pezkuwichain/pezkuwi-p2p-mobile
1
Fork 0
mirror of https://github.com/pezkuwichain/pezkuwi-p2p-mobile.git synced 2026-10-20 18:56:22 +00:00
Code Releases Activity

fix: use session_token for miniapp auth instead of from_miniapp

Browse Source 
- loginViaParams now accepts session_token from URL
- Removes insecure from_miniapp parameter
- Aligns with telegram-auth security update
This commit is contained in:
Kurdistan Tech Ministry committed 2026-02-06 04:35:12 +03:00
1 parent 2cef7b44fc
commit 5236f8c470
1 file changed
+9 -24
Download Patch File Download Diff File Expand all files Collapse all files
src/contexts/AuthContext.tsx
+9 -24
View File
@@ -157,38 +157,23 @@ export function AuthProvider({ children }: { children: ReactNode }) {
window.Telegram?.WebApp.HapticFeedback.notificationOccurred('success'); window.Telegram?.WebApp.HapticFeedback.notificationOccurred('success');
}, [user]); }, [user]);
// Login via URL params (from mini-app redirect) // Login via URL params (from mini-app redirect with session_token)
const loginViaParams = useCallback(async () => { const loginViaParams = useCallback(async () => {
const params = new URLSearchParams(window.location.search); const params = new URLSearchParams(window.location.search);
const tgId = params.get('tg_id'); const sessionToken = params.get('session_token');
const wallet = params.get('wallet');
const from = params.get('from'); const from = params.get('from');
const ts = params.get('ts');
if (!tgId || from !== 'miniapp') { // Check if coming from miniapp with session_token
if (!sessionToken || from !== 'miniapp') {
return false; return false;
} }
// Validate timestamp (not older than 5 minutes)
if (ts) {
const timestamp = parseInt(ts);
const now = Date.now();
if (now - timestamp > 5 * 60 * 1000) {
console.warn('URL params expired');
return false;
}
}
setIsLoading(true); setIsLoading(true);
try { try {
// Verify with backend and get/create user // Verify session token with backend
const { data, error: fnError } = await supabase.functions.invoke('telegram-auth', { const { data, error: fnError } = await supabase.functions.invoke('telegram-auth', {
body: { body: { sessionToken }
telegram_id: parseInt(tgId),
wallet_address: wallet || undefined,
from_miniapp: true
}
}); });
if (fnError) throw fnError; if (fnError) throw fnError;
@@ -215,7 +200,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
return true; return true;
} catch (err) { } catch (err) {
console.error('URL param login error:', err); console.error('Session token login error:', err);
return false; return false;
} finally { } finally {
setIsLoading(false); setIsLoading(false);
@@ -261,9 +246,9 @@ export function AuthProvider({ children }: { children: ReactNode }) {
return; return;
} }
// Try URL params auth (from mini-app redirect) // Try URL params auth (from mini-app redirect with session_token)
const params = new URLSearchParams(window.location.search); const params = new URLSearchParams(window.location.search);
if (params.get('from') === 'miniapp' && params.get('tg_id')) { if (params.get('from') === 'miniapp' && params.get('session_token')) {
const success = await loginViaParams(); const success = await loginViaParams();
if (success) return; if (success) return;
} }