2 Commits

Author	SHA1	Message	Date
Maurice	0577a9ccb9	fix(native): the hand-off page goes straight to SSO instead of TREK's login first ... The app's browser sign-in opens /native-handoff, which sends the user on to the identity provider by itself. The page was not on the list of public auth pages, so the 401 from loading the user sent the browser to /login with the hand-off as its return path first. On a server that also offers passwords the user then had to pick SSO a second time before getting back to the app.	2026-11-10 09:17:22 +01:00
jubnl	b556c636eb	fix: tighten 401 redirect allowlist and add reset-password paths ... Replaced loose includes()/startsWith() path checks with exact equality for static routes and strict prefix matching for dynamic-token routes. Added /forgot-password and /reset-password to the allowlist so the password-reset flow is usable without auth. Extracted isAuthPublicPath as a pure testable function with 14 unit tests covering regressions.	2026-04-20 21:55:15 +02:00