docs(deeplink): record why the mail link keeps its portal hop - #156
Merged
Conversation
The `attenuated` doc comment stated the stronger form of a `verified` link as settled fact — "once the mail link opens the app directly the app receives the raw token instead". That change is not being made, so the sentence would have been false in the file that defines trust. Enterprise rewriters (SafeLinks, Defender ATP) re-encode a mailed link onto their own host, so the tap resolves there: no App Link fires and the app never sees the link. Whether a fragment survives is undocumented. Against that, mailing the raw token buys one browser flash, because the portal already deep-links the app on success. The classification is unaffected — `attenuated` reasons about the strongest form the link could carry, not the form it carries today. Also replaces two `isSilentIntent(...) === false` assertions that could not fail: the guard returns false for every intent while the class has no members. One typecheck-gated assertion that `SilentIntent` is `never` takes their place, verified to fail when a route joins `silent`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes out Part 2B of #144 in code. No behaviour change.
Why
The
attenuateddoc comment stated the stronger form of averifiedlink as settled fact — "once the mail link opens the app directly the app receives the raw token instead." That change is not being made, so the sentence would have been false in the file that defines trust.Enterprise mail rewriters (Outlook SafeLinks, Defender ATP) re-encode a mailed link onto their own logging host, so the tap resolves against that host: no App Link fires, the mail client's in-app browser follows the redirect, and the app never sees the link. Whether a fragment survives that round trip is undocumented, and the shape is on record as breaking — FusionAuth #629, "Magic links don't work when Outlook 'safe links' are enabled". Against an unmeasurable carrier risk on a path that gates custom-handle claiming and account recovery, mailing the raw token buys one browser flash: the portal already deep-links the app the moment it succeeds.
The classification is unaffected.
attenuatedreasons about the strongest form averifiedlink could carry, not the form it carries today. The full argument is in the #144 comment.Also
Two assertions in
deepLinkUrl.test.tscould not fail:isSilentIntentreturns false for every intent while the class has no members, soexpect(...).toBe(false)was vacuous in both places. One typecheck-gated assertion thatSilentIntentisneverreplaces them — a real tripwire for the day a route joinssilent, since no runtime assertion can pin an empty class.Verification
node ./node_modules/typescript/bin/tsc --noEmit -p tsconfig.json— exit 0, empty output.CI=true npx vitest run— 480 files, 3721 tests, all passing, exit 0.notification: "silent"produceddeepLinkUrl.test.ts(90,9): error TS2322: Type 'true' is not assignable to type 'false', then reverted.