From 979053ea4f4eb6c2b6782a1a40c8b41d22a7e711 Mon Sep 17 00:00:00 2001 From: Abubeker Yasin Date: Thu, 27 Aug 2026 11:37:54 +0300 Subject: [PATCH] feat(auth): stage passenger sign-in on a single identifier field --- apps/edr-passenger-api/src/app.module.ts | 19 +- .../src/common/utils/phone.utils.ts | 77 +++ .../src/modules/auth/auth.controller.ts | 67 ++- .../src/modules/auth/auth.dto.ts | 61 +- .../modules/auth/passenger-auth.service.ts | 291 ++++++++- .../src/modules/bookings/bookings.service.ts | 34 +- .../portal/src/app/login/page.tsx | 560 +++++++++++++++--- .../portal/src/app/reset-password/page.tsx | 5 +- .../portal/src/app/verify-account/page.tsx | 12 +- .../portal/src/components/AppSidebar.tsx | 12 +- .../src/components/ChangePasswordModal.tsx | 5 +- .../src/components/FaydaSetupWizard.tsx | 5 +- .../portal/src/lib/api/auth.ts | 36 ++ .../portal/src/lib/auth-store.ts | 11 +- .../portal/src/lib/password.ts | 21 + 15 files changed, 1034 insertions(+), 182 deletions(-) create mode 100644 apps/edr-passenger-api/src/common/utils/phone.utils.ts create mode 100644 apps/edr-passenger-web/portal/src/lib/password.ts diff --git a/apps/edr-passenger-api/src/app.module.ts b/apps/edr-passenger-api/src/app.module.ts index bd8372b29..e3b85c21f 100644 --- a/apps/edr-passenger-api/src/app.module.ts +++ b/apps/edr-passenger-api/src/app.module.ts @@ -3,6 +3,7 @@ import { APP_FILTER } from "@nestjs/core"; import { ConfigModule, ConfigService } from "@nestjs/config"; import { ScheduleModule } from "@nestjs/schedule"; import { EventEmitterModule } from "@nestjs/event-emitter"; +import { ThrottlerModule } from "@nestjs/throttler"; import { TypeOrmModule, TypeOrmModuleOptions } from "@nestjs/typeorm"; import { IamBaselineSeeder, IamSeedModule } from "@edr/iam-seed"; import { IamModule as TriaIamModule } from "@tria-plc/iamapi-common/iam.module"; @@ -82,6 +83,17 @@ import { EOtpType } from "@tria-plc/iamapi-common"; }), ScheduleModule.forRoot(), EventEmitterModule.forRoot(), + // Named tiers only — no APP_GUARD is registered, so nothing is throttled until a + // controller opts in with @UseGuards(ThrottlerGuard). AuthController is currently the + // only one that does, because the staged sign-in exposes an account-existence lookup. + ThrottlerModule.forRoot([ + // 20/min, not the 5/min the commented-out decorators suggested: the staged sign-in + // legitimately costs 3-5 calls (lookup → request code → resend → complete → a retry + // after a typo), and the throttler keys on IP, so users sharing a NAT or mobile CGNAT + // address share the budget. 5 would lock real passengers out. + { name: "auth", limit: 20, ttl: 60_000 }, + { name: "strict", limit: 20, ttl: 60_000 }, + ]), TypeOrmModule.forRootAsync({ inject: [ConfigService], useFactory: (config: ConfigService): TypeOrmModuleOptions => @@ -97,8 +109,11 @@ import { EOtpType } from "@tria-plc/iamapi-common"; `Your EDR Passenger phone verification code is ${otp}. It will expire in 5 minutes.`, [EOtpType.RESET_PASSWORD]: ({ route }) => `Reset your EDR Passenger password using this link: ${route}`, - [EOtpType.SET_PASSWORD]: ({ route }) => - `Set your EDR Passenger password using this link: ${route}`, + // Carries the bare code as well as the link: the staged sign-in asks for the code + // inline, while the link is still what a `/set-password` deep link from an older SMS + // relies on. `OtpMessageContext` supplies both. + [EOtpType.SET_PASSWORD]: ({ otp, route }) => + `Your EDR Passenger code is ${otp}. Or set your password here: ${route}`, }, }), // Replaces the package's DataSeeder. Shared with edr-freight-api, which diff --git a/apps/edr-passenger-api/src/common/utils/phone.utils.ts b/apps/edr-passenger-api/src/common/utils/phone.utils.ts new file mode 100644 index 000000000..73ca8dc16 --- /dev/null +++ b/apps/edr-passenger-api/src/common/utils/phone.utils.ts @@ -0,0 +1,77 @@ +/** + * Phone normalisation shared by any lookup that has to match a number a customer typed + * against one already stored. Ethiopian numbers reach us in three interchangeable shapes + * (+2519…, 2519…, 09…) depending on whether they came from IAM, a guest booking form or a + * saved profile, so an exact-string match silently misses. + */ + +/** + * Returns all plausible normalised variants of a raw phone string so that the + * DB query matches regardless of how the number was stored (local 09… vs international +251…). + * Returns an empty array when the input is clearly invalid (< 7 digits). + */ +export function normalizePhoneVariants(raw: string): string[] { + // Strip whitespace, dashes, dots, parentheses — keep digits and a leading + + const stripped = raw.replace(/[^\d+]/g, ''); + const digits = stripped.replace(/^\+/, ''); + if (digits.length < 7) return []; + + const variants = new Set([stripped]); + + if (stripped.startsWith('+251') && digits.length === 12) { + // +251 9XXXXXXXX → 251 9XXXXXXXX (no +) → 09XXXXXXXX + variants.add(digits); // 251XXXXXXXXX + variants.add('0' + digits.slice(3)); // 09XXXXXXXXX + } else if (stripped.startsWith('251') && digits.length === 12) { + // 251 9XXXXXXXX → +251 9XXXXXXXX → 09XXXXXXXX + variants.add('+' + stripped); // +251XXXXXXXXX + variants.add('0' + digits.slice(3)); // 09XXXXXXXXX + } else if (stripped.startsWith('0') && digits.length === 10) { + // 09XXXXXXXX → +251 9XXXXXXXX → 251 9XXXXXXXX (no +) + variants.add('+251' + digits.slice(1)); // +251XXXXXXXXX + variants.add('251' + digits.slice(1)); // 251XXXXXXXXX + } else if (!stripped.startsWith('+') && digits.length >= 9) { + // bare international digits without + + variants.add('+' + digits); + } + + return [...variants]; +} + +/** + * A sign-in identifier is a single free-text field: the passenger types either an email + * address or a phone number and the server works out which. Phone is the default reading — + * an email must contain an `@` with something either side of it, everything else is treated + * as a number so that malformed emails don't silently fall through to a phone lookup that + * can never match. + */ +export type ResolvedIdentifier = { + kind: 'email' | 'phone'; + /** Lower-cased email, or null when the input is a phone number. */ + email: string | null; + /** Every stored shape the number could have, or [] when the input is an email. */ + phoneVariants: string[]; +}; + +const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; + +export function resolveIdentifier(raw: string): ResolvedIdentifier { + const trimmed = raw.trim(); + if (EMAIL_RE.test(trimmed)) { + return { kind: 'email', email: trimmed.toLowerCase(), phoneVariants: [] }; + } + return { kind: 'phone', email: null, phoneVariants: normalizePhoneVariants(trimmed) }; +} + +/** + * `+251912345678` → `+2519****678`. Shown on the OTP screen so the passenger can tell which + * number the code went to without the server handing back the full number to an unauthenticated + * caller. + */ +export function maskPhone(phone: string): string { + const stripped = phone.replace(/[^\d+]/g, ''); + if (stripped.length <= 7) return stripped; + const head = stripped.slice(0, stripped.startsWith('+') ? 5 : 4); + const tail = stripped.slice(-3); + return `${head}${'*'.repeat(4)}${tail}`; +} diff --git a/apps/edr-passenger-api/src/modules/auth/auth.controller.ts b/apps/edr-passenger-api/src/modules/auth/auth.controller.ts index 96ad8a178..ce076c970 100644 --- a/apps/edr-passenger-api/src/modules/auth/auth.controller.ts +++ b/apps/edr-passenger-api/src/modules/auth/auth.controller.ts @@ -21,6 +21,7 @@ import { ApiBearerAuth, } from "@nestjs/swagger"; import { IsPublic } from "@tria-plc/api-common/modules/auth/decorators/public.decorator"; +import { Throttle, ThrottlerGuard } from "@nestjs/throttler"; import { PassengerAuthService } from "./passenger-auth.service"; import { RegisterDto, @@ -28,12 +29,19 @@ import { ResendRegistrationCodeDto, FaydaRequestPasswordSetupDto, FaydaVerifyAndLoginDto, + IdentifierLookupDto, + PasswordSetupRequestDto, + PasswordSetupCompleteDto, } from "./auth.dto"; import { JwtGuard } from "../../common/jwt.guard"; @ApiTags("Passenger Auth") @Controller("auth") -// @Throttle({ auth: { limit: 5, ttl: 60_000 } }) +// Scoped to this controller rather than registered as a global APP_GUARD: the staged sign-in +// exposes an account-existence lookup, and rate limiting is the mitigation for it. Applying the +// guard app-wide would change the behaviour of every other module at the same time. +@UseGuards(ThrottlerGuard) +@Throttle({ auth: { limit: 20, ttl: 60_000 } }) export class AuthController { constructor(private passengerAuthService: PassengerAuthService) {} @@ -189,6 +197,63 @@ export class AuthController { return this.passengerAuthService.resetUserPassword(id, body.tempPassword); } + @Post("identifier/lookup") + @IsPublic() + @HttpCode(HttpStatus.OK) + // Tighter than the rest of the controller: this is the endpoint that answers "does this + // account exist", so it is the one worth making expensive to sweep. Still roomy enough + // that a passenger correcting a typo two or three times is unaffected. + @Throttle({ auth: { limit: 10, ttl: 60_000 } }) + @ApiOperation({ + summary: "Step 1 of sign-in — decide what to ask the user for next", + description: + "Takes a phone number or an email and reports whether the account exists and whether it " + + "already has a password. PASSWORD → ask for the password. NEEDS_PASSWORD_SETUP → send a " + + "code and let them set one. NOT_FOUND → sign them up.", + }) + @ApiResponse({ + status: 200, + description: "{ status, method?, maskedPhone? } — never returns email or user id", + }) + @ApiBody({ type: IdentifierLookupDto }) + lookupIdentifier(@Body() dto: IdentifierLookupDto) { + return this.passengerAuthService.lookupIdentifier(dto.identifier); + } + + @Post("password-setup/request") + @IsPublic() + @HttpCode(HttpStatus.OK) + @ApiOperation({ + summary: "Send the SMS code that lets an account with no password set one", + description: + "Covers Fayda-created accounts and abandoned registrations alike. Always returns " + + "{ sent: true } regardless of whether the account exists.", + }) + @ApiResponse({ status: 200, description: "{ sent: true }" }) + @ApiBody({ type: PasswordSetupRequestDto }) + requestPasswordSetup(@Body() dto: PasswordSetupRequestDto, @Request() req: any) { + return this.passengerAuthService.requestPasswordSetup(dto.identifier, req); + } + + @Post("password-setup/complete") + @IsPublic() + @HttpCode(HttpStatus.OK) + @ApiOperation({ + summary: "Redeem the code, set the password, and sign in", + description: + "Accepts both set-password codes (from password-setup/request) and verify-phone-number " + + "codes (from POST /auth/register), so one screen finishes both branches.", + }) + @ApiResponse({ + status: 200, + description: "Same shape as POST /auth/login — token, refreshToken and user.", + }) + @ApiResponse({ status: 401, description: "Invalid or expired code" }) + @ApiBody({ type: PasswordSetupCompleteDto }) + completePasswordSetup(@Body() dto: PasswordSetupCompleteDto) { + return this.passengerAuthService.completePasswordSetup(dto); + } + @Post("fayda/request-password-setup") @IsPublic() @HttpCode(HttpStatus.OK) diff --git a/apps/edr-passenger-api/src/modules/auth/auth.dto.ts b/apps/edr-passenger-api/src/modules/auth/auth.dto.ts index d7d80df94..76e748f93 100644 --- a/apps/edr-passenger-api/src/modules/auth/auth.dto.ts +++ b/apps/edr-passenger-api/src/modules/auth/auth.dto.ts @@ -1,4 +1,11 @@ -import { IsEmail, IsNotEmpty, IsString, ValidateNested } from 'class-validator'; +import { + IsEmail, + IsNotEmpty, + IsString, + IsStrongPassword, + Length, + ValidateNested, +} from 'class-validator'; import { Type } from 'class-transformer'; import { ApiProperty } from '@nestjs/swagger'; @@ -75,3 +82,55 @@ export class FaydaVerifyAndLoginDto { @IsString() otp: string; } + +/** + * Step 1 of the staged sign-in. One field: the passenger types either their phone number + * or their email and the server decides which of the three branches follows. + */ +export class IdentifierLookupDto { + @ApiProperty({ + example: '+251912345678', + description: 'Phone number or email address — the server detects which', + }) + @IsString() + @IsNotEmpty() + identifier: string; +} + +/** Step 2a: ask for the SMS code that lets an account with no password set one. */ +export class PasswordSetupRequestDto { + @ApiProperty({ example: '+251912345678', description: 'Phone number or email address' }) + @IsString() + @IsNotEmpty() + identifier: string; +} + +/** Step 2b: redeem the code, set the password, and receive a session in one call. */ +export class PasswordSetupCompleteDto { + @ApiProperty({ example: '+251912345678', description: 'Phone number or email address' }) + @IsString() + @IsNotEmpty() + identifier: string; + + @ApiProperty({ example: '123456', description: '6-digit code received via SMS' }) + @IsString() + @Length(4, 10) + otp: string; + + // The credential is written directly against iam.user_credentials rather than through + // the IAM's own set-password route, so the IAM's @IsStrongPassword rule has to be + // restated here or weak passwords would slip in unvalidated. + @ApiProperty({ example: 'Str0ng!Pass', format: 'password' }) + @IsStrongPassword({ + minLength: 8, + minLowercase: 1, + minUppercase: 1, + minNumbers: 1, + minSymbols: 1, + }) + newPassword: string; + + @ApiProperty({ example: 'Str0ng!Pass', format: 'password' }) + @IsString() + confirmPassword: string; +} diff --git a/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts b/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts index 51c57fec8..ea0b201c6 100644 --- a/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts +++ b/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts @@ -1,4 +1,5 @@ import { + BadRequestException, Injectable, ConflictException, InternalServerErrorException, @@ -13,7 +14,22 @@ import { AuthService as IamAuthService } from '@tria-plc/iamapi-common/module/au import { EUserType } from '@tria-plc/api-common/utils/enums/user.enum'; import { EOtpType } from '@tria-plc/iamapi-common/enums/otp.enum'; import { PrismaService } from '../../common/prisma.service'; -import { RegisterDto, LoginDto } from './auth.dto'; +import { RegisterDto, LoginDto, PasswordSetupCompleteDto } from './auth.dto'; +import { maskPhone, resolveIdentifier } from '../../common/utils/phone.utils'; + +/** + * The `iam.users` columns every sign-in branch needs. Kept separate from `IamUserRow` + * (which is profile-shaped) because the auth branches key off credential state, not metadata. + */ +type IamAuthRow = { + id: string; + email: string | null; + name: { en: string; am: string } | null; + username: string; + phone_number: string | null; + has_set_password: boolean; + verified_by: string | null; +}; type IamUserRow = { id: string; @@ -170,9 +186,19 @@ export class PassengerAuthService { async login(dto: LoginDto, req: any) { const iamAuthService = await this.resolveIamAuthService(req); + // `dto.email` may hold an email OR a phone number, in any of the shapes a passenger might + // type. Resolve it to the exact string the IAM stores before handing it over: the IAM + // matches the identifier literally, so someone entering `0912…` for a number stored as + // `+2519…` would be told their credentials are invalid despite a correct password. + const known = await this.findUserByIdentifier(dto.email); + const loginIdentifier = known?.email ?? known?.phone_number ?? dto.email; + let iamResult: { token: string; refreshToken: string } | { mfaRequired: boolean }; try { - iamResult = await iamAuthService.login({ email: dto.email, password: dto.password }); + iamResult = await iamAuthService.login({ + email: loginIdentifier, + password: dto.password, + }); } catch { this.eventEmitter.emit('auth.login.failed', { email: dto.email }); throw new UnauthorizedException('Invalid credentials'); @@ -184,14 +210,16 @@ export class PassengerAuthService { const { token, refreshToken } = iamResult as { token: string; refreshToken: string }; - // `dto.email` may hold an email OR a phone number (passengers without an email log in - // with their phone). Match on either so the post-auth lookup works regardless of which - // identifier was used. - const iamRows = await this.dataSource.query( - `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE email = $1 OR phone_number = $1 LIMIT 1`, - [dto.email], - ); - const iamUser = iamRows[0]; + // `known` is the same row the identifier resolved to; only fall back to a fresh lookup if + // the resolve missed but the IAM authenticated anyway. + let iamUser: { id: string; email: string | null } | null = known; + if (!iamUser) { + const iamRows = await this.dataSource.query( + `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE email = $1 OR phone_number = $1 LIMIT 1`, + [loginIdentifier], + ); + iamUser = iamRows[0] ?? null; + } if (!iamUser) { throw new InternalServerErrorException('IAM user not found after successful authentication'); } @@ -496,19 +524,26 @@ export class PassengerAuthService { } async resetUserPassword(id: string, tempPassword: string) { + await this.writeActiveCredential(id, tempPassword); + return { success: true, message: 'Password reset successfully' }; + } + + /** + * Replaces the user's active credential. The IAM keeps credential history and relies on + * exactly one row per user having `is_active = true`, so the old row is deactivated in the + * same call rather than deleted. + */ + private async writeActiveCredential(userId: string, password: string): Promise { const { hashPassword } = await import('@tria-plc/api-common/utils/argon'); - const passwordHash = await hashPassword(tempPassword); - // Deactivate existing credentials first (IAM keeps history, only one active at a time) + const passwordHash = await hashPassword(password); await this.dataSource.query( `UPDATE iam.user_credentials SET is_active = false WHERE user_id = $1 AND is_active = true`, - [id], + [userId], ); - // Insert new active credential await this.dataSource.query( `INSERT INTO iam.user_credentials (user_id, password, is_active) VALUES ($1, $2, true)`, - [id, passwordHash], + [userId, passwordHash], ); - return { success: true, message: 'Password reset successfully' }; } async requestFaydaPasswordSetup(phoneNumber: string, req: any): Promise<{ sent: boolean }> { @@ -554,15 +589,45 @@ export class PassengerAuthService { if (!users.length) throw new UnauthorizedException('Invalid phone number or OTP'); const u = users[0]; + await this.consumeSetupOtp(u.id, otp, 'Invalid phone number or OTP'); + + const { token, refreshToken } = await this.mintSession( + { ...u, verified_by: 'fayda' }, + 'fayda-otp-setup', + ); + + return { token, refreshToken, requiresPassword: !u.has_set_password, iamUserId: u.id }; + } + + /** + * Verifies and burns a one-time code from `iam.user_verifications`. + * + * Both password-setup entry points land here: `set-password` codes come from + * `password-setup/request`, `verify-phone-number` codes from `POST /auth/register`. Accepting + * both is what lets a single screen finish the "existing account with no password" branch and + * the "brand new signup" branch. + * + * Codes are argon2-hashed at rest, so this is a verify rather than an equality check. The + * attempt counter is incremented *before* the comparison so a crash mid-verify still costs an + * attempt, and the code is burned on the 6th try. + */ + private async consumeSetupOtp( + userId: string, + otp: string, + failureMessage = 'Invalid or expired code', + ): Promise { const verifications = await this.dataSource.query<{ id: string; verification_code: string; attempt_count: number; }[]>( `SELECT id, verification_code, attempt_count FROM iam.user_verifications - WHERE user_id = $1 AND otp_type = 'set-password' AND "isUsed" = false AND expires_at > NOW() + WHERE user_id = $1 + AND otp_type IN ('set-password', 'verify-phone-number') + AND "isUsed" = false + AND expires_at > NOW() ORDER BY created_at DESC LIMIT 1`, - [u.id], + [userId], ); - if (!verifications.length) throw new UnauthorizedException('Invalid phone number or OTP'); + if (!verifications.length) throw new UnauthorizedException(failureMessage); const v = verifications[0]; if (v.attempt_count >= 5) { @@ -578,12 +643,24 @@ export class PassengerAuthService { const { verifyPassword } = await import('@tria-plc/api-common/utils/argon'); const valid = await verifyPassword(otp, v.verification_code); - if (!valid) throw new UnauthorizedException('Invalid phone number or OTP'); + if (!valid) throw new UnauthorizedException(failureMessage); await this.dataSource.query( `UPDATE iam.user_verifications SET "isUsed" = true WHERE id = $1`, [v.id], ); + } + /** + * Inserts (or refreshes) an `iam.sessions` row and mints the token pair for it. The JWT payload + * is only the session id — `JwtGuard` resolves everything else from the table. + * + * `device` participates in a unique constraint on `(user_id, device)`, so each flow passes its + * own value and none of them clobbers a session another flow established. + */ + private async mintSession( + u: IamAuthRow, + device: string, + ): Promise<{ token: string; refreshToken: string }> { const userInfo = { id: u.id, email: u.email ?? '', @@ -604,19 +681,183 @@ export class PassengerAuthService { const sessions = await this.dataSource.query<{ id: string }[]>( `INSERT INTO iam.sessions (id, email, device, "userInfo", expiry_time, refresh_count, status, user_id) - VALUES (gen_random_uuid(), $1, 'fayda-otp-setup', $2::jsonb, NOW() + INTERVAL '1 day', 0, 'ACTIVE', $3) + VALUES (gen_random_uuid(), $1, $2, $3::jsonb, NOW() + INTERVAL '1 day', 0, 'ACTIVE', $4) ON CONFLICT (user_id, device) DO UPDATE SET status = 'ACTIVE', "userInfo" = EXCLUDED."userInfo", expiry_time = NOW() + INTERVAL '1 day', updated_at = NOW() RETURNING id`, - [u.email ?? '', JSON.stringify(userInfo), u.id], + [u.email ?? '', device, JSON.stringify(userInfo), u.id], ); const { generateToken, generateRefreshToken } = await import('@tria-plc/api-common/utils/token'); - const token = generateToken({ id: sessions[0].id }); - const refreshToken = generateRefreshToken({ id: sessions[0].id }); + return { + token: generateToken({ id: sessions[0].id }), + refreshToken: generateRefreshToken({ id: sessions[0].id }), + }; + } - return { token, refreshToken, requiresPassword: !u.has_set_password, iamUserId: u.id }; + /** + * Resolves the single sign-in identifier field to an `iam.users` row. + * + * A phone number reaches us in three interchangeable shapes (`+2519…`, `2519…`, `09…`) + * depending on whether the account was created by IAM signup, a guest booking or Fayda, so + * matching on one canonical form silently misses. `normalizePhoneVariants` produces every + * shape and the query matches any of them. + * + * `ORDER BY has_set_password DESC` makes a fully-registered account win over a leftover + * pending row that shares the same phone — otherwise a passenger with an abandoned signup + * would be pushed into password setup for an account they already finished. + */ + private async findUserByIdentifier(identifier: string): Promise { + const resolved = resolveIdentifier(identifier); + if (!resolved.email && resolved.phoneVariants.length === 0) return null; + + const rows = await this.dataSource.query( + `SELECT id, email, name, username, phone_number, has_set_password, verified_by + FROM iam.users + WHERE ($1::text IS NOT NULL AND lower(email) = $1) + OR phone_number = ANY($2::text[]) + ORDER BY has_set_password DESC + LIMIT 1`, + [resolved.email, resolved.phoneVariants], + ); + return rows[0] ?? null; + } + + /** + * Step 1 of the staged sign-in: decide which of the three branches the portal should render. + * + * This deliberately reports whether an account exists — the whole point of the flow is that the + * passenger stops guessing — so it is a user-enumeration oracle by design. `POST + * /v1/auth/forgot-password` already leaks the same fact by throwing `user_not_found`; the + * mitigation here is the throttle on this controller, not secrecy. Nothing identifying is + * returned: no email, no user id, and the phone only ever masked. + */ + async lookupIdentifier(identifier: string): Promise<{ + status: 'PASSWORD' | 'NEEDS_PASSWORD_SETUP' | 'NOT_FOUND'; + method?: 'fayda' | 'pending'; + maskedPhone?: string; + }> { + const user = await this.findUserByIdentifier(identifier); + if (!user) return { status: 'NOT_FOUND' }; + if (user.has_set_password) return { status: 'PASSWORD' }; + + return { + status: 'NEEDS_PASSWORD_SETUP', + method: user.verified_by === 'fayda' ? 'fayda' : 'pending', + maskedPhone: user.phone_number ? maskPhone(user.phone_number) : undefined, + }; + } + + /** + * Sends the SMS code that lets an account with no password set one. Covers both Fayda-created + * accounts and abandoned registrations — the distinction only changes the copy the portal + * shows, not what happens here. + * + * Always resolves `{ sent: true }`. Returning a real result would make this a cheaper + * enumeration oracle than `lookupIdentifier`, which at least sits behind the same throttle. + */ + async requestPasswordSetup(identifier: string, req: any): Promise<{ sent: boolean }> { + const user = await this.findUserByIdentifier(identifier); + if (!user || user.has_set_password) return { sent: true }; + + if (!user.phone_number) { + // OTP delivery is SMS + in-app only; there is no email channel. Every account-creation + // path requires a phone, so this should be unreachable — log it rather than fail silently. + this.logger.warn( + `requestPasswordSetup: user ${user.id} has no phone number — no channel to send a code on`, + ); + return { sent: true }; + } + + const iamAuthService = await this.resolveIamAuthService(req); + try { + await iamAuthService.generateVerificationCode({ + // Both fields must match the stored row exactly: the IAM looks the user up with + // `where: { phoneNumber, email }`, which is AND, not OR. Passing the values we just + // read back guarantees the match — including a null email, which TypeORM renders as + // `IS NULL` and which coercing to '' would break. + email: user.email as string, + phoneNumber: user.phone_number, + type: EOtpType.SET_PASSWORD, + }); + } catch (err) { + this.logger.error( + `[PassengerAuthService] password setup code failed for user ${user.id}`, + (err as Error).message, + ); + } + return { sent: true }; + } + + /** + * Redeems the code, writes the password, and returns a session — the passenger lands signed in + * rather than being bounced back to the login form. + * + * Returns the same shape as `login()` so the portal can store the result through one code path. + */ + async completePasswordSetup(dto: PasswordSetupCompleteDto): Promise<{ + token: string; + refreshToken: string; + user: { id: string; iamUserId: string; email: string | null; passengerId: string }; + }> { + if (dto.newPassword !== dto.confirmPassword) { + throw new BadRequestException('Passwords do not match'); + } + + const user = await this.findUserByIdentifier(dto.identifier); + // Same message whether the account is missing or the code is wrong: the branch was already + // disclosed by `lookupIdentifier`, but there is no reason to re-confirm it on every attempt. + if (!user) throw new UnauthorizedException('Invalid or expired code'); + if (user.has_set_password) { + throw new BadRequestException( + 'This account already has a password. Sign in with it instead.', + ); + } + + await this.consumeSetupOtp(user.id, dto.otp); + await this.writeActiveCredential(user.id, dto.newPassword); + + // Redeeming the code proves ownership of the phone, which is what promotes a Fayda-created + // `submitted` row or a pending signup to a usable account. + await this.dataSource.query( + `UPDATE iam.users + SET has_set_password = true, + status = 'accepted', + is_active = true, + is_phone_number_verified = true, + updated_at = NOW() + WHERE id = $1`, + [user.id], + ); + + const { token, refreshToken } = await this.mintSession( + { ...user, has_set_password: true }, + 'password-setup', + ); + + let passenger = await this.prisma.passenger.findUnique({ + where: { iamUserId: user.id }, + select: { id: true }, + }); + if (!passenger) { + const result = await this.provisionPassengerSatellite({ + iamUserId: user.id, + auditAction: 'USER_AUTO_PROVISIONED', + }); + passenger = { id: result.passengerId }; + } + + return { + token, + refreshToken, + user: { + id: user.id, + iamUserId: user.id, + email: user.email, + passengerId: passenger.id, + }, + }; } private standardizePhone(phone: string): string { diff --git a/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts b/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts index fc958be70..01367bdb1 100644 --- a/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts +++ b/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts @@ -13,6 +13,7 @@ import { CurrencyService } from '../currency/currency.service'; import { FareEngineService } from '../fare-engine/fare-engine.service'; import { PaymentsService } from '../payments/payments.service'; import { MAX_PAYMENT_HOURS } from '../../common/utils/payment-deadline.utils'; +import { normalizePhoneVariants } from '../../common/utils/phone.utils'; import { Currency, PassengerCategory, IdDocumentType } from '@prisma/client'; import { JourneyDirection } from '../seats/seats.dto'; import { resolveCurrencyFromNationality } from '../fare-engine/fare-engine.dto'; @@ -46,39 +47,6 @@ function resolvePackageRoundTripTotal( return adultCount * adultFareMinor + paidChildren * adultFareMinor; } -/** - * Returns all plausible normalised variants of a raw phone string so that the - * DB query matches regardless of how the number was stored (local 09… vs international +251…). - * Returns an empty array when the input is clearly invalid (< 7 digits). - */ -function normalizePhoneVariants(raw: string): string[] { - // Strip whitespace, dashes, dots, parentheses — keep digits and a leading + - const stripped = raw.replace(/[^\d+]/g, ''); - const digits = stripped.replace(/^\+/, ''); - if (digits.length < 7) return []; - - const variants = new Set([stripped]); - - if (stripped.startsWith('+251') && digits.length === 12) { - // +251 9XXXXXXXX → 251 9XXXXXXXX (no +) → 09XXXXXXXX - variants.add(digits); // 251XXXXXXXXX - variants.add('0' + digits.slice(3)); // 09XXXXXXXXX - } else if (stripped.startsWith('251') && digits.length === 12) { - // 251 9XXXXXXXX → +251 9XXXXXXXX → 09XXXXXXXX - variants.add('+' + stripped); // +251XXXXXXXXX - variants.add('0' + digits.slice(3)); // 09XXXXXXXXX - } else if (stripped.startsWith('0') && digits.length === 10) { - // 09XXXXXXXX → +251 9XXXXXXXX → 251 9XXXXXXXX (no +) - variants.add('+251' + digits.slice(1)); // +251XXXXXXXXX - variants.add('251' + digits.slice(1)); // 251XXXXXXXXX - } else if (!stripped.startsWith('+') && digits.length >= 9) { - // bare international digits without + - variants.add('+' + digits); - } - - return [...variants]; -} - function calculateAge(dateOfBirth: Date): number { const today = new Date(); let age = today.getFullYear() - dateOfBirth.getFullYear(); diff --git a/apps/edr-passenger-web/portal/src/app/login/page.tsx b/apps/edr-passenger-web/portal/src/app/login/page.tsx index 97a595244..5f7325072 100644 --- a/apps/edr-passenger-web/portal/src/app/login/page.tsx +++ b/apps/edr-passenger-web/portal/src/app/login/page.tsx @@ -1,50 +1,295 @@ 'use client'; -import { useForm } from 'react-hook-form'; -import { zodResolver } from '@hookform/resolvers/zod'; -import { z } from 'zod'; import { useRouter, useSearchParams } from 'next/navigation'; import { useAuthStore } from '@/lib/auth-store'; -import { useState, Suspense } from 'react'; +import { iamAuthApi } from '@/lib/api/auth'; +import { isStrongPassword, PASSWORD_RULE } from '@/lib/password'; +import { useState, useRef, Suspense } from 'react'; import Link from 'next/link'; -import { Train, ShieldCheck, Eye, EyeOff } from 'lucide-react'; +import { Train, Eye, EyeOff, Pencil } from 'lucide-react'; -const loginSchema = z.object({ - // Accepts either an email or a phone number. Passengers who registered without an - // email sign in with their phone number, which is sent in the same `email` field — - // the IAM matches on either identifier. - email: z.string().min(1, 'Phone or email is required'), - password: z.string().min(6, 'Password must be at least 6 characters'), -}); +/** + * Staged sign-in. + * + * The passenger gives one identifier — phone or email — and the server decides which of three + * things happens next. Previously this page asked for identifier *and* password up front and + * offered three competing links underneath ("Create account", "Already verified with Fayda?", + * "Forgot password?"), which made the user guess something only the server knows: whether their + * number has an account, and whether that account has a password yet. Guessing wrong dead-ended. + * + * Now exactly one branch is ever on screen. + */ +type Step = 'identifier' | 'password' | 'setup' | 'signup'; -type LoginForm = z.infer; +const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; + +/** + * Loose enough to accept every shape a passenger might type (`+2519…`, `2519…`, `09…`) and the + * occasional foreign number, strict enough that free text never reaches the signup branch — an + * identifier that is neither an email nor a number would otherwise be stored as a phone the SMS + * code can never reach. Mirrors the 7-digit floor in the API's `normalizePhoneVariants`. + */ +const looksLikePhone = (v: string) => v.replace(/[^\d]/g, '').length >= 7; function LoginContent() { const router = useRouter(); const searchParams = useSearchParams(); const login = useAuthStore((s) => s.login); + const registerUser = useAuthStore((s) => s.register); + const setUser = useAuthStore((s) => s.setUser); + + const [step, setStep] = useState('identifier'); const [error, setError] = useState(''); const [loading, setLoading] = useState(false); const [showPassword, setShowPassword] = useState(false); - const { register, handleSubmit, formState: { errors } } = useForm({ - resolver: zodResolver(loginSchema as any), - }); + // Step 1 + const [identifier, setIdentifier] = useState(''); + const identifierRef = useRef(null); - const onSubmit = async (data: LoginForm) => { + // Step 2 — sign in + const [password, setPassword] = useState(''); + + // Step 3 — set a password (existing account with none, or a fresh signup) + const [maskedPhone, setMaskedPhone] = useState(''); + const [setupMethod, setSetupMethod] = useState<'fayda' | 'pending' | 'new'>('pending'); + const [otp, setOtp] = useState(''); + const [newPassword, setNewPassword] = useState(''); + const [confirmPassword, setConfirmPassword] = useState(''); + const [resendNote, setResendNote] = useState(''); + + // Step 4 — signup + const [fullName, setFullName] = useState(''); + const [secondaryContact, setSecondaryContact] = useState(''); + + const identifierIsEmail = EMAIL_RE.test(identifier.trim()); + + const finish = () => { + const redirect = searchParams.get('redirect') || '/booking/search'; + router.push(redirect); + }; + + const goBackToIdentifier = () => { + setStep('identifier'); + setError(''); + setPassword(''); + setOtp(''); + setNewPassword(''); + setConfirmPassword(''); + setResendNote(''); + // Keep what they typed — they are usually fixing a typo, not starting over — but select + // it, so typing replaces the value instead of appending to it. Without this, clicking + // into a controlled input that still holds the old identifier silently concatenates. + setTimeout(() => identifierRef.current?.select(), 0); + }; + + const apiMessage = (err: any, fallback: string) => + err?.response?.data?.message || fallback; + + // --- Step 1: who are you? --------------------------------------------------- + const submitIdentifier = async (e: React.FormEvent) => { + e.preventDefault(); + const value = identifier.trim(); + if (!value) { + setError('Enter your phone number or email'); + return; + } + if (!EMAIL_RE.test(value) && !looksLikePhone(value)) { + setError('Enter a valid phone number or email address'); + return; + } setLoading(true); setError(''); try { - await login(data.email, data.password); - const redirect = searchParams.get('redirect') || '/booking/search'; - router.push(redirect); + const res = await iamAuthApi.lookupIdentifier(identifier.trim()); + const result = res.data.data; + + if (result.status === 'PASSWORD') { + setStep('password'); + return; + } + if (result.status === 'NEEDS_PASSWORD_SETUP') { + setMaskedPhone(result.maskedPhone || ''); + setSetupMethod(result.method || 'pending'); + // Fire the code now so the next screen is already actionable. It resolves even for + // an unknown identifier, so a failure here is a transport problem, not a verdict. + await iamAuthApi.requestPasswordSetup(identifier.trim()); + setStep('setup'); + return; + } + setStep('signup'); } catch (err: any) { - setError(err.response?.data?.message || 'Login failed. Please check your credentials.'); + setError(apiMessage(err, 'Something went wrong. Please try again.')); } finally { setLoading(false); } }; + // --- Step 2: existing account, has a password ------------------------------- + const submitPassword = async (e: React.FormEvent) => { + e.preventDefault(); + if (!password) { + setError('Enter your password'); + return; + } + setLoading(true); + setError(''); + try { + await login(identifier.trim(), password); + finish(); + } catch (err: any) { + setError(apiMessage(err, 'Incorrect password. Please try again.')); + } finally { + setLoading(false); + } + }; + + // --- Step 3: set a password with the SMS code ------------------------------- + const submitSetup = async (e: React.FormEvent) => { + e.preventDefault(); + if (!otp.trim()) { + setError('Enter the code we sent you'); + return; + } + if (!isStrongPassword(newPassword)) { + setError(PASSWORD_RULE); + return; + } + if (newPassword !== confirmPassword) { + setError('Passwords do not match'); + return; + } + setLoading(true); + setError(''); + try { + const res = await iamAuthApi.completePasswordSetup({ + identifier: identifier.trim(), + otp: otp.trim(), + newPassword, + confirmPassword, + }); + const { token, user } = res.data.data; + // The response carries a real session, so the user lands signed in instead of being + // sent back to the form. `setUser` is the same action `login()` persists through. + setUser(user as any, token); + finish(); + } catch (err: any) { + setError(apiMessage(err, 'That code is not valid. Please try again.')); + } finally { + setLoading(false); + } + }; + + const resend = async () => { + setLoading(true); + setError(''); + setResendNote(''); + try { + await iamAuthApi.requestPasswordSetup(identifier.trim()); + setResendNote('We sent a new code.'); + } catch (err: any) { + setError(apiMessage(err, 'Could not send a new code. Please try again.')); + } finally { + setLoading(false); + } + }; + + // --- Step 4: no account yet -------------------------------------------------- + const submitSignup = async (e: React.FormEvent) => { + e.preventDefault(); + const name = fullName.trim(); + const other = secondaryContact.trim(); + if (name.length < 2) { + setError('Enter your full name'); + return; + } + // A phone is always required — the verification code is sent by SMS and there is no + // email channel for it. An email is optional. + if (identifierIsEmail) { + if (!other) { + setError('Enter your phone number'); + return; + } + if (!looksLikePhone(other)) { + setError('Enter a valid phone number — your verification code is sent by SMS'); + return; + } + } else if (other && !EMAIL_RE.test(other)) { + // Only validate the shape when they actually typed something. + setError('Enter a valid email address'); + return; + } + + const phone = identifierIsEmail ? other : identifier.trim(); + // The IAM requires a non-empty account identifier in its `email` field but never checks + // that it is email-shaped, so a passenger with no email address signs up under their phone + // number — the same fallback `/register` uses. Both then match on either identifier. + const email = identifierIsEmail ? identifier.trim() : other || phone; + + setLoading(true); + setError(''); + try { + await registerUser({ fullName: name, email, phone }); + setMaskedPhone(phone); + setSetupMethod('new'); + setStep('setup'); + } catch (err: any) { + if (err?.response?.status === 409) { + setError('An account with this email or phone number already exists. Go back and sign in.'); + } else { + setError(apiMessage(err, 'Could not create your account. Please try again.')); + } + } finally { + setLoading(false); + } + }; + + /** + * The identifier, shown on every step after the first, with one way back to change it. + * + * It is a real `autocomplete="username"` input rather than a ``, and it is rendered + * *inside* each form. That is what makes password managers behave: a password field sitting + * alone in a form gives Chrome nothing to match a saved credential against, so it fills + * whichever password it holds for the origin — a password belonging to some other account. + * Pairing it with the username lets the manager fill the right credential, or none at all. + */ + const identifierChip = ( +
+ e.currentTarget.blur()} + className="flex-1 min-w-0 truncate bg-transparent border-0 p-0 text-sm text-gray-700 dark:text-gray-300 focus:outline-none focus:ring-0 cursor-default" + /> + +
+ ); + + const heading = { + identifier: { title: 'Sign in', subtitle: 'Enter your phone number or email to continue' }, + password: { title: 'Welcome back', subtitle: 'Enter your password to sign in' }, + setup: { title: 'Set your password', subtitle: 'Enter the code we sent, then choose a password' }, + signup: { title: 'Create your account', subtitle: 'We just need a couple of details' }, + }[step]; + + const setupBlurb = + setupMethod === 'fayda' + ? 'Your Fayda-verified account does not have a password yet.' + : setupMethod === 'new' + ? 'Your account is almost ready.' + : 'You started signing up but never chose a password.'; + return (
@@ -54,86 +299,227 @@ function LoginContent() {
-

Sign in

-

Welcome back

+

{heading.title}

+

{heading.subtitle}

-
- {error && ( -
- {error} -
- )} - -
- - - {errors.email && ( -

{errors.email.message}

- )} + {error && ( +
+ {error}
+ )} -
- -
+ {step === 'identifier' && ( + +
+ + { setIdentifier(e.target.value); setError(''); }} + className="input-field" + placeholder="+251912345678 or your@email.com" + autoComplete="username" + autoCapitalize="none" + autoCorrect="off" + spellCheck={false} + autoFocus + /> +
+ + + )} + + {step === 'password' && ( +
+ {identifierChip} +
+ +
+ { setPassword(e.target.value); setError(''); }} + className="input-field pr-10" + placeholder="••••••••" + autoComplete="current-password" + autoFocus + /> + +
+
+ + Forgot password? + +
+
+ +
+ )} + + {step === 'setup' && ( +
+ {identifierChip} +

+ {setupBlurb}{' '} + {maskedPhone + ? <>We sent a code to {maskedPhone}. + : 'We sent a code to your registered phone.'} +

+ +
+ + { setOtp(e.target.value); setError(''); }} + className="input-field tracking-widest" + placeholder="A1b2C3" + // The IAM issues codes with generateRandomString(6): letters and digits, + // and case-sensitive — so no numeric keypad and no autocapitalise. + inputMode="text" + autoComplete="one-time-code" + autoCapitalize="none" + autoCorrect="off" + spellCheck={false} + maxLength={6} + autoFocus + /> +
+ +
+ +
+ { setNewPassword(e.target.value); setError(''); }} + className="input-field pr-10" + placeholder="••••••••" + autoComplete="new-password" + /> + +
+

{PASSWORD_RULE}

+
+ +
+ { setConfirmPassword(e.target.value); setError(''); }} + className="input-field" placeholder="••••••••" + autoComplete="new-password" /> -
- {errors.password && ( -

{errors.password.message}

- )} -
- - Forgot password? - + + + +
+ {resendNote ? ( + {resendNote} + ) : ( + + )}
-
+
+ )} - - + {step === 'signup' && ( +
+ {identifierChip} +

+ We couldn't find an account for that {identifierIsEmail ? 'email' : 'number'}, so + let's create one. +

-
-
- Don't have an account? - - Create account - -
- - - Already verified with Fayda? Set up your password - -
+
+ + { setFullName(e.target.value); setError(''); }} + className="input-field" + placeholder="e.g. Abebe Kebede" + autoComplete="name" + autoFocus + /> +
-
+
+ + { setSecondaryContact(e.target.value); setError(''); }} + className="input-field" + placeholder={identifierIsEmail ? '+251912345678' : 'your@email.com'} + autoComplete={identifierIsEmail ? 'tel' : 'email'} + /> +

+ {identifierIsEmail + ? "We'll text your verification code to this number." + : "For receipts and booking confirmations. Your verification code is sent by SMS either way."} +

+
+ + + + )} + +
) : ( -
+
- Sign in - - - Register + Sign in or register
)} diff --git a/apps/edr-passenger-web/portal/src/components/ChangePasswordModal.tsx b/apps/edr-passenger-web/portal/src/components/ChangePasswordModal.tsx index a20301e85..4edf30b64 100644 --- a/apps/edr-passenger-web/portal/src/components/ChangePasswordModal.tsx +++ b/apps/edr-passenger-web/portal/src/components/ChangePasswordModal.tsx @@ -4,6 +4,7 @@ import { useState } from 'react'; import { createPortal } from 'react-dom'; import { X, CheckCircle } from 'lucide-react'; import { iamAuthApi } from '@/lib/api/auth'; +import { isStrongPassword, PASSWORD_RULE } from '@/lib/password'; interface ChangePasswordModalProps { isOpen: boolean; @@ -32,8 +33,8 @@ export default function ChangePasswordModal({ isOpen, onClose }: ChangePasswordM const handleSubmit = async (e: React.FormEvent) => { e.preventDefault(); setError(''); - if (newPassword.length < 6) { - setError('New password must be at least 6 characters.'); + if (!isStrongPassword(newPassword)) { + setError(PASSWORD_RULE); return; } if (newPassword !== confirmPassword) { diff --git a/apps/edr-passenger-web/portal/src/components/FaydaSetupWizard.tsx b/apps/edr-passenger-web/portal/src/components/FaydaSetupWizard.tsx index 92f3843fc..535739c1d 100644 --- a/apps/edr-passenger-web/portal/src/components/FaydaSetupWizard.tsx +++ b/apps/edr-passenger-web/portal/src/components/FaydaSetupWizard.tsx @@ -5,6 +5,7 @@ import { useRouter } from 'next/navigation'; import Link from 'next/link'; import { Train, ShieldCheck, CheckCircle, Info, ArrowLeft, ArrowRight } from 'lucide-react'; import { iamAuthApi } from '@/lib/api/auth'; +import { isStrongPassword, PASSWORD_RULE } from '@/lib/password'; interface FaydaSetupWizardProps { // Prefilled OTP when landing from the SMS link (/set-password?verificationCode=...) @@ -41,8 +42,8 @@ export default function FaydaSetupWizard({ initialOtp }: FaydaSetupWizardProps) const handleSetPassword = async (e: React.FormEvent) => { e.preventDefault(); setError(''); - if (newPassword.length < 6) { - setError('Password must be at least 6 characters.'); + if (!isStrongPassword(newPassword)) { + setError(PASSWORD_RULE); return; } if (newPassword !== confirmPassword) { diff --git a/apps/edr-passenger-web/portal/src/lib/api/auth.ts b/apps/edr-passenger-web/portal/src/lib/api/auth.ts index b37361238..b7703d1b6 100644 --- a/apps/edr-passenger-web/portal/src/lib/api/auth.ts +++ b/apps/edr-passenger-web/portal/src/lib/api/auth.ts @@ -36,6 +36,42 @@ export const iamAuthApi = { headers: { Authorization: `Bearer ${localStorage.getItem('auth_token')}` }, }), + // --- Staged sign-in (/login) ------------------------------------------------- + // Step 1: hand the server one field and let it say which branch follows. `identifier` + // is a phone number or an email; the server works out which. + lookupIdentifier: (identifier: string) => + axios.post<{ + success: boolean; + data: { + status: 'PASSWORD' | 'NEEDS_PASSWORD_SETUP' | 'NOT_FOUND'; + method?: 'fayda' | 'pending'; + maskedPhone?: string; + }; + }>(`${API_URL}/auth/identifier/lookup`, { identifier }), + + // Step 2a: SMS the code for an account that exists but has no password yet. + // Always resolves — the server reports { sent: true } even for an unknown identifier. + requestPasswordSetup: (identifier: string) => + axios.post(`${API_URL}/auth/password-setup/request`, { identifier }), + + // Step 2b: redeem the code and set the password. Unlike the older Fayda dance this + // returns a usable session directly, so the user lands signed in rather than back on + // the login form. Same response shape as POST /auth/login. + completePasswordSetup: (data: { + identifier: string; + otp: string; + newPassword: string; + confirmPassword: string; + }) => + axios.post<{ + success: boolean; + data: { + token: string; + refreshToken: string; + user: { id: string; iamUserId: string; email: string | null; passengerId: string }; + }; + }>(`${API_URL}/auth/password-setup/complete`, data), + faydaRequestPasswordSetup: (phoneNumber: string) => axios.post(`${API_URL}/auth/fayda/request-password-setup`, { phoneNumber }), diff --git a/apps/edr-passenger-web/portal/src/lib/auth-store.ts b/apps/edr-passenger-web/portal/src/lib/auth-store.ts index 0d6e46fd9..443fa46a8 100644 --- a/apps/edr-passenger-web/portal/src/lib/auth-store.ts +++ b/apps/edr-passenger-web/portal/src/lib/auth-store.ts @@ -113,13 +113,10 @@ export const useAuthStore = create((set, get) => ({ login: async (email: string, password: string) => { const response: any = await apiClient.post('/auth/login', { email, password }); const { token, user } = response.data || response; - - if (typeof window !== 'undefined') { - localStorage.setItem('auth_token', token); - localStorage.setItem('auth_user', JSON.stringify(user)); - } - - set({ user, token, isAuthenticated: true }); + // `setUser` is the one place a session is persisted. The staged sign-in's + // password-setup branch establishes a session without going through /auth/login, + // so it calls the same action rather than duplicating the storage writes. + get().setUser(user, token); }, register: async (data: RegisterData): Promise => { diff --git a/apps/edr-passenger-web/portal/src/lib/password.ts b/apps/edr-passenger-web/portal/src/lib/password.ts new file mode 100644 index 000000000..42b967d00 --- /dev/null +++ b/apps/edr-passenger-web/portal/src/lib/password.ts @@ -0,0 +1,21 @@ +/** + * The one password rule the portal enforces. + * + * It mirrors class-validator's `@IsStrongPassword` defaults, which is what the IAM applies on + * `PATCH /v1/auth/set-password` and what `POST /auth/password-setup/complete` applies on the + * passenger API. Screens that used a looser check (`length < 6`) accepted passwords the server + * then rejected with an opaque 400, so every screen shares this instead. + */ +export function isStrongPassword(pw: string): boolean { + return ( + pw.length >= 8 && + /[a-z]/.test(pw) && + /[A-Z]/.test(pw) && + /[0-9]/.test(pw) && + /[^A-Za-z0-9]/.test(pw) + ); +} + +/** The rule stated for humans. Shown as helper text and reused as the validation message. */ +export const PASSWORD_RULE = + 'Password must be at least 8 characters and include an upper-case letter, a lower-case letter, a number and a symbol.';