona on /explore so users can follow it 2026-04-26 11:43:24 +02:00
follow.integration.test.ts Locked-account profiles: private = stub + Pending follow flow 2026-04-25 23:38:26 +02:00
follow.server.ts Merge /follows/requests into /notifications as a tabbed inbox 2026-04-26 08:24:59 +02:00
jwt.server.ts Implement Planner-Journal handoff (Group 9) 2026-03-24 20:22:58 +00:00
legal.ts Apply public-content-visibility: visibility flag + public profile 2026-04-19 09:11:39 +02:00
logger.server.ts Add observability: health endpoints, structured logging, metrics, Grafana stack 2026-03-26 22:59:44 +01:00
metrics.server.ts Fix prom-client double-registration on prod 2026-04-19 10:44:57 +02:00
notifications.integration.test.ts Cursor-based pagination for /notifications 2026-04-26 01:42:32 +02:00
notifications.server.ts Cursor-based pagination for /notifications 2026-04-26 01:42:32 +02:00
oauth.server.test.ts Implement OAuth2 PKCE auth, discovery, and mobile API client 2026-04-13 00:41:40 +02:00
oauth.server.ts Implement Journal REST API v1 endpoints 2026-04-13 00:57:27 +02:00
operator.ts Add legal pages, ToS acceptance, and alpha banner 2026-04-18 00:08:48 +02:00
routes.server.ts Apply public-content-visibility: visibility flag + public profile 2026-04-19 09:11:39 +02:00
sentry.client.ts Stop Sentry on logout; fix E2E + Dockerfile for merged consolidation 2026-04-18 00:40:36 +02:00