Encode sign-in mail as base64 so webmail cannot mangle the verify token.

Quoted-printable still rewrote token= as token=3D in the raw MIME, which some clients never decode. Distinguish a missing token from a real expiry, and keep links valid for 60 minutes.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/unit/authMagicLinkVerifyRoute.test.ts

@@ -0,0 +1,91 @@
+import { NextRequest } from "next/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const isDatabaseConfiguredMock = vi.fn();
+const getSessionPepperMock = vi.fn();
+const hashSessionTokenMock = vi.fn();
+const findUniqueMock = vi.fn();
+const deleteMock = vi.fn();
+const upsertMock = vi.fn();
+const createSessionForUserMock = vi.fn();
+const setSessionCookieMock = vi.fn();
+
+vi.mock("../../lib/server/env", () => ({
+  isDatabaseConfigured: () => isDatabaseConfiguredMock(),
+  getSessionPepper: () => getSessionPepperMock(),
+}));
+
+vi.mock("../../lib/server/hash", () => ({
+  hashSessionToken: (...args: unknown[]) => hashSessionTokenMock(...args),
+}));
+
+vi.mock("../../lib/server/session", () => ({
+  createSessionForUser: (...args: unknown[]) =>
+    createSessionForUserMock(...args),
+  setSessionCookie: (...args: unknown[]) => setSessionCookieMock(...args),
+}));
+
+vi.mock("../../lib/server/db", () => ({
+  prisma: {
+    magicLinkToken: {
+      findUnique: (...args: unknown[]) => findUniqueMock(...args),
+      delete: (...args: unknown[]) => deleteMock(...args),
+    },
+    user: {
+      upsert: (...args: unknown[]) => upsertMock(...args),
+    },
+  },
+}));
+
+import { GET } from "../../app/api/auth/magic-link/verify/route";
+
+beforeEach(() => {
+  isDatabaseConfiguredMock.mockReset();
+  getSessionPepperMock.mockReset();
+  hashSessionTokenMock.mockReset();
+  findUniqueMock.mockReset();
+  deleteMock.mockReset();
+  upsertMock.mockReset();
+  createSessionForUserMock.mockReset();
+  setSessionCookieMock.mockReset();
+
+  isDatabaseConfiguredMock.mockReturnValue(true);
+  getSessionPepperMock.mockReturnValue("pepper");
+  hashSessionTokenMock.mockReturnValue("token-hash");
+});
+
+function getWithToken(token: string) {
+  return new NextRequest(
+    `https://x.test/api/auth/magic-link/verify?token=${encodeURIComponent(token)}`,
+  );
+}
+
+describe("GET /api/auth/magic-link/verify", () => {
+  it("redirects with invalid_link when the token is missing", async () => {
+    const res = await GET(
+      new NextRequest("https://x.test/api/auth/magic-link/verify"),
+    );
+    expect(res.status).toBe(307);
+    expect(res.headers.get("location")).toContain("error=invalid_link");
+  });
+
+  it("redirects with invalid_link when no row matches", async () => {
+    findUniqueMock.mockResolvedValue(null);
+    const res = await GET(getWithToken("a-token-value-long-enough"));
+    expect(res.status).toBe(307);
+    expect(res.headers.get("location")).toContain("error=invalid_link");
+  });
+
+  it("redirects with expired_link when the row is past expiresAt", async () => {
+    findUniqueMock.mockResolvedValue({
+      id: "row-1",
+      email: "a@b.c",
+      expiresAt: new Date(Date.now() - 1000),
+      nextPath: null,
+      draftPayload: null,
+    });
+    const res = await GET(getWithToken("a-token-value-long-enough"));
+    expect(res.status).toBe(307);
+    expect(res.headers.get("location")).toContain("error=expired_link");
+  });
+});

tests/unit/mail.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, describe, expect, it } from "vitest";
 import nodemailer from "nodemailer";
 import {
+  MAIL_TEXT_ENCODING,
   buildVerifyLinkParts,
   resolveMailFrom,
 } from "../../lib/server/mail";
@@ -8,12 +9,17 @@ import {
 const VERIFY_URL =
   "https://staging.communityrule.info/api/auth/magic-link/verify?token=5IdE_BHowaw-QJj7Rwue7CbB8wDXvYITvnxRb1FGqxA";
 
-function decodeQuotedPrintable(value: string): string {
-  return value
-    .replace(/=\r?\n/g, "")
-    .replace(/=([0-9A-Fa-f]{2})/g, (_, hex: string) =>
-      String.fromCharCode(Number.parseInt(hex, 16)),
-    );
+function decodeBase64Parts(raw: string): string {
+  const blocks = [
+    ...raw.matchAll(
+      /Content-Transfer-Encoding:\s*base64\s*\r?\n\r?\n([A-Za-z0-9+/=\s]+)/gi,
+    ),
+  ];
+  return blocks
+    .map((match) =>
+      Buffer.from(match[1].replace(/\s/g, ""), "base64").toString("utf8"),
+    )
+    .join("\n");
 }
 
 const MAIL_FROM_KEYS = ["SMTP_FROM", "CLOUDRON_MAIL_FROM"] as const;
@@ -30,15 +36,16 @@ afterEach(() => {
 });
 
 describe("buildVerifyLinkParts", () => {
-  it("puts the exact verify URL in both text and the HTML href", () => {
+  it("puts the exact verify URL in text, href, and visible HTML link", () => {
     const { text, html } = buildVerifyLinkParts(
       VERIFY_URL,
-      "Open this link to sign in (it expires in 15 minutes):",
+      "Open this link to sign in (it expires in 60 minutes):",
       "If you did not request this, you can ignore this email.",
       "Sign in",
     );
-    expect(text).toContain(VERIFY_URL);
+    expect(text).toContain(`<${VERIFY_URL}>`);
     expect(html).toContain(`href="${VERIFY_URL}"`);
+    expect(html).toContain(`>${VERIFY_URL}</a>`);
     expect(html).toContain(">Sign in</a>");
   });
 
@@ -57,10 +64,10 @@ describe("buildVerifyLinkParts", () => {
 });
 
 describe("MIME encoding of verify-link mail", () => {
-  it("keeps a clickable href after quoted-printable encoding", async () => {
+  it("uses base64 so the raw MIME never contains token=3D", async () => {
     const { text, html } = buildVerifyLinkParts(
       VERIFY_URL,
-      "Open this link to sign in (it expires in 15 minutes):",
+      "Open this link to sign in (it expires in 60 minutes):",
       "If you did not request this, you can ignore this email.",
       "Sign in",
     );
@@ -75,14 +82,17 @@ describe("MIME encoding of verify-link mail", () => {
       subject: "Sign in to Community Rule",
       text,
       html,
+      textEncoding: MAIL_TEXT_ENCODING,
     });
     const raw = Buffer.isBuffer(info.message)
       ? info.message.toString("utf8")
       : String(info.message);
-    const decoded = decodeQuotedPrintable(raw);
+    expect(raw).toMatch(/Content-Transfer-Encoding:\s*base64/i);
+    expect(raw).not.toContain("token=3D");
+    expect(raw).not.toMatch(/quoted-printable/i);
+    const decoded = decodeBase64Parts(raw);
     expect(decoded).toContain(`href="${VERIFY_URL}"`);
     expect(decoded).toContain(VERIFY_URL);
-    expect(decoded).not.toContain("token=3D");
   });
 });