till/managarten
1
0
Fork 0
mirror of https://github.com/Memo-2023/mana-monorepo.git synced 2026-05-14 20:01:09 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
managarten/services/mana-auth/src
History
Till JS e19a81c83c test(mana-auth): sso-config consistency spec 
Locks in the relationship between three places that must agree about
SSO origin configuration:

  1. TRUSTED_ORIGINS in better-auth.config.ts (Better Auth allow-list)
  2. CORS_ORIGINS env var on mana-auth in docker-compose.macmini.yml
  3. The HTTPS subset of (1) must be a subset of (2) — every origin
     Better Auth trusts must also pass CORS preflight

Background: root CLAUDE.md references this spec file as the canonical
"Adding an app to SSO" verification step (line 116) but the file
itself never existed. The first run of this spec immediately caught
two real bugs:

  - 3 origins in TRUSTED_ORIGINS were missing from CORS_ORIGINS
    (https://auth.mana.how, https://arcade.mana.how, https://whopxl.mana.how)
  - 22 zombie subdomain entries in CORS_ORIGINS left over from before
    the consolidation (calendar, chat, todo, ...) that no app actually
    routes to anymore

Both fixes shipped together with the TRUSTED_ORIGINS extraction in
the broader pre-launch sweep (commit 919fcca4b). This spec is the
guard against the same drift creeping back in.

Eight tests:
  - canonical mana.how + auth subdomain present
  - localhost dev origins (3001, 5173) present
  - all production origins HTTPS
  - all production origins on *.mana.how
  - no duplicates
  - every HTTPS trusted origin appears in mana-auth CORS_ORIGINS
  - soft warning for CORS_ORIGINS entries not in trustedOrigins
    (catches drift in the other direction)

8/8 pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-09 11:55:30 +02:00
..
auth test(mana-auth): sso-config consistency spec 2026-04-09 11:55:30 +02:00
db fix(mana-auth) + chore: rewrite /api/v1/auth/login JWT mint, remove Matrix stack 2026-04-08 16:32:13 +02:00
email feat: rename ManaCore to Mana across entire codebase 2026-04-05 20:00:13 +02:00
lib feat(services): create mana-auth (Hono + Bun) — Phase 5 auth rewrite 2026-03-28 02:43:44 +01:00
middleware refactor(shared-tailwind): rewrite themes.css to single-layer shadcn convention 2026-04-09 01:13:06 +02:00
routes fix(mana-auth) + chore: rewrite /api/v1/auth/login JWT mint, remove Matrix stack 2026-04-08 16:32:13 +02:00
services fix(mana-auth): account lockout was structurally dead + add failure-path tests 2026-04-08 18:29:00 +02:00
config.ts fix(mana-auth) + chore: rewrite /api/v1/auth/login JWT mint, remove Matrix stack 2026-04-08 16:32:13 +02:00
index.ts refactor(shared-tailwind): rewrite themes.css to single-layer shadcn convention 2026-04-09 01:13:06 +02:00