feat: move auth to Coolify Postgres by Skeyelab · Pull Request #88 · ericdahl-dev/clawproxy

Skeyelab · 2026-09-23T04:45:54Z

Summary

Replaces Neon Auth with app-owned email/password auth backed by Postgres.
Adds auth_users and auth_sessions tables plus first-party auth API routes.
Adds startup SQL migration runner so Coolify private Postgres can be initialized on deploy.
Updates Docker/Coolify docs and removes the Neon Auth dependency/env requirements.
Creates .env.example for local/Coolify Postgres setup.

Coolify

Created private Coolify Postgres database clawproxy-postgres in the existing clawproxy production project.
Updated the clawproxy.io app DATABASE_URL env var to the new internal Coolify DB URL.
Database verified in Coolify as running:healthy and not public.

Test Plan

yarn lint
yarn test:run
DATABASE_URL='postgresql://user:pass@localhost:5432/clawproxy' ENCRYPTION_KEY='0000000000000000000000000000000000000000000000000000000000000000' yarn build

Notes

Existing stale Neon env vars remain in Coolify but are no longer read by the app.
The new database is private; migrations are applied automatically by the custom server before it starts listening.

strix-security · 2026-09-23T04:46:00Z

Strix Security Review

All previously reported security findings have been resolved.

4 resolved findings

~~Non-atomic rate-limit counter allows concurrent requests to bypass the sign-in brute-force throttle~~ — resolved in bdaf2c1
~~Sign-in/sign-up throttling bypassable via spoofed X-Forwarded-For and per-process state~~ — resolved in 29948b0
~~Timing-based account enumeration on password sign-in endpoint~~ — resolved in 29948b0
~~Weak scrypt password-hashing parameters (N=16384) below OWASP recommendation~~ — resolved in bca647b

Review summary

Re-reviewed the full diff with focus on the app-owned email/password auth introduced by this PR. The previously open rate-limit finding is now resolved: recordAuthRateLimitAttempt performs a single atomic INSERT ... ON CONFLICT DO UPDATE whose count is incremented in the database (count + 1) with a matching conditional reset on window expiry, eliminating the lost-update bypass. The wider auth surface was also reviewed — session token generation and storage, password hashing (scrypt N=131072), sign-in/sign-up/sign-out/forgot-password routes, DB-backed rate limiting, schema and migration runner. No new security issues were identified; session cookies are properly scoped and hashed at rest, timing-safe scrypt verification is used with a dummy hash for missing users, and migration/SQL inputs are parameterized or safely escaped.

_{Updated for bdaf2c1.}

Reviewed by Strix
_{Re-run review · Configure security review settings}

strix-security

Strix flagged 2 new security findings below. See the pinned summary comment for the full PR status.

strix-security · 2026-09-23T04:49:01Z

+import { randomBytes, scrypt as scryptCallback, timingSafeEqual, type ScryptOptions } from 'node:crypto';
+
+const KEY_LENGTH = 64;
+const SCRYPT_PARAMS = { N: 16384, r: 8, p: 1 } as const;


~~Weak scrypt password-hashing parameters (N=16384) below OWASP recommendation~~

Resolved — no longer flagged as of bca647b.

strix-security · 2026-09-23T04:49:01Z

+export async function POST(request: Request) {
+  const body = await readJson(request);
+  const result = await signInWithPassword(stringField(body, 'email'), stringField(body, 'password'));
+
+  if (!result.ok) {
+    return NextResponse.json({ ok: false, error: result.error }, { status: result.status ?? 401 });
+  }
+
+  return okWithSession({ user: result.user }, result.token, result.expiresAt);
+}


~~Sign-in/sign-up throttling bypassable via spoofed X-Forwarded-For and per-process state~~

Resolved — no longer flagged as of 29948b0.

Skeyelab · 2026-09-23T04:59:33Z

@strix-security please rerun the security review. Addressed both findings: raised scrypt to N=131072 with increased maxmem and added fixed-window throttling for sign-in/sign-up attempts.

strix-security

Strix flagged a new security finding below. See the pinned summary comment for the full PR status.

strix-security · 2026-09-23T05:05:07Z

+  if (!user || !(await verifyPassword(password, user.passwordHash))) {
+    return { ok: false, error: 'Invalid email or password', status: 401 };
+  }


~~Timing-based account enumeration on password sign-in endpoint~~

Resolved — no longer flagged as of 29948b0.

Skeyelab · 2026-09-23T05:10:48Z

@strix-security please rerun again. Follow-up fixes: moved auth throttling into Postgres-backed counters keyed without X-Forwarded-For, added auth_rate_limits migration/table, and added dummy scrypt verification for missing users to reduce sign-in timing enumeration.

strix-security

Strix flagged a new security finding below. See the pinned summary comment for the full PR status.

strix-security · 2026-09-23T05:14:37Z

@@ -0,0 +1,75 @@
+import 'server-only';
+
+import { eq } from 'drizzle-orm';


~~Non-atomic rate-limit counter allows concurrent requests to bypass the sign-in brute-force throttle~~

Resolved — no longer flagged as of bdaf2c1.

strix-security · 2026-09-23T05:14:38Z

+export async function recordAuthRateLimitAttempt({
+  key,
+  kind,
+  windowMs,
+}: Omit<AuthRateLimitOptions, 'maxAttempts'>) {
+  const [entry] = await db.select().from(authRateLimits).where(eq(authRateLimits.key, key)).limit(1);
+  const windowStart = new Date();
+
+  if (!entry || nowMs() - entry.windowStart.getTime() >= windowMs) {
+    await db
+      .insert(authRateLimits)
+      .values({ key, kind, count: 1, windowStart, updatedAt: windowStart })
+      .onConflictDoUpdate({
+        target: authRateLimits.key,
+        set: { kind, count: 1, windowStart, updatedAt: windowStart },
+      });
+    return;
+  }
+
+  await db
+    .update(authRateLimits)
+    .set({ count: entry.count + 1, updatedAt: windowStart })
+    .where(eq(authRateLimits.key, key));
+}


~~Non-atomic rate-limit counter allows concurrent requests to bypass the sign-in brute-force throttle~~

Resolved — no longer flagged as of bdaf2c1.

Skeyelab · 2026-09-23T05:16:28Z

@strix-security please rerun once more. Fixed the remaining atomicity finding by changing rate-limit recording to a single Postgres upsert that increments count in the database.

feat: move auth to app-owned postgres

5810762

ci: remove neon auth build env

b1cb967

strix-security Bot reviewed Sep 23, 2026

View reviewed changes

fix: harden app-owned auth

bca647b

strix-security Bot reviewed Sep 23, 2026

View reviewed changes

fix: use db-backed auth throttling

29948b0

strix-security Bot reviewed Sep 23, 2026

View reviewed changes

fix: make auth rate limit increments atomic

bdaf2c1

Skeyelab merged commit 18c9b8a into master Sep 23, 2026
3 checks passed

This was referenced Sep 23, 2026

fix: make Postgres SSL mode configurable via DATABASE_SSL #91

Merged

fix: schema-drift check compared against wrong table + stale Neon DB #92

Merged

Navigation Menu

Repository navigation

feat: move auth to Coolify Postgres - #88

feat: move auth to Coolify Postgres#88
Skeyelab merged 5 commits into
masterfrom
feat/coolify-postgres-auth

Skeyelab commented Sep 23, 2026

Uh oh!

strix-security Bot commented Sep 23, 2026 •

edited

Loading

Uh oh!

strix-security Bot left a comment

Uh oh!

strix-security Bot Sep 23, 2026 •

edited

Loading

Uh oh!

strix-security Bot Sep 23, 2026 •

edited

Loading

Uh oh!

Skeyelab commented Sep 23, 2026

Uh oh!

strix-security Bot left a comment

Uh oh!

strix-security Bot Sep 23, 2026 •

edited

Loading

Uh oh!

Skeyelab commented Sep 23, 2026

Uh oh!

strix-security Bot left a comment

Uh oh!

strix-security Bot Sep 23, 2026 •

edited

Loading

Uh oh!

strix-security Bot Sep 23, 2026 •

edited

Loading

Uh oh!

Skeyelab commented Sep 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		@@ -0,0 +1,75 @@
		import 'server-only';

		import { eq } from 'drizzle-orm';

Conversation

Skeyelab commented Sep 23, 2026

Summary

Coolify

Test Plan

Notes

Uh oh!

strix-security Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Strix Security Review

Uh oh!

strix-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

strix-security Bot Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Weak scrypt password-hashing parameters (N=16384) below OWASP recommendation

Uh oh!

strix-security Bot Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Sign-in/sign-up throttling bypassable via spoofed X-Forwarded-For and per-process state

Uh oh!

Skeyelab commented Sep 23, 2026

Uh oh!

strix-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

strix-security Bot Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Timing-based account enumeration on password sign-in endpoint

Uh oh!

Skeyelab commented Sep 23, 2026

Uh oh!

strix-security Bot left a comment

Choose a reason for hiding this comment

Uh oh!

strix-security Bot Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Non-atomic rate-limit counter allows concurrent requests to bypass the sign-in brute-force throttle

Uh oh!

strix-security Bot Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Non-atomic rate-limit counter allows concurrent requests to bypass the sign-in brute-force throttle

Uh oh!

Skeyelab commented Sep 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

strix-security Bot commented Sep 23, 2026 •

edited

Loading

strix-security Bot Sep 23, 2026 •

edited

Loading

strix-security Bot Sep 23, 2026 •

edited

Loading

strix-security Bot Sep 23, 2026 •

edited

Loading

strix-security Bot Sep 23, 2026 •

edited

Loading

strix-security Bot Sep 23, 2026 •

edited

Loading