fix(auth,users): harden OAuth callback and user sync (4 issues)

[Darkvader-ship-it]

• closes AuthController.githubCallback puts the freshly issued JWT directly in the redirect URL's query string #131
• closes JwtStrategy.validate trusts the JWT payload's sub/username with no database lookup at all #132
• closes UsersService.upsertFromGithub matches an existing User purely by username, enabling account takeover via GitHub username reuse #133
• closes upsertFromGithub's account-exists branch never refreshes User.username/displayName/email/avatarUrl on repeat login #134

---

Branch: fix/auth-hardening-jwt-handoff-user-sync-takeover

Commit: 62762c1
Status: Created, committed, and pushed to origin.

---

Fix #1 – JWT in redirect URL

(src/auth/auth.controller.ts:36, src/auth/auth.service.ts:1)

• AuthService.createHandoffCode() generates a 32-byte hex code with a 5‑minute TTL, single-use via consumeHandoffCode() (prunes expired).
• githubCallback now:
  • calls createHandoffCode(accessToken),
  • sets an httpOnly access_token cookie (secure in production, sameSite:lax, maxAge 7d, path:/),
  • redirects to ${frontendUrl}/auth/callback?code=${code} (no token= in the URL).
• Added POST /auth/handoff and alias POST /auth/exchange
  (src/auth/auth.controller.ts:59) — exchanges the code for { accessToken }, throwing UnauthorizedException if missing/expired.

---

Fix #2 – JWT validate bypass

(src/auth/strategies/jwt.strategy.ts:1)

• Injected UsersService, added cookieExtractor (checks req.cookies or manual cookie header) and uses fromExtractors([Bearer, cookieExtractor]).
• validate() is now async and checks payload.sub, then awaits usersService.findOneRaw(payload.sub) — throws UnauthorizedException('User no longer exists') if deleted, preventing token use after account deletion.

---

Fix #3 – Staleness

(src/users/users.service.ts:53)

• On an existing GithubAccount path, updates:
  • account.login,
  • synchronises User.username, displayName, avatarUrl, email from fresh input,
  • respects username/email uniqueness before userRepo.save(),
  • then returns findOneRaw().

---

Fix #4 – Username takeover

(src/users/users.service.ts:105)

• Removed the findOne({ where: { username: input.login } }) fallback.
• On a new githubId, always creates a fresh User.
• If a username collision occurs, generates a unique one via generateUniqueUsername() (username, username-1, …); if an email collision occurs, sets email to null.

---

Spec updates

(src/users/users.service.spec.ts:93)

• Replaced the username-link test with a takeover-prevention test.
• Added a staleness sync test.

All 13 tests pass (default.bash:1).

---

Extra

• Fixed duplicate JSDoc in src/escrow/escrow.service.ts:582 that broke tsc parsing.

---

Verified

• ❌ token= absent from redirect URL
• ✅ code= present
• npx jest src/users/users.service.spec.ts → 13 passed
• git push succeeded

---

Let me know if you need this as a commit message, PR description, or converted to a different format (JSON, plain text, etc.).

[drips-wave]

@Darkvader-ship-it Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@Darkvader-ship-it is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.