Joaom/improve auth - #79
Conversation
…utdated related guides for improved clarity and user experience.
Add /loglife/unregister and /loglife/users routes, plus tests and a helper script for removing users during onboarding tests. Update API/development docs to reflect V1 register-first flow and provide clear monitoring/removal steps. Made-with: Cursor
Add a reusable script to restart local OpenClaw after plugin code changes and document it in the development workflow. Made-with: Cursor
Add auto-linking with LF-#### codes, dashboard polling via /api/verify/status, and hook-based verification in the plugin. Improve local ops with restart/list/unregister scripts, including unregister --all and phone input normalization without requiring a plus sign. Made-with: Cursor
Simplify step-two WhatsApp verification UI to a clear three-element flow (instruction, send button, waiting status). Add a background expiry sweep for pending links so unlinked numbers are automatically removed after timeout even if the user abandons the page. Made-with: Cursor
Simplifies the link step into a single registered/code message plus one clear WhatsApp CTA, and adds a change-number action while waiting so users can quickly correct wrong numbers.
Persists pending-link state across restarts, strengthens code-message suppression, and runs cleanup during status/user checks so stale provisional registrations are removed reliably. Also adds a visible verification countdown so users can see exactly when a link expires.
Removes backend registration immediately on dashboard/account number changes, refines waiting-state UI text, and strengthens plugin reply suppression so code-linking only sends the intended welcome message.
Treats LF-#### as a control token so linking codes never trigger user-facing assistant replies, including web auto-reply paths. Also adds a minimal copy affordance for the generated linking code in the dashboard.
Removes brittle prompt/suppression logic from the plugin and relies on a single deterministic plugin-sent welcome when a pending LF code is verified, with updated onboarding wording for the first WhatsApp message.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Free Tier Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
|
|
||
| if (verified) { | ||
| verifiedPhones.delete(phone); | ||
| } |
There was a problem hiding this comment.
Verified state permanently lost if Clerk update fails
High Severity
The /loglife/verify/status plugin endpoint deletes the phone from verifiedPhones immediately after reading its value. The server-side route in verify/status/route.ts then attempts a Clerk metadata update after the plugin has already consumed the one-shot state. If the Clerk updateUser call fails (network blip, rate limit, etc.), the catch block returns a 502 to the client, but the plugin has already deleted the verified state. Subsequent polls return verified: false, permanently losing the verification. The user must restart the entire linking flow.
Additional Locations (1)
|
|
||
| const whatsappPhone = (user?.unsafeMetadata as Record<string, string> | undefined)?.whatsappPhone || ""; | ||
| const waTarget = normalizeWaMeTarget(process.env.NEXT_PUBLIC_LOGLIFE_WHATSAPP_NUMBER); | ||
| const fullPhone = `${countryCode}${phoneLocal}`; |
There was a problem hiding this comment.
Register button enabled without entering phone number
Low Severity
fullPhone is computed as `${countryCode}${phoneLocal}` where countryCode defaults to "1" and phoneLocal defaults to "". So fullPhone is "1" on mount. The submit button's disabled check (!fullPhone.trim()) passes because "1" is truthy, allowing the user to submit with only a country code and no actual phone number. The plugin rejects it with a 400 (phone too short), but the button shouldn't be clickable in this state.
Additional Locations (1)
1 participant
Note
High Risk
Touches security- and availability-critical paths (phone verification, allow-list enforcement, and live mutation of
openclaw.json) and introduces background cleanup + message interception logic that could incorrectly allow/deny messaging if buggy.Overview
Updates the LogLife plugin onboarding model to generate an
LF-XXXXlink code during/loglife/register, persist pending links to disk, intercept WhatsApp inbound messages to complete verification, and expose a new/loglife/verify/statuspoll endpoint for the website.Adds user lifecycle management endpoints:
POST /loglife/unregister(includingall:true) andGET /loglife/users, and changes runtime config application to write merged generated config directly intoopenclaw.json(including cleanup of stale channel allow-list fields) instead of touching the file timestamp.Updates the website to use the new flow (register → send WhatsApp message → poll status), adds
/api/verify/statusand/api/unregisterproxy routes, and disconnect now also unregisters the phone from the gateway. Docs/navigation are refreshed (new AI rules page, API reference for new endpoints, revised onboarding/security model), DM policies default toallowlist, and new helper scripts are added for local gateway restart and user monitoring/unregistering.Written by Cursor Bugbot for commit f33dfe4. This will update automatically on new commits. Configure here.