Skip to content

fix: settings nav org-awareness and proxy cookie validation - #316

Merged
guyb1 merged 1 commit into
mainfrom
fix/settings-nav-and-cookie-validation
May 26, 2026
Merged

fix: settings nav org-awareness and proxy cookie validation#316
guyb1 merged 1 commit into
mainfrom
fix/settings-nav-and-cookie-validation

Conversation

@guyb1

@guyb1 guyb1 commented May 26, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Settings nav components now use getSettingsSections(orgId) instead of static settingsSections import, enabling org-scoped URLs when an org ID is present in the pathname
  • Dashboard layout isSettings check expanded to also match /org/*/settings paths
  • Proxy middleware no longer sets default-org cookie from URL (prevents cookie poisoning from invalid org URLs — cookie is now set by validated client component)
  • nav-config.ts exports getSettingsSections() function alongside backward-compatible settingsSections static array

Changed files (6)

  • layout.tsx — isSettings regex for org settings paths
  • settings-nav.tsx / settings-mobile-nav.tsx — dynamic sections from getSettingsSections(orgId)
  • nav-config.tsgetSettingsSections(orgId?) function export
  • proxy.ts — removed cookie setting from middleware
  • not-found.tsx — minor update

- Settings nav and mobile nav now derive sections dynamically via
  getSettingsSections(orgId) instead of static import, enabling
  org-scoped settings URLs when orgId is present in the pathname
- Dashboard layout isSettings check expanded to match /org/*/settings paths
- Proxy middleware no longer sets default-org cookie (moved to validated
  client component to prevent cookie poisoning from invalid org URLs)
- nav-config exports getSettingsSections function alongside static array
@guyb1
guyb1 merged commit ed1e9a9 into main May 26, 2026
3 checks passed
@guyb1
guyb1 deleted the fix/settings-nav-and-cookie-validation branch May 26, 2026 14:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant