Merge pull request #620 from CodebilityDev/feature/2fa-totp-authentication/juryyy

feat(auth): add sign-in rate limiting, 2FA challenge check, email/pas…

Author: bonfire404

apps/codebility/app/auth/actions.ts

@@ -4,6 +4,7 @@ import { redirect } from "next/navigation";
 import { useUserStore } from "@/store/codev-store";
 import { Codev } from "@/types/home/codev";
 import { createClientServerComponent } from "@/utils/supabase/server";
+import { checkRateLimit, recordRateLimitAttempt, resetRateLimit } from "@/lib/rate-limiter";
 import { uploadNdaToStorage, updateCodevNdaUrls } from "@/utils/ndaStorageService";
 
 const uploadProfileImage = async (

apps/codebility/app/auth/password-reset/action.ts

@@ -5,37 +5,36 @@ import { headers } from "next/headers";
 
 export const resetUserPassword = async (email: string) => {
     try {
-
+        const normalizedEmail = email.toLowerCase().trim();
         const supabase = await createClientServerComponent();
         const headersList = await headers();
-        const origin = headersList.get("origin") || process.env.NEXT_PUBLIC_APP_BASE_URL;
+        const origin = headersList.get("origin") || process.env.NEXT_PUBLIC_APP_BASE_URL || "http://localhost:3000";
 
-        // check the user of the email
+        // Check user record by email
         const { data, error: userError } = await supabase
             .from("codev")
-            .select()
-            .eq("email_address", email)
-            .single();
+            .select("id, application_status")
+            .eq("email_address", normalizedEmail)
+            .maybeSingle();
 
         if (userError) {
             console.error("Database query error:", userError);
             throw new Error(`Database error: ${userError.message}`);
         }
 
         if (!data) {
-            console.error("User not found for email:", email);
-            throw new Error("User not found");
+            console.error("User not found for email:", normalizedEmail);
+            throw new Error("No account found with this email address");
         }
 
-        const url = data.availability_status === "passed" 
+        // Determine redirect destination after magic link callback
+        const isPassed = data.application_status === "passed";
+        const url = isPassed 
             ? `${origin}/auth/callback?redirect_to=/home/account-settings` 
-            : `${origin}/auth/callback?redirect_to=/applicant/account-settings`;
+            : `${origin}/auth/callback?redirect_to=/applicant/waiting`;
 
-        /* 
-        * Send password reset email using Supabase
-        * The redirectTo URL is where the user will be redirected after clicking the link in the email
-        */
-        const { error } = await supabase.auth.resetPasswordForEmail(email, {
+        // Send password reset email using Supabase Auth
+        const { error } = await supabase.auth.resetPasswordForEmail(normalizedEmail, {
             redirectTo: url,
         });
 
@@ -44,8 +43,9 @@ export const resetUserPassword = async (email: string) => {
             throw new Error(error.message || "Failed to send reset email");
         }
 
-    } catch (error) {
+        return { success: true };
+    } catch (error: any) {
         console.error("Error resetting password:", error);
-        throw new Error(`Failed to reset password: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        throw new Error(error.message || "Failed to reset password");
     }
 };

apps/codebility/app/home/account-settings/_components/AccountSettingsChangePassword.tsx

@@ -16,6 +16,7 @@ import {
   FormMessage,
 } from "@codevs/ui/form";
 import { Input } from "@codevs/ui/input";
+import { updatePassword } from "../action";
 
 // Password validation schema
 const passwordChangeSchema = z

apps/codebility/app/home/account-settings/_components/AccountSettingsDialog.tsx

@@ -28,6 +28,7 @@ import {
 import { Input } from "@codevs/ui/input";
 
 import AccountSettingsBackdrop from "./AccountSettingsBackDrop";
+import { updateEmail } from "../action";
 import { createClientClientComponent } from "@/utils/supabase/client";
 
 const emailChangeSchema = z.object({

apps/codebility/lib/rate-limiter.ts

@@ -0,0 +1,73 @@
+interface RateLimitEntry {
+  attempts: number;
+  resetAt: number;
+}
+
+const rateLimitStore = new Map<string, RateLimitEntry>();
+
+function cleanupExpiredEntries() {
+  const now = Date.now();
+  for (const [key, entry] of rateLimitStore.entries()) {
+    if (now > entry.resetAt) {
+      rateLimitStore.delete(key);
+    }
+  }
+}
+
+export function checkRateLimit(
+  key: string,
+  maxAttempts: number = 5,
+  windowMs: number = 5 * 60 * 1000
+): { allowed: boolean; remaining: number; retryAfterSeconds: number } {
+  cleanupExpiredEntries();
+
+  const now = Date.now();
+  const normalizedKey = key.toLowerCase().trim();
+  const entry = rateLimitStore.get(normalizedKey);
+
+  if (!entry || now > entry.resetAt) {
+    return {
+      allowed: true,
+      remaining: maxAttempts,
+      retryAfterSeconds: 0,
+    };
+  }
+
+  if (entry.attempts >= maxAttempts) {
+    const retryAfterSeconds = Math.ceil((entry.resetAt - now) / 1000);
+    return {
+      allowed: false,
+      remaining: 0,
+      retryAfterSeconds: Math.max(retryAfterSeconds, 1),
+    };
+  }
+
+  return {
+    allowed: true,
+    remaining: maxAttempts - entry.attempts,
+    retryAfterSeconds: 0,
+  };
+}
+
+export function recordRateLimitAttempt(
+  key: string,
+  windowMs: number = 5 * 60 * 1000
+): void {
+  const now = Date.now();
+  const normalizedKey = key.toLowerCase().trim();
+  const entry = rateLimitStore.get(normalizedKey);
+
+  if (!entry || now > entry.resetAt) {
+    rateLimitStore.set(normalizedKey, {
+      attempts: 1,
+      resetAt: now + windowMs,
+    });
+  } else {
+    entry.attempts += 1;
+  }
+}
+
+export function resetRateLimit(key: string): void {
+  const normalizedKey = key.toLowerCase().trim();
+  rateLimitStore.delete(normalizedKey);
+}