Harden authentication sessions and recovery - #210
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
fcb1070 to
57ba421
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fcb107079c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
PR verification reportAll configured preview and verification checks passed.
Changed visual baselines: none. Updated from Baseline Checks run 30301794113, attempt 1 for |
57ba421 to
39499ee
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39499eebe5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
39499ee to
4ba25a4
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ba25a4379
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
4ba25a4 to
0e7135c
Compare
0e7135c to
9d4598f
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9d4598f4c9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
9d4598f to
3505de7
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3505de7c18
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3505de7 to
1fd3fe1
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
[AGENT] @codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
`#210` replaced the account-helper auth model with `_browserSessionAuthority` and added a boundary test enforcing it. The claim platform predates that, so this integrates rather than reverting either side: - New `convex/_claimSession.ts` wraps the session authority with the structured claim codes this branch exists to provide. A `ConvexError` from the guard is rethrown untouched, so the `AUTH_SESSION_INVALID` signal the web app converges sessions on still reaches it; only the plain-`Error` cases become `SIGN_IN_REQUIRED` / `EMAIL_NOT_VERIFIED`, which Convex would otherwise redact to one generic string in production. - `profileClaims`, `profileConnections`, `discordVerification`, `vrclinkingCredentials`, and `_accountFeatures` now authorize through it instead of the legacy account helpers or a direct identity read. - `_browserSessionAuthority` itself is left exactly as main wrote it; an earlier attempt to change its error contract broke main's own tests, which assert the plain messages. - Registered the new Discord OAuth action module and its two Next routes in the boundary inventories, with the markers those files actually use. - Test identities now insert a real `authSessions` row: the guard resolves the session named by the subject, so a fabricated `|web-session` suffix no longer authenticates. - Kept both new crons. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`#210` replaced the account-helper auth model with `_browserSessionAuthority` and added a boundary test enforcing it. The claim platform predates that, so this integrates rather than reverting either side: - New `convex/_claimSession.ts` wraps the session authority with the structured claim codes this branch exists to provide. A `ConvexError` from the guard is rethrown untouched, so the `AUTH_SESSION_INVALID` signal the web app converges sessions on still reaches it; only the plain-`Error` cases become `SIGN_IN_REQUIRED` / `EMAIL_NOT_VERIFIED`, which Convex would otherwise redact to one generic string in production. - `profileClaims`, `profileConnections`, `discordVerification`, `vrclinkingCredentials`, and `_accountFeatures` now authorize through it instead of the legacy account helpers or a direct identity read. - `_browserSessionAuthority` itself is left exactly as main wrote it; an earlier attempt to change its error contract broke main's own tests, which assert the plain messages. - Registered the new Discord OAuth action module and its two Next routes in the boundary inventories, with the markers those files actually use. - Test identities now insert a real `authSessions` row: the guard resolves the session named by the subject, so a fabricated `|web-session` suffix no longer authenticates. - Kept both new crons. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
[AGENT]
Summary
This completes the security and operational follow-up to the remembered-session lifetime fix on
main.Session contract
The ordinary remembered-session contract remains:
Recent authentication is a non-sliding 15-minute window measured from successful completion of a server-side challenge and bound to the replacement VRDex session. Password proof claiming stores only a SHA-256 proof hash, consumes the proof once, atomically creates at most one replacement session, and removes the original session and refresh-token tree. Concurrent challenges converge on that replacement. Because this is a full reauthentication, the replacement begins a new 90-day absolute lifetime.
Discord and Google remain ordinary sign-in methods, but ordinary OAuth sign-in cannot satisfy step-up because the installed auth stack does not bind provider freshness to the resulting VRDex session. OAuth-only step-up remains tracked in #202.
Security and recovery
RECENT_AUTH_REQUIRED; their original writes are never stored or replayed automaticallyVerification
Owner follow-up
After deployment:
VRDEX_HOSTED_E2E_AUTH_HELPERS=trueandVRDEX_HOSTED_E2E_BROWSER_TOKEN.the baseline on August 10, 2026 or after 14 complete deployed days,
whichever is later.
state and invoke the workflow with
production_auth=true. Do not retain orreuse that state.
Addresses #202
Closes #203
Closes #204
Closes #205
Closes #206