From 305bdebdd1912384e9774ef577b8e56c89713bee Mon Sep 17 00:00:00 2001 From: SimpleTest Date: Tue, 25 Aug 2026 23:18:58 +0300 Subject: [PATCH] Preserve account context after invalid sign-in links --- docs/public-launch-checklist.md | 16 +++---- docs/verification.md | 43 ++++++++++++++++++- .../controllers/user_session_controller.ex | 12 +++++- priv/gettext/default.pot | 6 +-- scripts/quality.sh | 4 +- .../user_session_controller_test.exs | 19 ++++++++ 6 files changed, 83 insertions(+), 17 deletions(-) diff --git a/docs/public-launch-checklist.md b/docs/public-launch-checklist.md index f11814c..582da6d 100644 --- a/docs/public-launch-checklist.md +++ b/docs/public-launch-checklist.md @@ -192,15 +192,13 @@ as forward-only rather than receiving an invented database rollback. the production Google OAuth client and exact callback origin. - [x] A production-generated authentication email reaches an external mailbox and is DKIM-signed by the production domain. -- [ ] Authentication-email action URLs use the production domain directly. - Brevo currently rewrites the action href through its tracking domain even - though the visible fallback origin is `https://whoneedhelp.com/`. A - read-only account check on 2026-08-21 found only Brevo's account-wide - anonymous-tracking control; Brevo documents that this still records - aggregate clicks, so it is not evidence that the primary action remains - direct. A newly delivered message was checked on 2026-08-25: its direct - production-domain fallback completed reauthentication and immediate - reuse was rejected, while its primary button was still provider-tracked. +- [x] Authentication-email action URLs use the production domain directly. + The app-only production release at `dcac2fa` removed the HTML action + anchor and leaves one visible copy-and-paste URL. A newly generated + production message was inspected in Gmail on 2026-08-25: Gmail's detected + link targeted `https://whoneedhelp.com` directly, no Brevo or UniSender + tracking host appeared, and the one-time link completed the explicit + production reauthentication flow. - [x] The Web Push provider accepts a production notification for a real active browser subscription without disabling the device. - [ ] A person has observed the resulting operating-system browser notification diff --git a/docs/verification.md b/docs/verification.md index 131b562..d63d5bd 100644 --- a/docs/verification.md +++ b/docs/verification.md @@ -1368,7 +1368,7 @@ this audit. | Consent-driven live tracking | Implemented and cross-client verified | On API 37, Android started `TrackingService` as a location foreground service with a persistent Stop notification. The Play-delivered production build repeated the disclosure, foreground permission, minimized-app sampling, notification Stop, raw-position deletion, offline recovery, and process-recreation paths on a physical phone. | Browsers stop with the page. Android has no `ACCESS_BACKGROUND_LOCATION`, unattended start, or route history. | | Privacy settings | Implemented and browser-verified | The profile exposed hidden, approximate public, exact for active match, and explicit exact-public options. Blocking and current-position cleanup have automated tests. | Exact public location remains a user opt-in; legal privacy and retention text still requires jurisdiction-specific review before launch. | | Reputation and anti-abuse | Implemented at MVP level | Handover codes, two-party completion, double-blind reviews, unique-counterpart ranking, optional movement/proximity evidence, reports, blocks, abuse signals, and moderator audit paths have automated tests. | The system is not bot-proof and does not claim identity verification. No punitive numeric policy is enabled without measured and approved thresholds. | -| Account registration and sign-in | Implemented and browser/physical-device verified | Email registration is a single passwordless flow: it records the display name and acceptance once, sends a confirmation link, and does not duplicate a user on subsequent sign-in. Confirmed users can keep using magic links or add a password in settings. Google OpenID Connect registration, sign-in, link, unlink, replay prevention, verified-email enforcement, and account-ownership rules are covered by the automated suite. Real headed Chrome exercised the development callback and identity-linking paths. The Play-delivered production build then completed production Google sign-in without a secondary ownership email or duplicate account. A production authentication email was also observed in the external Gmail mailbox with `whoneedhelp.com` DKIM signing. On 2026-08-25, a newly delivered message reached Gmail Inbox, its direct `https://whoneedhelp.com` fallback completed production reauthentication, and immediate reuse of the same token was rejected. | Brevo still rewrites the primary button href through its tracking domain. The direct fallback is verified, but eliminating the provider-tracked primary action remains an open deliverability/privacy decision. | +| Account registration and sign-in | Implemented and browser/physical-device verified | Email registration is a single passwordless flow: it records the display name and acceptance once, sends a confirmation link, and does not duplicate a user on subsequent sign-in. Confirmed users can keep using magic links or add a password in settings. Google OpenID Connect registration, sign-in, link, unlink, replay prevention, verified-email enforcement, and account-ownership rules are covered by the automated suite. Real headed Chrome exercised the development callback and identity-linking paths. The Play-delivered production build then completed production Google sign-in without a secondary ownership email or duplicate account. A production authentication email was also observed in the external Gmail mailbox with `whoneedhelp.com` DKIM signing. On 2026-08-25, a message generated after production release `dcac2fa` reached Gmail Inbox, Gmail detected one direct `https://whoneedhelp.com` link without a provider tracking host, and that link completed the explicit production reauthentication flow. | The application cannot guarantee how every mailbox provider chooses to auto-link visible text. SMTP exactly-once delivery is not claimed. | | Notifications and nearby alerts | Implemented and browser/physical-device verified | Users can configure push, quiet hours, category/urgency/day/time filters, a private matching center, and 1/3/5/10/25 km radii. Durable inbox notifications and Oban push jobs are tested; public notification payloads omit chat text, exact coordinates, and the private saved-area label. Immediate per-request nearby email is retired. Development Web Push and FCM delivery were exercised. The Play-delivered production build registered its FCM device, received one run-scoped production notification, and routed its tap to the in-app inbox; exact cleanup removed that notification and its jobs. A guarded production smoke then delivered one browser-only job to the newest real active Web Push subscription on its first attempt and removed the exact job and notification. | A batched nearby email digest is not implemented; it requires a defined cadence and delivery cursor. Provider acceptance and the still-active subscription are verified; visible operating-system presentation and click navigation were not programmatically observed. | | Social profiles | Manual links implemented; optional GitHub verification implemented and automated-tested | Manual links cannot set verification fields. The optional GitHub flow uses state, PKCE, a user-bound one-time session, unique provider ownership, and an audit record. The local protocol drill also performs real HTTP token/user exchanges without returning an access token to the application. | GitHub OAuth credentials are intentionally absent and are not required for registration or the help flow. The real external provider redirect/callback remains disabled and unverified; other providers remain manual/unverified. | | Support and content removal | Implemented and browser-verified | Public support, account deletion, general removal, and TAKE IT DOWN forms use separate audited workflows; public support remains pending and outside the staff queue until its private email link verifies the contact, while authenticated submissions use the account email immediately. Exact pending repeats are deduplicated, email/IP intake limits are independently configurable, and moderator-only operations can update verified cases. TAKE IT DOWN accepts URLs/text only and records a 48-hour review due time. Authenticated users can download an allowlisted JSON export, and moderators can run a read-only deletion relationship preflight. | The current product hosts no user media and does not claim TAKE IT DOWN coverage. Staffing, measured rate-limit thresholds, jurisdiction-specific legal classification, final retention rules, destructive account erasure/anonymisation, and identical-media-copy handling remain operational/legal work. | @@ -1377,7 +1377,7 @@ this audit. | Multiple web/worker instances | Implemented and locally failure/rollout-verified | The final isolated Compose drill passed BEAM crashes and sequential replacement with 3 web/2 worker replicas: all five nodes joined, PubSub passed, and 744/744 readiness requests succeeded. The project-owned kind cluster replaced all 2 web/2 worker pod UIDs under `maxUnavailable=0`; all four replacement pods joined, PubSub passed, and 363/363 samples ultimately succeeded. | Local PostGIS is a single instance. Production database HA, backups, and recovery are operator work and are not claimed complete. | | Local observability | Implemented and protocol-verified | Pinned Prometheus scraped the exact 3 web and 2 worker targets with a file Bearer credential; Grafana provisioned a healthy datasource and ten-panel web/worker/BEAM/Ecto/Oban dashboard; Alertmanager delivered firing and resolved webhooks for an induced scoped replica stop. | Local delivery does not establish production retention, notification-provider reliability, on-call policy, or measured alert thresholds. | | Encrypted local backup | Implemented and failure-verified | Pinned Restic streamed PostgreSQL custom format into pinned local MinIO with no host plaintext dump, passed full-data checking and a fresh-database restore, rejected a corrupted repository, and published no snapshot for an interrupted upload. The one-run MinIO project and volume were removed after retaining the non-secret evidence. | The drill proves the local mechanism, not off-site durability, database HA, or a production RPO/RTO/retention policy. | -| External protocol boundaries | Implemented and provider-verified for the current pilot paths | Assent/Req and Swoosh/gen_smtp paths have internal success/rejection/retry/replay/timeout coverage. Google OIDC discovery/authorization/token/JWKS with nonce and PKCE and the optional GitHub boundary are locally exercised through mocks. Real development checks covered Google, authenticated Brevo SMTP, Web Push, and FCM. Production checks covered Google OIDC, Brevo authentication-email receipt, a direct production-domain fallback link with one-time-token rejection, browser Web Push provider acceptance, and FCM delivery. The current push code includes provider-neutral HTTP delivery plus standards-based Web Push and FCM adapters with durable Oban retries and invalid-device cleanup. UniSender observations below are retained only as historical evidence and do not describe current wiring. | The real GitHub provider, a non-tracked primary authentication CTA, visible browser OS-notification interaction, and APNs remain unverified. SMTP exactly-once delivery is not claimed. | +| External protocol boundaries | Implemented and provider-verified for the current pilot paths | Assent/Req and Swoosh/gen_smtp paths have internal success/rejection/retry/replay/timeout coverage. Google OIDC discovery/authorization/token/JWKS with nonce and PKCE and the optional GitHub boundary are locally exercised through mocks. Real development checks covered Google, authenticated Brevo SMTP, Web Push, and FCM. Production checks covered Google OIDC, Brevo authentication-email receipt with a direct production-domain action, browser Web Push provider acceptance, and FCM delivery. The current push code includes provider-neutral HTTP delivery plus standards-based Web Push and FCM adapters with durable Oban retries and invalid-device cleanup. UniSender observations below are retained only as historical evidence and do not describe current wiring. | The real GitHub provider, visible browser OS-notification interaction, and APNs remain unverified. SMTP exactly-once delivery is not claimed. | ## Reproducible checks @@ -3367,6 +3367,45 @@ promoted. not changed. The direct-action checklist item remains open until a newly delivered production message is inspected after an app-only release. +# 2026-08-25 direct production authentication-link verification + +- Commit `dcac2fa0bc4b086ba76f4d9082306447926d040b` was deployed through an + app-only production release. The release did not include a migration. The + production readiness endpoint remained healthy with zero container restarts; + the frozen hackathon test deployment remained at + `cf7bacdf61ffb171ebac85e32dfcf12bc6972d59` and was not changed. +- One passwordless sign-in request for the existing operator generated one new + production message in Gmail. Gmail's auto-linked target used the direct + `https://whoneedhelp.com` origin; no Brevo or UniSender tracking hostname was + present in that target. The message was returned to unread state after the + check. +- Opening the direct link displayed the explicit same-account + reauthentication screen. Choosing the persistent-session action completed + sign-in and returned to the production home with the success notice. This + closes the direct authentication-action checklist item for the observed + production delivery; it does not claim that every mailbox client renders + plain URL text identically. +- Reopening a consumed or invalid magic link while already signed in exposed a + separate presentation defect: the readonly account field was blank. The + controller now populates that field only from the authenticated session's + account and otherwise preserves the existing empty unauthenticated form. A + focused regression test first failed against the old behavior and then + passed with the fix. +- Updating the controller shifted gettext source references. The catalog was + regenerated with `mix gettext.extract` before the final check. The quality + run also exposed a nondeterministic shell-test defect when a valid generated + VAPID key began with `-`; the test now terminates grep options with `--` + before comparing generated key material. +- The isolated full quality unit + `codex-heavy-wnh-invalid-link-quality-r2-20260825-231311-462995.service` + completed successfully in 4 minutes 18.128 seconds. ExUnit reported 488 + passing tests, and every configured quality and security gate passed. The + observed unit peak was 244.3 MiB with 11.9 MiB of swap. +- Exact post-run inspection found no container, network, volume, temporary + quality/security image, or gettext-generation image from the run. These last + controller, test, catalog, and quality-script changes remain local at the + time of this record; the public remote and frozen test were not changed. + # 2026-08-21 connected-device Play delivery recheck - The authorised physical device `72551e60` reported installed package diff --git a/lib/who_need_help_web/controllers/user_session_controller.ex b/lib/who_need_help_web/controllers/user_session_controller.ex index 2ab2cdc..2d2efc6 100644 --- a/lib/who_need_help_web/controllers/user_session_controller.ex +++ b/lib/who_need_help_web/controllers/user_session_controller.ex @@ -48,7 +48,7 @@ defmodule WhoNeedHelpWeb.UserSessionController do {:error, :not_found} -> conn |> put_flash(:error, gettext("The link is invalid or it has expired.")) - |> render(:new, form: Phoenix.Component.to_form(%{}, as: "user")) + |> render(:new, form: invalid_magic_link_form(conn)) end end @@ -158,6 +158,16 @@ defmodule WhoNeedHelpWeb.UserSessionController do |> render(:new, form: Phoenix.Component.to_form(user_params, as: "user")) end + defp invalid_magic_link_form(%{ + assigns: %{current_scope: %Scope{user: %Accounts.User{email: email}}} + }) do + Phoenix.Component.to_form(%{"email" => email}, as: "user") + end + + defp invalid_magic_link_form(_conn) do + Phoenix.Component.to_form(%{}, as: "user") + end + defp maybe_restore_pending_google(conn, %{"google_link" => token}) when is_binary(token) do case GoogleAuthPending.restore(conn, token) do {:ok, conn} -> conn diff --git a/priv/gettext/default.pot b/priv/gettext/default.pot index 652789e..a83144a 100644 --- a/priv/gettext/default.pot +++ b/priv/gettext/default.pot @@ -49,7 +49,7 @@ msgstr "" #: lib/who_need_help_web/components/layouts.ex:95 #: lib/who_need_help_web/components/layouts.ex:168 #: lib/who_need_help_web/controllers/user_registration_html/new.html.heex:14 -#: lib/who_need_help_web/controllers/user_session_controller.ex:215 +#: lib/who_need_help_web/controllers/user_session_controller.ex:225 #: lib/who_need_help_web/controllers/user_session_html/new.html.heex:10 #, elixir-autogen, elixir-format msgid "Log in" @@ -3757,7 +3757,7 @@ msgstr "" msgid "Email me a verification link" msgstr "" -#: lib/who_need_help_web/controllers/user_session_controller.ex:183 +#: lib/who_need_help_web/controllers/user_session_controller.ex:193 #, elixir-autogen, elixir-format msgid "Google sign-in connected. You can use it next time." msgstr "" @@ -3809,7 +3809,7 @@ msgstr "" msgid "We sent a verification link to %{email}. Open it to finish connecting Google." msgstr "" -#: lib/who_need_help_web/controllers/user_session_controller.ex:196 +#: lib/who_need_help_web/controllers/user_session_controller.ex:206 #, elixir-autogen, elixir-format msgid "You are signed in, but Google could not be connected. Try again in account settings." msgstr "" diff --git a/scripts/quality.sh b/scripts/quality.sh index 60c395f..daa6bbb 100755 --- a/scripts/quality.sh +++ b/scripts/quality.sh @@ -1756,9 +1756,9 @@ test "$generated_vapid_public" != "$generated_vapid_private" grep -Fx 'WEB_PUSH_VAPID_SUBJECT=mailto:contact@help.test' \ "$generated_vapid_env" >/dev/null if printf '%s' "$vapid_output" | - grep -F "$generated_vapid_public" >/dev/null || + grep -F -- "$generated_vapid_public" >/dev/null || printf '%s' "$vapid_output" | - grep -F "$generated_vapid_private" >/dev/null; then + grep -F -- "$generated_vapid_private" >/dev/null; then echo "VAPID generator printed generated key material." >&2 exit 1 fi diff --git a/test/who_need_help_web/controllers/user_session_controller_test.exs b/test/who_need_help_web/controllers/user_session_controller_test.exs index 2abdbb3..e1f61c1 100644 --- a/test/who_need_help_web/controllers/user_session_controller_test.exs +++ b/test/who_need_help_web/controllers/user_session_controller_test.exs @@ -296,6 +296,25 @@ defmodule WhoNeedHelpWeb.UserSessionControllerTest do assert html_response(conn, 200) =~ "The link is invalid or it has expired." end + + test "keeps the signed-in account visible when a magic link is invalid", %{ + conn: conn, + user: user + } do + html = + conn + |> log_in_user(user) + |> post(~p"/users/log-in", %{"user" => %{"token" => "invalid"}}) + |> html_response(200) + + assert html =~ "The link is invalid or it has expired." + + assert html =~ + ~s(]*id="login_form_magic_email")(?=[^>]*value="#{Regex.escape(user.email)}")(?=[^>]*\sreadonly(?:[=\s>]))[^>]*>/ + end end describe "DELETE /users/log-out" do