Repository navigation
cli: Use the correct build command during deploys. - #41
Merged
Merged
Conversation
cpojer
enabled auto-merge (squash)
March 27, 2026 07:45
Brooooooklyn
disabled auto-merge
March 27, 2026 13:33
cpojer
changed the title
cpojer
pushed a commit
that referenced
this pull request
Sep 11, 2026
…dashboard (#41) * fix(auth): set JWT as httpOnly cookie instead of URL query param for dashboard The 30-day JWT was passed in the redirect URL query parameter, exposing it in browser history, server/CDN logs, and Referer headers. For dashboard redirects, the API now sets the token as an httpOnly cookie on the shared domain via Set-Cookie on the 302 response. CLI (localhost) redirects remain unchanged as they are already safe. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(auth): correct cookie domain derivation, logout, and local dev fallback - Derive cookie domain from DASHBOARD_URL env var instead of naive .split(-2) on the redirect URL, which broke staging environments and multi-level TLDs - Add matching domain to deleteCookie in logout and auth middleware so browsers actually clear the domain-scoped cookie - Restore query param fallback in dashboard callback for local dev where localhost can't use domain cookies Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(auth): replace domain cookie with auth code exchange The domain cookie approach (.void.cloud) leaked production tokens to staging subdomains, breaking auth for users signed into both envs. Also, the callback preferred stale cookies over fresh query param tokens. Replace with a short-lived authorization code pattern: - API stores JWT in KV with 60s TTL, redirects with ?code=<uuid> - Dashboard callback exchanges code for JWT via POST /auth/exchange - Dashboard sets a host-only cookie (no domain, no cross-env leakage) - Logout and middleware revert to simple host-only deleteCookie - CLI/local-dev path unchanged (token in query param on localhost) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(auth): store auth codes in PostgreSQL for consistency and atomicity KV's eventual consistency meant the auth code written at one CF colo might not be visible when the dashboard exchanged it from another colo, causing intermittent login failures. The non-atomic KV get-then-delete also allowed parallel replays of the same code. Switch to PostgreSQL with atomic DELETE … RETURNING (same pattern as the existing OAuth nonce flow). Also derive `secure` flag from the request protocol instead of hardcoding false on the token fallback path. - Add auth_codes table (migration 0008) and store/consume/purge helpers - Wire purgeExpiredAuthCodes into the hourly cron alongside nonce purge - Fix secure: false regression in callback.server.ts token fallback Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes two things:
vite buildand did not support the inference build command.vite buildinstead of custom build scripts that might be defined. Now it checks and uses thepackage.json"build" script instead.