Fix/password reset and verification codes stored in plaintext#238
Fix/password reset and verification codes stored in plaintext#238Devnil434 wants to merge 4 commits intoAOSSIE-Org:mainfrom
Conversation
📝 WalkthroughWalkthroughThis PR hashes verification and password-reset codes before storing and comparing them, lowers the minimum password length from 8 to 6 across backend and frontend, and removes placeholder secrets from example configuration files. No exported function signatures were changed. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Client
participant Controller as AuthController
participant Utils as HashUtility
participant Database
User->>Client: Submit verification/reset code
Client->>Controller: POST /verify or /reset with code
Controller->>Utils: HashAuthCode(code, serverSecret)
Utils-->>Controller: hashedCode
Controller->>Database: Query for user with hashedCode
Database-->>Controller: user record (match or nil)
alt match
Controller-->>Client: 200 OK (verified/reset done)
else no match
Controller-->>Client: 400 Invalid code
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…ocket connection, debate ID, poll information, spectator IDs, transcript, questions, reactions, and presence.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@frontend/src/atoms/debateAtoms.ts`:
- Around line 63-65: The WebSocket 'question' case handler in useDebateWS is
creating question objects without the required type field, which conflicts with
the questionsAtom type; update the handler that constructs/sets questions (the
'question' switch/case in useDebateWS) to include the incoming event's type
property on each question object so each object matches the questionsAtom shape
(ensure the object includes type: event.type or the event.payload.type as
appropriate when calling set for questionsAtom).
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
frontend/src/atoms/debateAtoms.ts
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
| export const questionsAtom = atom<Array<{ | ||
| type: string; qId: string; text: string; spectatorHash: string; timestamp: number | ||
| }>>([]); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find all usages of questionsAtom and related setters/modifications
rg -n --type=ts --type=tsx 'questionsAtom' -A 2 -B 2Repository: AOSSIE-Org/DebateAI
Length of output: 90
🏁 Script executed:
# Also search for any WebSocket or API payload handling related to questions
rg -n --type=ts --type=tsx -i 'question.*payload|setQuestion|question.*ws' -A 2Repository: AOSSIE-Org/DebateAI
Length of output: 90
🏁 Script executed:
# Check if there's a type definition elsewhere for question objects
rg -n --type=ts --type=tsx 'type.*[Qq]uestion|interface.*[Qq]uestion' | head -30Repository: AOSSIE-Org/DebateAI
Length of output: 90
🏁 Script executed:
# Find all TypeScript files in the repository
fd -t f -e ts -e jsx | head -20Repository: AOSSIE-Org/DebateAI
Length of output: 778
🏁 Script executed:
# Search for questionsAtom usages without file type filter
rg -n 'questionsAtom' -A 3 -B 1Repository: AOSSIE-Org/DebateAI
Length of output: 3470
🏁 Script executed:
# Check the debateAtoms.ts file to see full context
cat -n frontend/src/atoms/debateAtoms.tsRepository: AOSSIE-Org/DebateAI
Length of output: 2998
🏁 Script executed:
# Check useDebateWS.ts to see the actual setQuestions implementation
cat -n frontend/src/hooks/useDebateWS.tsRepository: AOSSIE-Org/DebateAI
Length of output: 13140
🏁 Script executed:
# Also look for any question-related message handlers
rg -n 'setQuestions\|question.*message\|MESSAGE_TYPE' frontend/src/hooks/useDebateWS.ts -A 5 -B 2Repository: AOSSIE-Org/DebateAI
Length of output: 45
Add missing type field to question objects in WebSocket handler.
The questionsAtom type requires a type: string field, but the 'question' case handler in useDebateWS.ts (lines 264-274) does not include it when setting questions. Update the handler to include this required field from the incoming event data.
🤖 Prompt for AI Agents
In `@frontend/src/atoms/debateAtoms.ts` around lines 63 - 65, The WebSocket
'question' case handler in useDebateWS is creating question objects without the
required type field, which conflicts with the questionsAtom type; update the
handler that constructs/sets questions (the 'question' switch/case in
useDebateWS) to include the incoming event's type property on each question
object so each object matches the questionsAtom shape (ensure the object
includes type: event.type or the event.payload.type as appropriate when calling
set for questionsAtom).
1 participant
Summary
This PR fixes a high-severity security vulnerability where email verification and password reset codes were stored in plaintext in the database. All authentication codes are now securely hashed before persistence, preventing account takeover in the event of a database compromise.
Changes
Why
Verification and reset codes function as authentication secrets. Storing them in plaintext enables immediate account takeover if the database is leaked. Hashing aligns with standard security best practices and reduces breach impact.
Impact
Validation
-Invalid codes fail securely due to hash mismatch
Files Changed
Checklist
fixes #235
Summary by CodeRabbit
Security Enhancements
Authentication Changes
Question System Improvements
Maintenance
✏️ Tip: You can customize this high-level summary in your review settings.