feat(nimbus): password resets are delivered, from an origin nobody can forge - #4
Merged
Conversation
…n forge The delivery seam has been a documented no-op since it was written: a self-service reset minted a valid token and dropped it on the floor, and the only working path was an operator handing a link over out of band. It now sends over generic SMTP — nodemailer behind SMTP_HOST/PORT/SECURE/USER/PASS/ FROM — so Brevo, Gmail, Resend, SendGrid or a self-hosted relay all work with no code change. Unconfigured remains a supported mode, not a degraded one: no send, and the console path as before. Wiring delivery is what made an existing weakness live. The link was built from the request Host header, so anyone who knew an address could have this deployment mail them a correctly-branded link pointing at a host of their choosing. It is now minted from NIMBUS_PUBLIC_URL regardless of how the request was addressed, with an audit line when the two disagree — not a refusal, because refusing tells a prober which hosts are real. The route also answers before the SMTP conversation: awaiting it split response time 10ms for an unknown address against 6015ms for a known one, which is an enumeration oracle read off a stopwatch. CF-17 — the token is no longer written to the log stream by the request serializer, and it travels in the fragment, which browsers keep to themselves. CF-16 — the RSA signing key is encrypted at rest and has a rotation path. CF-36 — refresh rotation has a reuse grace window, and sign-out revokes by family so a raced rotation cannot orphan a live token. CF-47 — the portal origin derives from the configured apex. CF-34 — the console can abandon a stuck withdrawal. CF-33 — withdrawals are fetched by status rather than filtered client-side. CF-35 — treasury and withdrawal load failures no longer render as reassuring empty text. CF-37 — the public roadmap matches the code. CF-46 — the pay-proxy rationale is correct in both files. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of an estate-wide remediation of the 49-ticket defect register in
audit.md, sequenced by the phase plan inupgrade.md. Each ticket was resolved against its own Done when boxes, then handed to an independent reviewer told to assume it was not fixed and to walk the ticket's How it fails scenario through the new code.Verification
pnpm typecheckpasses across every workspace in this repo.What has NOT been verified
Stated plainly so review effort goes to the right places:
docker compose buildreturns exit 0 while cancelling every target, so a green build here would prove nothing anyway.partialorINCOMPLETE; where any of those touch this repo they are listed in the commit body rather than hidden.🤖 Generated with Claude Code