Secure DSV driver password reset links for production - #413
Merged
Conversation
Constraint: Driver resets must preserve driver, route, and vehicle relationships and cannot use unverified identity fields. Rejected: Name and phone reset | It does not prove control of the account. Confidence: high Scope-risk: moderate Directive: Keep DriverAccount reset persistence separate from CustomerAccount invitations. Tested: Prisma generate and validate; full lint, typecheck, tests, build; disposable PostgreSQL migration, concurrency, lockout, and session invalidation integration. Not-tested: SMS delivery and production deployment were intentionally not run.
…ility Constraint: Reset only active same-shop DSV accounts while preserving every delivery assignment. Rejected: Advisory lock alone | Driver and profile status writers do not share the authentication lock. Confidence: high Scope-risk: moderate Directive: Keep Caddy trust limited to its resolved address and one immediate proxy hop; refresh it when Caddy is recreated. Tested: PostgreSQL reset and eligibility races; scoped authorization, log redaction, proxy limits, configuration, and PIN login regressions. Not-tested: Web deployment and browser end-to-end completion are outside this server release.
Confidence: high Scope-risk: narrow Tested: Existing behavior and assertions preserved; CI lint failures mapped to mock method binding and promise factories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DSV administrators need a one-time link that lets a linked driver choose a new password without changing account links or delivery assignments. This integrates the implementation from #412 with the web contract already implemented at web SHA
49cca813716053598da3a0f047fc9a94e27b71b9.Validation: fresh Prisma generation/migration; PostgreSQL eligibility, concurrent mutation/consumption, expiration/reissue, password reuse, session revocation, relationship and audit checks; targeted route/proxy/config/PIN tests; full API lint/typecheck/test/build; Route Ops web build; compose config; secret scan; deploy/migration wrapper contracts. Local API suite: 2,377 passed; separate PostgreSQL reset scenarios: 2 passed; local HTTP release rehearsal: 52 checks passed with fixture cleanup. Full CI passed at https://github.com/EVNSolution/clever-route-server/actions/runs/34458363918 . Final source/security review: APPROVE after the race and privacy findings were addressed.
Deployment: additive new table only; previous runtime remains schema-compatible. Use exact merge-SHA CI, reviewed G007 restore evidence, guarded migration and existing image rollback. Web deployment and complete browser E2E remain a separate owner task.