Comparing 2d4edb6452..20a0c7eb92 - api - Gitea

groombook/api

Author	SHA1	Message	Date
Flea Flicker	20a0c7eb92	fix(GRO-2586): enforce trusted-origins allowlist on Better Auth CORS responses CI / Test (pull_request) Successful in 28s Details CI / Lint & Typecheck (pull_request) Successful in 33s Details CI / Build & Push Docker Images (pull_request) Successful in 1m29s Details Better Auth reflects the request Origin into Access-Control-Allow-Origin unconditionally, bypassing the trustedOrigins config. An attacker-origin page could XHR /api/auth/sign-in/social with credentials and read the OIDC authorize URL + state from the response body. - Add src/lib/auth-cors.ts: enforceAuthCors() wraps any Better Auth Response, stripping ACAO/ACAC for untrusted origins and enforcing the allowlist for trusted ones - Wire enforceAuthCors() into the /api/auth/* handler in src/index.ts - Add src/__tests__/authCors.test.ts: 6 regression tests covering trusted, untrusted, undefined, and empty-string origins - Update UAT_PLAYBOOK.md §4.1 with TC-API-1.29/1.30/1.31 CORS test cases Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-26 13:29:56 +00:00
Flea Flicker	c01e4acf0a	feat(GRO-2425): split CORS_ORIGIN on commas for multiple trusted auth origins (#216 ) CI / Test (push) Successful in 30s Details CI / Lint & Typecheck (push) Successful in 45s Details CI / Build & Push Docker Images (push) Successful in 1m10s Details CI / Test (pull_request) Successful in 25s Details CI / Lint & Typecheck (pull_request) Failing after 12m18s Details CI / Build & Push Docker Images (pull_request) Has been skipped Details feat(GRO-2425): split CORS_ORIGIN on commas for multiple trusted auth origins Co-authored-by: Flea Flicker <flea@groombook.dev> Co-committed-by: Flea Flicker <flea@groombook.dev>	2026-06-18 00:46:29 +00:00
Flea Flicker	10b78d810d	Merge pull request 'feat(GRO-2359): add POST /api/portal/clients-from-auth for OOBE' (#212 ) from feature/2357-p2-portal-clients-from-auth into dev CI / Test (push) Successful in 26s Details CI / Lint & Typecheck (push) Successful in 32s Details CI / Build & Push Docker Images (push) Successful in 41s Details GRO-2359 (api): feat(GRO-2359): add POST /api/portal/clients-from-auth for OOBE (#212)	2026-06-11 16:34:34 +00:00
Flea Flicker	cdeebec021	feat(GRO-2359): add POST /api/portal/clients-from-auth for OOBE (web) CI / Test (pull_request) Successful in 29s Details CI / Lint & Typecheck (pull_request) Successful in 41s Details CI / Build & Push Docker Images (pull_request) Successful in 1m40s Details The OOBE flow on the web portal calls this endpoint to create a fresh `clients` row bound to the Better Auth user's email when the SSO bridge returns 404. Returns 201 on success, 409 if a client with that email already exists (portal-selection case), 401/503 on auth issues, 400 on invalid body. The OOBE success path navigates the user back to `/` and lets the existing `session-from-auth` re-bridge; the new client is now resolvable by email, so the bridge mints a real portal session. Tests cover: 401 (no session), 400 (zod), 201 + persisted values (name trimmed, optional fields normalized to null), 409 (existing client or unique-constraint race), 503 (auth not configured). Paired with the web PR on `feature/2357-p2-sso-to-oobe-routing`. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-06-11 16:17:16 +00:00

Diff Content Not Available