297afca1ae
Adds rate limiting to /api/auth/login and /api/auth/register and removes
their wide-open CORS allowlist.
Rate limiting (@upstash/ratelimit + @upstash/redis):
- 5 attempts per 15-minute sliding window per IP, prefix "tcgvault:auth"
- new lib/rate-limit.js, lazy singleton, single source of truth
- reads KV_REST_API_URL / KV_REST_API_TOKEN (Vercel Upstash Marketplace
convention — auto-provisioned, no manual env-var setup needed)
- fail-closed in production if env vars are missing (better to error
one login than silently disable brute-force protection on live)
- fail-open in dev/test if env vars are missing (single console.warn)
- fail-open on Upstash backend outage (defense-in-depth — don't lock
the entire userbase out if Upstash is down)
- IP extracted from x-forwarded-for first hop, with socket fallback;
NOT req.body.email (rotates) or Authorization header (absent on
unauthenticated login)
CORS:
- Removed Access-Control-Allow-Origin: * + companion headers + OPTIONS
preflight from login.js and register.js
- These are first-party endpoints called from the same-origin SPA; the
"*" allowlist was a development convenience that shipped to prod
- verify.js is OUT OF SCOPE per architect's "cors-tighten" deferral
(see convoy plan § Architect's calls)
Other handler ordering preserved verbatim per brief: method gate first,
then rate-limit check (returns 429 with Retry-After header), then the
existing try/catch + body parsing + DB work.
Pre-merge requirements: KV_REST_API_URL + KV_REST_API_TOKEN must be set
in Vercel Production (already done — Upstash marketplace integration
auto-provisioned both, confirmed by maintainer 2026-05-23).
Convoy: fix-auth-bypass / Brief 4
Co-authored-by: Cursor <cursoragent@cursor.com>
38 lines
982 B
JSON
38 lines
982 B
JSON
{
|
|
"name": "tcg-vault",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint .",
|
|
"setup-db": "node scripts/setup-neon-db.js",
|
|
"import-popular": "node scripts/import-popular-sets.js",
|
|
"import-all": "node scripts/bulk-import-all.js"
|
|
},
|
|
"dependencies": {
|
|
"@neondatabase/serverless": "^1.0.1",
|
|
"@upstash/ratelimit": "^2.0.8",
|
|
"@upstash/redis": "^1.38.0",
|
|
"@vercel/blob": "^1.1.1",
|
|
"@vercel/postgres": "^0.10.0",
|
|
"bcryptjs": "^3.0.2",
|
|
"dotenv": "^17.2.1",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"next": "^16.2.6",
|
|
"node-fetch": "^3.3.2",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1",
|
|
"resend": "^4.7.0"
|
|
},
|
|
"devDependencies": {
|
|
"autoprefixer": "^10.4.21",
|
|
"eslint": "^9.39.4",
|
|
"eslint-config-next": "^16.2.6",
|
|
"postcss": "^8.5.6",
|
|
"tailwindcss": "^3.4.17",
|
|
"typescript": "^5.9.3"
|
|
}
|
|
}
|