openhands 7f39ba4257 fix: harden SSO ticket flow and revoke tickets on logout ...

Reuse the outstanding auth_ticket instead of minting a fresh one on every
/client load, so reloading the page or opening a second tab no longer
invalidates a game session that is still connecting. New tickets are minted
with a guard against the previously-read value so concurrent launches
converge on the same ticket.

Revoke the auth_ticket when signing out (toolbar, header and sign-out
everywhere) so a leaked ticket can no longer be replayed against the
emulator, and prevent SSO leakage via referral by setting no-referrer on the
client iframe. Strip all whitespace from the ticket prefix and build the
launch URL through a tested helper that handles query strings, existing sso
params and URL fragments correctly.

2026-08-29 20:54:06 +02:00

..

admin

Fix Turbopack module resolution for lzma and restore path imports

2026-08-25 22:19:59 +02:00

auth

fix: harden SSO ticket flow and revoke tickets on logout

2026-08-29 20:54:06 +02:00

client-cache

style: format code biome

2026-07-13 21:57:41 +02:00

foundation

fix: harden update pipeline and restore a clean production build

2026-08-28 12:48:04 +02:00

furni

fix: furniture interaction detection and automatic catalog offer_id rebuild

2026-08-21 13:39:21 +02:00

images

Add production observability: Sentry, pino, and sharp badge encoding.

2026-07-17 23:09:57 +02:00

services

perf: use lzma-wasm for SWF decompression and drop vite

2026-08-29 19:27:27 +02:00

utils

Apply Biome lint fixes

2026-08-25 22:26:05 +02:00

validators

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

access-guard.ts

refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5)

2026-08-01 14:15:39 +02:00

action-helper.test.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

action-helper.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

admin-content-modules-contract.test.ts

chore(db): finish Prisma cutover to Drizzle Kit tooling

2026-08-01 15:02:21 +02:00

admin-fetch.test.ts

fix: bootstrap admin CSRF tokens

2026-08-02 11:46:43 +02:00

admin-fetch.ts

fix: bootstrap admin CSRF tokens

2026-08-02 11:46:43 +02:00

admin-helpers.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

admin-helpers.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

admin-list.ts

refactor: replace Prisma ORM runtime with Drizzle ORM facade

2026-07-31 14:11:03 +02:00

admin-nav-config.test.ts

feat(admin): configurable sidebar menu order and visibility

2026-07-30 21:45:53 +02:00

admin-nav-config.ts

feat(admin): configurable sidebar menu order and visibility

2026-07-30 21:45:53 +02:00

admin-nav.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

admin-nav.ts

feat: relocate import tools into studio and harden catalog/furnidata integrity

2026-08-24 17:13:03 +02:00

admin-operations-contract.test.ts

feat(admin): items_base browser and AdminPageShell on core pages

2026-07-30 20:41:31 +02:00

admin-theme-source-audit.test.ts

test: verify housekeeping foundation boundaries

2026-08-26 17:44:03 +02:00

api-auth.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

api-auth.ts

refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5)

2026-08-01 14:15:39 +02:00

api-handler.ts

refactor: clean up duplicate imports and dead code

2026-08-09 11:51:26 +02:00

api-response.ts

chore: CSP script nonces, deploy health check, dead-code cleanup

2026-07-21 20:27:08 +02:00

api.test.ts

fix(admin): polish tickets, photos purge note, drizzle contracts

2026-08-01 15:07:54 +02:00

api.ts

fix(admin): polish tickets, photos purge note, drizzle contracts

2026-08-01 15:07:54 +02:00

as-child.ts

refactor: remove explicit any across admin forms and catalog actions

2026-07-18 20:31:18 +02:00

auth.ts

refactor: extract shared login credential verification into auth/login-core

2026-08-27 15:17:54 +02:00

bans.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

bans.ts

fix(admin): polish tickets, photos purge note, drizzle contracts

2026-08-01 15:07:54 +02:00

cache.test.ts

Add performance optimizations and component refactors

2026-08-17 22:02:21 +02:00

cache.ts

Add performance optimizations and component refactors

2026-08-17 22:02:21 +02:00

cached-db.ts

perf: optimize CMS queries, caching, and asset delivery

2026-08-14 11:20:37 +02:00

catalog-assets.test.ts

fix: use configured furni source and catalog assets

2026-08-02 14:22:05 +02:00

catalog-assets.ts

fix: use configured furni source and catalog assets

2026-08-02 14:22:05 +02:00

catalog-layouts.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

catalog-layouts.ts

style: format code biome

2026-07-13 21:57:41 +02:00

catalog-translations.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

catalog-translations.ts

style: format code biome

2026-07-13 21:57:41 +02:00

ci-workflow-contract.test.ts

chore(db): finish Prisma cutover to Drizzle Kit tooling

2026-08-01 15:02:21 +02:00

client-translation-files.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

client-translation-files.ts

style: format code biome

2026-07-13 21:57:41 +02:00

client-url.test.ts

fix: harden SSO ticket flow and revoke tickets on logout

2026-08-29 20:54:06 +02:00

client-url.ts

fix: harden SSO ticket flow and revoke tickets on logout

2026-08-29 20:54:06 +02:00

csp.test.ts

fix: remove nonce from style-src to allow unsafe-inline to work

2026-08-01 22:09:22 +02:00

csp.ts

fix: remove nonce from style-src to allow unsafe-inline to work

2026-08-01 22:09:22 +02:00

db-pool.test.ts

refactor: replace Prisma ORM runtime with Drizzle ORM facade

2026-07-31 14:11:03 +02:00

db-pool.ts

refactor: replace Prisma ORM runtime with Drizzle ORM facade

2026-07-31 14:11:03 +02:00

db.ts

fix: harden update pipeline and restore a clean production build

2026-08-28 12:48:04 +02:00

deploy-workflow-contract.test.ts

fix: preserve runtime furni assets during deploy

2026-08-02 17:32:32 +02:00

deployment-id.test.ts

fix: add automatic deployment skew protection

2026-08-01 21:52:28 +02:00

form-data.test.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

form-data.ts

style: format code biome

2026-07-13 21:57:41 +02:00

format-date.test.ts

refactor: full codebase overhaul — dead code removal, env validation, logger migration, date consolidation, Prisma schema cleanup, button consistency, useEffect deps, test coverage

2026-07-25 17:33:06 +02:00

format-date.ts

fix: resolve all biomaly lint errors and warnings across CMS

2026-07-20 17:41:53 +02:00

format.test.ts

fix: preserve user figures in avatar imager

2026-08-09 21:48:43 +02:00

format.ts

fix: preserve user figures in avatar imager

2026-08-09 21:48:43 +02:00

habbo-gamedata-hotel.test.ts

Add multi-hotel Habbo gamedata locale in CMS settings.

2026-07-17 22:28:18 +02:00

habbo-gamedata-hotel.ts

fix: use configured furni source and catalog assets

2026-08-02 14:22:05 +02:00

hotel-name.ts

refactor: resolve hotel name directly from HOTEL_NAME env

2026-08-27 16:42:12 +02:00

imager.test.ts

fix: omit default params in avatar URL for cleaner URLs

2026-08-09 20:03:26 +02:00

imager.ts

fix: preserve user figures in avatar imager

2026-08-09 21:48:43 +02:00

import-backend-contract.test.ts

refactor: clean up duplicate imports and dead code

2026-08-09 11:51:26 +02:00

json5-patch.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

json5-patch.ts

style: format code biome

2026-07-13 21:57:41 +02:00

logger.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

logger.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

media-storage.ts

Fix Turbopack module resolution for lzma and restore path imports

2026-08-25 22:19:59 +02:00

motion.ts

Migrate from framer-motion to motion/react

2026-07-28 18:49:25 +02:00

move-suggestions.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

move-suggestions.ts

style: format code biome

2026-07-13 21:57:41 +02:00

observability-contract.test.ts

chore: remove Sentry integration

2026-08-01 22:12:31 +02:00

permission-slugs.ts

chore(db): finish Prisma cutover to Drizzle Kit tooling

2026-08-01 15:02:21 +02:00

permissions.ts

chore(db): remove Prisma facade and drop prisma:generate from CI

2026-08-01 14:38:42 +02:00

proxy-access.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

proxy-access.ts

perf(html): replace proxyAuth with getToken to remove set-cookie; add Cache-Control per auth state

2026-08-01 18:37:19 +02:00

proxy-auth-contract.test.ts

perf(html): replace proxyAuth with getToken to remove set-cookie; add Cache-Control per auth state

2026-08-01 18:37:19 +02:00

rate-limit.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

rate-limit.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

redis-cache.ts

Add performance optimizations and component refactors

2026-08-17 22:02:21 +02:00

redis.ts

feat: replace Redis with DragonflyDB

2026-08-12 14:34:29 +02:00

report-error.ts

chore: remove Sentry integration

2026-08-01 22:12:31 +02:00

safe-action-shared.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

safe-action-shared.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

safe-action.ts

style: format code biome

2026-07-13 21:57:41 +02:00

sanitize.ts

feat: speed up admin clone import and enable Cache Components

2026-08-05 11:10:16 +02:00

server-log.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

server-log.ts

refactor: full codebase overhaul — dead code removal, env validation, logger migration, date consolidation, Prisma schema cleanup, button consistency, useEffect deps, test coverage

2026-07-25 17:33:06 +02:00

sse-client.ts

feat: speed up admin clone import and enable Cache Components

2026-08-05 11:10:16 +02:00

staff-smoke-contract.test.ts

feat: relocate import tools into studio and harden catalog/furnidata integrity

2026-08-24 17:13:03 +02:00

theme-contrast.test.ts

fix test expectation for accent foreground contrast

2026-08-08 21:49:24 +02:00

theme-contrast.ts

export parseHex, relativeLuminance, softLightSurface for testing

2026-08-08 21:46:40 +02:00

theme-css.ts

feat: make panel border color configurable via theme editor

2026-07-16 15:53:53 +02:00

theme-custom-store.ts

refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (6)

2026-08-01 14:15:43 +02:00

theme-presets.ts

Improvements: remove dead config, fix ESM, add URL validation, unify types, add missing logging

2026-07-26 20:28:11 +02:00

theme-settings.test.ts

style: format code biome

2026-07-13 21:57:41 +02:00

theme-settings.ts

style: format code biome

2026-07-13 21:57:41 +02:00

translations-utils.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

translations-utils.ts

style: format code biome

2026-07-13 21:57:41 +02:00

trax-format.test.ts

test: add unit tests for pure logic modules

2026-08-07 18:53:59 +02:00

trax-format.ts

style: format code biome

2026-07-13 21:57:41 +02:00

use-event-source.ts

feat: public events/polls, friends graph, captcha, SSE hardening, and admin UX

2026-07-21 21:08:33 +02:00

utils.ts

style: format code biome

2026-07-13 21:57:41 +02:00