accounted

Files

T

Mattsson fc54e79e08 fix(auth): scope the home-domain ok cookie to the signed-in user (#2083 )

The gnubok-home-ok cache cookie stored only the host, so any account that
signed in within the 15-minute TTL window inherited the previous user's
"this is home" verdict in the same browser and skipped the brand-host
bounce entirely: a user with no ties to a white-label brand could land
inside the branded shell instead of being redirected to the canonical
domain (amnas account-switch repro, two logins 9 s apart).

The cookie value is now userId~host and the middleware only skips the
affinity check when both match the current session. Old host-only cookies
never match, so the check re-runs and the format self-migrates; no
sign-out hook is needed because a foreign verdict misses by construction.


Claude-Session: https://claude.ai/code/session_01EBJAE7b6B64HaKybjaC66B

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-31 14:58:17 +02:00

__tests__

fix(auth): scope the home-domain ok cookie to the signed-in user (#2083 )

2026-08-31 14:58:17 +02:00

client.ts

chore: gitignore dev_docs and remove from tracking (#7 )

2026-03-09 15:50:56 +01:00

fetch-all.ts

fix(errors): keep the SQLSTATE when wrapping database errors (#2027 )

2026-08-30 10:48:05 +02:00

middleware.ts

fix(auth): scope the home-domain ok cookie to the signed-in user (#2083 )