Repository navigation
Bind cross-app handoffs to the browser that started them - #98
Merged
Merged
Conversation
Member
Author
|
Companion PRs for the one release: robosystems RoboFinSystems/robosystems#1945 · robosystems-core #98 · robosystems-typescript-client RoboFinSystems/robosystems-typescript-client#302 · robosystems-python-client RoboFinSystems/robosystems-python-client#286 · robosystems-app RoboFinSystems/robosystems-app#518 · roboledger-app RoboFinSystems/roboledger-app#527 |
This was referenced Oct 25, 2026
Merged
Merged
The committed lockfile predated package.json (it pinned @robosystems/client 2.1.0 and jsdom 29), so the release job's npm ci refused it. CI installs with npm ci too, so drift fails on the pull request rather than at publish.
Apps still on an older core send no nonce_hash and complete only an unbound handoff; sending them to start a bridge of their own looped them through the login home. An app on this core still ignores a session_id it did not start. A browser that cannot hold a nonce now stops at the retry page instead of going round again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardening from a platform security review; companion to the robosystems
bugfix/input-validation-hardeningPR. Public text is deliberately brief.mintBrowserNonce, kept in its ownsessionStorage) and sends the hash to the login home as?nonce_hash=; the login home passes it into the exchange, and completion presents the nonce.handleSSOLogincompletes only a bridge this browser started; asession_idarriving without one is stripped, not redeemed.getSSORedirectUrl/navigateToApptake{ nonceHash }; without one they send the browser to the target's/login?return_to=so the target starts a bound bridge of its own (one extra hop foruseCrossAppLinkand the app switcher).ssoExchange(token, app, browserNonceHash?),ssoComplete(sessionId, browserNonce?),buildLoginHomeUrl({ nonceHash })— all optional.npm ci --ignore-scripts.Contract
Additive API; a core minor. Behaviour change: a cross-app link now lands on the target's login page, which bridges itself. Works against the current API (the new fields are optional and ignored by an API that predates them); the binding is enforced once the robosystems PR deploys and the apps send hashes.
Deploy order: API → this publish → robosystems-app (its PR on the same branch name) → the product apps bump.
Test plan
npm run test— 625 passed, 16 skipped (new cases insso.test.ts,sso.sdk.test.ts,login-home.test.ts,LoginRedirector.test.tsx,rowsToCsv.test.ts)🤖 Generated with Claude Code