PAB-36: support auth on Vercel previews

[pablopunk]

Summary

This PR adds authentication support for Vercel preview deployments, which previously couldn't complete OAuth sign-in because the WorkOS redirect URI is fixed to the production callback (https://nvm.fyi/api/auth/callback).

How it works

The implementation introduces a secure, short-lived handoff mechanism between the production callback and preview deployments:

1. Sign-in detection (signin.ts): When a sign-in request originates from a recognized Vercel preview hostname (matching the project's deployment pattern), the OAuth state parameter is replaced with a signed, one-time preview state token (stored in Upstash Redis with a 60-second TTL) that encodes the preview origin and return path.

2. Production callback (callback.ts): After WorkOS authentication completes, if the state decodes as a preview state, the callback does not set a session cookie on the production domain. Instead, it creates an encrypted session grant (a short-lived encrypted JWT containing the sealed session) and redirects the user to the preview deployment's /api/auth/preview-exchange endpoint.

3. Preview exchange (preview-exchange.ts): A new endpoint on the preview deployment that validates the grant is intended for its own origin, then sets the session cookie directly on the preview hostname and redirects to the return path.

Security measures

• Preview auth is restricted to the project's own Vercel deployment hostname pattern; foreign deployments are rejected.
• Both the preview state and session grant expire after 60 seconds.
• The preview state is single-use (consumed via Redis getdel).
• The session grant is bound to a specific origin and validated on exchange.
• Preview auth fails closed (returns 503) when Redis is unavailable.
• The production callback does not set a production session cookie for preview logins.

Other changes

• preview-auth.ts: New library implementing preview state encoding/decoding and session grant creation/consumption using jose for JWT signing/encryption and Upstash Redis for state storage.
• preview-auth.test.ts: Unit tests covering preview domain validation, grant round-tripping, malformed state rejection, and foreign deployment rejection.
• README.md: Documents the preview auth flow, security model, and deployment guidance (scoping secrets to trusted preview branches, keeping fork protection enabled).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nvm	Ready	Preview, Comment	Jul 12, 2026 3:52pm

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	❌
Security	✅
Business Logic	❌

Access your configuration settings here.

​