trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/apps/journal/app/routes
History
Ullrich Schäfer d64c47614d
Implement completeAuth chokepoint + caller migration 
Implements all of unify-auth-completion (12/14 tasks done; manual
smoke + archive-time spec sync remain).

Design refinement during implementation: completeAuth supports two
response shapes via a `mode` parameter:
- mode: 'redirect' (loaders / direct browser navigation; auth.verify.tsx)
- mode: 'json' (action handlers called by imperative fetch from
  client forms; api.auth.login, api.auth.register)

Both modes share createSession + safeReturnTo + Set-Cookie. JSON mode
carries `{ ok: true, step: "done", redirectTo }` (the `step` field
preserves the existing client-form check).

Why two modes: passkey ceremonies are inherently imperative
(start → browser WebAuthn API → finish), so action handlers can't
move to <Form>/useFetcher. Picking option (B) from the design grill —
the chokepoint owns destination selection while clients navigate —
required this dual shape. The 3 hardcoded client-side targets
(returnTo ?? "/", "/", "/?add-passkey=1") collapse into 1 server-side
sanitization pass (safeReturnTo) inside completeAuth.

New module:
- apps/journal/app/lib/auth/session.ts: cookie session storage
  (sessionStorage, createSession, getSessionUser, destroySession)
  moved from auth.server.ts. Legacy import path kept via re-exports
  with @deprecated JSDoc.
- apps/journal/app/lib/auth/completion.ts: completeAuth + safeReturnTo.
- apps/journal/app/lib/auth/completion.test.ts: 10 contract tests
  covering both modes, returnTo sanitization (path-relative, protocol-
  relative, absolute-URL, malformed), Set-Cookie attachment, redirect
  status, JSON shape.

Caller migration:
- api.auth.register.ts passkey-finish → completeAuth(json)
- api.auth.login.ts finish-passkey → completeAuth(json)
- api.auth.login.ts verify-code → completeAuth(json)
- auth.verify.tsx magic-link consumer → completeAuth(redirect)

Client form updates:
- auth.login.tsx: pass returnTo in fetch body, read result.redirectTo
  on done.
- auth.register.tsx: pass returnTo: "/?add-passkey=1" for the magic-
  link verify-code path (preserves the post-register passkey prompt
  via the chokepoint's safeReturnTo, instead of hardcoding it
  client-side).

Verified:
- pnpm typecheck && pnpm lint: green across all 15 workspaces.
- pnpm --filter @trails-cool/journal test: 126 passed.
- pnpm test:e2e auth: 4/4 passed without modification — confirms the
  refactor is behaviour-preserving for the user-facing flows that
  matter most (passkey register + login).

Spec delta in openspec/changes/unify-auth-completion/specs/ applies at
/opsx:archive time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-08 02:38:15 +02:00
..
activities.$id.tsx Apply public-content-visibility: visibility flag + public profile 2026-04-19 09:11:39 +02:00
activities._index.tsx Add ClientMap wrapper to avoid lazy() SSR resolution 2026-04-06 22:52:57 +02:00
activities.new.tsx Implement Journal activity feed (Group 10) 2026-03-24 23:20:04 +01:00
api.auth.login.ts Implement completeAuth chokepoint + caller migration 2026-05-08 02:38:15 +02:00
api.auth.register.ts Implement completeAuth chokepoint + caller migration 2026-05-08 02:38:15 +02:00
api.events.ts Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
api.follows.$id.approve.ts Locked-account profiles: private = stub + Pending follow flow 2026-04-25 23:38:26 +02:00
api.follows.$id.reject.ts Locked-account profiles: private = stub + Pending follow flow 2026-04-25 23:38:26 +02:00
api.metrics.ts Add observability: health endpoints, structured logging, metrics, Grafana stack 2026-03-26 22:59:44 +01:00
api.notifications.$id.read.ts Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
api.notifications.read-all.ts Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
api.routes.$id.callback.ts Fix CORS on Planner→Journal callback endpoint 2026-03-25 01:16:32 +00:00
api.routes.$id.edit-in-planner.ts Sync notes through GPX, Journal, and Planner roundtrip 2026-04-11 03:35:40 +02:00
api.routes.$id.gpx.ts Add route detail day segment highlighting and per-day GPX export 2026-04-11 00:44:11 +02:00
api.settings.delete-account.ts Add account settings page with passkey management 2026-03-29 10:09:06 +02:00
api.settings.email.ts Add account settings page with passkey management 2026-03-29 10:09:06 +02:00
api.settings.passkey.delete.ts Add account settings page with passkey management 2026-03-29 10:09:06 +02:00
api.settings.profile.ts Implement social-feed: local follows + /feed + profile visibility 2026-04-25 22:51:18 +02:00
api.sync.callback.$provider.ts Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
api.sync.connect.$provider.ts Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
api.sync.disconnect.$provider.ts Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
api.sync.push.$provider.$routeId.ts Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
api.sync.webhook.$provider.ts Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
api.users.$username.follow.ts Implement social-feed: local follows + /feed + profile visibility 2026-04-25 22:51:18 +02:00
api.users.$username.unfollow.ts Implement social-feed: local follows + /feed + profile visibility 2026-04-25 22:51:18 +02:00
api.v1.activities.$id.ts Implement Journal REST API v1 endpoints 2026-04-13 00:57:27 +02:00
api.v1.activities._index.ts DRY up ZodError → FieldError mapping 2026-04-19 11:45:09 +02:00
api.v1.auth.devices.$id.ts Implement Journal REST API v1 endpoints 2026-04-13 00:57:27 +02:00
api.v1.auth.devices.ts Implement Journal REST API v1 endpoints 2026-04-13 00:57:27 +02:00
api.v1.routes.$id.ts DRY up ZodError → FieldError mapping 2026-04-19 11:45:09 +02:00
api.v1.routes._index.ts DRY up ZodError → FieldError mapping 2026-04-19 11:45:09 +02:00
api.v1.routes.compute.ts Session-bind /api/route and /api/overpass 2026-04-21 22:18:45 +02:00
api.v1.routes.test.ts fix: enforce Terms gate on bearer-token API requests 2026-05-08 01:59:28 +02:00
api.v1.test.ts Add unit tests for REST API validation and pagination 2026-04-13 00:58:18 +02:00
api.v1.uploads.ts DRY up ZodError → FieldError mapping 2026-04-19 11:45:09 +02:00
api.well-known.trails-cool.test.ts Implement OAuth2 PKCE auth, discovery, and mobile API client 2026-04-13 00:41:40 +02:00
api.well-known.trails-cool.ts Implement OAuth2 PKCE auth, discovery, and mobile API client 2026-04-13 00:41:40 +02:00
auth.accept-terms.tsx Prompt users with stale terms_version to re-accept 2026-04-19 08:06:16 +02:00
auth.login.tsx Implement completeAuth chokepoint + caller migration 2026-05-08 02:38:15 +02:00
auth.logout.tsx Implement Journal auth: passkeys + magic links, no passwords 2026-03-23 17:38:46 +01:00
auth.register.tsx Implement completeAuth chokepoint + caller migration 2026-05-08 02:38:15 +02:00
auth.verify.tsx Implement completeAuth chokepoint + caller migration 2026-05-08 02:38:15 +02:00
explore.tsx Include the demo persona on /explore so users can follow it 2026-04-26 11:43:24 +02:00
feed.tsx Add Followed/Public toggle to /feed for signed-in users 2026-04-26 09:03:38 +02:00
follows.requests.tsx Merge /follows/requests into /notifications as a tabbed inbox 2026-04-26 08:24:59 +02:00
home.tsx Implement /explore: local user discovery directory 2026-04-26 09:24:19 +02:00
legal.imprint.tsx Apply minimal legal-review follow-ups 2026-04-19 07:27:56 +02:00
legal.privacy.tsx Add Send to Wahoo UI, i18n, and privacy disclosure 2026-04-30 22:44:50 +02:00
legal.terms.tsx Store Terms version alongside acceptance timestamp 2026-04-19 07:46:34 +02:00
notifications.tsx Merge /follows/requests into /notifications as a tabbed inbox 2026-04-26 08:24:59 +02:00
oauth.authorize.tsx Implement OAuth2 PKCE auth, discovery, and mobile API client 2026-04-13 00:41:40 +02:00
oauth.token.ts Implement Journal REST API v1 endpoints 2026-04-13 00:57:27 +02:00
privacy.tsx Add legal pages, ToS acceptance, and alpha banner 2026-04-18 00:08:48 +02:00
routes.$id.edit.tsx Apply public-content-visibility: visibility flag + public profile 2026-04-19 09:11:39 +02:00
routes.$id.tsx Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
routes._index.tsx Add ClientMap wrapper to avoid lazy() SSR resolution 2026-04-06 22:52:57 +02:00
routes.new.tsx Implement Journal route management (Group 8) 2026-03-23 22:25:10 +01:00
settings._index.tsx Split /settings into 4 sub-pages with a sidebar layout 2026-04-26 09:48:00 +02:00
settings.account.tsx Split /settings into 4 sub-pages with a sidebar layout 2026-04-26 09:48:00 +02:00
settings.connections.tsx Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
settings.profile.tsx Split /settings into 4 sub-pages with a sidebar layout 2026-04-26 09:48:00 +02:00
settings.security.tsx Split /settings into 4 sub-pages with a sidebar layout 2026-04-26 09:48:00 +02:00
settings.tsx Split /settings into 4 sub-pages with a sidebar layout 2026-04-26 09:48:00 +02:00
sync.import.$provider.tsx Wahoo capability adapters + caller migration (groups 3-5) 2026-05-08 01:25:33 +02:00
users.$username.followers.tsx Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
users.$username.following.tsx Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00
users.$username.tsx Implement notifications + supporting fixes 2026-04-26 01:28:55 +02:00