tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
auth-yes/tasks/complete/2026-0825.01.gem.feat.magic-passes.ephemeral-1-click-guest-links-0045.md
google-labs-jules[bot] 2d34aa15a7 feat: implement ephemeral 1-click magic link redemption (/pass) 
Implements the GET /pass?token=... endpoint for validating session tokens, resolving the correct target application domain dynamically, and routing users seamlessly using ephemeral 1-click magic links.
Also updates the Sessions Hub UI hand-off modal to display the 1-Click Magic Link and adds full test coverage.

Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 08:25:31 +00:00

1.6 KiB
Raw Blame History

TASK METADATA

  • Target Files:
    • server/main.ts
    • ui/components/SessionsPage.tsx
    • server/main.test.ts
  • Core Objective: Implement GET /pass?token=... for 1-click ephemeral session redemption and update the Sessions Hub hand-off UI with copyable magic links.
  • Dependencies: server/auth-session.ts, server/db.ts
  • Additional Important Notes: Sets wildcard .atyg.org cookie, cleans host-only cookie, and redirects cleanly to target app domain or dashboard.

1. Architectural Considerations & Risks

  • Security & Cookie Scoping:
    • /pass must validate that the token is active and not expired before issuing Set-Cookie headers.
    • Must use getCookieDomain() so subdomains (e.g. ed-droid.atyg.org) receive the session cookie immediately.
  • Target URL Redirection:
    • If the session has custom scopes for an application (e.g. app:ed-droid), /pass looks up the domain of ed-droid and redirects directly to https://ed-droid.atyg.org.
    • If no specific app is scoped, redirects to /dashboard.

2. Proposed Implementation

  1. Backend Route (server/main.ts):
    • Add GET /pass:
      • Reads c.req.query("token").
      • Validates token against Valkey/PostgreSQL.
      • Sets session_id cookie on .atyg.org.
      • Determines redirect URL and returns 302 Found.
  2. UI Update (ui/components/SessionsPage.tsx):
    • Add "1-Click Magic Link" tab in #handoffModal.
    • Copyable link: https://auth.atyg.org/pass?token=ay_sess_....
  3. Automated Tests (server/main.test.ts):
    • Add test case verifying token validation, cookie setting, and redirection.