Add refresh-token auth flow and harden HTML injection paths#425

Merged

valentinpalkovic merged 25 commits intovalentin/viral-sharing-2from

refresh-token

May 7, 2026

Commits on May 7, 2026

Avoid setting innerHTML to prevent XSS, and ban it with ESLint

ghengeveld
authored and
valentinpalkovic
committed
Add refresh-token session handling for OAuth auth flow.

authored and
valentinpalkovic
committed
Avoid reopening the auth dialog when receiving a login message, which could replace the tracked window and drop the subsequent grant/code message

ghengeveld
authored and
valentinpalkovic
committed
Sync refreshed auth tokens into React state.

authored and
valentinpalkovic
committed
Stop retrying terminal OAuth refresh errors.

authored and
valentinpalkovic
committed
Propagate token refresh failures to auth exchange.

authored and
valentinpalkovic
committed
Defer persisting auth session until login completes.

authored and
valentinpalkovic
committed
Prevent stale refresh responses after logout.

authored and
valentinpalkovic
committed
Allow refresh responses without rotating refresh tokens.

authored and
valentinpalkovic
committed
Gracefully clear legacy raw-token auth storage values.

authored and
valentinpalkovic
committed
Sync auth state across tabs via storage events.

authored and
valentinpalkovic
committed
Show a session-expired notification on refresh failure.

authored and
valentinpalkovic
committed
Expand ESLint sink restrictions for HTML/code injection.

authored and
valentinpalkovic
committed
Use browser timeout APIs consistently in auth refresh.

authored and
valentinpalkovic
committed
Revert PulsatingEffect to shorthand fragment syntax.

authored and
valentinpalkovic
committed
Cleanup
valentinpalkovic
committed
Fix React not imported
valentinpalkovic
committed
Persist OAuth subdomain instead of full token endpoint URL

valentinpalkovic
and
claude
committed
Wire share auth and tests through new AuthStorage flow

valentinpalkovic
and
claude
committed
Drop redundant auth-flow state introduced with refresh tokens
valentinpalkovic
committed
Fix session-id correlation and drop unsafe refresh retry
valentinpalkovic
committed
Rename AuthStorage to AuthSession
valentinpalkovic
committed
Untrack .omc/ working directory
valentinpalkovic
committed
Cover computed and template-literal forms in HTML/code-sink bans
valentinpalkovic
committed
Drop clientId and tokenEndpoint from TokenExchangeParameters
valentinpalkovic
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add refresh-token auth flow and harden HTML injection paths#425

Add refresh-token auth flow and harden HTML injection paths#425
valentinpalkovic merged 25 commits intovalentin/viral-sharing-2from
refresh-token

Commits on May 7, 2026

Avoid setting innerHTML to prevent XSS, and ban it with ESLint

Add refresh-token session handling for OAuth auth flow.

Avoid reopening the auth dialog when receiving a login message, which could replace the tracked window and drop the subsequent grant/code message

Sync refreshed auth tokens into React state.

Stop retrying terminal OAuth refresh errors.

Propagate token refresh failures to auth exchange.

Defer persisting auth session until login completes.

Prevent stale refresh responses after logout.

Allow refresh responses without rotating refresh tokens.

Gracefully clear legacy raw-token auth storage values.

Sync auth state across tabs via storage events.

Show a session-expired notification on refresh failure.

Expand ESLint sink restrictions for HTML/code injection.

Use browser timeout APIs consistently in auth refresh.

Revert PulsatingEffect to shorthand fragment syntax.

Cleanup

Fix React not imported

Persist OAuth subdomain instead of full token endpoint URL

Wire share auth and tests through new AuthStorage flow

Drop redundant auth-flow state introduced with refresh tokens

Fix session-id correlation and drop unsafe refresh retry

Rename AuthStorage to AuthSession

Untrack .omc/ working directory

Cover computed and template-literal forms in HTML/code-sink bans

Drop clientId and tokenEndpoint from TokenExchangeParameters