Jakob WennbergandClaude Fable 5
b420f3e1d9
* feat(domains): dual-domain cutover to app.accounted.se The user-facing app moves to app.accounted.se while app.gnubok.se stays alive for machine traffic (MCP connectors, API keys, third-party OAuth callbacks, webhooks, crons), so no third-party callback registration is on the critical path. - next.config: host redirect app.gnubok.se -> NEXT_PUBLIC_APP_URL for page traffic only (/api, /.well-known, /_next excluded). Arms itself only once NEXT_PUBLIC_APP_URL leaves the legacy host, so merging this is inert and the cutover is a pure env flip + redeploy. - skatteverket: redirect_uri pinned via NEXT_PUBLIC_SKV_OAUTH_BASE_URL (Utvecklarportalen registration is slow to change); the OAuth callback now resolves the flow from the state token + stored oauth_user_id via the service client instead of session cookies, which no longer exist on the OAuth host. Legacy same-domain flows fall back to the session. - popup listeners (SkatteverketConnectPanel, AGIPanel) accept postMessage from the pinned OAuth origin; event.source identity check unchanged. - /.well-known discovery docs reflect the allowlisted request host so existing MCP connectors on app.gnubok.se keep a self-consistent issuer/resource after the flip; spoofed hosts fall back to canonical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: log dual-domain cutover decision Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(review): recency-bound SKV state lookup, exact localhost match in discovery allowlist - The oauth_state lookup now only considers rows updated in the last 10 minutes: bounds how long a leaked/phished authorize URL stays completable, keeps the row set far below PostgREST's 1000-row cap, and surfaces query errors instead of misreporting them as CSRF. - resolveDiscoveryBaseUrl matches localhost/127.0.0.1 exactly; the prefix check reflected spoofed hosts like localhost.evil.example. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
41 lines
1.4 KiB
TypeScript
41 lines
1.4 KiB
TypeScript
import { describe, it, expect, afterEach, vi } from 'vitest'
|
|
import { isAllowedSkvPopupOrigin } from '../popup-origin'
|
|
|
|
const APP = 'https://app.accounted.se'
|
|
const OAUTH = 'https://app.gnubok.se'
|
|
|
|
describe('isAllowedSkvPopupOrigin', () => {
|
|
afterEach(() => {
|
|
vi.unstubAllEnvs()
|
|
})
|
|
|
|
it('always allows the window own origin', () => {
|
|
expect(isAllowedSkvPopupOrigin(APP, APP)).toBe(true)
|
|
})
|
|
|
|
it('allows the pinned SKV OAuth origin when configured', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SKV_OAUTH_BASE_URL', OAUTH)
|
|
expect(isAllowedSkvPopupOrigin(OAUTH, APP)).toBe(true)
|
|
})
|
|
|
|
it('normalises the pinned base URL to an origin (path/trailing slash ignored)', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SKV_OAUTH_BASE_URL', `${OAUTH}/`)
|
|
expect(isAllowedSkvPopupOrigin(OAUTH, APP)).toBe(true)
|
|
})
|
|
|
|
it('rejects foreign origins even when a pin is configured', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SKV_OAUTH_BASE_URL', OAUTH)
|
|
expect(isAllowedSkvPopupOrigin('https://evil.example', APP)).toBe(false)
|
|
})
|
|
|
|
it('rejects cross-origin messages when no pin is configured', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SKV_OAUTH_BASE_URL', '')
|
|
expect(isAllowedSkvPopupOrigin(OAUTH, APP)).toBe(false)
|
|
})
|
|
|
|
it('rejects cross-origin messages when the pin is malformed', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SKV_OAUTH_BASE_URL', 'not a url')
|
|
expect(isAllowedSkvPopupOrigin(OAUTH, APP)).toBe(false)
|
|
})
|
|
})
|