feat(routes): auth surfaces — sign-in, registration, MFA, passkeys, SSO, SAML, LDAP, device, OIDC

Author: yahyafakhroji

app/routes.ts

@@ -0,0 +1,45 @@
+import { type RouteConfig, index, route } from '@react-router/dev/routes';
+
+export default [
+  index('routes/_index.tsx'),
+  route('authorize', 'routes/authorize.tsx'),
+  route('login', 'routes/login.tsx'),
+  route('login/password', 'routes/login.password.tsx'),
+  route('signup', 'routes/signup.tsx'),
+  route('signup/password', 'routes/signup.password.tsx'),
+  route('password/reset', 'routes/password.reset.tsx'),
+  route('password/new', 'routes/password.new.tsx'),
+  route('password/change', 'routes/password.change.tsx'),
+  route('verify', 'routes/verify.tsx'),
+  route('verify/success', 'routes/verify.success.tsx'),
+  route('signed-in', 'routes/signed-in.tsx'),
+  route('sso', 'routes/sso.tsx'),
+  route('sso/link', 'routes/sso.link.tsx'),
+  route('logout', 'routes/logout.tsx'),
+  route('logout/success', 'routes/logout.success.tsx'),
+  route('error', 'routes/error.tsx'),
+  route('sso/:provider/callback', 'routes/sso.$provider.callback.tsx'),
+  route('sso/:provider/error', 'routes/sso.$provider.error.tsx'),
+  route('login/mfa', 'routes/login.mfa.tsx'),
+  route('login/passkey', 'routes/login.passkey.tsx'),
+  route('login/security-key', 'routes/login.security-key.tsx'),
+  route('login/verify/authenticator', 'routes/login.verify.authenticator.tsx'),
+  route('login/verify/email', 'routes/login.verify.email.tsx'),
+  route('login/verify/sms', 'routes/login.verify.sms.tsx'),
+  route('setup/passkey', 'routes/setup.passkey.tsx'),
+  route('setup/security-key', 'routes/setup.security-key.tsx'),
+  route('setup/authenticator', 'routes/setup.authenticator.tsx'),
+  route('setup/email', 'routes/setup.email.tsx'),
+  route('setup/sms', 'routes/setup.sms.tsx'),
+  route('setup/mfa', 'routes/setup.mfa.tsx'),
+  route('accounts', 'routes/accounts.tsx'),
+  // P6 Task 6: device authorization grant — user-code entry screen.
+  route('device', 'routes/device.tsx'),
+  // P6 Task 7: device/authorize — consent (authorize / deny).
+  route('device/authorize', 'routes/device.authorize.tsx'),
+  // P6 Task 9: LDAP credential-entry route.
+  route('sso/ldap', 'routes/sso.ldap.tsx'),
+  // Catch-all uses a separate module — RR7 derives route IDs from file paths,
+  // so two entries pointing at the same file produce a duplicate-ID error.
+  route('*', 'routes/catchall.tsx'),
+] satisfies RouteConfig;

app/routes/_index.tsx

@@ -0,0 +1,9 @@
+import { redirect } from 'react-router';
+
+export function loader() {
+  return redirect('/login'); // Phase 1 implements /login; until then this falls through to error.tsx
+}
+
+export default function Index() {
+  return null;
+}

app/routes/_schemas/check-your-email.ts

@@ -0,0 +1,15 @@
+import { data } from 'react-router';
+
+/**
+ * Enumeration-safe "check your email" response helper.
+ *
+ * SECURITY: Both the new-user path and the duplicate-email (ALREADY_EXISTS) path
+ * MUST return the same response when email verification is required. Sharing a single
+ * function in this module makes that structural guarantee explicit — callers cannot
+ * accidentally diverge by copy-pasting or writing their own version.
+ *
+ * Timing hardening (constant-delay no-op) is a Phase 6 item (ENH-01).
+ */
+export function genericCheckYourEmail(email: string) {
+  return data({ sent: true as const, email }, { status: 200 });
+}

app/routes/_schemas/password.test.ts

@@ -0,0 +1,79 @@
+import { resetRequestSchema, newPasswordSchema } from './password';
+import { describe, it, expect } from 'vitest';
+
+describe('resetRequestSchema', () => {
+  it('accepts a valid loginName', () => {
+    const result = resetRequestSchema.safeParse({ loginName: 'user@example.com' });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects an empty loginName', () => {
+    const result = resetRequestSchema.safeParse({ loginName: '' });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts optional organization and requestId', () => {
+    const result = resetRequestSchema.safeParse({
+      loginName: 'user@example.com',
+      organization: 'org-123',
+      requestId: 'oidc_abc',
+    });
+    expect(result.success).toBe(true);
+  });
+});
+
+describe('newPasswordSchema', () => {
+  it('accepts valid code, userId, and matching passwords', () => {
+    const result = newPasswordSchema.safeParse({
+      code: 'RESETCODE',
+      userId: 'user-1',
+      password: 'SuperSecret1!',
+      confirm: 'SuperSecret1!',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects when code is missing', () => {
+    const result = newPasswordSchema.safeParse({
+      code: '',
+      userId: 'user-1',
+      password: 'SuperSecret1!',
+      confirm: 'SuperSecret1!',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects when userId is missing', () => {
+    const result = newPasswordSchema.safeParse({
+      code: 'RESETCODE',
+      userId: '',
+      password: 'SuperSecret1!',
+      confirm: 'SuperSecret1!',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects when passwords do not match', () => {
+    const result = newPasswordSchema.safeParse({
+      code: 'RESETCODE',
+      userId: 'user-1',
+      password: 'SuperSecret1!',
+      confirm: 'DifferentPass2!',
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const paths = result.error.issues.map((i) => i.path.join('.'));
+      expect(paths).toContain('confirm');
+    }
+  });
+
+  it('rejects password shorter than 8 characters', () => {
+    const result = newPasswordSchema.safeParse({
+      code: 'RESETCODE',
+      userId: 'user-1',
+      password: 'short',
+      confirm: 'short',
+    });
+    expect(result.success).toBe(false);
+  });
+});

app/routes/_schemas/password.ts

@@ -0,0 +1,24 @@
+import { REQUEST_ID_PATTERN } from '../_shared/request-id';
+import { z } from 'zod';
+
+export const resetRequestSchema = z.object({
+  loginName: z.string().min(1),
+  organization: z.string().optional(),
+  requestId: z.string().optional(),
+});
+
+export const newPasswordSchema = z
+  .object({
+    code: z.string().min(1),
+    userId: z.string().min(1),
+    password: z.string().min(8),
+    confirm: z.string().min(8),
+    organization: z.string().optional(),
+    // CODE-MIN-24: reject a tampered mid-ceremony requestId at the boundary so it cannot
+    // forward into /authorize. Allowlist matches the Zitadel-issued prefixes.
+    requestId: z.string().regex(REQUEST_ID_PATTERN).optional(),
+  })
+  .refine((v) => v.password === v.confirm, {
+    path: ['confirm'],
+    message: 'Passwords must match',
+  });

app/routes/_schemas/register.test.ts

@@ -0,0 +1,56 @@
+import { registerSchema, signupPasswordSchema } from './register';
+import { describe, it, expect } from 'vitest';
+
+describe('registerSchema', () => {
+  it('accepts a valid registration', () => {
+    const result = registerSchema.safeParse({
+      email: 'alice@acme.test',
+      firstName: 'Alice',
+      lastName: 'Acme',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects an invalid email', () => {
+    const result = registerSchema.safeParse({
+      email: 'not-an-email',
+      firstName: 'Alice',
+      lastName: 'Acme',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts optional fields when provided', () => {
+    const result = registerSchema.safeParse({
+      email: 'alice@acme.test',
+      firstName: 'Alice',
+      lastName: 'Acme',
+      organization: 'org1',
+      requestId: 'oidc_1',
+      deviceTrackingToken: 'tok123',
+    });
+    expect(result.success).toBe(true);
+  });
+});
+
+describe('signupPasswordSchema', () => {
+  it('rejects when password and confirm do not match', () => {
+    const result = signupPasswordSchema.safeParse({
+      password: 'correct-horse',
+      confirm: 'wrong-horse',
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const confirmError = result.error.issues.find((i) => i.path.includes('confirm'));
+      expect(confirmError?.message).toBe('Passwords must match');
+    }
+  });
+
+  it('accepts when password and confirm match', () => {
+    const result = signupPasswordSchema.safeParse({
+      password: 'correct-horse',
+      confirm: 'correct-horse',
+    });
+    expect(result.success).toBe(true);
+  });
+});

app/routes/_schemas/register.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+
+// NOTE: zod 4 ships z.email() as a top-level validator; z.string().email() still works
+// (it delegates to z.email() internally) — we keep the string().email() form here
+// because it keeps the schema consistent with the other string fields and satisfies
+// the locked spec. If z.string().email() is deprecated in a future minor, swap to
+// z.email() and drop the z.string() wrapper.
+export const registerSchema = z.object({
+  email: z.string().email(),
+  firstName: z.string().min(1),
+  lastName: z.string().min(1),
+  deviceTrackingToken: z.string().optional(),
+  requestId: z.string().optional(),
+  organization: z.string().optional(),
+});
+
+export const signupPasswordSchema = z
+  .object({ password: z.string().min(8), confirm: z.string().min(8) })
+  .refine((v) => v.password === v.confirm, { path: ['confirm'], message: 'Passwords must match' });

app/routes/_schemas/verify.test.ts

@@ -0,0 +1,56 @@
+import { verifyCodeSchema, changePasswordSchema } from './verify';
+import { describe, it, expect } from 'vitest';
+
+describe('verifyCodeSchema', () => {
+  it('accepts userId and code at minimum', () => {
+    const result = verifyCodeSchema.safeParse({ userId: 'u1', code: '123456' });
+    expect(result.success).toBe(true);
+  });
+
+  it('accepts optional invite flag', () => {
+    const result = verifyCodeSchema.safeParse({ userId: 'u1', code: '123456', invite: 'true' });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects missing userId', () => {
+    const result = verifyCodeSchema.safeParse({ code: '123456' });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects missing code', () => {
+    const result = verifyCodeSchema.safeParse({ userId: 'u1' });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe('changePasswordSchema', () => {
+  it('accepts matching passwords with a sessionId', () => {
+    const result = changePasswordSchema.safeParse({
+      sessionId: 'sess1',
+      password: 'Secret123',
+      confirm: 'Secret123',
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects mismatched confirm', () => {
+    const result = changePasswordSchema.safeParse({
+      sessionId: 'sess1',
+      password: 'Secret123',
+      confirm: 'Different1',
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0].path).toContain('confirm');
+    }
+  });
+
+  it('rejects password shorter than 8 characters', () => {
+    const result = changePasswordSchema.safeParse({
+      sessionId: 'sess1',
+      password: 'short',
+      confirm: 'short',
+    });
+    expect(result.success).toBe(false);
+  });
+});

app/routes/_schemas/verify.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+
+export const verifyCodeSchema = z.object({
+  userId: z.string().min(1),
+  code: z.string().min(1),
+  invite: z.enum(['true', 'false']).optional(),
+  loginName: z.string().optional(),
+  organization: z.string().optional(),
+  requestId: z.string().optional(),
+});
+
+export const changePasswordSchema = z
+  .object({
+    sessionId: z.string().min(1),
+    password: z.string().min(8),
+    confirm: z.string().min(8),
+    requestId: z.string().optional(),
+  })
+  .refine((v) => v.password === v.confirm, { path: ['confirm'], message: 'Passwords must match' });

app/routes/_shared/app-origin.server.test.ts

@@ -0,0 +1,25 @@
+import { trustedAppOrigin } from './app-origin.server';
+import { describe, it, expect } from 'vitest';
+
+describe('trustedAppOrigin', () => {
+  it('returns the trusted publicOrigin and IGNORES the request Host (anti-injection)', () => {
+    // SECURITY: even when the attacker spoofs the request Host (and thus the URL host),
+    // the returned origin is the trusted config value — never the request host. This is
+    // the property that closes the Host-header verification-link injection.
+    const request = new Request('https://attacker.example/id/signup');
+    const origin = trustedAppOrigin(request, 'https://auth.datum.net');
+    expect(origin).toBe('https://auth.datum.net');
+    expect(origin).not.toContain('attacker.example');
+  });
+
+  it('honors a non-https trusted origin verbatim (e.g. local dev)', () => {
+    const request = new Request('http://evil.test/id/signup');
+    expect(trustedAppOrigin(request, 'http://localhost:3000')).toBe('http://localhost:3000');
+  });
+
+  it('falls back to the request origin when publicOrigin is undefined (dev/test/fake)', () => {
+    // In dev/test/fake PUBLIC_ORIGIN is optional, so the request origin is the fallback.
+    const request = new Request('http://localhost:3000/id/signup?x=1');
+    expect(trustedAppOrigin(request, undefined)).toBe('http://localhost:3000');
+  });
+});