Fix/admin token security - #140
Closed
HoangHieu21201 wants to merge 3 commits into
Closed
HoangHieu21201 wants to merge 3 commits into
HoangHieu21201 wants to merge 3 commits into
Conversation
…nkHub into fix/admin-token-security
|
Warning Review limit reached
Next review available in: 34 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (14)
📝 WalkthroughWalkthroughPR bổ sung refresh token cho xác thực user/admin, endpoint làm mới phiên, tự động retry request sau lỗi 401, lưu trữ token tương ứng trên frontend, đồng thời cập nhật khởi tạo reCAPTCHA và script phát triển. ChangesVòng đời token xác thực
Khởi tạo frontend
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant APIClient
participant AuthAPI
participant Storage
Client->>APIClient: Gửi request
APIClient-->>Client: Lỗi 401
APIClient->>Storage: Đọc refresh token
APIClient->>AuthAPI: POST refresh-token
AuthAPI-->>APIClient: Token mới
APIClient->>Storage: Lưu token mới
APIClient-->>Client: Retry request
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/app/Http/Controllers/Api/Admin/AdminAccountController.php`:
- Around line 89-94: Update AdminAccountController::logout at
backend/app/Http/Controllers/Api/Admin/AdminAccountController.php lines 89-94 to
delete both admin_token and admin_refresh_token for the authenticated admin
instead of only currentAccessToken(). Apply the same change in
AuthController::logout at
backend/app/Http/Controllers/Api/Auth/AuthController.php lines 79-84, deleting
both auth_token and refresh_token for the authenticated user.
In `@backend/app/Http/Controllers/Api/Auth/GoogleAuthController.php`:
- Around line 38-43: Thay đổi luồng trong GoogleAuthController, đặc biệt đoạn
tạo token và redirect, để không đưa accessToken hoặc refreshToken vào query
string. Tạo exchange code ngắn hạn, dùng một lần với khả năng `exchange`, chuyển
hướng frontend chỉ với mã này, đồng thời bổ sung endpoint POST
`/auth/google/exchange` để xác thực quyền exchange, xoá mã sau khi dùng và phát
hành cặp token thật.
In `@backend/routes/api.php`:
- Around line 110-113: Update the auth route definitions around the
/refresh-token and logout routes: apply the ability:refresh middleware
specifically to AuthController::refresh, and wrap business routes protected by
auth:sanctum with ability:access (or abilities:access,...). Ensure refresh
tokens cannot access business endpoints, while access tokens retain normal
access.
In `@frontend/package.json`:
- Line 10: Update the frontend package.json dev script to run the Laravel
package:discover bootstrap step before invoking concurrently. Preserve all
existing Vite, queue, scheduler, crawler, API, and Reverb processes and their
arguments after the bootstrap completes.
In `@frontend/src/composables/useUtilities.js`:
- Around line 4-13: Move refresh-token handling from browser storage to
backend-issued httpOnly, Secure, SameSite=Strict cookies. In
frontend/src/composables/useUtilities.js, remove refresh-token keys from the
storage-based authentication key collections; in
frontend/src/pages/admin/auth/Login.vue, frontend/src/pages/user/auth/Login.vue,
and frontend/src/pages/user/auth/Register.vue, remove refresh-token localStorage
writes and rely on the backend cookie; in
frontend/src/pages/user/auth/CallBackGoogle.vue, stop persisting the
refresh_token received in the Google callback query string.
In `@frontend/src/pages/user/auth/ForgotPassword.vue`:
- Around line 154-172: The reCAPTCHA initialization polling continues
indefinitely after script load failure or component unmount. In
frontend/src/pages/user/auth/ForgotPassword.vue lines 154-172, retain the retry
timer, add bounded/error handling for script loading including script.onerror,
and clear the timer in onUnmounted; apply the same cancellation and
script.onerror handling in frontend/src/pages/user/contact/Index.vue lines
158-176, using each component’s existing initialization flow.
In `@frontend/src/utils/adminApiClient.js`:
- Around line 63-96: The refresh flow leaves isRefreshing permanently true when
no refresh token exists, so queued 401 requests are never released. In
frontend/src/utils/adminApiClient.js lines 63-96, add the no-token branch
alongside the refreshToken check to call processQueue with the authentication
error and null token, then reset isRefreshing; apply the same change in
frontend/src/utils/clientApiClient.js lines 119-148 around
getUserRefreshToken().
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 51485924-aaf6-46d6-b1a7-39ddc9056236
📒 Files selected for processing (14)
backend/app/Http/Controllers/Api/Admin/AdminAccountController.phpbackend/app/Http/Controllers/Api/Auth/AuthController.phpbackend/app/Http/Controllers/Api/Auth/GoogleAuthController.phpbackend/routes/api.phpfrontend/package.jsonfrontend/src/composables/useUtilities.jsfrontend/src/pages/admin/auth/Login.vuefrontend/src/pages/user/auth/CallBackGoogle.vuefrontend/src/pages/user/auth/ForgotPassword.vuefrontend/src/pages/user/auth/Login.vuefrontend/src/pages/user/auth/Register.vuefrontend/src/pages/user/contact/Index.vuefrontend/src/utils/adminApiClient.jsfrontend/src/utils/clientApiClient.js
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
admin token
Summary by CodeRabbit
Tính năng mới
Cải tiến