Skip to content

Release 0.20.2: start calls name an address only when requested (PFL-769) - #46

Merged
erudenko merged 6 commits into
mainfrom
worktree-pfl-769-react-2fa-enrol
Nov 5, 2026
Merged

erudenko merged 6 commits into
mainfrom
worktree-pfl-769-react-2fa-enrol

Conversation

@erudenko

@erudenko erudenko commented Nov 5, 2026 •

Copy link
Copy Markdown
Member

Patch release for PFL-769.

Changes

  • Starting a sign-in: email link, OTP resend, passkey sign-up and forgot password send redirect_url only when the request gave one. They used to send the app's default, which failed on an app that doesn't list the server's default in its redirect URLs.
  • Forgot password: the success screen no longer requires a redirect_url.
  • Opened email link: an answer that is the sign-in page now shows "You're signed in". A screen that starts its request on mount no longer holds an old sign-in path.
  • Page URL: a redirect_url left on the sign-in, sign-up or forgot-password page isn't carried into the attempt.

Behaviour change

With no target given, an email link, OTP or password reset ends where the server's answer says: the app's first registered redirect URL, or the server's default if the app has none. Put the URL you want first in the list. This changes the ending for an app that lists the server's default with another URL ahead of it: users now go to that first URL.

Testing

  • Lint, unit tests, build, Storybook build and Playwright pass.
  • Tested against a local server on three apps: one that lists the default, one with no redirect URLs and one with only its own URL. Start and forgot-password calls ran fully. The local mailer delivers nothing, so completing a link or code was stubbed, using the address the server's rule gives and a real target check.
  • Not tested against production.

Crafted with agentic harness Magus (https://github.com/MadAppGang/magus)

https://claude.ai/code/session_012wctgs8R7pfHS6Hp7aZ4KN

…769)

Email link, OTP resend, passkey sign-up and forgot password sent the app's default
redirect as if it had been requested. The server validates what it is sent, and an
app need not list the server's default, so those starts failed on such an app. They
now send only a requested address and the server picks otherwise. The forgot-password
success screen no longer requires one, and a tab waiting on its link applies the
app's default at the end.

Co-Authored-By: Magus <magus@madappgang.com>

Crafted with agentic harness Magus (https://github.com/MadAppGang/magus)
Claude-Session: https://claude.ai/code/session_012wctgs8R7pfHS6Hp7aZ4KN
Co-Authored-By: Magus <magus@madappgang.com>

Crafted with agentic harness Magus (https://github.com/MadAppGang/magus)
Claude-Session: https://claude.ai/code/session_012wctgs8R7pfHS6Hp7aZ4KN
The screen starts its request on mount, so its ending held the sign-in path from
before the flow registered it, and the real page looked like another address.

Co-Authored-By: Magus <magus@madappgang.com>

Crafted with agentic harness Magus (https://github.com/MadAppGang/magus)
Claude-Session: https://claude.ai/code/session_012wctgs8R7pfHS6Hp7aZ4KN
A redirect_url left on the sign-in or forgot-password page URL is no longer carried
into the attempt, and useSignInEnding reads the latest navigate as well as the latest
sign-in path. The changelog states where each ending goes with no target.

Co-Authored-By: Magus <magus@madappgang.com>

Crafted with agentic harness Magus (https://github.com/MadAppGang/magus)
Claude-Session: https://claude.ai/code/session_012wctgs8R7pfHS6Hp7aZ4KN

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

Co-Authored-By: Magus <magus@madappgang.com>

Crafted with agentic harness Magus (https://github.com/MadAppGang/magus)
Claude-Session: https://claude.ai/code/session_012wctgs8R7pfHS6Hp7aZ4KN
…-769)

Reading the latest navigate changed what an opened link does with a path outside the
flow, from a page load to a history push that a host with no router can't render. The
ending goes back to the navigate of its own render, and only the sign-in path is read
late. Tests now cover the page param on sign-up and forgot password too.

Co-Authored-By: Magus <magus@madappgang.com>

Crafted with agentic harness Magus (https://github.com/MadAppGang/magus)
Claude-Session: https://claude.ai/code/session_012wctgs8R7pfHS6Hp7aZ4KN
@erudenko
erudenko merged commit 97f5aa2 into main Nov 5, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant