Waleed 66bab935db fix(chat): close SSO auth bypass via checkSSOAccess body flag (#4408) ...

* fix(chat): close SSO auth bypass via checkSSOAccess body flag

- Remove checkSSOAccess short-circuit; SSO branch always validates via getSession()
- Skip chat_auth cookie issuance/validation for SSO deployments to prevent replay
- Split eligibility pre-flight into dedicated POST /api/chat/[identifier]/sso route
- Drop .passthrough() and checkSSOAccess from deployed chat contracts
- Add SSO branch test coverage in chat utils

* fix(chat): cast allowedEmails to string[] for SSO eligibility check

* fix(chat): close SSO GET cookie replay and add eligibility rate limit

- Skip chat_auth cookie validation for SSO in GET handler (replay vector for pre-fix cookies)
- Route SSO GET through getSession() instead of always returning auth_required_sso so post-IdP config fetch works
- Add per-IP rate limiting to /api/chat/[identifier]/sso to prevent allowlist enumeration

2026-05-02 11:16:25 -07:00

..

docs

feat(gmail): add edit draft and update label tools (#4374)

2026-04-30 19:51:02 -07:00

realtime

feat(workflows): lock/duplicate improvements for workflows (#4387)

2026-05-01 20:42:10 -07:00

sim

fix(chat): close SSO auth bypass via checkSSOAccess body flag (#4408)

2026-05-02 11:16:25 -07:00