feat(#187): login do dono (OTP) + publicar no mural - #288
Draft
Lucas-Belucci-Bellini wants to merge 3 commits into
Draft
feat(#187): login do dono (OTP) + publicar no mural#288Lucas-Belucci-Bellini wants to merge 3 commits into
Lucas-Belucci-Bellini wants to merge 3 commits into
Conversation
O operador loga por codigo OTP (6 digitos no e-mail) e publica no mural
direto do site; a escrita usa o access_token e o RLS so libera o dono.
Sair encerra a sessao; visitante continua so lendo. Cliente: requestOtp/
verifyOtp/getAccessToken (com refresh) em src/core/supabase.js (Auth
REST por fetch, sem SDK). Requer 1 ajuste no painel (template de e-mail
com {{ .Token }}) -- doc em docs/SUPABASE.md. Verificado: UI de login,
compositor do dono + Sair, feed lendo do banco, sem erros de console.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ch5ibVnhNZG2qGaa83sXd3
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
CodeQL apontou guardar access_token/refresh_token no localStorage como clear-text storage de dado sensivel (exfiltravel por XSS). Passa a manter a sessao SO em memoria (variavel de modulo) -- token nunca vai pro disco. Custo: relogar ao recarregar a pagina (ok pra publicacao eventual). Verificado: nada de sb:session no localStorage, login UI e leitura do mural OK, build limpo. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ch5ibVnhNZG2qGaa83sXd3
CodeQL flagou dado sensivel/PII hardcoded no bundle. O cliente nao precisa do e-mail do dono: o gating de UI passa a ser 'esta logado' e a autorizacao REAL continua no RLS do banco (escrita so do e-mail do operador, no policy server-side). Remove OWNER_EMAIL do src; input de login sem prefill. Verificado: nenhum e-mail no client, build limpo, login UI e leitura do mural OK. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ch5ibVnhNZG2qGaa83sXd3
This was referenced Jun 22, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔐 Login do dono (OTP) + publicar no mural
Continuação do #287: agora você loga como operador e publica no mural direto do site. Método escolhido: código OTP de 6 dígitos no e-mail (melhor pra SPA com hash routing).
Como funciona
access_token; o RLS no banco só autoriza o e-mail do dono — qualquer outro é rejeitado.getAccessToken()renova viarefresh_token.web = leve
Tudo via Auth REST por
fetch(requestOtp/verifyOtp/refresh) emsrc/core/supabase.js— sem SDK.⚙️ 1 ajuste seu no painel do Supabase (uma vez)
Pro e-mail mostrar o código (e não só o link mágico): Authentication → Email Templates → Magic Link, inclua
{{ .Token }}no corpo. Passo-a-passo + env vars emdocs/SUPABASE.md.Verificação
vite buildlimpo. No navegador: deslogado → caixa de login renderiza e o feed lê do banco; com sessão do dono (simulada) → compositor + "Sair" aparecem; sem erros de console. O round-trip real do e-mail/código você testa ao vivo (daqui não recebo o e-mail) — por isso não disparei envio de OTP pra não encher sua caixa.🤖 Generated with Claude Code
Generated by Claude Code