security: session, token & widget identity hardening (7 fixes)

[BunsDev]

Batches 7 Codex security fixes: widget session minting, magic link logging, unsigned segment webhook, invitation magic links, widget bearer token, and two unverified widget identify fixes.

[Copilot]

Pull request overview

This PR batches several security-oriented changes across widget identity, Segment webhook verification, and auth logging/account-linking behavior.

Changes:

• Simplifies the unverified widget-session issuance guard in /api/widget/identify.
• Requires and verifies an HMAC signature for all inbound Segment identify webhooks, and adds tests for the signature enforcement.
• Redacts magic-link request URL tokens in auth logs, and adjusts auth provider account-linking trust configuration.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
apps/web/src/routes/api/widget/identify.ts	Simplifies the unverified identify/session issuance predicate and related call sites.
apps/web/src/lib/server/integrations/segment/user-sync.ts	Enforces mandatory shared-secret + HMAC signature verification for inbound Segment identify webhooks.
apps/web/src/lib/server/integrations/segment/tests/user-sync.test.ts	Adds coverage for missing secret, missing signature, and valid signature cases.
apps/web/src/lib/server/auth/index.ts	Adds magic-link query redaction helper and updates magic-link request/response logging + trusted account-linking providers construction.
apps/web/src/lib/server/auth/tests/magic-link-security.test.ts	Updates expectations to assert request-token redaction behavior in auth logging.

Comments suppressed due to low confidence (2)

apps/web/src/lib/server/auth/index.ts:714

• The magic-link handler is now logging the Location response header. Magic-link redirects commonly include the one-time token and/or sensitive redirect parameters in the URL, so logging location reintroduces a credential/PII leak into server logs (the previous code explicitly avoided this).

      const location = response.headers.get('location')
      console.log(
        `[auth] magic-link response: status=${response.status}, location=${location ?? 'none'}`
      )

apps/web/src/lib/server/auth/index.ts:269

• Same as above: adding every built-in social provider to accountLinking.trustedProviders implicitly trusts them for automatic email-based linking. This should be restricted to an explicit allowlist of providers whose email verification semantics you trust.

        }
      }
      socialProviders[provider.id] = providerConfig
      trustedProviders.push(provider.id)
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.