2d34aa15a7
Implements the GET /pass?token=... endpoint for validating session tokens, resolving the correct target application domain dynamically, and routing users seamlessly using ephemeral 1-click magic links. Also updates the Sessions Hub UI hand-off modal to display the 1-Click Magic Link and adds full test coverage. Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
44 lines
1.6 KiB
Markdown
44 lines
1.6 KiB
Markdown
# TASK METADATA
|
|
|
|
- **Target Files:**
|
|
- `server/main.ts`
|
|
- `ui/components/SessionsPage.tsx`
|
|
- `server/main.test.ts`
|
|
- **Core Objective:** Implement `GET /pass?token=...` for 1-click ephemeral
|
|
session redemption and update the Sessions Hub hand-off UI with copyable magic
|
|
links.
|
|
- **Dependencies:** `server/auth-session.ts`, `server/db.ts`
|
|
- **Additional Important Notes:** Sets wildcard `.atyg.org` cookie, cleans
|
|
host-only cookie, and redirects cleanly to target app domain or dashboard.
|
|
|
|
---
|
|
|
|
### 1. Architectural Considerations & Risks
|
|
|
|
- **Security & Cookie Scoping:**
|
|
- `/pass` must validate that the token is active and not expired before
|
|
issuing Set-Cookie headers.
|
|
- Must use `getCookieDomain()` so subdomains (e.g. `ed-droid.atyg.org`)
|
|
receive the session cookie immediately.
|
|
- **Target URL Redirection:**
|
|
- If the session has custom scopes for an application (e.g. `app:ed-droid`),
|
|
`/pass` looks up the domain of `ed-droid` and redirects directly to
|
|
`https://ed-droid.atyg.org`.
|
|
- If no specific app is scoped, redirects to `/dashboard`.
|
|
|
|
---
|
|
|
|
### 2. Proposed Implementation
|
|
|
|
1. **Backend Route (`server/main.ts`):**
|
|
- Add `GET /pass`:
|
|
- Reads `c.req.query("token")`.
|
|
- Validates token against Valkey/PostgreSQL.
|
|
- Sets `session_id` cookie on `.atyg.org`.
|
|
- Determines redirect URL and returns `302 Found`.
|
|
2. **UI Update (`ui/components/SessionsPage.tsx`):**
|
|
- Add **"1-Click Magic Link"** tab in `#handoffModal`.
|
|
- Copyable link: `https://auth.atyg.org/pass?token=ay_sess_...`.
|
|
3. **Automated Tests (`server/main.test.ts`):**
|
|
- Add test case verifying token validation, cookie setting, and redirection.
|