2 Commits

Include renames

Author	SHA1	Message	Date
Moheeb Zara	f2df287b35	fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5) ... Independent adversarial audit verdict was NOT SAFE; fixed: - P0-1 /auth/confirm no longer trusts the query `type` (pinned to 'email_change'); a public endpoint feeding an attacker-chosen OTP type into verifyOtp was an unintended auth entrypoint. - P0-2 email sync uses the verifyOtp response user, not a follow-up getUser() that may not reflect the just-verified identity; /me now reconciles space_members.email against the authoritative auth email on load, so a missed sync self-heals (no permanent stale email). - P1-1 requestEmailChange builds the confirm origin from NEXT_PUBLIC_APP_URL only, never request headers (forged Host could redirect the confirmation link / capture token_hash). - P2-1 isSecretConfigField also catches password/token/private_key/ *_token/*_password so non-conventionally-named credentials can't be stored in plaintext integrations.config. 521 tests; build clean.	2026-05-18 17:01:25 -07:00
Moheeb Zara	5edd778cf6	feat(me): self-service email change, verified (P3e) ... requestEmailChange -> supabase.auth.updateUser({email},{emailRedirectTo /auth/confirm}); with Secure email change on (recommended) Supabase double-confirms old+new. New /auth/confirm route verifyOtp(email_change) then syncs the denormalized space_members.email to the authoritative auth email ONLY post-verification (idempotent). proxy.ts whitelists /auth/confirm (exact). Profile-tab UI shows current email + change control. REQUIRES Supabase config (template -> /auth/confirm?token_hash= {{ .TokenHash }}&type=email_change + redirect allowlist) — documented in P3f. 521 tests; build clean (flow not exercisable without that config).	2026-05-18 15:53:39 -07:00