Repository navigation
fix: attempt-scoped flow limits, and login_methods on the registration email OTP path - #486
Merged
Merged
Conversation
verify-email-otp and generate-email-otp answer 403 login_method_disabled for a verified account unless email_otp is a login method. accountVerification is set only for an actual change. Decoys mirror the refusal. Closes #470.
…piry to the attempt A stranger who knows an address can no longer use up or void the owner's codes and links.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #468. Closes #470.
#468: limits and links belong to the attempt
perIdentityon the identifier plus the ephemeral token'sjti(or the requester's IP when there is none), so another attempt for the same address keeps its own allowance.perIdentity(20 per window by default), so minting fresh attempts cannot message an address without bound. Hardcoded multiplier rather than a new config key, to avoid a types release;FLOW_RATE_LIMITSkeeps its shape.POST /magic-linkexpires only the same attempt's earlier links.#470: registration email OTP honours login_methods
/otp/verify-email-otpand/otp/generate-email-otpanswer403 login_method_disabledfor an already verified account whenemail_otpis off (this also covers the passkey-required rule). Unverified accounts still get their registration code.accountVerification: trueonly for an actual unverified-to-verified change. Decoy responders refuse the same way.For review
email_otpoff, the 403 on the registration path tells a caller a verified account exists. That was already true for passkey-required and phishing-resistant-only accounts; the alternative is a silent 200 with no send./registration/registerstill mails an (unusable for sign-in) code to an existing verified account whenemail_otpis off. Left as is.magicLink.perIp(20) equals the cross-attempt cap, so one network location can still reach the magic link cap for an address; documented.Checks
typecheck, lint, prettier, build, coverage (142 files, 2003 tests; statements 98.9%, branches 95.41%). Tests added fail with the src changes reverted (10 for #470, 18 for #468).