Create a system analysis task plan in `tasks/new/` detailing how to redesign
the Sessions management page's header and unified drawer, strictly adhering to
the Auth-Yes SSR JSX standards and vanilla JS implementations.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Drafts a comprehensive task specification for implementing zero-trust
scope guards on internal API routes and SSR UI pages, as requested.
The file adheres strictly to the repository's Kanban and Markdown
metadata guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Implements the GET /pass?token=... endpoint for validating session tokens, resolving the correct target application domain dynamically, and routing users seamlessly using ephemeral 1-click magic links.
Also updates the Sessions Hub UI hand-off modal to display the 1-Click Magic Link and adds full test coverage.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Implement iterative session cookie candidate resolution in getAuthenticatedUser
- Eliminate Hono first-match limitation causing mobile login redirect loops
- Use absolute UTC ISO strings for PostgreSQL session expiry queries
- Opportunistically clear host-level cookies upon shadow detection
- Ensure exhaustive server-side session revocation across all cookie candidates on logout
- Add automated regression test for cookie shadowing in server/main.test.ts
- Rename and standardize tasks/path.md with 5-template orchestrator standard
feat(auth-api): implement Tier 1 Traefik Ingress Control & Bypass Matrix
Key additions:
1. **Dynamic Bypass Matix:** Implemented native Deno path prefix routing and IPv4 CIDR subnet allowlisting directly inside the edge proxy sub-request without needing database lookups, ensuring <30μs latency.
2. **Dual-Response Protocol (Unregistered Fallback):** Unregistered domains properly redirect web browsers to a central SSR 404/Error page (`/errors/unregistered`), while APIs/headless clients receive strict 403 JSON payloads.
3. **Guest Sandboxes & In-Flight Promotion:** Introduced `POST /api/guests/sandbox` to rapidly provision ephemeral passkey-less sessions, and updated the WebAuthn verification endpoint to detect and promote those sessions without destroying their continuous UI state.
4. **Docs & UI:** Created `TIER1_INGRESS_SPEC.md` and wired up all dynamic bypass properties into the Admin Application Registry dashboard.
