* fix(auth): resolve BankID confirmation and email-hook link hosts through the trusted-origin registry
The BankID confirmation mail built its /auth/callback link from the raw
forwarded host and protocol; it is the one auth link GoTrue's redirect
allowlist never sees, since the link is minted here and sent through
Resend. The Send Email hook followed GoTrue's redirect_to verbatim: the
webhook signature proves who sent the payload, not that every destination
in it should be followed, and the GoTrue allowlist is a hand-configured
glob.
Both now resolve the destination through lib/domains/trusted-app-origin
like every other auth link (canonical, this deployment's own Vercel hosts,
or a registered brands.domain). Unknown, lookalike, credential-bearing,
non-default-port and malformed destinations collapse to the canonical
/auth/callback with no next path; a registered brand host over http is
upgraded to https. Brand sender identity is taken from the RESOLVED host,
so mail branding and link destination always agree. A brands-table read
failure refuses instead of mailing a wrong-host link: the BankID helper
returns step resolve_origin (signup rolls back, login re-send logs), the
hook answers 500 so Supabase retries.
Drops the proto parameter from the BankID helper; the resolver owns the
scheme.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0189cGB2YxptqVxBLJ2RkB5T
* fix(auth): read the sender brand once, failure-aware, before minting or sending auth mail
CodeRabbit: resolveTrustedAppOrigin could classify a brand host, then the
separate resolveBrandByHost read for the sender could fail and return null,
so a brand link went out with the platform sender; the BankID helper had
already minted the magic link by then. Both sites now read the brand with
resolveBrandResultByHost on the resolved host and refuse on a failed read
for any non-canonical origin (BankID: step resolve_origin before
generateLink; hook: 500 so Supabase retries). On the canonical origin a
failed read is the platform sender either way, so mail still goes out.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0189cGB2YxptqVxBLJ2RkB5T
* fix(auth): treat a credential-bearing redirect_to as untrusted in the email hook
Superagent P2: URL.origin drops userinfo, so a redirect_to with credentials
on a served host passed the origin comparison and was cloned into the auth
link with the credentials still in it. No flow of ours sends one; the hook
now rejects any redirect_to carrying username or password outright and
links to the canonical /auth/callback with no next path.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0189cGB2YxptqVxBLJ2RkB5T
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Mattsson
cb962fae88