dev_agentandClaude Opus 5.5 0dccf87b06 Make login state single-use on the server ...

A saved copy of the signed login cookie verified until it expired, so the
callback accepted it again with a second valid authorization code. The
login now records its state as pending and the callback consumes it,
refusing a replay with the same 400 as a state mismatch.

The pending-state set moves from gcal into auth as PendingStates, so login
and the Google Calendar connect share one mechanism. It is in memory, so a
flow started before a restart fails closed after it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 01:31:24 -04:00

..

ai

Feature 20: Scheduler and Weekly Automation (#182)

2026-10-10 19:30:23 -04:00

auth

Make login state single-use on the server

2026-10-11 01:31:24 -04:00

chat

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

config

Feature 19: Notifications - Web Push and Google Chat (#169)

2026-10-09 18:04:05 -04:00

db

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

dinners

Feature 20: Scheduler and Weekly Automation (#182)

2026-10-10 19:30:23 -04:00

forwarded

Feature 03 task 5: Trusted proxy handling for forwarded headers (#23)

2026-10-03 11:05:33 -04:00

frontend

Feature 01 task 3: Embed the PWA build with SPA fallback (#4)

2026-10-02 22:47:01 -04:00

gcal

Make login state single-use on the server

2026-10-11 01:31:24 -04:00

home

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

household

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

ideas

Withhold unsafe recipe sources from idea job results (BASE-01) (#170)

2026-10-09 19:04:44 -04:00

jobs

Withhold unsafe recipe sources from idea job results (BASE-01) (#170)

2026-10-09 19:04:44 -04:00

notify

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

plan

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

push

Feature 19: Notifications - Web Push and Google Chat (#169)

2026-10-09 18:04:05 -04:00

recipes

Feature 15: Recipe Detail and Kitchen Reading Mode (#162)

2026-10-09 14:01:14 -04:00

scheduler

Feature 20: Scheduler and Weekly Automation (#182)

2026-10-10 19:30:23 -04:00

secretbox

Feature 04 task 1: secretbox: AES-256-GCM secrets at rest (#17)

2026-10-03 09:46:29 -04:00

secureurl

Feature 03 task 1: OIDC login and callback against Authentik (#16)

2026-10-03 09:58:05 -04:00

server

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

shopping

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

store

Feature 19: Notifications - Web Push and Google Chat (#169)

2026-10-09 18:04:05 -04:00

suggest

Feature 21: Home Dashboard (#181)

2026-10-10 20:07:53 -04:00

vapid

Feature 19: Notifications - Web Push and Google Chat (#169)

2026-10-09 18:04:05 -04:00