accounted

Files

T

Mattsson fc54e79e08 fix(auth): scope the home-domain ok cookie to the signed-in user (#2083 )

The gnubok-home-ok cache cookie stored only the host, so any account that
signed in within the 15-minute TTL window inherited the previous user's
"this is home" verdict in the same browser and skipped the brand-host
bounce entirely: a user with no ties to a white-label brand could land
inside the branded shell instead of being redirected to the canonical
domain (amnas account-switch repro, two logins 9 s apart).

The cookie value is now userId~host and the middleware only skips the
affinity check when both match the current session. Old host-only cookies
never match, so the check re-runs and the format self-migrates; no
sign-out hook is needed because a foreign verdict misses by construction.


Claude-Session: https://claude.ai/code/session_01EBJAE7b6B64HaKybjaC66B

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-31 14:58:17 +02:00

fetch-all.test.ts

fix(errors): keep the SQLSTATE when wrapping database errors (#2027 )

2026-08-30 10:48:05 +02:00

middleware.test.ts

fix(auth): scope the home-domain ok cookie to the signed-in user (#2083 )

2026-08-31 14:58:17 +02:00

proxy-timing.test.ts

feat(perf): measure the auth proxy per request (Server-Timing + proxy completed log) (#1922 )

2026-08-26 13:55:42 +02:00

rls.pg.test.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890 )