Skip to content

Fix magic link validation for turnkey#3341

Open
lukabuz wants to merge 2 commits into
mainfrom
fix/fix-magic-link-validation
Open

Fix magic link validation for turnkey#3341
lukabuz wants to merge 2 commits into
mainfrom
fix/fix-magic-link-validation

Conversation

@lukabuz

@lukabuz lukabuz commented May 12, 2026

Copy link
Copy Markdown
Contributor

Changelist

  • Fix magic link validation to be origin-based

Test Plan

Test the turnkey flow

Summary by CodeRabbit

Release Notes

  • Bug Fixes
    • Strengthened email magic link validation during sign-in. The authentication system now implements more robust URL parsing and comparison mechanisms to validate magic links more reliably. This update provides improved error handling for invalid or malformed URLs that may be encountered during the sign-in process, enhancing overall system reliability and user experience.

Review Change Stack

@coderabbitai

coderabbitai Bot commented May 12, 2026

Copy link
Copy Markdown
Contributor

Warning

Rate limit exceeded

@lukabuz has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 38 minutes and 26 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 20450482-3a37-40a7-8613-fa35278319c8

📥 Commits

Reviewing files that changed from the base of the PR and between f2be2e9 and 003998d.

📒 Files selected for processing (1)
  • indexer/services/comlink/src/controllers/api/v4/turnkey-controller.ts
📝 Walkthrough

Walkthrough

Magic-link validation in TurnkeyController.signIn is updated to parse both the configured validation URL and the supplied magic link as URL objects, then validate by comparing their origin values. URL parsing failures are treated as invalid. The URL constructor is imported to support this new approach.

Changes

Magic-link validation via URL origin

Layer / File(s) Summary
Magic-link validation via URL origin
indexer/services/comlink/src/controllers/api/v4/turnkey-controller.ts
URL constructor is imported and magic-link validation logic is refactored from prefix matching to URL origin comparison, with parse failures treated as invalid.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

  • dydxprotocol/v4-chain#3297: Directly related—the prior PR added the prefix-based validation that this PR replaces with URL-origin comparison.

Suggested reviewers

  • Sam-dYdX
  • davidli1997
  • shrenujb

Poem

🐰 A magic link once matched with a simple prefix test,
Now compares origins with cryptographic rest,
URL parsing brings security's gentle touch,
Validating journeys safely—not too much!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The PR description is incomplete, missing required sections like Author/Reviewer Checklist and appropriate label selections per the template. Complete the Author/Reviewer Checklist section and manually add relevant labels (e.g., 'bug' for the fix, and any other applicable labels per repository guidelines).
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately and concisely describes the main change: fixing magic link validation for the turnkey authentication flow.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/fix-magic-link-validation

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

  • Generate code and open pull requests
  • Plan features and break down work
  • Investigate incidents and troubleshoot customer tickets together
  • Automate recurring tasks and respond to alerts with triggers
  • Summarize progress and report instantly

Built for teams:

  • Shared memory across your entire org—no repeating context
  • Per-thread sandboxes to safely plan and execute work
  • Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@indexer/services/comlink/src/controllers/api/v4/turnkey-controller.ts`:
- Line 7: Move the built-in Node.js import "import { URL } from 'url';" to the
top of the import block so Node built-ins come before external and scoped
packages, and ensure there is a blank line separating the built-in group from
the next import group; locate the import in turnkey-controller.ts and reorder it
above other imports (keeping other imports unchanged) to satisfy ESLint
import/order.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: eaf20846-b55a-4d08-9b8e-6e8a0184e21c

📥 Commits

Reviewing files that changed from the base of the PR and between 5ee9766 and f2be2e9.

📒 Files selected for processing (1)
  • indexer/services/comlink/src/controllers/api/v4/turnkey-controller.ts

import express from 'express';
import { matchedData } from 'express-validator';
import fetch from 'node-fetch';
import { URL } from 'url';

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Fix import order to resolve pipeline failure.

The url import violates ESLint's import/order rule. Built-in Node.js modules must come before external packages and scoped packages, with blank lines separating groups.

📦 Proposed fix for import order

Move the url import to the top and add proper spacing:

+import { URL } from 'url';
+
 import { stats } from '@dydxprotocol-indexer/base';
 import { TurnkeyUsersTable } from '@dydxprotocol-indexer/postgres';
 import { TurnkeyApiClient, TurnkeyApiTypes, Turnkey as TurnkeyServerSDK } from '@turnkey/sdk-server';
 import express from 'express';
 import { matchedData } from 'express-validator';
 import fetch from 'node-fetch';
-import { URL } from 'url';
 import {
   Controller, Post, Route, Body,
 } from 'tsoa';
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
import { URL } from 'url';
import { URL } from 'url';
import { stats } from '@dydxprotocol-indexer/base';
import { TurnkeyUsersTable } from '@dydxprotocol-indexer/postgres';
import { TurnkeyApiClient, TurnkeyApiTypes, Turnkey as TurnkeyServerSDK } from '@turnkey/sdk-server';
import express from 'express';
import { matchedData } from 'express-validator';
import fetch from 'node-fetch';
import {
Controller, Post, Route, Body,
} from 'tsoa';
🧰 Tools
🪛 GitHub Actions: Indexer Lint / 0_lint.txt

[error] 6-7: ESLint (import/order): There should be at least one empty line between import groups (lines 6:1, 7:1).


[error] 7-7: ESLint (import/order): url import should occur before import of @dydxprotocol-indexer/base (line 7:1).


[error] Lint step failed: eslint --ext .ts,.js . (exit status 1).

🪛 GitHub Actions: Indexer Lint / lint

[error] 6-7: ESLint (import/order): There should be at least one empty line between import groups.


[error] 7-7: ESLint (import/order): url import should occur before import of @dydxprotocol-indexer/base.


[error] Step failed: eslint --ext .ts,.js . (lint: Failed; exit status 1, exit code != 0).


[error] pnpm run lint:all failed due to comlink@0.0.1 lint error (ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL; Command failed with exit code 1).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@indexer/services/comlink/src/controllers/api/v4/turnkey-controller.ts` at
line 7, Move the built-in Node.js import "import { URL } from 'url';" to the top
of the import block so Node built-ins come before external and scoped packages,
and ensure there is a blank line separating the built-in group from the next
import group; locate the import in turnkey-controller.ts and reorder it above
other imports (keeping other imports unchanged) to satisfy ESLint import/order.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

1 participant