Repository navigation
security: add server/auth session layer and redacting logger (PR 1.1) - #9
Merged
Merged
Conversation
PR 1.1 of docs/MILESTONES.md (SECURITY §2.1, §2.11).
- server/auth/session-core.ts: pure session logic behind small
SessionAuth / SessionCookieStore interfaces (unit-tested with fakes).
Hardened cookie: httpOnly, secure in production, sameSite=lax,
path=/, 7-day TTL, `__Host-` prefix in production.
- server/auth/session.ts: Next adapter. getCurrentUser is React.cache'd
(one verification per request); requireUser throws
AppError('UNAUTHENTICATED'); *Checked variants verify revocation for
sensitive operations (RISKS R22); destroySession clears the cookie
and revokes refresh tokens.
- server/errors.ts: AppError with a fixed code set (Result helpers in
P2.1). server/observability/logger.ts: pino with key-path redaction
for cookies, tokens, emails, transcripts; pino externalised from the
server bundle.
- (root) and (auth) layouts, pages, signout and profile routes now use
the session layer; the dead x-next-url / PUBLIC_ROUTES code is gone;
lib/actions/auth.action.ts keeps only sign-in/up and streak helpers
until P1.4.
Verified: pnpm lint, typecheck, knip, vitest 17/17 (session core +
redaction), next build; runtime smoke on `next start` with a throwaway
user: anonymous 307, `__Host-session` 200, signout clears cookie and
the old cookie fails the revocation check; no cookie text in logs.
Grep gates: console.* = 0, process.env outside config/env.ts = 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR 1.1 of
docs/MILESTONES.md(Phase 1 — security hardening). Implements SECURITY §2.1 (sessions) and §2.11 (logging) as the first realserver/modules of the target architecture.server/auth/session-core.ts— pure session logic behindSessionAuth/SessionCookieStoreinterfaces; hardened cookie (httpOnly, secure in prod, sameSite=lax, path=/, 7-day TTL,__Host-prefix in production)server/auth/session.ts— Next adapter:getCurrentUser(React.cache — one verification per request),requireUser→AppError('UNAUTHENTICATED'),*Checkedvariants for sensitive ops (R22),destroySessionclears cookie and revokes refresh tokensserver/errors.ts(AppError, fixed code set) andserver/observability/logger.ts(pino, key-path redaction for cookies/tokens/emails/transcripts)x-next-url/PUBLIC_ROUTEScode removed;lib/actions/auth.action.tsreduced to sign-in/up + streak helpers (gone in P1.4)Type
Verification
pnpm lint✔ ·pnpm typecheck✔ ·knip✔ ·vitest17/17 (session core with fakes; logger redaction asserts no cookie/token/email/transcript text is emitted) ·next build✔next startwith a throwaway Auth user: anonymous/profile→ 307;__Host-sessioncookie → 200;POST /api/auth/signoutclears the cookie and the old cookie fails the revocation check afterwards; server log contains no cookie material. Test user and doc deleted.console.*in app code = 0;process.envoutsideconfig/env.ts= 0Server checklist
requireUserCheckedin profile update)process.envoutsideconfig/env.ts; no PII in logs (redaction tested)readSessionnull cases)Risk watch-list
revokeRefreshTokenson sign-out. After this deploys, run the one-off all-users revocation (script in P1.1 follow-up note below). R22 accepted as documented.Follow-up before closing R1: one-off
scripts/revoke-all-sessions.ts(adminlistUsers→revokeRefreshTokens) run once against production after deploy; tracked indocs/RISKS.md.🤖 Generated with Claude Code