refactor(server): improve magic link login flow (#10736)

packages/frontend/apps/ios/App/App/Plugins/Auth/AuthPlugin.swift

@@ -17,8 +17,9 @@ public class AuthPlugin: CAPPlugin, CAPBridgedPlugin {
         let endpoint = try call.getStringEnsure("endpoint")
         let email = try call.getStringEnsure("email")
         let token = try call.getStringEnsure("token")
+        let clientNonce = call.getString("clientNonce")
         
-        let (data, response) = try await self.fetch(endpoint, method: "POST", action: "/api/auth/magic-link", headers: [:], body: ["email": email, "token": token])
+        let (data, response) = try await self.fetch(endpoint, method: "POST", action: "/api/auth/magic-link", headers: [:], body: ["email": email, "token": token, "client_nonce": clientNonce])
 
         if response.statusCode >= 400 {
           if let textBody = String(data: data, encoding: .utf8) {

packages/frontend/apps/ios/src/app.tsx

@@ -169,11 +169,12 @@ framework.scope(ServerScope).override(AuthProvider, resolver => {
   const serverService = resolver.get(ServerService);
   const endpoint = serverService.server.baseUrl;
   return {
-    async signInMagicLink(email, linkToken) {
+    async signInMagicLink(email, linkToken, clientNonce) {
       const { token } = await Auth.signInMagicLink({
         endpoint,
         email,
         token: linkToken,
+        clientNonce,
       });
       await writeEndpointToken(endpoint, token);
     },

packages/frontend/apps/ios/src/plugins/auth/definitions.ts

@@ -3,6 +3,7 @@ export interface AuthPlugin {
     endpoint: string;
     email: string;
     token: string;
+    clientNonce?: string;
   }): Promise<{ token: string }>;
   signInOauth(options: {
     endpoint: string;

packages/frontend/core/src/modules/cloud/impl/auth.ts

@@ -8,13 +8,17 @@ export function configureDefaultAuthProvider(framework: Framework) {
   framework.scope(ServerScope).override(AuthProvider, resolver => {
     const fetchService = resolver.get(FetchService);
     return {
-      async signInMagicLink(email: string, token: string) {
+      async signInMagicLink(
+        email: string,
+        token: string,
+        clientNonce?: string
+      ) {
         await fetchService.fetch('/api/auth/magic-link', {
           method: 'POST',
           headers: {
             'Content-Type': 'application/json',
           },
-          body: JSON.stringify({ email, token }),
+          body: JSON.stringify({ email, token, client_nonce: clientNonce }),
         });
       },
 

packages/frontend/core/src/modules/cloud/provider/auth.ts

@@ -1,7 +1,11 @@
 import { createIdentifier } from '@toeverything/infra';
 
 export interface AuthProvider {
-  signInMagicLink(email: string, token: string): Promise<void>;
+  signInMagicLink(
+    email: string,
+    token: string,
+    clientNonce?: string
+  ): Promise<void>;
 
   signInOauth(
     code: string,

packages/frontend/core/src/modules/cloud/services/auth.ts

@@ -79,6 +79,7 @@ export class AuthService extends Service {
     redirectUrl?: string // url to redirect to after signed-in
   ) {
     track.$.$.auth.signIn({ method: 'magic-link' });
+    this.setClientNonce();
     try {
       const scheme = this.urlService.getClientScheme();
       const magicLinkUrlParams = new URLSearchParams();
@@ -95,6 +96,7 @@ export class AuthService extends Service {
           // we call it [callbackUrl] instead of [redirect_uri]
           // to make it clear the url is used to finish the sign-in process instead of redirect after signed-in
           callbackUrl: `/magic-link?${magicLinkUrlParams.toString()}`,
+          client_nonce: this.store.getClientNonce(),
         }),
         headers: {
           'content-type': 'application/json',

packages/frontend/core/src/modules/cloud/stores/auth.ts

@@ -74,7 +74,11 @@ export class AuthStore extends Store {
   }
 
   async signInMagicLink(email: string, token: string) {
-    await this.authProvider.signInMagicLink(email, token);
+    await this.authProvider.signInMagicLink(
+      email,
+      token,
+      this.getClientNonce()
+    );
   }
 
   async signInOauth(code: string, state: string, provider: string) {