@drawbridge/drawbridge-agents 0.1.27 → 0.1.28
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -139,6 +139,14 @@ skill) so it stops living only in tribal memory.
|
|
|
139
139
|
- The api's `POST /oauth/google/callback` returns `redirectTo` in its 400 body when it read the state
|
|
140
140
|
row before failing, so app-web can keep the resume target across `/auth?error=oauth`. A
|
|
141
141
|
`oauth.state.invalid` failure cannot — that row is what carried the target.
|
|
142
|
+
- Google sign-in NEVER auto-links (`profile/disconnect-google` must stick): the callback signs in
|
|
143
|
+
only on an exact google account row; an email-only match is refused with `code: google.not.linked`
|
|
144
|
+
in the error body, which app-web's `/api/auth/google` maps to `/auth?error=google-not-linked`
|
|
145
|
+
(and `google.already.linked` back to `/account`) — deliberate refusals carry `code` and skip
|
|
146
|
+
Sentry on both sides. Explicit linking runs GET `/oauth/google/link/start` (authenticated); its
|
|
147
|
+
state row carries `data.link` (user id) and the callback's **link-mode result has NO token pair**,
|
|
148
|
+
so the BFF must only (re)write session/refresh/csrf cookies when `result.sessionToken` is present —
|
|
149
|
+
writing them unconditionally signs the user out mid-link.
|
|
142
150
|
|
|
143
151
|
## Reporting (api ↔ app-web)
|
|
144
152
|
|
package/package.json
CHANGED