mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
2f52f66879
Two correctness gaps on the v1.4.41 onboarding-discovery endpoint, caught in the v1.4.41 QA round: 1. The route called `identifier.toLowerCase()` before the OR-match on `username` / `email`, but `registerSchema` applies no transform on write — both columns are stored exactly as typed. A user registered as `MixedCase@Example.com` would never resolve through this route, and iOS onboarding would route them to the sign-up branch despite an existing account. 2. The route header claimed an edge-level limit on `/api/auth/*` covered brute-force enumeration; no such middleware exists. Sibling `/api/auth/passkey/login-options` carries a per-route throttle. We mirror that shape — `checkRateLimit("auth:check-user:<ip>", 30, 15 * 60 * 1000)` — and rewrite the header comment so the rationale matches reality. Tests pin both invariants: a `MixedCase@Example.com` probe hits `findFirst` with the case preserved, and a 429 short-circuits the `findFirst` call entirely.