refactor(server): improve magic link login flow (#10736)

packages/frontend/core/src/modules/cloud/impl/auth.ts

@@ -8,13 +8,17 @@ export function configureDefaultAuthProvider(framework: Framework) {
   framework.scope(ServerScope).override(AuthProvider, resolver => {
     const fetchService = resolver.get(FetchService);
     return {
-      async signInMagicLink(email: string, token: string) {
+      async signInMagicLink(
+        email: string,
+        token: string,
+        clientNonce?: string
+      ) {
         await fetchService.fetch('/api/auth/magic-link', {
           method: 'POST',
           headers: {
             'Content-Type': 'application/json',
           },
-          body: JSON.stringify({ email, token }),
+          body: JSON.stringify({ email, token, client_nonce: clientNonce }),
         });
       },
 

packages/frontend/core/src/modules/cloud/provider/auth.ts

@@ -1,7 +1,11 @@
 import { createIdentifier } from '@toeverything/infra';
 
 export interface AuthProvider {
-  signInMagicLink(email: string, token: string): Promise<void>;
+  signInMagicLink(
+    email: string,
+    token: string,
+    clientNonce?: string
+  ): Promise<void>;
 
   signInOauth(
     code: string,

packages/frontend/core/src/modules/cloud/services/auth.ts

@@ -79,6 +79,7 @@ export class AuthService extends Service {
     redirectUrl?: string // url to redirect to after signed-in
   ) {
     track.$.$.auth.signIn({ method: 'magic-link' });
+    this.setClientNonce();
     try {
       const scheme = this.urlService.getClientScheme();
       const magicLinkUrlParams = new URLSearchParams();
@@ -95,6 +96,7 @@ export class AuthService extends Service {
           // we call it [callbackUrl] instead of [redirect_uri]
           // to make it clear the url is used to finish the sign-in process instead of redirect after signed-in
           callbackUrl: `/magic-link?${magicLinkUrlParams.toString()}`,
+          client_nonce: this.store.getClientNonce(),
         }),
         headers: {
           'content-type': 'application/json',

packages/frontend/core/src/modules/cloud/stores/auth.ts

@@ -74,7 +74,11 @@ export class AuthStore extends Store {
   }
 
   async signInMagicLink(email: string, token: string) {
-    await this.authProvider.signInMagicLink(email, token);
+    await this.authProvider.signInMagicLink(
+      email,
+      token,
+      this.getClientNonce()
+    );
   }
 
   async signInOauth(code: string, state: string, provider: string) {