fix(den): block email OTP sign-in under required SSO and dedupe SSO start request - #5138
Open
alexgvozden wants to merge 3 commits into
Open
alexgvozden wants to merge 3 commits into
alexgvozden wants to merge 3 commits into
Conversation
Email OTP sign-in issues a session and creates unknown users just like email/password, so the single-org SSO guard now rejects it too. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
React StrictMode runs the sign-in effect twice in dev. The second sign-in/sso call overwrote the OAuth state cookie, so the callback failed with state_mismatch. Both runs now await the same request. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
|
@alexgvozden is attempting to deploy a commit to the Different AI Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub. 3 Skipped Deployments
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /sign-in/email-otpin addition to email/password sign-in and sign-up.sign-in/ssorequest per attempt, even when React runs the effect twice.Why
sign-in/ssocall overwrote the OAuth state cookie, so the IdP callback failed withstate_mismatch.Issue
Scope
ee/apps/den-api/src/routes/auth/index.ts: newisBetterAuthEmailOtpSignInRequestmatcher, used ingetSingleOrgAuthGuardResponse.ee/apps/den-web/app/sso/[orgSlug]/page.tsx: in-flight requests are kept in a ref keyed by org slug, callback URLs, login hint and attempt number. Retry still sends a new request because the attempt number changes.ee/apps/den-api/test/single-org-route-guards.test.ts: test for the new matcher.Out of scope
/email-otp/send-verification-otpand similar). Only the route that issues a session is blocked.Testing
Ran
bun test --conditions development test/single-org-route-guards.test.ts(inee/apps/den-api)pnpm exec tsc --noEmit -p .(inee/apps/den-web)Result
Unknown database 'openwork_test'from a backgroundoauthResourcequery). It appeared in some runs and not others, with or without this change, and needs a local test database that my machine does not have.CI status
Manual verification
sso_requiredforPOST /api/auth/sign-in/email-otp) is covered only by the matcher unit test.state_mismatchfix was not re-verified in a browser after these commits.Evidence
Risk
Rollback
🤖 Generated with Claude Code