Juan Castro 438a4584de fix(hosting): keep alternate-host bootstrap stubs from shadowing private apps ...

A public origin-bootstrap app row planted on an alternate hosting domain
could resolve ahead of the owner's private app and skip the private
access gate (PUT-1883).

- get-user-app-token canonicalizes hosted-subdomain origins before uid
  derivation and bootstrap, so every hosting variant shares one app row
- the app create/update conflict check crosses hosting-domain variants,
  so an existing alt-host stub is absorbed by the owner's create
- resolveOwnedAppForHostedSite and the canonical-uid lookup order
  matches private-first with a deterministic id tiebreak

2026-09-23 16:39:22 -04:00

..

AuthController.test.ts

fix(hosting): keep alternate-host bootstrap stubs from shadowing private apps

2026-09-23 16:39:22 -04:00

AuthController.ts

fix(hosting): keep alternate-host bootstrap stubs from shadowing private apps

2026-09-23 16:39:22 -04:00

authOriginGating.test.ts

tests: big test push for better coverage (#3490)

2026-08-01 14:29:59 -07:00