hahachait
ff9da4d324
- Cookie-based auth via backend proxy (httpOnly JWTs) - Supabase Postgres persistence for sessions/messages/profiles + RLS - Fix cross-user session leak (token cache keyed by full token, not 50-char prefix) - Fix missing table grants (42501) via migration; auto-provision profiles on user creation - Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering - Frontend auth-state reset + credentials include - OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled) - Tests: chatValidation, appState
2.7 KiB
Session Security and Persistence Fixes Implementation Plan
For agentic workers: Execute inline with test-first checkpoints.
Goal: Remove cross-user stale chat exposure, verify existing persistence/rate limits, and close remaining backend validation gaps.
Architecture: Keep the existing backend Supabase service and explicit ownership checks. Reset all frontend conversation state on every auth transition. Move the chat-session listing route before the parameterized chat route. Add deterministic backend tests for validation and ownership helpers.
Tech Stack: Express 5, Supabase JS, React 19, Vite, Node test runner.
Global Constraints
- Do not expose service credentials to frontend code.
- Keep explicit
req.user.uidownership checks even when using the service-role client. - Do not update React state during render.
- Verify each behavioral change with a focused test or runtime smoke check.
Task 1: Backend route and validation coverage
Files:
-
Create:
backend/src/routes/chatValidation.js -
Create:
backend/test/chatValidation.test.js -
Modify:
backend/src/routes/chat.js -
Write failing tests for valid/invalid metadata, empty/oversized text, and owned/unowned session decisions.
-
Run
node --test backend/test/chatValidation.test.jsand confirm the missing helper fails. -
Implement minimal pure validation/ownership helpers.
-
Use helpers in the chat POST path and preserve 404 ownership behavior.
-
Run the focused test and confirm pass.
Task 2: Frontend auth transition cleanup
Files:
-
Create:
frontend/src/appState.js -
Create:
frontend/test/appState.test.js -
Modify:
frontend/src/App.jsx -
Write failing tests for reset state after sign-out and sign-in.
-
Run the focused test and confirm failure.
-
Implement a pure reset-state helper and call it from the auth effect, aborting active requests and clearing sessions on sign-out.
-
Keep reset side effects inside
useEffect, not render. -
Run the focused test and frontend build.
Task 3: Route ordering and existing infrastructure verification
Files:
-
Modify:
backend/src/routes/chat.jsonly if needed. -
Place
GET /sessionsbeforeGET /:chatId. -
Verify rate-limit middleware is installed and mounted on auth/chat/sessions.
-
Verify migration and database service configuration without committing credentials.
-
Run backend syntax/tests and frontend build.
Task 4: Runtime verification
- Start local Supabase/backend/frontend where available.
- Exercise health, unauthorized protected routes, rate-limit boundary, and browser sign-out/sign-in state reset.
- Report exact observed outputs and any unavailable checks.