Login logout flow

[kentcdodds]

Implement session-aware homepage navigation, enforce authentication redirects for account/login/signup pages, and add a functional logout feature.

---

 

---

Note

Medium Risk
Touches authentication/session cookie handling and redirect behavior; mistakes could cause open redirects, broken login routing, or sessions not clearing correctly.

Overview
Adds session-aware auth flow across client and worker. The client App now fetches /session to render nav links as either Login/Signup or the signed-in email linking to /account, and the login form honors a safe redirectTo query param after successful auth.

On the server, introduces /login and /signup handlers that redirect authenticated users to /account, adds a /session JSON endpoint, and adds a POST /logout that clears the auth cookie. Unauthenticated /account requests now redirect to /login with a validated redirectTo back to the originally requested path, and Playwright E2E coverage is added for redirect + logout behavior.

^{Written by Cursor Bugbot for commit 0e30adf. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[kentcdodds]

@cursoragent I think this got removed because you did not cp .env.example to .env. That should be in the instructions and you should do that when creating a new environment before starting any work. Could you please update the instructions to do this? Don't update any scripts. Just make sure the instructions are clear that this needs to be done upon setup of the environment.

[cursor]

Summary

• Clarified agent setup to copy .env.example to .env before dev/tests.【F:AGENTS.md†L10-L18】
• Strengthened local dev instructions to copy .env.example before starting work.【F:docs/agents/setup.md†L14-L22】

Testing

• ⚠️ Not run (documentation-only change).

 

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: Open redirect vulnerability via protocol-relative URLs
  • Added explicit rejection of protocol-relative redirect targets so only single-slash relative paths are accepted.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issue.}

[cursor]

COOKIE_SECRET removed from worker environment types

High Severity

The COOKIE_SECRET binding was accidentally removed from Cloudflare.Env and the NodeJS.ProcessEnv extension was also removed. The codebase relies on COOKIE_SECRET in server/handler.ts via appEnv.COOKIE_SECRET, and the Zod schema in types/env-schema.ts still validates its presence. This breaks TypeScript type safety — code accessing the cookie secret will now have type errors or lose type checking. As noted in the PR discussion, this happened because .env.example wasn't copied to .env before running wrangler types.

 

[kentcdodds]

@cursor, great job, now do this and undo your changes to the worker-configuration.d.ts file.

[cursor]

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

• ✅ Fixed: COOKIE_SECRET removed from worker environment types
  • Regenerated the Wrangler types with COOKIE_SECRET present, restoring the Cloudflare.Env and NodeJS.ProcessEnv declarations.