[grade=B] feat(auth): onboard missing credentials into encrypted vault

2026-08-22 05:41:38 -07:00
parent d313b1e872
commit 84edb035e3
24 changed files with 959 additions and 235 deletions
@@ -287,7 +287,11 @@
  async function resumeExistingSession(returnUrl) {
    if (!returnUrl || !isAllowedReturnUrl(returnUrl)) return false;
    try {
-      const res = await fetch('/api/v1/auth/sso-handoff', {
+      const parsedReturn = new URL(returnUrl, window.location.origin);
+      const suffix = SITE.tld.startsWith('.') ? SITE.tld : `.${SITE.tld}`;
+      const serviceId = parsedReturn.hostname.slice(0, -suffix.length);
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(serviceId)) return false;
+      const res = await fetch(`/api/v1/auth/sso-handoff?serviceId=${encodeURIComponent(serviceId)}`, {
        credentials: 'include',
        cache: 'no-store',
      });