Phase 1 收缩 + Phase 2 后端可用（重放到 main） - #112
Conversation
Phase 1: remove crawler/community/dead-feature surface. Phase 2: auth refresh, AI-surface auth, agent plan D1 persistence, currency writer, dashboard catch-all rewrite + layout guard + login consolidation, R4 contract/smoke. main's redone CF migration is byte-identical on all Phase-2 touched files, so features applied cleanly. Conflicts: logger (kept main's console fix), wrangler (kept real database_id + version note), lockfile (regen), main iOS-chat docs (prettier fix). pnpm check green.
Greptile SummaryThis PR cherry-picks Phase 1 (product contraction, −44k lines: removes crawler/social/community domains, shrinks schema from 48→24 tables) and Phase 2 (targeted backend hardening: signed refresh tokens, agent plan D1 persistence, currency rate fetching, dashboard auth guard and catch-all proxy rewrite) onto main.
Confidence Score: 3/5The core auth hardening (non-enumerable refresh tokens) is correct, but refresh token rotation does not actually revoke old tokens, leaving a window where a captured refresh token stays usable for up to 30 days after the legitimate holder has already rotated it. Most of the changes — route contraction, agent D1 persistence with user-scoped ownership, currency rate fetching, contract tests, dashboard auth centralization — are well-implemented. The auth service refresh flow fixes the enumerable-session-ID vulnerability as described, but the rotation mechanism it introduces does not follow through: old refresh tokens remain valid because no JTI tracking or session replacement occurs on use. The advertised security property is partially undelivered, warranting attention before merging into main on an active product. packages/api/src/services/auth.service.ts (refreshSession rotation gap), packages/api/src/routes/auth.ts (POST /refresh endpoint depends on it)
|
| Filename | Overview |
|---|---|
| packages/api/src/services/auth.service.ts | Adds refreshSession + generateRefreshToken (signed JWT instead of enumerable session ID — correct fix). However token rotation does not revoke old tokens, leaving captured refresh tokens reusable until JWT expiry. |
| packages/api/src/routes/auth.ts | Adds POST /refresh endpoint; signin/social responses now include refreshToken. Zod-validated, proper 401 mapping. No independent issues beyond the rotation gap in auth.service.ts. |
| packages/api/src/routes/agent.ts | Replaces module-level Map with D1-backed upsert (aiPlanDrafts), adds authRequired() for all routes, adds userId ownership scoping on every plan read/write — well-executed. |
| packages/api/src/routes/currency.ts | Fixes the 'always returns null' bug by fetching from frankfurter.app on stale cache; adds Zod query validation, manual serializeRate to avoid key-mangling by convertKeysToSnakeCase, and graceful fallback. |
| packages/api/src/routes/contract.test.ts | New R4 gate: 12 contract tests verify routes are mounted by checking pre-handler middleware statuses (401/400/403 ≠ 404). Solid regression guard for route removals. |
| apps/dashboard/src/app/(dashboard)/layout.tsx | Converted to client component to centralize auth guard; uses useAuth + useEffect redirect. Children are still server-rendered as RSC via the children prop. |
| packages/database/src/schema/ai-plans.ts | New ai_plan_drafts table with (session_id, user_id) unique index enabling single-query upsert in savePlan. Migration SQL matches schema definition. |
Sequence Diagram
%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Client
participant Auth as POST /api/auth/refresh
participant AS as auth.service
participant DB as D1 (authSessions)
Client->>Auth: "{ refreshToken: signedJWT }"
Auth->>AS: refreshSession(db, refreshToken, secret)
AS->>AS: verifyToken(refreshToken) → payload
AS->>AS: "check payload.typ === 'refresh'"
AS->>DB: isSessionValid(payload.sid)
DB-->>AS: true
AS->>DB: SELECT user by payload.sub
DB-->>AS: user row
AS->>AS: generateToken(userId, email, secret, sid)
AS->>AS: generateRefreshToken(userId, email, secret, sid)
note over AS,DB: old refreshToken NOT revoked (same sid still valid)
AS-->>Auth: "{ token, refreshToken rotated }"
Auth-->>Client: "200 { token, refreshToken, userId, email }"
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Client
participant Auth as POST /api/auth/refresh
participant AS as auth.service
participant DB as D1 (authSessions)
Client->>Auth: "{ refreshToken: signedJWT }"
Auth->>AS: refreshSession(db, refreshToken, secret)
AS->>AS: verifyToken(refreshToken) → payload
AS->>AS: "check payload.typ === 'refresh'"
AS->>DB: isSessionValid(payload.sid)
DB-->>AS: true
AS->>DB: SELECT user by payload.sub
DB-->>AS: user row
AS->>AS: generateToken(userId, email, secret, sid)
AS->>AS: generateRefreshToken(userId, email, secret, sid)
note over AS,DB: old refreshToken NOT revoked (same sid still valid)
AS-->>Auth: "{ token, refreshToken rotated }"
Auth-->>Client: "200 { token, refreshToken, userId, email }"
Reviews (1): Last reviewed commit: "chore: replay Phase 1 contraction + Phas..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| const userId = String(user.id); | ||
| const email = user.email ?? ''; | ||
| const token = await generateToken(userId, email, secret, payload.sid); | ||
| const rotatedRefreshToken = await generateRefreshToken(userId, email, secret, payload.sid); | ||
|
|
||
| return { token, refreshToken: rotatedRefreshToken, userId, email }; |
There was a problem hiding this comment.
refreshSession mints a rotated refresh token but does not invalidate the previous one. Both the old and the new token share the same sid, and isSessionValid only checks whether that session row exists — it never records or expires the individual JWT. So a captured refresh token can be called against /refresh indefinitely (until the 30-day JWT expiry) even after the legitimate holder has already rotated it. Token rotation's security property — making a previously captured token immediately unusable — is therefore not delivered here.
To fix properly, either (a) store a jti per issued refresh token and reject reused JTIs, or (b) delete the old authSessions row and create a new one on every /refresh call, so any JWT carrying the old sid fails isSessionValid.
refreshSession re-minted tokens bound to the same sid, and isSessionValid only checks session existence, so a captured refresh token stayed replayable for its full 30-day JWT lifetime even after the legitimate holder rotated it. Rotate the server-side session on refresh: mint a fresh sid via createSession, then delete the old one. Because both the old refresh token and the access token minted alongside it carry the now-deleted sid, they are rejected by isSessionValid on any subsequent use.
|
Too many files changed for review. ( Bypass the limit by tagging |
1 participant
概要
把 Phase 1 产品收缩 + Phase 2 后端可用 重放到 main。两阶段均经 subagent 逐任务实现 + 独立审查，
pnpm check全绿，并在本地 workerd（flue dev --target cloudflare）上跑通完整 web 核心流程冒烟。Spec：
docs/superpowers/specs/2026-07-07-product-refocus-design.md（R1–R9）Phase 1 — 收缩（净 −44k 行）
Phase 2 — 后端可用（靶向：后端自洽 + Web 端到端）
POST /api/auth/refresh（session 重签，refreshToken 用 jose 签名 JWT 而非可枚举 session id — 修复了账号接管漏洞）/rates接 frankfurter.app 写入方（修「永远返回 null」）/api/:path*catch-all rewrite；客户端(dashboard)/layout.tsx集中鉴权守卫；登录收敛到/与并行 iOS-chat 工作线的关系
本分支基于 main（含 CF Workers 迁移）重放。并行线的 iOS chat 契约对齐（
/sessions/:id/messages等）与本分支无功能冲突（Phase 1 保留 chat；Phase 2 只给 chat/query 加鉴权）。合并冲突（若有）在本 PR 内解决——请两边 review。验证
pnpm check全绿（typecheck + lint + api/dashboard/D1 集成/contract 测试）flue dev启动 +pnpm smoke端到端绿：注册→登录→建行程→加天→加 POI→列表→分账Need help on this PR? Tag
/codesmithwith what you need. Autofix is enabled.