Add explicit workspace auth handoff

LEANDERANTONY · LEANDERANTONY · commit de42f8b140ea · 2026-04-27T21:27:45.000+05:30
diff --git a/backend/auth_models.py b/backend/auth_models.py
@@ -23,3 +23,25 @@ class GoogleSignInExchangeRequestModel(BaseModel):
     @classmethod
     def _strip_text(cls, value):
         return str(value or "").strip()
+
+
+class WorkspaceHandoffStartRequestModel(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    target_url: str = Field(default="", max_length=500)
+
+    @field_validator("target_url", mode="before")
+    @classmethod
+    def _strip_target_url(cls, value):
+        return str(value or "").strip()
+
+
+class WorkspaceHandoffExchangeRequestModel(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    handoff_token: str = Field(min_length=1, max_length=200)
+
+    @field_validator("handoff_token", mode="before")
+    @classmethod
+    def _strip_handoff_token(cls, value):
+        return str(value or "").strip()
diff --git a/backend/routers/auth.py b/backend/routers/auth.py
@@ -3,12 +3,18 @@
 from backend.auth_models import (
     GoogleSignInExchangeRequestModel,
     GoogleSignInStartRequestModel,
+    WorkspaceHandoffExchangeRequestModel,
+    WorkspaceHandoffStartRequestModel,
 )
 from backend.request_auth import get_optional_auth_tokens
 from backend.services.auth_cookies import (
     clear_auth_cookies,
     set_auth_cookies,
 )
+from backend.services.auth_handoff_service import (
+    exchange_workspace_handoff,
+    start_workspace_handoff,
+)
 from backend.services.auth_session_service import (
     exchange_google_code,
     restore_authenticated_session,
@@ -95,6 +101,37 @@ def restore_session_route(
         _raise_http_error(error)
 
 
+@router.post("/workspace-handoff/start")
+def start_workspace_handoff_route(
+    payload: WorkspaceHandoffStartRequestModel,
+    auth_tokens=Depends(get_optional_auth_tokens),
+):
+    access_token, refresh_token = auth_tokens
+    try:
+        return start_workspace_handoff(
+            access_token=access_token or "",
+            refresh_token=refresh_token or "",
+            target_url=payload.target_url,
+        )
+    except AppError as error:
+        _raise_http_error(error)
+
+
+@router.post("/workspace-handoff/exchange")
+def exchange_workspace_handoff_route(
+    payload: WorkspaceHandoffExchangeRequestModel,
+    response: Response,
+):
+    try:
+        result = exchange_workspace_handoff(
+            handoff_token=payload.handoff_token,
+        )
+        _apply_session_cookies(response, result)
+        return _scrub_session_tokens(result)
+    except AppError as error:
+        _raise_http_error(error)
+
+
 @router.post("/session/sign-out")
 def sign_out_route(
     response: Response,
diff --git a/backend/services/auth_handoff_service.py b/backend/services/auth_handoff_service.py
@@ -0,0 +1,105 @@
+from __future__ import annotations
+
+import threading
+import time
+import uuid
+from dataclasses import dataclass, field
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
+
+from src.errors import InputValidationError
+
+from backend.services.auth_session_service import restore_authenticated_session
+
+
+HANDOFF_TTL_SECONDS = 60
+
+
+@dataclass
+class WorkspaceHandoffRecord:
+    access_token: str
+    refresh_token: str
+    created_at: float = field(default_factory=time.time)
+
+
+_HANDOFFS: dict[str, WorkspaceHandoffRecord] = {}
+_LOCK = threading.Lock()
+
+
+def _prune_handoffs() -> None:
+    cutoff = time.time() - HANDOFF_TTL_SECONDS
+    stale_tokens = [
+        token
+        for token, record in _HANDOFFS.items()
+        if record.created_at < cutoff
+    ]
+    for token in stale_tokens:
+        _HANDOFFS.pop(token, None)
+
+
+def _append_handoff_query(target_url: str, handoff_token: str) -> str:
+    url = str(target_url or "").strip()
+    parsed = urlsplit(url)
+    query_items = [
+        (key, value)
+        for key, value in parse_qsl(parsed.query, keep_blank_values=True)
+        if key != "handoff"
+    ]
+    query_items.append(("handoff", handoff_token))
+    return urlunsplit(
+        (
+            parsed.scheme,
+            parsed.netloc,
+            parsed.path,
+            urlencode(query_items),
+            parsed.fragment,
+        )
+    )
+
+
+def start_workspace_handoff(
+    *,
+    access_token: str,
+    refresh_token: str,
+    target_url: str,
+) -> dict:
+    normalized_access = str(access_token or "").strip()
+    normalized_refresh = str(refresh_token or "").strip()
+    normalized_target = str(target_url or "").strip()
+
+    if not normalized_access or not normalized_refresh:
+        raise InputValidationError("Sign in with Google before entering the workspace.")
+    if not normalized_target:
+        raise InputValidationError("A workspace target URL is required.")
+
+    with _LOCK:
+        _prune_handoffs()
+        handoff_token = uuid.uuid4().hex
+        _HANDOFFS[handoff_token] = WorkspaceHandoffRecord(
+            access_token=normalized_access,
+            refresh_token=normalized_refresh,
+        )
+
+    return {
+        "status": "ready",
+        "redirect_url": _append_handoff_query(normalized_target, handoff_token),
+    }
+
+
+def exchange_workspace_handoff(*, handoff_token: str) -> dict:
+    normalized_token = str(handoff_token or "").strip()
+    if not normalized_token:
+        raise InputValidationError("A workspace handoff token is required.")
+
+    with _LOCK:
+        _prune_handoffs()
+        record = _HANDOFFS.pop(normalized_token, None)
+
+    if record is None:
+        raise InputValidationError(
+            "That workspace handoff expired. Open the workspace from the landing page again."
+        )
+
+    return restore_authenticated_session(
+        access_token=record.access_token,
+        refresh_token=record.refresh_token,
+    )
diff --git a/frontend/src/components/landing-page.tsx b/frontend/src/components/landing-page.tsx
@@ -7,6 +7,7 @@ import {
   exchangeGoogleCode,
   restoreAuthSession,
   signOutAuthSession,
+  startWorkspaceHandoff,
   startGoogleSignIn,
 } from "@/lib/api";
 import type { AuthSessionResponse } from "@/lib/api-types";
@@ -147,6 +148,24 @@ export function LandingPage() {
     }
   }
 
+  async function handleEnterWorkspace() {
+    setAuthActionLoading(true);
+    setAuthError(null);
+    try {
+      const response = await startWorkspaceHandoff(
+        "https://app.job-application-copilot.xyz",
+      );
+      window.location.href = response.redirect_url;
+    } catch (error) {
+      setAuthError(
+        error instanceof Error
+          ? error.message
+          : "Workspace handoff failed unexpectedly.",
+      );
+      setAuthActionLoading(false);
+    }
+  }
+
   const isSignedIn = authStatus === "signed_in";
   const signedInLabel =
     authSession?.app_user.display_name ||
@@ -207,9 +226,14 @@ export function LandingPage() {
 
           <div className="hero-actions">
             {isSignedIn ? (
-              <Link href="https://app.job-application-copilot.xyz" className="primary-button">
-                Enter workspace
-              </Link>
+              <button
+                className="primary-button"
+                disabled={authActionLoading}
+                onClick={() => void handleEnterWorkspace()}
+                type="button"
+              >
+                {authActionLoading ? "Opening workspace..." : "Enter workspace"}
+              </button>
             ) : (
               <button
                 className="primary-button"
diff --git a/frontend/src/hooks/useWorkspaceSession.ts b/frontend/src/hooks/useWorkspaceSession.ts
@@ -26,6 +26,7 @@ import {
 } from "react";
 
 import {
+  exchangeWorkspaceHandoff,
   exchangeGoogleCode,
   loadSavedWorkspace,
   restoreAuthSession,
@@ -132,6 +133,7 @@ export function useWorkspaceSession({
       clearLegacyAuthTokens();
 
       const params = new URLSearchParams(window.location.search);
+      const handoffToken = params.get("handoff");
       const authCode = params.get("code");
       const authFlow = params.get("auth_flow") ?? "";
       const authErrorDescription =
@@ -147,6 +149,39 @@ export function useWorkspaceSession({
         return;
       }
 
+      if (handoffToken) {
+        setAuthStatus("restoring");
+        setAuthError(null);
+        try {
+          const response = await exchangeWorkspaceHandoff(handoffToken);
+          if (!cancelled) {
+            setAuthSession(response);
+            setAuthStatus("signed_in");
+            setNotice({
+              level: "success",
+              message: `Signed in as ${
+                response.app_user.display_name ||
+                response.app_user.email ||
+                "your account"
+              }.`,
+            });
+          }
+        } catch (error) {
+          if (!cancelled) {
+            setAuthSession(null);
+            setAuthStatus("signed_out");
+            setAuthError(
+              error instanceof Error
+                ? error.message
+                : "Workspace handoff failed unexpectedly.",
+            );
+          }
+        } finally {
+          clearAuthQueryParams();
+        }
+        return;
+      }
+
       if (authCode) {
         setAuthStatus("restoring");
         setAuthError(null);
diff --git a/frontend/src/lib/api-types.ts b/frontend/src/lib/api-types.ts
@@ -521,6 +521,11 @@ export type GoogleSignInStartResponse = {
   redirect_url: string;
 };
 
+export type WorkspaceHandoffStartResponse = {
+  status: string;
+  redirect_url: string;
+};
+
 export type SavedWorkspaceMeta = {
   job_title: string;
   expires_at: string;
diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
@@ -23,6 +23,7 @@ import type {
   WorkspaceArtifactExportResponse,
   WorkspaceArtifactPreviewRequest,
   WorkspaceArtifactPreviewResponse,
+  WorkspaceHandoffStartResponse,
   AssistantStreamEvent,
   WorkspaceAssistantRequest,
   WorkspaceAssistantResponse,
@@ -176,6 +177,26 @@ export async function signOutAuthSession() {
   });
 }
 
+export async function startWorkspaceHandoff(targetUrl: string) {
+  return request<WorkspaceHandoffStartResponse>("/auth/workspace-handoff/start", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ target_url: targetUrl }),
+  });
+}
+
+export async function exchangeWorkspaceHandoff(handoffToken: string) {
+  return request<AuthSessionResponse>("/auth/workspace-handoff/exchange", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ handoff_token: handoffToken }),
+  });
+}
+
 export async function uploadResumeFile(file: File) {
   const payload = await fileToUploadPayload(file);
   return request<WorkspaceResumeUploadResponse>("/workspace/resume/upload", {
diff --git a/frontend/src/lib/auth-session.ts b/frontend/src/lib/auth-session.ts
@@ -33,6 +33,7 @@ export function clearAuthQueryParams() {
   url.searchParams.delete("auth_flow");
   url.searchParams.delete("error");
   url.searchParams.delete("error_description");
+  url.searchParams.delete("handoff");
   window.history.replaceState({}, document.title, url.toString());
 }
 
diff --git a/tests/test_backend_auth.py b/tests/test_backend_auth.py

Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,7 @@ export function clearAuthQueryParams() {`
`33`	`33`	`url.searchParams.delete("auth_flow");`
`34`	`34`	`url.searchParams.delete("error");`
`35`	`35`	`url.searchParams.delete("error_description");`
	`36`	`+ url.searchParams.delete("handoff");`
`36`	`37`	`window.history.replaceState({}, document.title, url.toString());`
`37`	`38`	`}`
`38`	`39`