isra el fdc1609946 fix(auth): check Google token audience and align reset responses ...

The tokeninfo response was trusted without checking who the token was
issued for, so a token minted for any other Google OAuth client was
accepted. The audience is now matched against GOOGLE_CLIENT_ID and the
verified-email flag is required. The audience check is skipped with a
logged warning when the variable is unset, so an unconfigured environment
does not lose Google sign-in.

Password reset requests now return the same response whether or not the
address is registered, an unknown address on reset reports the same error
as a bad code, a non-string email no longer reaches the query, and the
code is drawn from crypto.randomInt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-02 14:29:31 +03:00

..

src

fix(auth): check Google token audience and align reset responses

2026-08-02 14:29:31 +03:00

test

…

.dockerignore

…

.env.example

fix(auth): check Google token audience and align reset responses

2026-08-02 14:29:31 +03:00

.eslintrc.js

…

.gitignore

…

.prettierrc

…

Dockerfile

…

nest-cli.json

…

package.json

…

pnpm-lock.yaml

…

Procfile

…

tsconfig.build.json

…

tsconfig.json

…