Merge pull request #1727 from mxllv/fix/issues-1563-1564-1565-1566-tracking-view-token-select-public-root-timing

fix(backend): public tracking view, hide verification token, public root route, equalise login timing

Author: mftee

backend/src/app.controller.ts

@@ -1,10 +1,12 @@
 import { Controller, Get } from '@nestjs/common';
 import { AppService } from './app.service';
+import { Public } from './auth/decorators/public.decorator';
 
 @Controller()
 export class AppController {
   constructor(private readonly appService: AppService) {}
 
+  @Public()
   @Get()
   getHello(): string {
     return this.appService.getHello();

backend/src/auth/auth.service.ts

@@ -27,6 +27,13 @@ export interface AuthResponse {
   refreshToken: string;
 }
 
+// Hash of a throwaway password, compared against when the email is unknown so
+// that "no such account" and "wrong password" cost the same bcrypt work.
+const TIMING_EQUALISATION_HASH = bcrypt.hashSync(
+  'timing-equalisation-password',
+  12,
+);
+
 @Injectable()
 export class AuthService {
   private readonly logger = new Logger(AuthService.name);
@@ -41,7 +48,10 @@ export class AuthService {
 
   async validateUser(email: string, password: string): Promise<User | null> {
     const user = await this.usersService.findByEmail(email);
-    if (!user) return null;
+    if (!user) {
+      await this.usersService.verifyPassword(password, TIMING_EQUALISATION_HASH);
+      return null;
+    }
     const isMatch = await this.usersService.verifyPassword(
       password,
       user.passwordHash,

backend/src/shipments/shipments.service.ts

@@ -486,6 +486,31 @@ export class ShipmentsService {
     };
   }
 
+  /**
+   * Public tracking view: status and route only. The full shipment (price,
+   * cargo description, notes, party records) is never returned here.
+   */
+  async findByTracking(trackingNumber: string) {
+    const shipment = await this.shipmentRepo.findOne({
+      where: { trackingNumber },
+    });
+    if (!shipment) {
+      throw new NotFoundException(
+        `No shipment found for tracking number ${trackingNumber}`,
+      );
+    }
+    return {
+      trackingNumber: shipment.trackingNumber,
+      status: shipment.status,
+      origin: shipment.origin,
+      destination: shipment.destination,
+      pickupDate: shipment.pickupDate,
+      estimatedDeliveryDate: shipment.estimatedDeliveryDate,
+      actualDeliveryDate: shipment.actualDeliveryDate,
+      updatedAt: shipment.updatedAt,
+    };
+  }
+
   async update(
     id: string,
     shipperId: string,

backend/src/users/entities/user.entity.ts

@@ -50,7 +50,12 @@ export class User {
   })
   refreshToken: string | null;
 
-  @Column({ name: 'verification_token', nullable: true, type: 'varchar' })
+  @Column({
+    name: 'verification_token',
+    nullable: true,
+    type: 'varchar',
+    select: false,
+  })
   verificationToken: string | null;
 
   @Column({