Build Magic Link Authentication

mkdir magic-link && cd magic-link && npm init -y && npm pkg set type=module
npm i ioredis pg hono @hono/node-server zod
npm i -D typescript tsx @types/node @types/pg

CREATE TABLE IF NOT EXISTS users (
  id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email       TEXT NOT NULL UNIQUE,            -- stored lower-cased
  created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
);
CREATE TABLE IF NOT EXISTS sessions (
  id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  token_hash      TEXT NOT NULL UNIQUE,        -- sha256 of the cookie value
  user_id         UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  user_agent      TEXT,
  ip_address      TEXT,
  created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
  last_active_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
  expires_at      TIMESTAMPTZ NOT NULL,
  revoked_at      TIMESTAMPTZ
);
CREATE INDEX IF NOT EXISTS sessions_user ON sessions (user_id) WHERE revoked_at IS NULL;

// src/magic-link.ts
import { randomBytes, createHash } from "node:crypto";
import { Redis } from "ioredis";
import pg from "pg";

export const redis = new Redis(process.env.REDIS_URL ?? "redis://127.0.0.1:6379");
export const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL });

const LINK_TTL_SEC = 10 * 60;
const SESSION_DAYS = 30;
const sha256 = (s: string) => createHash("sha256").update(s).digest("hex");

// Plug in your email provider's SDK here (Postmark, SES, Resend, ...).
export type SendMail = (to: string, link: string) => Promise<void>;

// Counter that starts its window on the first hit; returns false once over the limit.
async function allow(key: string, limit: number, windowSec: number) {
  const [[, count]] = (await redis.multi().incr(key).expire(key, windowSec, "NX").exec())!;
  return (count as number) <= limit;
}

// Only same-site relative paths: "//evil.com" and "https://..." would be open redirects.
export const safePath = (p?: string) => (p && /^\/(?![/\\])/.test(p) ? p : "/");

export async function requestMagicLink(email: string, ip: string, redirectTo: string | undefined, sendMail: SendMail) {
  email = email.trim().toLowerCase();
  const ok = (await allow(`magic:rate:email:${email}`, 5, 3600)) && (await allow(`magic:rate:ip:${ip}`, 20, 3600));
  if (!ok) return; // the caller answers identically either way, so nobody can probe which emails exist

  const token = randomBytes(32).toString("base64url");     // 256 bits, URL-safe
  const key = `magic:token:${sha256(token)}`;               // only the hash is stored
  const latest = `magic:latest:${email}`;
  const previous = await redis.set(latest, key, "EX", LINK_TTL_SEC, "GET"); // newest link wins
  if (previous) await redis.del(previous);
  await redis.set(key, JSON.stringify({ email, redirectTo: safePath(redirectTo) }), "EX", LINK_TTL_SEC);

  await sendMail(email, `${process.env.APP_URL}/auth/verify?token=${token}`);
}

// Consume the token atomically: GETDEL means two clicks (or a scanner and a human) cannot both win.
export async function verifyMagicLink(token: string, ip: string, userAgent: string) {
  const raw = await redis.getdel(`magic:token:${sha256(token)}`);
  if (!raw) return null;
  const { email, redirectTo } = JSON.parse(raw) as { email: string; redirectTo: string };

  const { rows: [user] } = await pool.query(
    `INSERT INTO users (email) VALUES ($1)
     ON CONFLICT (email) DO UPDATE SET email = EXCLUDED.email RETURNING id`, [email]);

  const sessionToken = randomBytes(32).toString("base64url");
  const expiresAt = new Date(Date.now() + SESSION_DAYS * 86_400_000);
  await pool.query(
    `INSERT INTO sessions (token_hash, user_id, user_agent, ip_address, expires_at) VALUES ($1,$2,$3,$4,$5)`,
    [sha256(sessionToken), user.id, userAgent.slice(0, 300), ip, expiresAt]);
  return { sessionToken, expiresAt, redirectTo };
}

export async function sessionFromToken(token: string) {
  const { rows: [s] } = await pool.query(
    `UPDATE sessions SET last_active_at = now()
     WHERE token_hash = $1 AND revoked_at IS NULL AND expires_at > now()
     RETURNING id, user_id`, [sha256(token)]);
  return s as { id: string; user_id: string } | undefined;
}

export async function listSessions(userId: string) {
  const { rows } = await pool.query(
    `SELECT id, user_agent, ip_address, created_at, last_active_at FROM sessions
     WHERE user_id = $1 AND revoked_at IS NULL AND expires_at > now() ORDER BY last_active_at DESC`, [userId]);
  return rows;
}

// exceptId keeps the current device signed in ("sign out everywhere else")
export async function revokeSessions(userId: string, opts: { id?: string; exceptId?: string }) {
  const { rowCount } = await pool.query(
    `UPDATE sessions SET revoked_at = now()
     WHERE user_id = $1 AND revoked_at IS NULL
       AND ($2::uuid IS NULL OR id = $2) AND ($3::uuid IS NULL OR id <> $3)`,
    [userId, opts.id ?? null, opts.exceptId ?? null]);
  return rowCount ?? 0;
}

// src/app.ts
import { serve } from "@hono/node-server";
import { Hono } from "hono";
import { deleteCookie, getCookie, setCookie } from "hono/cookie";
import { z } from "zod";
import * as auth from "./magic-link";

const app = new Hono<{ Variables: { session: { id: string; user_id: string } } }>();
const COOKIE = "sid";
const TokenSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/); // 32 random bytes, base64url
const secure = process.env.NODE_ENV === "production";
const clientIp = (c: any) => c.req.header("x-forwarded-for")?.split(",")[0].trim() ?? "unknown"; // trust only behind your proxy

const sendMail: auth.SendMail = async (to, link) => { console.log(`mail to ${to}: ${link}`); }; // replace

app.post("/auth/request", async (c) => {
  const body = z.object({ email: z.email(), redirectTo: z.string().max(200).optional() }).safeParse(await c.req.json().catch(() => null));
  if (!body.success) return c.json({ error: "Enter a valid email address." }, 400);
  await auth.requestMagicLink(body.data.email, clientIp(c), body.data.redirectTo, sendMail);
  return c.json({ message: "If that address can sign in, a link is on its way." });
});

// GET only shows a button. Mail scanners and link previewers fetch GET URLs, and must not burn the one-time token.
app.get("/auth/verify", (c) => {
  const token = TokenSchema.safeParse(c.req.query("token"));
  if (!token.success) return c.text("Invalid link.", 400);
  c.header("Referrer-Policy", "no-referrer");
  c.header("Cache-Control", "no-store");
  return c.html(`<form method="post" action="/auth/verify"><input type="hidden" name="token" value="${token.data}"><button>Sign in</button></form>`);
});

app.post("/auth/verify", async (c) => {
  const form = await c.req.parseBody();
  const token = TokenSchema.safeParse(form.token);
  const result = token.success && await auth.verifyMagicLink(token.data, clientIp(c), c.req.header("user-agent") ?? "");
  if (!result) return c.text("This link is invalid or expired. Request a new one.", 400);
  setCookie(c, COOKIE, result.sessionToken, { httpOnly: true, secure, sameSite: "Lax", path: "/", expires: result.expiresAt });
  return c.redirect(result.redirectTo, 303);
});

app.use("/me/*", async (c, next) => {
  const t = getCookie(c, COOKIE);
  const s = t && await auth.sessionFromToken(t);
  if (!s) return c.json({ error: "Not signed in" }, 401);
  c.set("session", s);
  await next();
});
app.get("/me/sessions", async (c) => {
  const s = c.get("session");
  return c.json((await auth.listSessions(s.user_id)).map((r) => ({ ...r, current: r.id === s.id })));
});
app.delete("/me/sessions/:id", async (c) => {
  const s = c.get("session");
  const id = z.uuid().safeParse(c.req.param("id"));
  if (!id.success) return c.json({ error: "Bad id" }, 400);
  return c.json({ revoked: await auth.revokeSessions(s.user_id, { id: id.data }) });
});
app.post("/me/sessions/revoke-others", async (c) => {
  const s = c.get("session");
  return c.json({ revoked: await auth.revokeSessions(s.user_id, { exceptId: s.id }) });
});
app.post("/me/logout", async (c) => {
  const s = c.get("session");
  await auth.revokeSessions(s.user_id, { id: s.id });
  deleteCookie(c, COOKIE, { path: "/" });
  return c.json({ ok: true });
});

serve({ fetch: app.fetch, hostname: "127.0.0.1", port: Number(process.env.PORT ?? 3000) });

$ curl -s -XPOST 127.0.0.1:3000/auth/request -H 'content-type: application/json' -d '{"email":"Yuki@Example.com","redirectTo":"/dashboard"}'
{"message":"If that address can sign in, a link is on its way."}
$ curl -si -c jar.txt -XPOST 127.0.0.1:3000/auth/verify -d "token=$TOKEN" | grep -i '^location\|set-cookie'
location: /dashboard
set-cookie: sid=...; Path=/; HttpOnly; SameSite=Lax
$ curl -s -XPOST 127.0.0.1:3000/auth/verify -d "token=$TOKEN"
This link is invalid or expired. Request a new one.