Repository navigation
Offer Continue as on the sign-in page after an AI client sign-in - #1456
Merged
Merged
Conversation
The chat also hands out plain dashboard links (/connectors/<id>) for a connector that is not set up yet; those still asked for the password a user had typed a minute earlier to connect Claude. The sign-in page now offers "Continue as <email>" from the same recent sign-in cookie the setup links use, with the same checks; signing out forgets it.
helpcodeai
enabled auto-merge (squash)
November 2, 2026 19:02
helpcodeai
disabled auto-merge
November 2, 2026 19:05
Review: seven days left a password-free dashboard sign-in on a shared browser where someone only connected an AI client. Two hours covers the setup the chat hands out right after connecting. The requests that turn the cookie into a session now need a custom header, which a page on another origin (a sibling subdomain included) cannot send.
helpcodeai
enabled auto-merge (squash)
November 2, 2026 19:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
This follows #1452. In the Claude onboarding, after the post-approve picker, Claude reaches the new connector through "List connectors". That answer links to
/connectors/<id>, not to a/s/<token>setup link, so the user was still asked for the password they had typed a minute earlier on the authorization page. A production end-to-end test on Cloud showed it.Change
RecentSignInService(new, inAuthModule).amcp_signincookie: signed, httpOnly, not revoked bysessionsValidFrom, e-mail verified on Cloud, no workspace that enforces SSO.SetupLinksControllernow uses it, with the same behaviour as before./api/auth/recent-sign-in(new controller).GETanswers which account signed in (e-mail and name only), or 204.POSTreturns a dashboard session, or 401.DELETEclears the cookie.redirect, through the sameafterSignInas a password sign-in.DELETE, so the sign-in page offers nothing right after.Cloud and self-hosted
The behaviour is the same in both modes. The cookie only reaches the API when the dashboard and the authorization page share a host; otherwise
GETanswers 204 and the page looks as before.Tests
Backend, in
packages/backend:npx jest --maxWorkers=4 src/auth/recent-sign-in src/adapters/setup-links.controller.spec.ts src/auth/login.controller.spec.ts: 4 suites passed.RecentSignInService(valid, missing, revoked, unverified, SSO-enforced, unknown user; session on the requested, last-used or fallback workspace; none without a membership).RecentSignInController(GET,POST,DELETE).SetupLinksControllerspecs moved to the service.npx tsc --noEmit -p tsconfig.json: passed.Frontend, in
packages/frontend:npx tsc --noEmit -p tsconfig.json: passed.npx eslinton the changed files: 0 errors (3 existing warnings).npx playwright test tests/e2e/login-recent-sign-in.spec.ts tests/e2e/setup-link.spec.ts tests/e2e/social-login.spec.ts tests/e2e/login-redirect-safe.spec.ts: 29 passed.