mirror of
https://github.com/tiennm99/llmapikey.git
synced 2026-06-17 12:48:54 +00:00
tiennm99
559bac8104
Self-contained GitHub OAuth (Arctic) with a stateless HS256 signed-cookie session (jose); Supabase is downgraded to the Postgres host only. - Origin-derived callback (no redirect-uri env); read:user scope; access token read once at callback and discarded (no token storage). - CSRF via single-use state cookie; open-redirect guard on next. - getCurrentGithubIdentity() now reads the session cookie, preserving the numeric provider_id identity contract for admin/dashboard/mint. - Remove @supabase/ssr + @supabase/supabase-js, middleware, and the supabase-dependent rls test; delete lib/supabase clients.
13 lines
428 B
JavaScript
13 lines
428 B
JavaScript
/**
|
|
* Open-redirect guard. Only same-origin relative paths are allowed; anything
|
|
* else (absolute URLs, protocol-relative `//host`, missing) falls back to
|
|
* `/dashboard`. Shared by `/auth/login` and `/auth/callback`.
|
|
*
|
|
* @param {string | null | undefined} next
|
|
* @returns {string}
|
|
*/
|
|
export function sanitizeNext(next) {
|
|
if (next && next.startsWith("/") && !next.startsWith("//")) return next;
|
|
return "/dashboard";
|
|
}
|