✨ server: add auth method to sardine

[aguxez]

Summary

• send siwe or webauthn to Sardine through the existing customer tag shape
• preserve the existing source tag and legacy WebAuthn fallback
• keep client-IP forwarding from issue server: track client ip with sardine #1171 out of scope

Relates to #1173.

Verification

• pnpm nx test:ts server passed
• pnpm nx test:eslint server passed
• Prettier and git diff --check passed
• Repository harness checks passed
• Full Vitest was blocked by an unrelated protobuf descriptor build error
• Focused auth runtime tests were blocked by the local PostgreSQL service using port 8432

Summary by CodeRabbit

• Bug Fixes
  • Improved customer analytics tracking for authentication and registration.
  • Authentication events now include the specific method used, such as SIWE or WebAuthn, alongside the existing source information.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a3f1f4e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ce88ab69-84f9-4bb1-8cb9-72a1bc9a4440

📥 Commits

Reviewing files that changed from the base of the PR and between 6e1b198 and 695cbaf.

📒 Files selected for processing (2)

• server/test/api/auth.test.ts
• server/utils/createCredential.ts

---

Walkthrough

Customer metadata now records an auth_method tag for SIWE and WebAuthn credential flows. Authentication and registration tests verify the new tag alongside the existing source tag.

Changes

Authentication method attribution

Layer / File(s)	Summary
Credential metadata tagging and validation server/utils/createCredential.ts, server/test/api/auth.test.ts	createCredential adds the authentication-method tag to customer metadata. SIWE and WebAuthn tests verify the expected tag values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• exactly/exa#674: Extends the same createCredential customer-tagging logic.
• exactly/exa#1175: Modifies the same files for different customer analytics metadata.

Suggested reviewers: nfmelendez, cruzdanilo

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the server change and the addition of an authentication method to Sardine.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sardine-auth

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch sardine-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 695cbaf4c9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3f1f4ea30

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Derive the tag from the verified auth method

When a WebAuthn authenticator returns an address-shaped credential ID (for example, 0x followed by 40 hex characters), the ID satisfies both the Base64URL validator and isAddress(). The registration path still verifies it as WebAuthn and supplies options.webauthn, but this ternary reports siwe to Sardine, corrupting the authentication-method signal. Derive the value from the verified request method or the presence of options.webauthn instead of the credential ID's syntax.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep the new tag in sorted order

The new tag is appended after source, leaving this project-controlled array unsorted even though the repository requires additions to arrays to be inserted in the middle or in sorted position for diff friendliness. Place auth_method before source here and in the corresponding test expectations so future edits preserve the established ordering convention.

AGENTS.md reference: AGENTS.md:L16-L16

Useful? React with 👍 / 👎.