⨯ email-auth f8e7560d little-moments mtlynch

f8e7560d

By: Michael Lynch <git@mtlynch.io>

Remove IsMagicLoginTokenValid and its TOCTOU check in loginConfirmGet

The GET handler validated the token before rendering the confirmation
page, but the POST handler re-validated atomically on submit. Between
the two requests the token could expire or be consumed, making the GET
check advisory at best. Removing it eliminates a store method and the
TOCTOU window.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Suite timing

	Time to Start	Worker time	Duration	Time to finish	Idle
Config	0s	3s	3s	3s	0s
Eval	2s	1m54s	1m54s	1m57s	0s
Build	1m43s	4m59s	1m48s	3m32s	1s
Suite	0s	6m56s	3m32s	3m32s	1s

Timeline

Agent Instructions

This page shows suite timings.

This page is also available in machine-friendly formats. Request one with the Accept header:

curl --netrc -H 'Accept: application/json' https://nix-ci.com/cb:mtlynch:little-moments/email-auth/f8e7560dd7f874e9c4159f08a782c33d691de284/timing
curl --netrc -H 'Accept: text/markdown' https://nix-ci.com/cb:mtlynch:little-moments/email-auth/f8e7560dd7f874e9c4159f08a782c33d691de284/timing

For more instructions, fetch https://nix-ci.com/instructions .