Flea Flicker
20a0c7eb92
Better Auth reflects the request Origin into Access-Control-Allow-Origin unconditionally, bypassing the trustedOrigins config. An attacker-origin page could XHR /api/auth/sign-in/social with credentials and read the OIDC authorize URL + state from the response body. - Add src/lib/auth-cors.ts: enforceAuthCors() wraps any Better Auth Response, stripping ACAO/ACAC for untrusted origins and enforcing the allowlist for trusted ones - Wire enforceAuthCors() into the /api/auth/* handler in src/index.ts - Add src/__tests__/authCors.test.ts: 6 regression tests covering trusted, untrusted, undefined, and empty-string origins - Update UAT_PLAYBOOK.md §4.1 with TC-API-1.29/1.30/1.31 CORS test cases Co-Authored-By: Paperclip <noreply@paperclip.ing>
GroomBook API
GroomBook API service — extracted from the groombook/app monorepo.
Overview
This repository contains the GroomBook API service, including:
- REST API endpoints
- Database schema and migrations (via Drizzle ORM)
- Authentication (via Better Auth)
- Background job handlers
Structure
src/ # API service source
packages/db/ # Database schema, migrations, and utilities
packages/types/ # Shared TypeScript types
Setup
pnpm install
cp .env.example .env # Fill in required environment variables
pnpm --filter @groombook/api dev
Docker
docker build -t ghcr.io/groombook/api:latest .
docker run -p 3000:3000 ghcr.io/groombook/api:latest
License
AGPL-3.0-only