okooooooo/mailflare
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
69fef6978cf97576dfd98cc895c1d6469393d04d
mailflare/package.json
T
Oday BakkourandClaude Fable 5.1 2e3c3e6f0b feat(auth): password reset by recovery email and TOTP two-factor authentication 
The app collected a recovery email at first run and never read it, and had
no second factor. A lost password meant editing D1 by hand.

Password reset
- `POST /api/auth/password-reset/request` mails a single-use link (hashed
  token, 30 minutes) to the account's `reset_email`. It answers 200 for any
  well-formed input so the form cannot probe for accounts, and is behind the
  login rate limiter and Turnstile.
- `POST /api/auth/password-reset/confirm` sets the password, burns the
  token, revokes every session and writes an audit entry.
- Reset mail goes through `sendSystemEmail` straight to the send binding
  from the first admin mailbox on a sending-enabled domain: no Sent copy,
  no contact upsert, no webhooks, auto-generated headers.
- New /forgot-password and /reset-password pages; "Forgot password?" on the
  login form.

Two-factor authentication
- RFC 6238 TOTP over Web Crypto (`src/lib/auth/totp.ts`, no dependency;
  verified against the RFC 4226/6238 test vectors), ±1 step tolerance,
  constant-time compare. `qrcode` renders the otpauth URL as inline SVG.
- Enrolment stores a secret but only trusts it once the user proves a code
  from it; that also issues 8 single-use recovery codes and signs out every
  other session. Turning it off needs the password and a current code.
- Login with MFA on returns `{ mfaRequired, challengeToken }` instead of a
  session (`login_challenges`, 5 minutes); `/api/auth/mfa/verify` accepts a
  TOTP or recovery code and issues the session, so the SPA still receives
  its bearer token on the final step.
- Settings > Account > Security gains a card with enrol / new codes / off
  dialogs; `/api/auth/me` exposes `mfaEnabled`.

Related
- Changing a password now signs out every other session.
- Admins can set a password on a managed account (PATCH /api/accounts/[id]
  gains `password`; every session of that user is revoked). The route
  already hashed passwords but no caller ever passed one.
- Migration 0031: three columns on users, `password_reset_tokens`,
  `mfa_recovery_codes`, `login_challenges`; bootstrap SQL and backup list
  updated.

Verified on local D1: unknown and known accounts get the same reset answer;
a bad token, a used token and a reused token are rejected; redemption
revokes an open session and the old password stops working; enrolment
rejects a wrong password and a wrong code; confirming with a real code
returns 8 codes and revokes the other session but not the current one;
login then requires MFA, a wrong code is rejected, a right code and a
recovery code each sign in, the challenge is consumed, a recovery code
cannot be reused, and disabling restores password-only login. The QR
enrolment, MFA step and reset pages were exercised in the browser.
tsc (11) and eslint (105) unchanged from main.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-08 15:18:33 +03:00

105 lines
4.3 KiB
JSON
Raw Blame History

{
"name": "mailflare",
"version": "0.2.0",
"private": true,
"scripts": {
"dev": "next dev",
"build": "next build",
"build:next": "next build",
"start": "next start",
"lint": "eslint .",
"deploy": "opennextjs-cloudflare build && npm run db:migrate:remote && npm run deploy:worker",
"deploy:worker": "OPEN_NEXT_DEPLOY=true wrangler deploy",
"deploy:local": "npm run build && npm run deploy",
"deploy:with-migrations": "npm run deploy:local",
"upload": "opennextjs-cloudflare build && OPEN_NEXT_DEPLOY=true wrangler versions upload",
"preview": "opennextjs-cloudflare build && opennextjs-cloudflare preview",
"cf-typegen": "wrangler types --env-interface CloudflareEnv ./cloudflare-env.d.ts",
"db:generate": "drizzle-kit generate",
"db:migrate:local": "wrangler d1 migrations apply DB --local",
"db:migrate:remote": "wrangler d1 migrations apply DB --remote",
"migrate": "wrangler d1 migrations apply DB",
"db:seed": "curl -X POST http://localhost:3000/api/seed"
},
"cloudflare": {
"bindings": {
"CF_TOKEN": {
"description": "Runtime Cloudflare API token used by Mailflare onboarding to call the Zones and Email Routing APIs. Cloudflare's deploy/build token is not passed to the app, so create this separately at https://dash.cloudflare.com/profile/api-tokens with `Zone Read`, `Email Routing Edit`, and `Email Routing Rules Write` permissions for the zones you will connect. Add `Email Sending Edit` to enable outbound mail. Paste only the token secret value, without `Bearer`."
},
"TURNSTILE_SECRET_KEY": {
"description": "Cloudflare Turnstile secret key used to verify login and first-run registration challenges. Pair with NEXT_PUBLIC_TURNSTILE_SITE_KEY at build time."
},
"NEXT_PUBLIC_TURNSTILE_SITE_KEY": {
"description": "Cloudflare Turnstile public site key used by the login and first-run registration widgets."
},
"CF_EMAIL_WORKER_NAME": {
"description": "Worker name used when creating Cloudflare Email Routing rules. Set this to the deployed Worker name; if you rename the Worker, update this value too."
},
"GITHUB_UPDATE_TOKEN": {
"description": "Fine-grained GitHub token for the installation repository with Actions: write permission, Contents: write read permission. Used only by the admin update endpoint to dispatch update.yml."
},
"GITHUB_UPDATE_REF": {
"description": "Optional branch used to dispatch updates. Leave blank to use the repository default branch."
},
"GITHUB_UPDATE_REPO": {
"description": "Your github repository that connect to cloudflare worker"
},
"CF_EMAIL": {
"description": "Legacy Global API Key auth only. Use this with `CF_API_KEY` instead of `CF_TOKEN`."
},
"CF_API_KEY": {
"description": "Legacy Global API Key auth only. Prefer `CF_TOKEN` for new deployments."
}
}
},
"license": "SEE LICENSE IN LICENSE",
"dependencies": {
"@opennextjs/cloudflare": "^1.19.9",
"@radix-ui/react-dialog": "^1.1.15",
"@radix-ui/react-dropdown-menu": "^2.1.16",
"@radix-ui/react-label": "^2.1.8",
"@radix-ui/react-select": "^2.2.6",
"@radix-ui/react-separator": "^1.1.8",
"@radix-ui/react-slot": "^1.2.4",
"@radix-ui/react-tabs": "^1.1.13",
"@radix-ui/react-toast": "^1.2.15",
"@tanstack/react-query": "^5.100.11",
"bcryptjs": "^3.0.3",
"class-variance-authority": "^0.7.1",
"clsx": "^2.1.1",
"dayjs": "^1.11.20",
"drizzle-orm": "^0.45.2",
"lucide-react": "^1.16.0",
"mimetext": "^3.0.28",
"nanoid": "^5.1.16",
"next": "16.3.3",
"postal-mime": "^2.7.4",
"qrcode": "^1.5.4",
"react": "^19.1.7",
"react-dom": "^19.1.7",
"tailwind-merge": "^3.6.0",
"zod": "^4.4.3"
},
"devDependencies": {
"@cloudflare/workers-types": "^5.20260828.1",
"@eslint/eslintrc": "^3",
"@tailwindcss/postcss": "^4",
"@types/bcryptjs": "^2.4.6",
"@types/node": "^20.19.41",
"@types/qrcode": "^1.5.6",
"@types/react": "^19.1.7",
"@types/react-dom": "^19.1.7",
"drizzle-kit": "^0.31.10",
"eslint": "^9",
"eslint-config-next": "16.3.3",
"tailwindcss": "^4",
"typescript": "^5.7.4",
"wrangler": "^4.127.1"
},
"overrides": {
"@esbuild-kit/core-utils": {
"esbuild": "^0.25.4"
}
}
}
Reference in new issue View Git Blame Copy Permalink