oficina / home Public

Handle expired chooser sessions without blocked form redirects

Paul Campbell pushed by paul@keymail.dev 1 month ago 69f8897382b4d66331988caf8c85a9240dd5355a parent 9ccdd2b

1 file changed, +3 −1

implementation/directory-runtime.md +3 −1

CI passed — run details

diff --git a/implementation/directory-runtime.md b/implementation/directory-runtime.md

index 3c957e7..f7d9211 100644

--- a/implementation/directory-runtime.md

+++ b/implementation/directory-runtime.md

@@ -1,6 +1,6 @@

# Mount the directory-owned Docs entry

-Status: proposal for independent Fable review. Base is reviewed, unmounted chooser07043915daebae10512a710915263093ed793b5b and directory store4c0d84811a018c53a47b604a0de5885baec0771e. Home discussion24 approved the parent directory designfa64e28. Docs Home linking is now deployed1e862f8 and merged5fe0447. This plan does not make that existing-account pilot into authoritative team admission.

+Status: base9ccdd2b independently APPROVED by configured claude-fable-5 (Home29); the expired-session continuation clarification below requires a follow-up verdict. Base is reviewed, unmounted chooser07043915daebae10512a710915263093ed793b5b and directory store4c0d84811a018c53a47b604a0de5885baec0771e. Home discussion24 approved the parent directory designfa64e28. Docs Home linking is now deployed1e862f8 and merged5fe0447. This plan does not make that existing-account pilot into authoritative team admission.

## Existing source and boundary

@@ -28,6 +28,8 @@ Before chooser handlers consult the session, reject duplicate actual session coo

Zero choices renders the reviewed empty page; one choice uses the existing303 GET redirect to the registered app's /auth/start with local return /. Multiple choices render the reviewed form. The successful POST response depends on separately reviewed continuation amendment95dcd682ac106ab725d9a85f141285709ab3659c: return200, immediate meta-refresh plus a plain fallback link to the revalidated stored destination. Preserve CSRF and the post-selection membership re-query. This avoids an unbounded outgoing CSP list; no wildcard or global form-action change. Do not implement or deploy the successful POST integration before that amendment is approved and its browser/fallback tests pass.

+A source-backed browser check exposed a second redirect-chain case: an expired directory session on an otherwise same-origin chooser POST currently returns303 to /auth/start and then to the credential origin, where form-action self blocks it. Handle this inside the chooser subject helper after Select has applied its existing method/path checks and CSRF protection. When that helper finds no current session on POST, render the same200 continuation template to the fixed validated directory origin plus /auth/start?return_to=%2Fapps%2Fdocs. An anonymous GET still uses the existing303. Refactor only the common final rendering/header step; the successful-choice caller validates its stored Docs origin, while the reauthentication caller constructs its destination entirely from validated runtime origin and fixed constants. No submitted team, arbitrary URL, query parameter or resource path enters that destination. Both set no-store and no-referrer and keep a real plain fallback link. This starts authentication only; it does not retain the stale submitted selection or create a membership/session/proof. After sign-in the chooser re-queries current membership and the person selects again if several teams remain. Test real expired-session POST in Chromium/WebKit with scripts on/off, fallback navigation, fixed Home return and unchanged CSRF/unknown-host refusal; do not treat the old blocked behavior as accepted integration.

Generic app entry never transfers a document path through Home or guesses which team's resource it is. Direct resource returns stay in the original Docs instance's sealed handoff. No global selected-team cookie is introduced; two tabs select independently. The public bare docs.oficina.works alias remains its original instance until the separately reviewed compatibility cutover. This slice adds only the directory /apps/docs entry path, not a new bare-host gateway or deployment route.

## Evidence and release sequence