fix(dev): accept prod-minted sessions and keep logout on localhost

[davidsu]

Note

Description

Fixes two auth gaps in the base44 dev local server that left cli-created apps stuck in a broken login loop. First, a token minted by production (e.g. after a Google OAuth round-trip) was rejected locally because resolveCurrentUser only knew about users created through local OTP signup, so User/me returned 404 and the app stayed logged out despite holding a valid token. Second, the SDK’s logout() navigates to /api/apps/auth/logout?from_url=<app>, which the dev server bounced to production — prod rejects foreign from_url targets and redirects to its own host, stranding the browser on base44.com.

Related Issue

None

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Other (please describe):

Changes Made

• routes/entities/current-user.ts — when a valid token carries a subject with no local user record, create one on first sight (via a new createLocalUser helper) instead of returning not_found. The inserted document mirrors the shape written by the OTP registration path (id, email, full_name, is_service, is_verified, disabled, role, collaborator_role, timestamps), so subsequent requests resolve the same stable user.
• main.ts — handle GET /api/apps/auth/logout locally, registered before the existing /api/apps/auth/* redirect carve-out. A new isLocalRedirectTarget() guard only honours from_url values on http(s)://localhost or 127.0.0.1; anything else falls through to a plain Logged out response rather than becoming an open redirect.
• utils.ts — extract deriveFullNameFromEmail() and reuse it from both auth-router.ts (OTP registration) and the new local-user creation path, removing the duplicated regex.
• tests/cli/dev-auth.spec.ts — hoist serverUrl to suite scope and add three cases: a prod-minted token yields a working session with a stable id across calls, logout 302s back to a localhost from_url, and a foreign origin is not used as a redirect target.
• CHANGELOG.md — two entries under Fixed describing both behaviours.

Testing

• I have tested these changes locally
• I have added/updated tests as needed
• All tests pass (npm test)

Checklist

• My code follows the project’s style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (if applicable)
• My changes generate no new warnings
• I have updated docs/ (AGENTS.md) if I made architectural changes

Additional Notes

The logout route is intentionally answered locally rather than loosening production’s from_url sanitisation, which is a shared security control — local sessions are client-side JWTs the SDK has already cleared, so there is no server-side session to tear down. Note that resolveCurrentUser decodes rather than verifies the JWT, so the create-on-first-sight path trusts any well-formed token subject; that is consistent with the existing dev-server behaviour and acceptable for a localhost-only development server, but it means the dev user store can accumulate records for arbitrary subjects.

---

_{🤖 Generated by Claude | 2026-07-28 13:50 UTC | 8e3e3da}

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.1.6-pr.579.8e3e3da

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.1.6-pr.579.8e3e3da"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.1.6-pr.579.8e3e3da"
  }
}

• 📦 Preview Package: @base44-preview/cli@0.1.6-pr.579.8e3e3da
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}