tiennm99/coolify
1
0 Fork 0
mirror of https://github.com/tiennm99/coolify.git synced 2026-10-14 12:16:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): bind magic links to their invitation

Browse Source 
Include the invitation UUID in generated magic link tokens and validate the
matching stored invitation link before logging the user in, preventing stale
or same-email invitations from being reused.
This commit is contained in:
Andras Bacsai committed 2026-06-02 12:57:30 +02:00
1 parent 40d570f195
commit cd06e10b1b
4 files changed
+45 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/Feature/InvitationLinkHandlingTest.php
+24 -2
View File
@@ -39,12 +39,13 @@ function createInvitationLinkFixture(array $invitationAttributes = []): array
'force_password_reset' => true,
'email_verified_at' => null,
]);
$token = Crypt::encryptString("{$user->email}@@@{$password}");
$uuid = (string) new Cuid2(32);
$token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
$link = route('auth.link', ['token' => $token]);
$invitation = TeamInvitation::create(array_merge([
'team_id' => $team->id,
'uuid' => (string) new Cuid2(32),
'uuid' => $uuid,
'email' => $user->email,
'role' => 'member',
'link' => $link,
@@ -87,6 +88,27 @@ it('rejects a magic link when the invitation was revoked', function () {
expect($user->teams()->where('personal_team', false)->exists())->toBeFalse();
});
it('rejects a magic link when another invitation exists for the same email', function () {
[, $user, , $token, $invitation] = createInvitationLinkFixture();
$invitation->delete();
$otherTeam = Team::factory()->create();
TeamInvitation::create([
'team_id' => $otherTeam->id,
'uuid' => (string) new Cuid2(32),
'email' => $user->email,
'role' => 'admin',
'link' => url('/invitations/other-invitation'),
'via' => 'link',
]);
$this->get(route('auth.link', ['token' => $token]))
->assertRedirect(route('login'));
$this->assertGuest();
expect($user->teams()->where('team_id', $otherTeam->id)->exists())->toBeFalse();
});
it('rejects a magic link when the invitation expired', function () {
[, $user, , $token, $invitation] = createInvitationLinkFixture();
$invitation->forceFill([
tests/Feature/LinkLoginEmailVerificationTest.php
+6 -4
View File
@@ -39,10 +39,11 @@ describe('invitation link login', function () {
]);
$user->teams()->attach($team->id, ['role' => 'member']);
$token = Crypt::encryptString("{$user->email}@@@{$password}");
$uuid = 'email-verification-test-invitation';
$token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
TeamInvitation::create([
'team_id' => $team->id,
'uuid' => 'email-verification-test-invitation',
'uuid' => $uuid,
'email' => $user->email,
'role' => 'member',
'link' => route('auth.link', ['token' => $token]),
@@ -65,10 +66,11 @@ describe('invitation link login', function () {
]);
$user->teams()->attach($team->id, ['role' => 'member']);
$token = Crypt::encryptString("{$user->email}@@@{$password}");
$uuid = 'email-verification-login-test-invitation';
$token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
TeamInvitation::create([
'team_id' => $team->id,
'uuid' => 'email-verification-login-test-invitation',
'uuid' => $uuid,
'email' => $user->email,
'role' => 'member',
'link' => route('auth.link', ['token' => $token]),