stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Preserve shared screenshots through operator sign-in #741

New Issue
Closed
opened 2026-08-13 13:22:15 +00:00 by timmy · 0 comments
timmy commented 2026-08-13 13:22:15 +00:00
Owner
Copy Link

User impact

When an installed mobile app shares a screenshot while its operator session has expired, the server currently drops shared=image and the login client rejects launch=new. After successful sign-in the capture sheet does not reopen, and the staged private screenshot remains stranded.

Scope

Preserve only the bounded launch=new&shared=image continuation through token and passkey sign-in. Reject arbitrary marker values, duplicates, malformed pairs, extra fields, cross-origin continuations, and oversized share text.

Acceptance tests

  • An unauthenticated root request with launch=new&shared=image plus valid share fields redirects to login with the complete bounded continuation.
  • Token and passkey sign-in return to that continuation.
  • Invalid marker combinations, duplicates, unknown fields, fragments, and oversized values fall back safely to .//login.
  • Existing text-only share continuations remain supported.
  • Full test suite and Gitea Actions pass.
## User impact When an installed mobile app shares a screenshot while its operator session has expired, the server currently drops `shared=image` and the login client rejects `launch=new`. After successful sign-in the capture sheet does not reopen, and the staged private screenshot remains stranded. ## Scope Preserve only the bounded `launch=new&shared=image` continuation through token and passkey sign-in. Reject arbitrary marker values, duplicates, malformed pairs, extra fields, cross-origin continuations, and oversized share text. ## Acceptance tests - An unauthenticated root request with `launch=new&shared=image` plus valid share fields redirects to login with the complete bounded continuation. - Token and passkey sign-in return to that continuation. - Invalid marker combinations, duplicates, unknown fields, fragments, and oversized values fall back safely to `./`/login. - Existing text-only share continuations remain supported. - Full test suite and Gitea Actions pass.
timmy self-assigned this 2026-08-13 13:22:15 +00:00
timmy closed this issue 2026-08-13 13:27:40 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#741
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?