genprompt

TARGET LOCK: confirm or correct

Repo        shopfront · /home/dev/code/shopfront
            branch main (default main) · tree clean · via argument
Occupancy   free
Scope       single root
Stack       Node 20 · Express 4.19 · TypeScript 5.4 · Prisma 5.14 · role backend API engineer
Contract    CLAUDE.md · hard rules: "feature branches only, never push to main" (CLAUDE.md:12),
            "no new dependencies without asking" (CLAUDE.md:19)
Ancestors   none found · user-level: ~/.claude/CLAUDE.md
Truth       docs/auth.md, then CLAUDE.md
Gates       npm run lint (script) · npm run typecheck (script) · npm test (script, vitest)
New docs    docs/security/YYYY-MM-DD-<topic>.md → docs/security/2026-10-13-auth-review.md
Archetype   Q: security · autonomy: Phase 1 read-only, Phase 2 behind an approval gate
Last prompt none

Reply "go" to accept, or correct any line.

You: go

Grounded by: a read-only pass over src/routes/auth.ts, src/services/reset.ts, src/app.ts and
src/middleware/. Findings that reshaped the prompt:

• The rate limiter is mounted on /api only (src/app.ts:31). The /auth routes are outside it.
• The reset token is compared with === (src/services/reset.ts:47), not a constant-time compare.
• Whether used reset tokens are deleted is [UNVERIFIED]: no delete call found in reset.ts.

Repo: /home/dev/code/shopfront (branch main)
Read CLAUDE.md FIRST. Where this prompt and CLAUDE.md disagree, follow CLAUDE.md and tell me.
Task: security review of login and password reset, then fix what is safe to fix now.
HARD LINES: local only; never touch production or any remote system; never print secret values;
never weaken a control to pass a test.

ATTACK SURFACE, as I read it (verify, then extend):
- POST /auth/login (src/routes/auth.ts:14): anonymous; no rate limit (src/app.ts:31 mounts it on /api)
- POST /auth/reset/request (src/routes/auth.ts:41): anonymous; sends mail via src/services/mail.ts
- POST /auth/reset/confirm (src/routes/auth.ts:58): anonymous; token check at src/services/reset.ts:47

CURRENT-STATE SKEPTICISM: docs/auth.md:22 says "all auth routes are rate-limited". src/app.ts:31
says otherwise. Believe the code, and record the doc drift.

PHASE 1 (READ-ONLY): threat model + findings.
- Check: enumeration via login and reset responses, brute force, token entropy, expiry and reuse,
  timing-safe compares, session fixation, cookie flags, secrets in the repo, npm audit (read-only).
- Write docs/security/2026-10-13-auth-review.md with a findings table:

  | ID | Severity | file:line | Evidence (quoted) | Repro | Recommendation | FIX-NOW or RECORD |

  No speculative findings. Checked and retired items go in a FALSE POSITIVES table.
STOP after Phase 1 and show me the FIX-NOW list. Do not start Phase 2 until I say so.

PHASE 2: fix the FIX-NOW items only, on a feature branch (CLAUDE.md:12).
Each fix lands with a test proving the attack is refused AND the legitimate case still works.
RECORD, DO NOT ACT: lockout policy and reset-token lifetime are product decisions. Record them.

WHAT YOU CANNOT DO: production config, mail-provider settings, secret rotation. List what you need.

VERIFICATION: run before every commit. Never commit red.
    npm run lint
    npm run typecheck
    npm test
Record the baseline numbers first. Expected delta: tests up by at least one per fix.
DON'T: add dependencies (CLAUDE.md:19), push to main, touch files outside src/ and the doc.
DEFINITION OF DONE: doc written; approved fixes landed green with tests; nothing else changed.
REPORT: findings count by severity, gate numbers before and after, commits with SHAs,
`git status` at the end, and "no files outside scope touched" confirmed.
Start with Phase 1 now.

Saved: ~/.genprompt/generated-prompts/shopfront/2026-10-13-security-auth-login-reset.md

Next: paste the prompt into a second Claude Code chat. When the worker stops after Phase 1,
paste its report back here and genprompt writes the Phase 2 rulings.