peter/siftlode
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(auth): address second-round review findings

Browse Source 
- OAuth-cancel feedback now keys on the live session, not link_uid: ANY
  signed-in cancel (add-another-account via /auth/login, link, or upgrade)
  redirects to /?oauth=cancelled and gets a neutral "Google sign-in was
  cancelled" toast — the add-account path set no marker and was silent, and
  the shared ?link= message wrongly called an upgrade "account linking"
- drop 127.0.0.1 from the dev OAuth host allowlist: only the localhost
  callbacks are registered in the Google console, so a 127.0.0.1 origin now
  falls back to the fixed callback instead of a redirect_uri_mismatch
- Welcome: extract the shared goResend handler (banner CTA + sign-in link) and
  merge the two adjacent signin-only blocks
This commit is contained in:
peter
2026-07-23 01:24:34 +02:00
parent c837b59373
commit bacef11e33
6 changed files with 43 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_oauth_redirect.py
+3 -1
View File
@@ -30,7 +30,6 @@ def test_dev_known_host_returns_to_that_origin(monkeypatch):
monkeypatch.setattr(auth, "settings", _dev_settings())
assert auth._oauth_redirect_uri(_req("localhost:5173")) == "http://localhost:5173/auth/callback"
assert auth._oauth_redirect_uri(_req("localhost:8080")) == "http://localhost:8080/auth/callback"
assert auth._oauth_redirect_uri(_req("127.0.0.1:5173")) == "http://127.0.0.1:5173/auth/callback"
def test_dev_host_is_case_insensitive(monkeypatch):
@@ -41,6 +40,9 @@ def test_dev_host_is_case_insensitive(monkeypatch):
def test_dev_unknown_or_missing_host_falls_back_to_configured(monkeypatch):
monkeypatch.setattr(auth, "settings", _dev_settings())
# An origin not on the allowlist (or a request with no Host) must not drive the redirect.
# 127.0.0.1 is deliberately NOT allowlisted (not registered in the Google console), so it falls
# back to the fixed configured callback rather than producing a redirect_uri_mismatch.
assert auth._oauth_redirect_uri(_req("127.0.0.1:5173")) == "http://localhost:8080/auth/callback"
assert auth._oauth_redirect_uri(_req("evil.example.com")) == "http://localhost:8080/auth/callback"
assert auth._oauth_redirect_uri(_req(None)) == "http://localhost:8080/auth/callback"