Repository navigation
Conversation
cpojer
enabled auto-merge (squash)
March 27, 2026 06:41
cpojer
disabled auto-merge
March 27, 2026 13:34
cpojer
pushed a commit
that referenced
this pull request
Sep 11, 2026
… replay (#39) * fix(api): validate OAuth state nonce via KV to prevent login CSRF and replay The nonce was generated and included in the HMAC-signed state but never checked on callback. Now it is stored in ROUTING KV with a 10-minute TTL during /auth/login and validated + deleted (single-use) during /auth/callback. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(api): move OAuth nonce from KV to PostgreSQL for strong consistency KV's eventual consistency makes nonce lookups flaky when login and callback hit different CF colos. Switch to a PostgreSQL-backed oauth_nonces table with atomic DELETE ... RETURNING for true single-use guarantees. Use PG now() for both store and consume to keep a single clock source. Add periodic purge of expired nonces in the scheduled handler to clean up abandoned login flows. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(api): make nonce purge best-effort so it cannot block billing rollover Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Brooooooklyn
added a commit
that referenced
this pull request
Sep 15, 2026
…leanup) 28 commits from main. Seven conflicts: - packages/deploy-cloudflare/src/version.ts: both sides extended the trigger snapshot at the same spots — kept main's `sourceConfigPath` reader, settings hash and traffic-preserve flags next to our `addresses` reader and replay. main's new `resolvePreservedTraffic` rebuilds the trigger config on every versioned deploy and would have dropped `addresses`; it now carries the key through. - packages/void/src/cli/deploy.ts: `discoverRootWranglerConfig` keeps our export and main's `wrangler.toml` refusal. - packages/void/AGENT_PROMPT.md: our docs sentence (with email) plus main's platform-forks paragraph. - platform/packages/api/test/integration/auth-email-verification.test.ts: main removed the preview-repo signup tests; ours sat after them. Dropped the removed test, kept every owner-email-change test. - platform/meta/operations.md: main replaced the inventory with a maintainer runbook; re-added a condensed Email section (invariants, the unexecuted one-time zone setup, deploy order, rollback, the two retroactive pre-checks). platform/meta/progress.md: main retired it; took main's. platform/packages/api/README.md: both admin rows kept. One auto-merge follow-up: main's new onboarding page test expected a raw `'` in `void connect '<url>'`; our `escapeHtml` escapes quotes (`'`, rendered back by the browser). The test now expects the escaped form. Gates on the merged tree: fmt/lint 0, `vp run check` 0, unit 5103/5103, platform 3761/3761, platform runtime build 0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SStP281NuirMSouULEE2pW
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When initializing a new project, or migrating an existing static page to void via
void init, it proposes either D1 or Postgres, which in some situations doesn't make sense. This PR adds a third option without a database.