Repository navigation
fix: subscription follow-ups to #215 - #216
Merged
Merged
Conversation
countPendingSubscriptionsForEmail counted every never-confirmed row, and nothing ever deletes one, so a stranger naming an address on five posts left it unable to subscribe by email again. Rows the reader cancelled also kept holding a slot. The cap now counts live pending rows created in the last seven days. created_at is a sound "pending since" once cancelled rows are excluded: the only upsert branch that turns an old row back into a pending one leaves unsubscribed_at set.
confirmSubscription keeps the confirm token alive so a re-click after a mail-client prefetch still lands on the success page. After the reader unsubscribed, that same link went on rendering "you're subscribed". getSubscriptionByConfirmToken now resolves nothing for a confirmed and then cancelled row; re-subscribing mints a fresh link as before. It also gets the same 64-hex shape guard as getSubscriptionByToken, so junk tokens on the un-rate-limited confirm GET cost no D1 read.
The Referrer-Policy relaxation and the self-origin CSRF check have to cover the same form pages, but index.ts kept its own regex. Export isSelfOriginFormPath from lib/cors.ts and use it in both places, so a new form can't land in one list and not the other. The RFC 8058 one-click path, which serves no form, is back on no-referrer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up review of the subscription system after #215.
Fixes
countPendingSubscriptionsForEmailcounted every never-confirmed row and nothing deletes them, so five forged subscribes left an address unable to subscribe by email again. It now counts live pending rows from the last 7 days (PENDING_WINDOW_MS); cancelled pending rows no longer hold a slot. No migration: once cancelled rows are excluded,created_atis the pending-since time.getSubscriptionByConfirmTokennow resolves nothing for that row, and gets the same 64-hex shape guard as the unsubscribe lookup, so junk tokens on the un-rate-limited confirm GET cost no D1 read.Cleanup
SELF_ORIGIN_POST_PATHSviaisSelfOriginFormPathinlib/cors.tsinstead of a second regex inindex.ts./one-click(no form) is back onno-referrer.api.subscriptions.ts.docs/ANTISPAM.mddescribes the windowed cap.Testing
lint,typecheck,test(3278),manifest:check,build,sizepass locally. The four new behavior tests fail onmainwithout the source changes. Each commit typechecks and passes the subscription suites on its own.