Auth Fix

Fixed an issue where the user would be redirected to a localhost address because an auth url was not set in the env.

src/auth.ts

@@ -3,44 +3,10 @@ import NextAuth from "next-auth";
 import Credentials from "next-auth/providers/credentials";
 import Google from "next-auth/providers/google";
 import { authConfig } from "@/auth.config";
-import { finalizeOtp, verifyOtp } from "@/lib/auth/otp.service";
+import { authorizeCredentials } from "@/lib/auth/authorize-credentials";
 import { prisma } from "@/lib/db/prisma";
-import { checkRateLimit } from "@/lib/security/rate-limit";
-import { secretsMatch } from "@/lib/security/secrets-match";
 
-/**
- * Two credential shapes, both ending in the same finalizeOtp() call and
- * the same `{id, email, name, image}` return shape — see
- * src/lib/auth/otp.service.ts's own header for the full verify/finalize
- * design this builds on.
- *
- * `{ email, code }` — the normal path, used by sign-in, registration, and
- * (since the "administrator invite verifies via OTP too" work) invitation
- * acceptance as well: verifyOtp then finalizeOtp back to back in this one
- * request (functionally "verify and consume in one shot" from the
- * caller's point of view).
- *
- * `{ email, finalize: "true", token }` — used only by the installer's own
- * immediate post-completion sign-in, where the administrator's code was
- * already consumed by installApplication's own earlier verifyOtp call
- * (inside its transaction) and can't be re-entered (one-time use). `token`
- * must match the live INSTALLATION_TOKEN — required because
- * /api/auth/callback/credentials is a public route regardless of this
- * change (true of any Credentials provider), so this path must
- * independently prove the caller already holds a secret an attacker can't
- * have, not just trust that it's being called "from the right place".
- * Without this, a race window (someone else's verifiedAt-but-not-yet-
- * consumedAt row, mid-wizard) would be forgeable via a direct POST to that
- * route with just a guessed email. (Invitation acceptance no longer uses
- * this path — it has its own real OTP code to re-enter here instead, so
- * there's nothing left to trust a bare token for there.)
- */
-function verifyFinalizeToken(token: string): boolean {
-  if (!token) return false;
-
-  const installToken = process.env.INSTALLATION_TOKEN;
-  return !!installToken && secretsMatch(token, installToken);
-}
+export { authorizeCredentials } from "@/lib/auth/authorize-credentials";
 
 export const { handlers, auth, signIn, signOut } = NextAuth({
   ...authConfig,
@@ -58,40 +24,17 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
         email: { label: "Email", type: "email" },
         code: { label: "Code", type: "text" },
         // Only ever set by the installer's own trusted server-side sign-in
-        // call — never rendered on any real form. See this file's own
-        // header for the full finalize/token design.
+        // call — never rendered on any real form. See
+        // src/lib/auth/authorize-credentials.ts's own header for the full
+        // finalize/token design.
         finalize: { label: "Finalize", type: "text" },
         token: { label: "Token", type: "text" },
       },
-      authorize: async (raw) => {
-        const email = typeof raw?.email === "string" ? raw.email.trim().toLowerCase() : "";
-        if (!email) return null;
-
-        // Keyed by the attempted email, not IP — this is what actually
-        // stops credential stuffing against one account regardless of how
-        // many source addresses it's spread across. 30 attempts per 15
-        // minutes is well above anything a real forgetful user would ever
-        // hit, while still making online guessing impractical.
-        const { allowed } = checkRateLimit(`signin:${email}`, { maxAttempts: 30, windowMs: 15 * 60 * 1000 });
-        if (!allowed) return null;
-
-        if (raw?.finalize === "true") {
-          const token = typeof raw?.token === "string" ? raw.token : "";
-          if (!verifyFinalizeToken(token)) return null;
-          if (!(await finalizeOtp(prisma, email))) return null;
-        } else {
-          const code = typeof raw?.code === "string" ? raw.code : "";
-          if (!code) return null;
-          const verified = await verifyOtp(prisma, email, code);
-          if (!verified.ok) return null;
-          if (!(await finalizeOtp(prisma, email))) return null;
-        }
-
-        const user = await prisma.user.findUnique({ where: { email } });
-        if (!user) return null;
-
-        return { id: user.id, email: user.email, name: user.name, image: user.image };
-      },
+      // Kept in its own module (not inlined here) so it's importable from
+      // a plain Vitest test without dragging in this file's NextAuth(...)
+      // construction, which needs the Next.js runtime — see
+      // authorize-credentials.ts's own header.
+      authorize: authorizeCredentials,
     }),
   ],
   callbacks: {

src/features/installation/__tests__/auth-finalize.integration.test.ts

@@ -0,0 +1,194 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { prisma } from "@/services/scheduling/__tests__/fixtures";
+import { authorizeCredentials } from "@/lib/auth/authorize-credentials";
+import { requestOtp, verifyOtp } from "@/lib/auth/otp.service";
+import { MockEmailProvider } from "@/services/notifications/providers/mock-email-provider";
+import { installApplication } from "../installer.service";
+import type { InstallInput } from "../schema";
+
+/**
+ * Regression coverage for a real production bug: installApplication's own
+ * transaction consumes the administrator's OTP row via finalizeOtp (see
+ * installer.service.ts) — but src/auth.ts's Credentials provider used to
+ * call finalizeOtp a *second* time on its `{finalize:"true"}` sign-in
+ * path, which always fails (finalizeOtp is one-time-use) and turned every
+ * successful install into a CredentialsSignin error on the very last
+ * step. installer.service.integration.test.ts and
+ * otp.service.integration.test.ts each separately proved their own half
+ * correctly; neither exercised the interaction between them, which is
+ * exactly where this broke. This file exercises that interaction, end to
+ * end, against a real MySQL database.
+ */
+
+const INSTALLATION_TOKEN = "auth-finalize-test-install-token";
+
+function buildInput(overrides: Partial<InstallInput> = {}): InstallInput {
+  return {
+    installationToken: INSTALLATION_TOKEN,
+    administrator: {
+      firstName: "Test",
+      lastName: "Owner",
+      email: `auth-finalize-test-${Date.now()}-${Math.random().toString(36).slice(2, 8)}@example.com`,
+      phone: "",
+    },
+    business: { name: "Auth Finalize Test Barbershop", shortName: "", description: "", email: "", phone: "", website: "" },
+    location: {
+      addressLine1: "1 Test Street",
+      addressLine2: "",
+      city: "Testville",
+      region: "",
+      postalCode: "T1 1TT",
+      country: "GB",
+      timezone: "Europe/London",
+      currency: "GBP",
+      locale: "en-GB",
+    },
+    hours: (["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"] as const).map((dayOfWeek) => ({
+      dayOfWeek,
+      isClosed: dayOfWeek === "SUNDAY",
+      opensAtMinutes: dayOfWeek === "SUNDAY" ? undefined : 540,
+      closesAtMinutes: dayOfWeek === "SUNDAY" ? undefined : 1080,
+    })),
+    bookingRules: {
+      allowGuestBooking: false,
+      minNoticeMinutes: 120,
+      maxAdvanceDays: 60,
+      cancellationWindowHours: 24,
+      rescheduleWindowHours: 24,
+      slotIntervalMinutes: 30,
+      bufferBeforeMinutes: 0,
+      bufferAfterMinutes: 5,
+      maxAppointmentsPerDay: null,
+      maxAppointmentsPerStaffPerDay: null,
+      customerCanChooseStaff: true,
+      requireApproval: false,
+    },
+    branding: { logoUrl: "", coverImageUrl: "", themeColor: "", backgroundColor: "" },
+    starterServices: [
+      { categoryName: "Haircuts", name: "Classic Cut", description: "", price: "20.00", durationMinutes: 30, active: true, allowOnlineBooking: true },
+    ],
+    ...overrides,
+  };
+}
+
+async function verifyAdministratorEmail(email: string): Promise<void> {
+  const mockProvider = new MockEmailProvider();
+  await requestOtp(prisma, { email, purpose: "install", emailProvider: mockProvider });
+  const sent = mockProvider.sentEmails[0];
+  const code = /verification code is (\d{6})/.exec(sent?.text ?? "")?.[1];
+  if (!code) throw new Error("Test setup failed: couldn't extract the OTP code from the captured email.");
+  const result = await verifyOtp(prisma, email, code);
+  if (!result.ok) throw new Error(`Test setup failed: OTP verification failed (${result.reason}).`);
+}
+
+async function buildVerifiedInput(overrides: Partial<InstallInput> = {}): Promise<InstallInput> {
+  const input = buildInput(overrides);
+  await verifyAdministratorEmail(input.administrator.email);
+  return input;
+}
+
+async function resetInstallationSingleton(): Promise<void> {
+  await prisma.applicationInstallation.deleteMany({ where: { id: "singleton" } });
+}
+
+async function cleanupInstalledBusiness(businessId: string | undefined): Promise<void> {
+  if (!businessId) return;
+  const staff = await prisma.staffProfile.findMany({ where: { businessId }, select: { id: true, userId: true } });
+  const userIds = staff.map((s) => s.userId);
+  await prisma.staffService.deleteMany({ where: { staffId: { in: staff.map((s) => s.id) } } });
+  await prisma.staffProfile.deleteMany({ where: { businessId } });
+  await prisma.service.deleteMany({ where: { businessId } });
+  await prisma.serviceCategory.deleteMany({ where: { businessId } });
+  await prisma.rolePermission.deleteMany({ where: { role: { businessId } } });
+  await prisma.role.deleteMany({ where: { businessId } });
+  await prisma.auditLog.deleteMany({ where: { entityId: businessId } });
+  await prisma.loyaltyProgramme.deleteMany({ where: { businessId } });
+  await prisma.bookingRule.deleteMany({ where: { businessId } });
+  await prisma.businessSettings.deleteMany({ where: { businessId } });
+  await prisma.businessHours.deleteMany({ where: { businessId } });
+  await prisma.businessLocation.deleteMany({ where: { businessId } });
+  await prisma.business.deleteMany({ where: { id: businessId } });
+  await prisma.user.deleteMany({ where: { id: { in: userIds } } });
+  await resetInstallationSingleton();
+}
+
+describe("authorizeCredentials — post-install finalize sign-in (integration)", () => {
+  let createdBusinessId: string | undefined;
+  let originalToken: string | undefined;
+
+  beforeEach(async () => {
+    await resetInstallationSingleton();
+    createdBusinessId = undefined;
+    originalToken = process.env.INSTALLATION_TOKEN;
+    process.env.INSTALLATION_TOKEN = INSTALLATION_TOKEN;
+  });
+
+  afterEach(async () => {
+    await cleanupInstalledBusiness(createdBusinessId);
+    process.env.INSTALLATION_TOKEN = originalToken;
+  });
+
+  it("signs the administrator in immediately after a real installApplication() success — the exact sequence submitInstallationAction runs", async () => {
+    const input = await buildVerifiedInput();
+    const result = await installApplication(prisma, { input, installedVersion: "test" });
+    expect(result.success).toBe(true);
+    if (!result.success) return;
+    createdBusinessId = result.businessId;
+
+    // This is the reported bug: before the fix, this call always returned
+    // null (CredentialsSignin) because installApplication already
+    // consumed the OTP row and this path tried to finalize it again.
+    const user = await authorizeCredentials({
+      email: input.administrator.email,
+      finalize: "true",
+      token: INSTALLATION_TOKEN,
+    });
+
+    expect(user).not.toBeNull();
+    expect(user?.id).toBe(result.userId);
+    expect(user?.email).toBe(input.administrator.email);
+  });
+
+  it("rejects the finalize path with a wrong installation token, even right after a real install", async () => {
+    const input = await buildVerifiedInput();
+    const result = await installApplication(prisma, { input, installedVersion: "test" });
+    expect(result.success).toBe(true);
+    if (!result.success) return;
+    createdBusinessId = result.businessId;
+
+    const user = await authorizeCredentials({ email: input.administrator.email, finalize: "true", token: "wrong-token" });
+    expect(user).toBeNull();
+  });
+
+  it("rejects the finalize path entirely if no INSTALLATION_TOKEN is configured", async () => {
+    const input = await buildVerifiedInput();
+    const result = await installApplication(prisma, { input, installedVersion: "test" });
+    expect(result.success).toBe(true);
+    if (!result.success) return;
+    createdBusinessId = result.businessId;
+
+    delete process.env.INSTALLATION_TOKEN;
+    const user = await authorizeCredentials({ email: input.administrator.email, finalize: "true", token: INSTALLATION_TOKEN });
+    expect(user).toBeNull();
+  });
+
+  it("the ordinary {email, code} sign-in path is unaffected by this fix — still verifies and consumes its own fresh code", async () => {
+    const email = `auth-finalize-normal-${Date.now()}@example.com`;
+    const mockProvider = new MockEmailProvider();
+    await requestOtp(prisma, { email, purpose: "login", emailProvider: mockProvider });
+    const code = /verification code is (\d{6})/.exec(mockProvider.sentEmails[0]?.text ?? "")?.[1];
+    if (!code) throw new Error("Test setup failed: couldn't extract the OTP code.");
+
+    await prisma.user.upsert({
+      where: { email },
+      update: {},
+      create: { email, name: "Normal Login User" },
+    });
+
+    const user = await authorizeCredentials({ email, code });
+    expect(user).not.toBeNull();
+    expect(user?.email).toBe(email);
+
+    await prisma.user.deleteMany({ where: { email } });
+  });
+});

src/lib/auth/authorize-credentials.ts

@@ -0,0 +1,81 @@
+import { finalizeOtp, verifyOtp } from "@/lib/auth/otp.service";
+import { prisma } from "@/lib/db/prisma";
+import { checkRateLimit } from "@/lib/security/rate-limit";
+import { secretsMatch } from "@/lib/security/secrets-match";
+
+/**
+ * Two credential shapes — see src/lib/auth/otp.service.ts's own header
+ * for the full verify/finalize design this builds on.
+ *
+ * `{ email, code }` — the normal path, used by sign-in, registration, and
+ * (since the "administrator invite verifies via OTP too" work) invitation
+ * acceptance as well: verifyOtp then finalizeOtp back to back in this one
+ * request (functionally "verify and consume in one shot" from the
+ * caller's point of view).
+ *
+ * `{ email, finalize: "true", token }` — used only by the installer's own
+ * immediate post-completion sign-in. Deliberately does NOT call
+ * finalizeOtp itself (unlike the branch above) — installApplication's own
+ * transaction already did, consuming the row as part of creating the
+ * administrator (see installer.service.ts). finalizeOtp is one-time-use
+ * (it sets consumedAt and refuses a second call on the same row), so
+ * calling it again here would always fail and turn every successful
+ * install into a CredentialsSignin error on this very last step — this
+ * was exactly that bug, caught because it reproduces on every install.
+ * `token` matching the live INSTALLATION_TOKEN is this branch's entire
+ * proof of legitimacy instead — required because
+ * /api/auth/callback/credentials is a public route regardless of this
+ * change (true of any Credentials provider), so this path must
+ * independently prove the caller already holds a secret an attacker
+ * can't have, not just trust that it's being called "from the right
+ * place". (Invitation acceptance doesn't use this path — it has its own
+ * real OTP code to re-enter here instead.)
+ */
+function verifyFinalizeToken(token: string): boolean {
+  if (!token) return false;
+
+  const installToken = process.env.INSTALLATION_TOKEN;
+  return !!installToken && secretsMatch(token, installToken);
+}
+
+/**
+ * The Credentials provider's `authorize` logic, pulled out of src/auth.ts
+ * into this module specifically so it's importable in a plain Vitest
+ * test without dragging in `next-auth`'s `NextAuth(...)` construction
+ * (which needs the Next.js runtime and fails to resolve under Vitest —
+ * see auth-finalize.integration.test.ts's own header for why this
+ * function's correctness matters enough to need that). src/auth.ts wires
+ * this in verbatim as its Credentials provider's `authorize` option.
+ */
+export async function authorizeCredentials(
+  raw: Partial<Record<"email" | "code" | "finalize" | "token", unknown>> | undefined,
+): Promise<{ id: string; email: string | null; name: string | null; image: string | null } | null> {
+  const email = typeof raw?.email === "string" ? raw.email.trim().toLowerCase() : "";
+  if (!email) return null;
+
+  // Keyed by the attempted email, not IP — this is what actually
+  // stops credential stuffing against one account regardless of how
+  // many source addresses it's spread across. 30 attempts per 15
+  // minutes is well above anything a real forgetful user would ever
+  // hit, while still making online guessing impractical.
+  const { allowed } = checkRateLimit(`signin:${email}`, { maxAttempts: 30, windowMs: 15 * 60 * 1000 });
+  if (!allowed) return null;
+
+  if (raw?.finalize === "true") {
+    const token = typeof raw?.token === "string" ? raw.token : "";
+    if (!verifyFinalizeToken(token)) return null;
+    // No finalizeOtp call here — installApplication's own
+    // transaction already consumed it. See this file's own header.
+  } else {
+    const code = typeof raw?.code === "string" ? raw.code : "";
+    if (!code) return null;
+    const verified = await verifyOtp(prisma, email, code);
+    if (!verified.ok) return null;
+    if (!(await finalizeOtp(prisma, email))) return null;
+  }
+
+  const user = await prisma.user.findUnique({ where: { email } });
+  if (!user) return null;
+
+  return { id: user.id, email: user.email, name: user.name, image: user.image };
+}