Fix account takeover risk

apps/server/convex/auth.ts

@@ -85,11 +85,25 @@ export const createAuth = (
 		// Use Convex site URL as baseURL so OAuth callbacks work correctly
 		baseURL: convexSiteUrl,
 		database: authComponent.adapter(ctx),
-		// TODO: add email verification (requireEmailVerification + sendVerificationEmail)
 		emailAndPassword: {
 			enabled: true,
 			minPasswordLength: 8,
 			maxPasswordLength: 128,
+			// SECURITY: Require verified email to prevent account takeover via
+			// unverified email registration exploiting email-based migration linking (OSS-37)
+			requireEmailVerification: true,
+			sendResetPassword: async ({ user, url }: { user: { email: string }; url: string }) => {
+				// TODO: integrate with email provider (e.g., Resend, SendGrid)
+				console.log(`[Auth] Password reset requested for ${user.email}: ${url}`);
+			},
+		},
+		emailVerification: {
+			sendOnSignUp: true,
+			sendVerificationEmail: async ({ user, url }: { user: { email: string }; url: string }) => {
+				// TODO: integrate with email provider (e.g., Resend, SendGrid)
+				// For now, log the verification URL for development/debugging
+				console.log(`[Auth] Verification email for ${user.email}: ${url}`);
+			},
 		},
 		socialProviders: {
 			// Only include GitHub OAuth if credentials are configured

apps/server/convex/users.ts

@@ -94,7 +94,16 @@ export const ensure = mutation({
 
 		// MIGRATION: Link WorkOS users to Better Auth by email
 		// Uses .first() since duplicate emails may exist from prior migrations
+<<<<<<< HEAD
+		// SECURITY: Only link if the caller's email is verified to prevent account takeover
+		// via unverified email registration (see OSS-37)
+		const isEmailVerified = identity.emailVerified ?? false;
+		if (!existing && args.email && isEmailVerified && Date.now() < EMAIL_LINK_MIGRATION_DEADLINE_MS) {
+||||||| 54e09ce
+		if (!existing && args.email) {
+=======
 		if (!existing && args.email && Date.now() < EMAIL_LINK_MIGRATION_DEADLINE_MS) {
+>>>>>>> main
 			const existingByEmail = await ctx.db
 				.query("users")
 				.withIndex("by_email", (q) => q.eq("email", args.email))
@@ -107,8 +116,11 @@ export const ensure = mutation({
 					updatedAt: Date.now(),
 				});
 				existing = existingByEmail;
-				console.log(`[Auth Migration] Linked user ${args.email} from WorkOS to Better Auth`);
+				console.log(`[Auth Migration] Linked user ${args.email} from WorkOS to Better Auth (email verified)`);
 			}
+		} else if (!existing && args.email && !isEmailVerified && Date.now() < EMAIL_LINK_MIGRATION_DEADLINE_MS) {
+			// Log attempts to link with unverified email for security monitoring
+			console.warn(`[Auth Migration] Blocked linking for unverified email ${args.email} (potential account takeover attempt)`);
 		}
 
 		const now = Date.now();
@@ -264,6 +276,11 @@ export const getByExternalId = query({
 				profile?.encryptedOpenRouterKey ?? user.encryptedOpenRouterKey,
 =======
 <<<<<<< HEAD
+||||||| 54e09ce
+			encryptedOpenRouterKey:
+				profile?.encryptedOpenRouterKey ?? user.encryptedOpenRouterKey,
+=======
+<<<<<<< HEAD
 ||||||| 54e09ce
 			encryptedOpenRouterKey:
 				profile?.encryptedOpenRouterKey ?? user.encryptedOpenRouterKey,
@@ -274,6 +291,7 @@ export const getByExternalId = query({
 >>>>>>> main
 >>>>>>> main
 >>>>>>> main
+>>>>>>> main
 >>>>>>> main
 			fileUploadCount: profile?.fileUploadCount ?? user.fileUploadCount ?? 0,
 			aiUsageCents: user.aiUsageCents,
@@ -378,6 +396,11 @@ export const getByExternalIdInternal = internalQuery({
 				profile?.encryptedOpenRouterKey ?? user.encryptedOpenRouterKey,
 =======
 <<<<<<< HEAD
+||||||| 54e09ce
+			encryptedOpenRouterKey:
+				profile?.encryptedOpenRouterKey ?? user.encryptedOpenRouterKey,
+=======
+<<<<<<< HEAD
 ||||||| 54e09ce
 			encryptedOpenRouterKey:
 				profile?.encryptedOpenRouterKey ?? user.encryptedOpenRouterKey,
@@ -388,6 +411,7 @@ export const getByExternalIdInternal = internalQuery({
 >>>>>>> main
 >>>>>>> main
 >>>>>>> main
+>>>>>>> main
 >>>>>>> main
 			fileUploadCount: profile?.fileUploadCount ?? user.fileUploadCount ?? 0,
 			aiUsageCents: user.aiUsageCents,

apps/web/src/routes/api/models.ts

@@ -76,6 +76,99 @@ async function fetchModelsFromOpenRouter(): Promise<Response> {
 	}
 }
 
+function getClientIp(request: Request): string | null {
+	if (!TRUST_PROXY_MODE) {
+		return null;
+	}
+
+	if (TRUST_PROXY_MODE === "cloudflare") {
+		const cfConnectingIp = request.headers.get("cf-connecting-ip")?.trim();
+		return cfConnectingIp || null;
+	}
+
+	if (TRUST_PROXY_MODE === "vercel") {
+		const vercelForwardedFor = request.headers.get("x-vercel-forwarded-for")?.trim();
+		if (vercelForwardedFor) {
+			const first = vercelForwardedFor.split(",")[0]?.trim();
+			if (first) return first;
+		}
+		return null;
+	}
+
+	if (TRUST_PROXY_MODE === "true") {
+		const forwardedFor = request.headers.get("x-forwarded-for")?.trim();
+		if (forwardedFor) {
+			const first = forwardedFor.split(",")[0]?.trim();
+			if (first) return first;
+||||||| 54e09ce
+=======
+<<<<<<< HEAD
+if (TRUST_PROXY_MODE === "true") {
+	console.warn("[Models API] TRUST_PROXY=true requires x-forwarded-for for rate limiting");
+}
+
+if (!TRUST_PROXY_MODE) {
+	console.warn("[Models API] TRUST_PROXY is unset; models endpoint will reject requests when IP is unavailable");
+}
+
+if (
+	TRUST_PROXY_MODE &&
+	TRUST_PROXY_MODE !== "cloudflare" &&
+	TRUST_PROXY_MODE !== "vercel" &&
+	TRUST_PROXY_MODE !== "true"
+) {
+	console.warn("[Models API] Unrecognized TRUST_PROXY value; models endpoint will reject requests when IP is unavailable");
+}
+
+const modelsIpRatelimit = upstashRedis
+	? new Ratelimit({
+			redis: upstashRedis,
+			limiter: Ratelimit.slidingWindow(30, "60 s"),
+			prefix: "ratelimit:models:ip",
+		})
+	: null;
+
+async function fetchModelsFromOpenRouter(): Promise<Response> {
+	try {
+		const response = await fetch(OPENROUTER_MODELS_URL, {
+			headers: {
+				Accept: "application/json",
+			},
+			signal: AbortSignal.timeout(OPENROUTER_FETCH_TIMEOUT_MS),
+		});
+
+		if (!response.ok) {
+			return json(
+				{ error: "Upstream service error" },
+				{ status: 502 },
+			);
+		}
+
+		const payload = await response.text();
+
+		if (upstashRedis) {
+			try {
+				await upstashRedis.set(MODELS_CACHE_KEY, payload, {
+					ex: MODELS_CACHE_TTL_SECONDS,
+				});
+			} catch (error) {
+				console.warn("[Models API] Failed to write cache:", error);
+			}
+		}
+
+		return new Response(payload, {
+			status: 200,
+			headers: {
+				"Content-Type": "application/json",
+				"Cache-Control": "no-store",
+			},
+		});
+	} catch (error) {
+		console.warn("[Models API] OpenRouter fetch failed:", error);
+		return json({ error: "Upstream service unavailable" }, { status: 502 });
+	}
+}
+
 function getClientIp(request: Request): string | null {
 	if (!TRUST_PROXY_MODE) {
 		return null;
@@ -617,6 +710,7 @@ function getClientIp(request: Request): string | null {
 			const first = forwardedFor.split(",")[0]?.trim();
 			if (first) return first;
 >>>>>>> main
+>>>>>>> main
 >>>>>>> main
 		}
 		return null;