feat: ignore robots when accessing magic link

Author: michalsn

phpstan-baseline.php

@@ -480,6 +480,18 @@
 	'count' => 1,
 	'path' => __DIR__ . '/tests/Authentication/HasAccessTokensTest.php',
 ];
+$ignoreErrors[] = [
+	'rawMessage' => 'Accessing offset \'HTTP_USER_AGENT\' directly on $_SERVER is discouraged.',
+	'identifier' => 'codeigniter.superglobalAccess',
+	'count' => 1,
+	'path' => __DIR__ . '/tests/Controllers/MagicLinkTest.php',
+];
+$ignoreErrors[] = [
+	'rawMessage' => 'Assigning \'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\' directly on offset \'HTTP_USER_AGENT\' of $_SERVER is discouraged.',
+	'identifier' => 'codeigniter.superglobalAccessAssign',
+	'count' => 1,
+	'path' => __DIR__ . '/tests/Controllers/MagicLinkTest.php',
+];
 $ignoreErrors[] = [
 	'rawMessage' => 'Only booleans are allowed in a ternary operator condition, string|null given.',
 	'identifier' => 'ternary.condNotBoolean',

src/Controllers/MagicLinkController.php

@@ -15,6 +15,7 @@
 
 use App\Controllers\BaseController;
 use CodeIgniter\Events\Events;
+use CodeIgniter\Exceptions\PageNotFoundException;
 use CodeIgniter\HTTP\IncomingRequest;
 use CodeIgniter\HTTP\RedirectResponse;
 use CodeIgniter\I18n\Time;
@@ -160,6 +161,10 @@ public function verify(): RedirectResponse
             return redirect()->route('login')->with('error', lang('Auth.magicLinkDisabled'));
         }
 
+        if ($this->request->getUserAgent()->isRobot()) {
+            throw PageNotFoundException::forPageNotFound();
+        }
+
         $token = $this->request->getGet('token');
 
         /** @var UserIdentityModel $identityModel */

tests/Controllers/MagicLinkTest.php

@@ -14,6 +14,7 @@
 namespace Tests\Controllers;
 
 use CodeIgniter\Config\Factories;
+use CodeIgniter\Exceptions\PageNotFoundException;
 use CodeIgniter\I18n\Time;
 use CodeIgniter\Shield\Authentication\Actions\EmailActivator;
 use CodeIgniter\Shield\Authentication\Authenticators\Session;
@@ -47,6 +48,14 @@ protected function setUp(): void
         Services::injectMock('routes', $routes);
     }
 
+    protected function tearDown(): void
+    {
+        parent::tearDown();
+
+        // Clean up any robot user agent set in tests
+        unset($_SERVER['HTTP_USER_AGENT']);
+    }
+
     public function testAfterLoggedInNotAllowDisplayMagicLink(): void
     {
         $this->user->createEmailIdentity([
@@ -177,4 +186,28 @@ public function testMagicLinkVerifyRedirectsIfNotAllowed(): void
             lang('Auth.magicLinkDisabled'),
         );
     }
+
+    public function testMagicLinkVerifyReturns404ForRobotUserAgent(): void
+    {
+        $this->expectException(PageNotFoundException::class);
+
+        /** @var User $user */
+        $user = fake(UserModel::class);
+        $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
+
+        $identities = model(UserIdentityModel::class);
+
+        // Insert User Identity for Magic link login
+        $identities->insert([
+            'user_id' => $user->id,
+            'type'    => Session::ID_TYPE_MAGIC_LINK,
+            'secret'  => 'validtoken123',
+            'expires' => Time::now()->addMinutes(60),
+        ]);
+
+        // Simulate a robot user agent
+        $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)';
+
+        $this->get(route_to('verify-magic-link') . '?token=validtoken123');
+    }
 }