MattssonandClaude Fable 5 024420d655 fix(auth): exempt allowlisted emails from home-domain brand-host bounce (#2077) ...

A signup-allowlisted partner owner (brand_signup_allowlist) could sign up
on an invite-only brand domain but was then exiled to the canonical domain
by the middleware home-domain affinity rule before any team membership
existed: the layout-level exemption in resolveBrandDomainBounce was
unreachable because the middleware redirect runs first. Rule 2 now checks
the allowlist (fail-closed) and lets those sessions stay, caching the
verdict like other home verdicts. Found via the Ziffr owner lockout.


Claude-Session: https://claude.ai/code/session_011eQDGWLppyy6BZ6Rx6shjd

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-31 13:44:31 +02:00

..

__tests__

fix(auth): exempt allowlisted emails from home-domain brand-host bounce (#2077)

2026-08-31 13:44:31 +02:00

client.ts

chore: gitignore dev_docs and remove from tracking (#7)

2026-03-09 15:50:56 +01:00

fetch-all.ts

fix(errors): keep the SQLSTATE when wrapping database errors (#2027)

2026-08-30 10:48:05 +02:00

middleware.ts

fix(auth): exempt allowlisted emails from home-domain brand-host bounce (#2077)

2026-08-31 13:44:31 +02:00

proxy-timing.ts

feat(perf): measure the auth proxy per request (Server-Timing + proxy completed log) (#1922)

2026-08-26 13:55:42 +02:00

server.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

service-client.ts

fix(supabase): stop server clients leaking a 30s refresh ticker per request (#1612)

2026-08-17 14:30:17 +02:00