fix: verify auth credentials before dashboard access - #13
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
There was a problem hiding this comment.
Pull request overview
This PR hardens the prototype authentication flow by adding an in-memory user store, signed session cookies, credential verification, and dashboard access protection.
Changes:
- Adds signup/login credential storage and verification with normalized emails and
crypto.scryptpassword hashing. - Adds signed session-cookie helpers, dashboard authentication checks, and logout cookie clearing.
- Expands route tests and documents the auth-session hardening work.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
views/signup.ejs |
Adds a name to the auth mode toggle input. |
test/auth-form-routes.test.js |
Expands backend route coverage for auth, sessions, dashboard protection, and favicon handling. |
src/services/auth-store.js |
Introduces the prototype in-memory auth user store and password verification. |
src/middleware/session.js |
Adds signed session token, cookie parsing, session creation, and session clearing helpers. |
src/app.js |
Wires auth store/session middleware into signup, login, logout, and dashboard routes. |
docs/pr-auth-session/auth-session-hardening.md |
Documents the auth issue, implementation summary, validation, and scope limits. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| const name = part.slice(0, separatorIndex); | ||
| const value = part.slice(separatorIndex + 1); | ||
| cookies[name] = decodeURIComponent(value); |
|
|
||
| const SESSION_COOKIE = "taskify_session"; | ||
| const SESSION_MAX_AGE_SECONDS = 60 * 60 * 8; | ||
| const SESSION_SECRET = process.env.SESSION_SECRET || "taskify-development-session-secret"; |
Comment on lines
+61
to
+78
| const user = { | ||
| id: crypto.randomUUID(), | ||
| username: String(username || "").trim(), | ||
| email: normalizedEmail, | ||
| passwordHash: await hashPassword(password), | ||
| createdAt: new Date().toISOString(), | ||
| }; | ||
|
|
||
| usersByEmail.set(normalizedEmail, user); | ||
| usersById.set(user.id, user); | ||
|
|
||
| return { ok: true, user: toPublicUser(user) }; | ||
| } | ||
|
|
||
| async function verifyCredentials(email, password) { | ||
| const user = usersByEmail.get(normalizeEmail(email)); | ||
|
|
||
| if (!user) { |
Comment on lines
+141
to
+143
| app.post("/logout", (req, res) => { | ||
| res.setHeader("Set-Cookie", clearSessionCookie()); | ||
| return res.redirect(303, "/signup"); |
Comment on lines
+78
to
+82
| if (!user) { | ||
| return null; | ||
| } | ||
|
|
||
| const matches = await verifyPassword(password, user.passwordHash); |
Comment on lines
+4
to
+5
| const usersByEmail = new Map(); | ||
| const usersById = new Map(); |
Comment on lines
+96
to
+97
| function clearSessionCookie() { | ||
| return `${SESSION_COOKIE}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This tightens the backend authentication flow after the earlier POST-route
fix.
crypto.scryptHttpOnly,SameSite=Laxsession cookies/dashboardfrom unauthenticated or tampered-session requestsTesting
npm test— 22 tests passednpm run coverage— 90.18% statement coverage/dashboardredirects to/signup/dashboard401Scope note
The user store is intentionally in-memory because the coursework app does not
yet have a production database. This PR fixes the backend authentication
contract and session protection, but durable accounts would need a database-
backed follow-up.