fix: handle desktop OAuth handoff fallback

[kankunnawat]

Description

Fixes #9535.

Plane Cloud returns successful desktop OAuth sessions through a versioned deep link:

plane://open?v=1&o=<base64url-origin>&p=<base64url-path>

Plane Desktop v3 currently treats the deep-link host (open) as a web path and navigates to /open?... instead of decoding the handoff. Because the web app had no compatibility route for that path, authentication middleware sent the user back to sign-in even though Google OAuth had completed successfully.

This change adds a narrow /open fallback that:

• decodes version 1 origin and path parameters;
• accepts the handoff only when its decoded origin matches the current Plane instance;
• accepts only same-origin absolute paths;
• redirects invalid or unsupported payloads to the app root.

The desktop protocol handler can still be corrected independently; this fallback restores login for already-released clients and self-hosted instances without weakening the origin boundary.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Test plan

• ./node_modules/.bin/turbo run test --filter=web — 11/11 tasks; 4/4 handoff cases
• ./node_modules/.bin/turbo run check:types --filter=web — 11/11 tasks
• ./node_modules/.bin/turbo run build --filter=web — 11/11 tasks
• Changed files pass oxfmt --check
• Changed source and test files pass oxlint --deny-warnings
• Browser verification against the production build:
  • valid same-origin handoff reached /d/auth/?token=one-time-token;
  • different-instance, cross-origin, and malformed handoffs were rejected to /.

Test scenarios

• Valid v1 handoff for the current instance redirects to the decoded OAuth completion path.
• Handoff for another Plane instance is rejected.
• Cross-origin path payload is rejected.
• Unsupported versions and malformed base64url payloads are rejected.

Summary by CodeRabbit

• New Features

  • Added support for desktop deep-link handoffs through a dedicated route.
  • Valid handoffs now redirect to the requested in-app destination.
  • Invalid, unsupported, malformed, or cross-origin handoffs safely fall back to the home page.

• Tests

  • Added coverage for valid handoffs and rejected redirect scenarios.

[coderabbitai]

📝 Walkthrough

Walkthrough

The web app now handles legacy plane://open desktop handoffs. It validates version, origin, and destination parameters, redirects valid same-origin paths, falls back to / for invalid input, and adds focused tests.

Changes

Desktop handoff routing

Layer / File(s)	Summary
Handoff validation and tests apps/web/helpers/desktop-handoff.helper.ts, apps/web/helpers/desktop-handoff.helper.spec.mjs, apps/web/package.json	Adds Base64URL decoding, version and origin checks, destination normalization, rejection handling, and a Node test script.
Open route redirect wiring apps/web/app/routes/core.ts, apps/web/app/routes/redirects/core/desktop-handoff.tsx	Maps /open to the desktop handoff route. The route redirects valid destinations and uses / for invalid input.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: sriramveeraghanta

Sequence Diagram(s)

sequenceDiagram
  participant DesktopClient
  participant OpenRoute
  participant resolveDesktopHandoffRedirect
  participant PlaneInstance
  DesktopClient->>OpenRoute: Navigate to /open?v=1&o=...&p=...
  OpenRoute->>resolveDesktopHandoffRedirect: Validate and decode parameters
  resolveDesktopHandoffRedirect-->>OpenRoute: Destination path or null
  alt Valid handoff
    OpenRoute->>PlaneInstance: Redirect to decoded destination
  else Invalid handoff
    OpenRoute->>PlaneInstance: Redirect to /
  end

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The implementation satisfies issue #9535 by supporting v1 handoffs, validating same-origin data, and rejecting invalid, cross-instance, and cross-origin payloads.
Out of Scope Changes check	✅ Passed	All changes support the desktop OAuth fallback, including routing, validation, regression tests, and the test script.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly identifies the desktop OAuth handoff fallback, which is the primary change in the pull request.
Description check	✅ Passed	The description explains the problem, implementation, scope, references, test plan, and test scenarios in sufficient detail.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}