#256 address review feedback R1-M1 R1-L1 R1-L2 R1-N1 R1-N2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: b-at-neu

app/api/auth/webhook/route.ts

@@ -42,7 +42,7 @@ const webhookEventSchema = z.discriminatedUnion('type', [
   magicLinkEventSchema,
 ]);
 
-const BAD_REQUEST = new Response(null, { status: 400 });
+const badRequest = () => new Response(null, { status: 400 });
 
 export async function POST(req: Request): Promise<Response> {
   // Read the raw body once — needed both for signature verification and JSON parsing.
@@ -57,18 +57,18 @@ export async function POST(req: Request): Promise<Response> {
     signatureHeader,
     kidHeader,
   );
-  if (!valid) return BAD_REQUEST;
+  if (!valid) return badRequest();
 
   // Parse and validate the payload.
   let parsed: unknown;
   try {
     parsed = JSON.parse(rawBody);
   } catch {
-    return BAD_REQUEST;
+    return badRequest();
   }
 
   const result = webhookEventSchema.safeParse(parsed);
-  if (!result.success) return BAD_REQUEST;
+  if (!result.success) return badRequest();
 
   const event = result.data;
 
@@ -95,7 +95,7 @@ export async function POST(req: Request): Promise<Response> {
         // TypeScript exhaustiveness guard — unreachable if zod schema is complete.
         const _exhaustive: never = event;
         void _exhaustive;
-        return BAD_REQUEST;
+        return badRequest();
       }
     }
   } catch (err) {

lib/email/templates.ts

@@ -1,3 +1,5 @@
+import 'server-only';
+
 // Email templates for Neon Auth webhook events.
 //
 // Tailwind classes are ignored by email clients, so inline styles are used here.
@@ -7,6 +9,16 @@
 //   background ~ #ffffff.
 // Using matching hex values (not Tailwind variables) is intentional for email.
 
+// Prevent HTML injection in user-supplied values interpolated into email markup.
+function escapeHtml(s: string): string {
+  return s
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
 interface LayoutOptions {
   title: string;
   content: string;
@@ -67,6 +79,7 @@ export function otpEmail({
   code,
   expiresInMinutes,
 }: OtpEmailOptions): EmailTemplate {
+  const safeCode = escapeHtml(code);
   const expiryLine = expiresInMinutes
     ? `This code expires in ${expiresInMinutes} minute${expiresInMinutes === 1 ? '' : 's'}.`
     : '';
@@ -75,7 +88,7 @@ export function otpEmail({
     <h1 style="margin:0 0 8px;font-size:20px;font-weight:700;color:#09090b;">Your sign-in code</h1>
     <p style="margin:0 0 24px;font-size:14px;color:#71717a;">Use the code below to sign in to Aplio.</p>
     <div style="background:#f4f4f5;border-radius:6px;padding:20px;text-align:center;margin-bottom:24px;">
-      <span style="font-size:36px;font-weight:700;letter-spacing:0.15em;color:#09090b;font-family:'Courier New',monospace;">${code}</span>
+      <span style="font-size:36px;font-weight:700;letter-spacing:0.15em;color:#09090b;font-family:'Courier New',monospace;">${safeCode}</span>
     </div>
     ${expiryLine ? `<p style="margin:0;font-size:13px;color:#71717a;">${expiryLine}</p>` : ''}
   `;
@@ -105,6 +118,7 @@ export function magicLinkEmail({
   url,
   expiresInMinutes,
 }: MagicLinkEmailOptions): EmailTemplate {
+  const safeUrl = escapeHtml(url);
   const expiryLine = expiresInMinutes
     ? `This link expires in ${expiresInMinutes} minute${expiresInMinutes === 1 ? '' : 's'}.`
     : '';
@@ -113,10 +127,10 @@ export function magicLinkEmail({
     <h1 style="margin:0 0 8px;font-size:20px;font-weight:700;color:#09090b;">Sign in to Aplio</h1>
     <p style="margin:0 0 24px;font-size:14px;color:#71717a;">Click the button below to sign in. The link will open your Aplio session.</p>
     <div style="text-align:center;margin-bottom:24px;">
-      <a href="${url}" style="display:inline-block;background:#18181b;color:#ffffff;text-decoration:none;padding:12px 28px;border-radius:6px;font-size:14px;font-weight:600;">Sign in to Aplio</a>
+      <a href="${safeUrl}" style="display:inline-block;background:#18181b;color:#ffffff;text-decoration:none;padding:12px 28px;border-radius:6px;font-size:14px;font-weight:600;">Sign in to Aplio</a>
     </div>
     ${expiryLine ? `<p style="margin:0;font-size:13px;color:#71717a;">${expiryLine}</p>` : ''}
-    <p style="margin:16px 0 0;font-size:12px;color:#71717a;">Or copy this link into your browser:<br /><span style="color:#09090b;word-break:break-all;">${url}</span></p>
+    <p style="margin:16px 0 0;font-size:12px;color:#71717a;">Or copy this link into your browser:<br /><span style="color:#09090b;word-break:break-all;">${safeUrl}</span></p>
   `;
 
   const textLines = [

lib/email/verify-webhook.ts

@@ -94,8 +94,13 @@ export async function verifyWebhookSignature(
   kidHeader: string | null,
 ): Promise<VerifyWebhookResult> {
   // Skip verification in local dev when the sentinel is set.
-  if (process.env.NEON_AUTH_WEBHOOK_SECRET === DEV_SENTINEL)
+  // The production guard prevents this bypass if the sentinel is accidentally
+  // deployed — NODE_ENV=production is always set by Next.js in a production build.
+  if (process.env.NEON_AUTH_WEBHOOK_SECRET === DEV_SENTINEL) {
+    if (process.env.NODE_ENV === 'production')
+      throw new Error('DEV_SENTINEL cannot be used in production');
     return { valid: true };
+  }
 
   if (!signatureHeader || !kidHeader) return { valid: false };
 

lib/types.ts

@@ -230,33 +230,6 @@ export type AdminUserListItem = Prisma.UserGetPayload<{
   };
 }>;
 
-// Neon Auth webhook event discriminated union — parsed by zod in the webhook route.
-// The `data` field shapes match what Neon sends for each event type; expiry fields
-// are optional because Neon may omit them for certain configurations.
-export type NeonAuthWebhookOtpEvent = {
-  type: 'send.otp';
-  data: {
-    email: string;
-    otp: string;
-    expires_at?: string;
-    expires_in_minutes?: number;
-  };
-};
-
-export type NeonAuthWebhookMagicLinkEvent = {
-  type: 'send.magic_link';
-  data: {
-    email: string;
-    magic_link: string;
-    expires_at?: string;
-    expires_in_minutes?: number;
-  };
-};
-
-export type NeonAuthWebhookEvent =
-  | NeonAuthWebhookOtpEvent
-  | NeonAuthWebhookMagicLinkEvent;
-
 // Identity shape passed to nav components so sidebar and mobile nav agree
 // on what to display in the user menu.
 export interface NavIdentity {