Repository navigation
Prevent signed photo URLs from crossing account switches - #595
Merged
Merged
Conversation
#591 merged at 7563462 and production served it at 16:06Z (build-info), with /api/health database, auth and service role ok. Every fix in the ledger is now live. A row is only called clean after the signed-out production crawl is re-run on it, and that crawl was refused by this environment's permission check, so the 358 rows read "fixed, live — re-crawl pending" (a status now defined in the section's legend) rather than clean. 32 rows are clean; 8 stay open on the intermittent #418. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KP9rt5rVQ9jDMpZp2xBy3K
…dia-session-ownership-20260927
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After all authentication observers unmount, another tab can switch accounts and the next signed-in view can reuse the previous account’s cached photo URL. This change ties cached URLs and pending signing requests to the current browser session, so the new account obtains its own authorized URL. Late responses from the previous session are discarded; token refresh within the same session keeps the existing URL.
Private-image placeholders match between server rendering and initial browser hydration, while later client-side mounts reuse cached images immediately. The display test harness loads the real cookie-owner dependencies. Seven permanent browser cases cover account switching, both delayed-response orders, signed-in/signed-out/external-image hydration, and immediate cached-image remounts.
Validation on the exact application/test source: 20,722 unit tests across 1,623 files, 146 focused session/fixture cases, the 247-page production build, generated-route types and lint pass (15 existing warnings). All seven media browser cases and 25 display cases pass. The private frozen-tree comparison matches 5,189 application/test/config files; only the five evidence documents differ. Hosted database/mobile and Vercel preview pass; hosted Web/E2E remain separately tracked while running. Synthetic browser provider/image transport does not claim live bucket-policy verification.
The audit records production acceptance of worker release e14b12e. This PR also merges #593’s audit documentation and preserves the newer lane A ownership claim from #594, all 14,186 permanent audit records and the generated findings index. SEC-001 remains open because the family-media bucket is still public. No database migration or production bucket-policy change is included.