fix(auth): point emailed auth links at lapwingdata.com on native - #366
Merged
Conversation
Inside the Tauri/Android WebView, window.location.origin is the shell's synthetic http://tauri.localhost, so the redirectTo/emailRedirectTo URLs baked into Supabase registration-confirmation and password-reset emails were dead links. New platform helper authRedirectOrigin() returns the canonical https://lapwingdata.com origin when isNativeApp() (emailed auth links open in a mail client / real browser, never the app WebView) and the current origin on the web; authBackend's resetPassword and signUp now use it. Since on native the emailed link completes in the browser rather than the app, the Register success and Forgot-Password sent toasts gain native-specific copy (all locales) telling the user to confirm via the email link in their browser, then return to the app and sign in. Also on the same screen: the check-login-rate pre-check now fails open — an infrastructure failure of the edge function (network error/throw) no longer aborts sign-in with a generic error, while a genuine rate-limit rejection still blocks with its message. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PdpAnoQ6Y1dqDX3ScnQekD
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
lapwing | c9db40b | Commit Preview URL Branch Preview URL |
Aug 01 2026, 12:12 AM |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Coverage SummaryLines: 57.11% (7088/12411) · Statements: 56.25% · Functions: 53.39% · Branches: 53.64% Per-file coverage
|
…directs # Conflicts: # CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Inside the Tauri webview
window.location.originishttp://tauri.localhost, so registration-confirmation and password-reset emails carried dead redirect URLs — registration and reset were broken funnels in the native Android app (password login itself was fine).authRedirectOrigin()insrc/lib/platform.ts:https://lapwingdata.comwhenisNativeApp(), else the current origin (previews/self-hosted keep redirecting to themselves). Used for bothredirectTo(/reset-password) andemailRedirectTo(/auth/callback) inauthBackend.ts.Login.tsx: thecheck-login-ratepre-check is wrapped in its own try/catch so a thrown rate-check failure (network error) no longer aborts the login with a generic error. A genuine "locked" verdict still blocks.Related Issues
Part of the LapWing Android v0.2.0 release push.
Type of Change
Checklist
npm run lintpassesnpm run typecheckpassesnpm run test:runpasses — 2352 testsnpm run buildsucceeds — via typecheck/CIREADME.md,CLAUDE.md, Credits,CHANGELOG.md) — CHANGELOG entry addeddatalogParser.ts, added tests, updated the formats table — n/aNotes for Reviewers
check-login-ratefailure aborted the login entirely (the masking bug); an error returned by the function already fell through to the login attempt (datacomes back null and therateCheck && !allowedguard passes). After: both failure shapes fail open. This slightly widens fail-open behavior on a client-side advisory check — the server-side rate recording and Supabase's own auth limits are untouched. If you'd rather fail closed on thrown errors, drop that hunk and the redirect fix stands alone.https://lapwingdata.com/auth/callbackandhttps://lapwingdata.com/reset-password(likely already true for the web deploy — please confirm before merging).Generated by Claude Code