cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): retain protected deep-link state through sign-in

Browse Source
This commit is contained in:
cesnimda
2026-10-10 14:32:24 +02:00
parent c37cab560a
commit 6843767176
6 changed files with 250 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/README.md
+7 -1
View File
@@ -21,4 +21,10 @@ Before application changes, the Login component regression run has **17passing/1
Existing session/account invalidation intentionally disposes the previous page/providers and replaces with `/login?sessionChanged=1`; previous-account private context must remain discarded. Backend ownership and role checks remain authoritative. Synthetic accounts/disposable SQLite only; no real external identity provider or production data.
Current repair status: **IN PROGRESS**. Original AUTH-01 remains open until GREEN and full validation. P5-15-02 and production are not cleared. Broader human/device/font qualification, historical preference500 causes, the CV Unsaved intermittent observation and P5-13 deferral remain open.
## Bounded implementation checkpoint
`App.Shell` now carries pathname/search/hash plus the existing navigation context through the same landing/sign-in state. `safeAuthReturnPath` rejects external/protocol-relative targets, controls/backslashes, malformed encoding, recursively encoded unsafe paths and normalized authentication-entry loops, including case variants. It returns valid internal strings unchanged. Login uses that validated destination across local, two-factor, Google and Microsoft completion, replaying only validated existing Jobs return context. Account-disposal entries explicitly abandon old destinations. No URL storage, Analytics aggregation, authentication API or provider changes.
Final application changes have fresh **1,033/1,033 backend**, **490/490 frontend**, **31/31 focused Login**, the unchanged original native AUTH-01 **1/1**, and new native return/security journeys **5/5** passing. TypeScript, lint and both builds pass. The case-insensitive login-loop gap also has separate RED evidence before correction: two failures, two selected passes and27 not selected; final31 cases pass. External identity callbacks/two-factor are component fixtures, not live provider acceptance.
The complete browser/security/fidelity reconciliation is still running. Current checkpoint status: **IN PROGRESS**, with the demonstrated AUTH-01 repaired but no final acceptance claim yet. P5-15-02 and production are not cleared. Broader human/device/font qualification, historical preference500 causes, the CV Unsaved intermittent observation and P5-13 deferral remain open.