From 74672dce752ed4df8ece7653242d9f191345bf5e Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:05:39 +0200
Subject: [PATCH 01/49] feat(apps-proxy): add kai-preview config keys

Add KaiPreview struct with HandshakeSigningKey, SessionSigningKey,
SessionTTL (default 4h), and AllowedIDEOrigins fields. Wire it into
Config and add tests for defaults and required-field validation.
---
 .../pkg/service/appsproxy/config/config.go    | 12 ++++++++
 .../service/appsproxy/config/config_test.go   | 29 +++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/config/config_test.go

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index 198345343a..d92f366f7d 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -24,10 +24,19 @@ type Config struct {
 	Upstream         Upstream          `configKey:"-" configUsage:"Configuration options for upstream"`
 	SandboxesAPI     SandboxesAPI      `configKey:"sandboxesAPI"`
 	CsrfTokenSalt    string            `configKey:"csrfTokenSalt" configUsage:"Salt used for generating CSRF tokens" validate:"required" sensitive:"true"`
+	KaiPreview       KaiPreview        `configKey:"kaiPreview"`
 	K8s              K8s               `configKey:"k8s" configUsage:"Kubernetes configuration."`
 	E2bWebhook       E2BWebhook        `configKey:"e2bWebhook"`
 }
 
+// KaiPreview configures the stateless iframe-auth path for the kai-preview flow.
+type KaiPreview struct {
+	HandshakeSigningKey string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
+	SessionSigningKey   string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
+	SessionTTL          time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)."`
+	AllowedIDEOrigins   []string      `configKey:"allowedIdeOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,url"`
+}
+
 type API struct {
 	Listen    string   `configKey:"listen" configUsage:"Listen address of the configuration HTTP API." validate:"required,hostname_port"`
 	PublicURL *url.URL `configKey:"publicUrl" configUsage:"Public URL of the configuration HTTP API for link generation." validate:"required"`
@@ -74,6 +83,9 @@ func New() Config {
 				Host:   "localhost:8000",
 			},
 		},
+		KaiPreview: KaiPreview{
+			SessionTTL: 4 * time.Hour,
+		},
 	}
 }
 
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
new file mode 100644
index 0000000000..2f949631e4
--- /dev/null
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -0,0 +1,29 @@
+package config_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/common/configmap"
+)
+
+func TestKaiPreviewConfig_Defaults(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	assert.Equal(t, 4*time.Hour, cfg.KaiPreview.SessionTTL)
+}
+
+func TestKaiPreviewConfig_RequiresSigningKeys(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	cfg.CookieSecretSalt = "x"
+	cfg.CsrfTokenSalt = "x"
+	// KaiPreview signing keys intentionally empty
+	err := configmap.ValidateAndNormalize(&cfg)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "kaiPreview.handshakeSigningKey")
+}

From e5298b4c58ae950e62b35bab2a3b9100d3bd32a7 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:13:25 +0200
Subject: [PATCH 02/49] fix(apps-proxy): tighten kai-preview config validation

---
 internal/pkg/service/appsproxy/config/config.go      | 4 ++--
 internal/pkg/service/appsproxy/config/config_test.go | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index d92f366f7d..e557060fa8 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -24,7 +24,7 @@ type Config struct {
 	Upstream         Upstream          `configKey:"-" configUsage:"Configuration options for upstream"`
 	SandboxesAPI     SandboxesAPI      `configKey:"sandboxesAPI"`
 	CsrfTokenSalt    string            `configKey:"csrfTokenSalt" configUsage:"Salt used for generating CSRF tokens" validate:"required" sensitive:"true"`
-	KaiPreview       KaiPreview        `configKey:"kaiPreview"`
+	KaiPreview       KaiPreview        `configKey:"kaiPreview" configUsage:"kai-preview iframe-auth configuration."`
 	K8s              K8s               `configKey:"k8s" configUsage:"Kubernetes configuration."`
 	E2bWebhook       E2BWebhook        `configKey:"e2bWebhook"`
 }
@@ -34,7 +34,7 @@ type KaiPreview struct {
 	HandshakeSigningKey string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
 	SessionSigningKey   string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
 	SessionTTL          time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)."`
-	AllowedIDEOrigins   []string      `configKey:"allowedIdeOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,url"`
+	AllowedIDEOrigins   []string      `configKey:"allowedIdeOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
 }
 
 type API struct {
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
index 2f949631e4..6baaaa1687 100644
--- a/internal/pkg/service/appsproxy/config/config_test.go
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -26,4 +26,5 @@ func TestKaiPreviewConfig_RequiresSigningKeys(t *testing.T) {
 	err := configmap.ValidateAndNormalize(&cfg)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "kaiPreview.handshakeSigningKey")
+	assert.Contains(t, err.Error(), "kaiPreview.sessionSigningKey")
 }

From f3ea3e38ede07b2f81b08f868791897cf615eafd Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:18:13 +0200
Subject: [PATCH 03/49] feat(apps-proxy): kai-preview JWT mint/verify helpers

---
 go.mod                                        |   2 +-
 .../apphandler/authproxy/kaipreview/jwt.go    | 130 ++++++++++++++++++
 .../authproxy/kaipreview/jwt_test.go          | 101 ++++++++++++++
 3 files changed, 232 insertions(+), 1 deletion(-)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go

diff --git a/go.mod b/go.mod
index e019d44be1..8656864592 100644
--- a/go.mod
+++ b/go.mod
@@ -302,7 +302,7 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/gohugoio/hashstructure v0.6.0 // indirect
 	github.com/gohugoio/hugo v0.147.6 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
new file mode 100644
index 0000000000..8d3bf424c5
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -0,0 +1,130 @@
+// Package kaipreview implements the kai-preview iframe-auth path: a stateless
+// JWT handshake (mint → bootstrap → exchange) that yields a host-only session
+// cookie for embedding dev-mode data apps inside the kbc-ui SPA.
+package kaipreview
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+const (
+	purposeHandshake = "kai-preview-embed"
+	purposeSession   = "kai-preview-session"
+	handshakeTTL     = 60 * time.Second
+)
+
+// HandshakeClaims carries the authorization scope from mint to exchange.
+type HandshakeClaims struct {
+	AppID     string `json:"app_id"`
+	ProjectID string `json:"project"`
+	Purpose   string `json:"purpose"`
+	JTI       string `json:"jti"`
+	jwt.RegisteredClaims
+}
+
+// SessionClaims carries the authorization scope inside the session cookie.
+type SessionClaims struct {
+	AppID     string `json:"app_id"`
+	ProjectID string `json:"project"`
+	Purpose   string `json:"purpose"`
+	TTL       int64  `json:"ttl_s"` // total intended lifetime in seconds (for halfway-refresh detection)
+	jwt.RegisteredClaims
+}
+
+// NeedsRefresh returns true when the cookie has passed the midpoint of its TTL.
+func (c SessionClaims) NeedsRefresh(now time.Time) bool {
+	if c.IssuedAt == nil {
+		return true
+	}
+	elapsed := now.Sub(c.IssuedAt.Time)
+	return elapsed*2 > time.Duration(c.TTL)*time.Second
+}
+
+func MintHandshakeJWT(key string, clock clockwork.Clock, appID, projectID string) (string, error) {
+	now := clock.Now()
+	jti, err := randomHex(16)
+	if err != nil {
+		return "", errors.Errorf("kai-preview: generate jti: %w", err)
+	}
+	claims := HandshakeClaims{
+		AppID:     appID,
+		ProjectID: projectID,
+		Purpose:   purposeHandshake,
+		JTI:       jti,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(handshakeTTL)),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(key))
+	if err != nil {
+		return "", errors.Errorf("kai-preview: sign handshake JWT: %w", err)
+	}
+	return signed, nil
+}
+
+func VerifyHandshakeJWT(key string, clock clockwork.Clock, raw string) (*HandshakeClaims, error) {
+	claims := &HandshakeClaims{}
+	parser := jwt.NewParser(jwt.WithTimeFunc(clock.Now), jwt.WithValidMethods([]string{"HS256"}))
+	_, err := parser.ParseWithClaims(raw, claims, func(t *jwt.Token) (any, error) {
+		return []byte(key), nil
+	})
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: verify handshake JWT: %w", err)
+	}
+	if claims.Purpose != purposeHandshake {
+		return nil, errors.Errorf("kai-preview: handshake JWT has wrong purpose: %q", claims.Purpose)
+	}
+	return claims, nil
+}
+
+func MintSessionJWT(key string, clock clockwork.Clock, appID, projectID string, ttl time.Duration) (string, error) {
+	now := clock.Now()
+	claims := SessionClaims{
+		AppID:     appID,
+		ProjectID: projectID,
+		Purpose:   purposeSession,
+		TTL:       int64(ttl.Seconds()),
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(ttl)),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(key))
+	if err != nil {
+		return "", errors.Errorf("kai-preview: sign session JWT: %w", err)
+	}
+	return signed, nil
+}
+
+func VerifySessionJWT(key string, clock clockwork.Clock, raw string) (*SessionClaims, error) {
+	claims := &SessionClaims{}
+	parser := jwt.NewParser(jwt.WithTimeFunc(clock.Now), jwt.WithValidMethods([]string{"HS256"}))
+	_, err := parser.ParseWithClaims(raw, claims, func(t *jwt.Token) (any, error) {
+		return []byte(key), nil
+	})
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: verify session JWT: %w", err)
+	}
+	if claims.Purpose != purposeSession {
+		return nil, errors.Errorf("kai-preview: session JWT has wrong purpose: %q", claims.Purpose)
+	}
+	return claims, nil
+}
+
+func randomHex(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
new file mode 100644
index 0000000000..a75ad6e820
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
@@ -0,0 +1,101 @@
+package kaipreview
+
+import (
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testHandshakeKey = "test-handshake-key-must-be-long-enough"
+	testSessionKey   = "test-session-key-also-long-enough"
+)
+
+func TestHandshakeJWT_RoundTrip(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintHandshakeJWT(testHandshakeKey, clock, "app-123", "proj-456")
+	require.NoError(t, err)
+	require.NotEmpty(t, token)
+
+	claims, err := VerifyHandshakeJWT(testHandshakeKey, clock, token)
+	require.NoError(t, err)
+	assert.Equal(t, "app-123", claims.AppID)
+	assert.Equal(t, "proj-456", claims.ProjectID)
+	assert.Equal(t, "kai-preview-embed", claims.Purpose)
+	assert.NotEmpty(t, claims.JTI)
+}
+
+func TestHandshakeJWT_ExpiredAfter60s(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintHandshakeJWT(testHandshakeKey, clock, "app-123", "proj-456")
+	require.NoError(t, err)
+
+	clock.Advance(61 * time.Second)
+
+	_, err = VerifyHandshakeJWT(testHandshakeKey, clock, token)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "expired")
+}
+
+func TestHandshakeJWT_WrongKeyRejected(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintHandshakeJWT(testHandshakeKey, clock, "app-123", "proj-456")
+	require.NoError(t, err)
+
+	_, err = VerifyHandshakeJWT("different-key-different-length", clock, token)
+	require.Error(t, err)
+}
+
+func TestSessionJWT_RoundTrip(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	claims, err := VerifySessionJWT(testSessionKey, clock, token)
+	require.NoError(t, err)
+	assert.Equal(t, "app-123", claims.AppID)
+	assert.Equal(t, "proj-456", claims.ProjectID)
+	assert.Equal(t, "kai-preview-session", claims.Purpose)
+}
+
+func TestSessionJWT_ExpiredAfterTTL(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	clock.Advance(4*time.Hour + time.Second)
+
+	_, err = VerifySessionJWT(testSessionKey, clock, token)
+	require.Error(t, err)
+}
+
+func TestSessionJWT_HalfwayDetection(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	clock.Advance(1 * time.Hour) // < 50% — should not need refresh
+	claims, err := VerifySessionJWT(testSessionKey, clock, token)
+	require.NoError(t, err)
+	assert.False(t, claims.NeedsRefresh(clock.Now()))
+
+	clock.Advance(2 * time.Hour) // total 3h, > 50% of 4h
+	claims, err = VerifySessionJWT(testSessionKey, clock, token)
+	require.NoError(t, err)
+	assert.True(t, claims.NeedsRefresh(clock.Now()))
+}

From 9ec1387900903626d77157ff974b90b4ccadc94b Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:27:40 +0200
Subject: [PATCH 04/49] fix(apps-proxy): use RegisteredClaims.ID for
 kai-preview JWT jti

---
 go.mod                                                         | 2 +-
 .../appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go     | 3 +--
 .../proxy/apphandler/authproxy/kaipreview/jwt_test.go          | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/go.mod b/go.mod
index 8656864592..4323a0bf3b 100644
--- a/go.mod
+++ b/go.mod
@@ -30,6 +30,7 @@ require (
 	github.com/go-playground/universal-translator v0.18.1
 	github.com/go-playground/validator/v10 v10.30.2
 	github.com/go-resty/resty/v2 v2.17.2
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/gofrs/flock v0.13.0
 	github.com/gofrs/uuid/v5 v5.4.0
 	github.com/google/go-cmp v0.7.0
@@ -302,7 +303,6 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/gohugoio/hashstructure v0.6.0 // indirect
 	github.com/gohugoio/hugo v0.147.6 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
index 8d3bf424c5..f9c9f8e977 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -25,7 +25,6 @@ type HandshakeClaims struct {
 	AppID     string `json:"app_id"`
 	ProjectID string `json:"project"`
 	Purpose   string `json:"purpose"`
-	JTI       string `json:"jti"`
 	jwt.RegisteredClaims
 }
 
@@ -57,8 +56,8 @@ func MintHandshakeJWT(key string, clock clockwork.Clock, appID, projectID string
 		AppID:     appID,
 		ProjectID: projectID,
 		Purpose:   purposeHandshake,
-		JTI:       jti,
 		RegisteredClaims: jwt.RegisteredClaims{
+			ID:        jti,
 			IssuedAt:  jwt.NewNumericDate(now),
 			ExpiresAt: jwt.NewNumericDate(now.Add(handshakeTTL)),
 		},
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
index a75ad6e820..e80ff9d16f 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
@@ -27,7 +27,7 @@ func TestHandshakeJWT_RoundTrip(t *testing.T) {
 	assert.Equal(t, "app-123", claims.AppID)
 	assert.Equal(t, "proj-456", claims.ProjectID)
 	assert.Equal(t, "kai-preview-embed", claims.Purpose)
-	assert.NotEmpty(t, claims.JTI)
+	assert.NotEmpty(t, claims.ID)
 }
 
 func TestHandshakeJWT_ExpiredAfter60s(t *testing.T) {

From ef39afa720cf4daad65a18fdf96158a2b64aa7ff Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:30:29 +0200
Subject: [PATCH 05/49] feat(apps-proxy): kai-preview STA token verifier

---
 .../authproxy/kaipreview/sta_verifier.go      | 61 +++++++++++++++++++
 .../authproxy/kaipreview/sta_verifier_test.go | 51 ++++++++++++++++
 2 files changed, 112 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go
new file mode 100644
index 0000000000..f8e4d92843
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go
@@ -0,0 +1,61 @@
+package kaipreview
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+// STAVerifyResult is the subset of Storage API's tokens/verify response that the
+// kai-preview flow consumes. We deliberately ignore email, name, roles — see
+// docs/superpowers/specs/2026-05-14-dev-iframe-auth-design.md "no identity in
+// transit".
+type STAVerifyResult struct {
+	ProjectID string
+}
+
+type STAVerifier struct {
+	baseURL string
+	client  *http.Client
+}
+
+func NewSTAVerifier(baseURL string, client *http.Client) *STAVerifier {
+	return &STAVerifier{baseURL: baseURL, client: client}
+}
+
+func (v *STAVerifier) Verify(ctx context.Context, token string) (*STAVerifyResult, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, v.baseURL+"/v2/storage/tokens/verify", nil)
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: build STA verify request: %w", err)
+	}
+	req.Header.Set("X-StorageApi-Token", token)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := v.client.Do(req)
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: STA verify call: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		return nil, errors.New("kai-preview: STA token unauthorized")
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.Errorf("kai-preview: STA verify returned %d", resp.StatusCode)
+	}
+
+	var body struct {
+		Owner struct {
+			ID string `json:"id"`
+		} `json:"owner"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return nil, errors.Errorf("kai-preview: decode STA verify response: %w", err)
+	}
+	if body.Owner.ID == "" {
+		return nil, errors.New("kai-preview: STA verify response missing owner.id")
+	}
+	return &STAVerifyResult{ProjectID: body.Owner.ID}, nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go
new file mode 100644
index 0000000000..52acf775c4
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go
@@ -0,0 +1,51 @@
+package kaipreview
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSTAVerifier_Success(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "GET", r.Method)
+		assert.Equal(t, "/v2/storage/tokens/verify", r.URL.Path)
+		assert.Equal(t, "test-token", r.Header.Get("X-StorageApi-Token"))
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"owner": map[string]any{"id": "proj-456", "name": "Test Project"},
+		})
+	}))
+	defer srv.Close()
+
+	v := NewSTAVerifier(srv.URL, srv.Client())
+	res, err := v.Verify(context.Background(), "test-token")
+	require.NoError(t, err)
+	assert.Equal(t, "proj-456", res.ProjectID)
+}
+
+func TestSTAVerifier_Unauthorized(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+	}))
+	defer srv.Close()
+
+	v := NewSTAVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(context.Background(), "bad-token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unauthorized")
+}
+
+func TestSTAVerifier_NetworkError(t *testing.T) {
+	t.Parallel()
+	v := NewSTAVerifier("http://127.0.0.1:1", http.DefaultClient) // port 1 = unreachable
+	_, err := v.Verify(context.Background(), "token")
+	require.Error(t, err)
+}

From 82035d455a049a74ecf61a2bdd5e3f699991ac3b Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:34:40 +0200
Subject: [PATCH 06/49] test(apps-proxy): cover kai-preview STA verifier error
 paths

---
 .../authproxy/kaipreview/sta_verifier_test.go | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go
index 52acf775c4..8ce61506d5 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go
@@ -49,3 +49,45 @@ func TestSTAVerifier_NetworkError(t *testing.T) {
 	_, err := v.Verify(context.Background(), "token")
 	require.Error(t, err)
 }
+
+func TestSTAVerifier_MissingOwnerID(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"owner":{}}`))
+	}))
+	defer srv.Close()
+
+	v := NewSTAVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(context.Background(), "token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "missing owner.id")
+}
+
+func TestSTAVerifier_ServerError(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	v := NewSTAVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(context.Background(), "token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "500")
+}
+
+func TestSTAVerifier_MalformedJSON(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("not-json"))
+	}))
+	defer srv.Close()
+
+	v := NewSTAVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(context.Background(), "token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "decode STA verify response")
+}

From 86afbf8aad21f2193b394698f933a7c107398c08 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:36:43 +0200
Subject: [PATCH 07/49] feat(apps-proxy): kai-preview host-only Partitioned
 session cookie

---
 .../apphandler/authproxy/kaipreview/cookie.go | 51 ++++++++++++++
 .../authproxy/kaipreview/cookie_test.go       | 70 +++++++++++++++++++
 2 files changed, 121 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
new file mode 100644
index 0000000000..276f0a5afc
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
@@ -0,0 +1,51 @@
+package kaipreview
+
+import (
+	"net/http"
+	"time"
+)
+
+const SessionCookieName = "kbc-kai-preview-session"
+
+// SetSessionCookie writes the kai-preview session cookie on w. The cookie is
+// host-only (no Domain), Secure, HttpOnly, SameSite=None, Partitioned (CHIPS).
+// See docs/superpowers/specs/2026-05-14-dev-iframe-auth-design.md for the full
+// attribute rationale.
+func SetSessionCookie(w http.ResponseWriter, jwt string, ttl time.Duration) {
+	http.SetCookie(w, &http.Cookie{
+		Name:        SessionCookieName,
+		Value:       jwt,
+		Path:        "/",
+		Secure:      true,
+		HttpOnly:    true,
+		SameSite:    http.SameSiteNoneMode,
+		Partitioned: true,
+		MaxAge:      int(ttl.Seconds()),
+	})
+}
+
+// ClearSessionCookie writes a cookie that invalidates any existing kai-preview
+// session cookie on the same host. Used by the exchange endpoint on validation
+// failure and by future sign-out flows.
+func ClearSessionCookie(w http.ResponseWriter) {
+	http.SetCookie(w, &http.Cookie{
+		Name:        SessionCookieName,
+		Value:       "",
+		Path:        "/",
+		Secure:      true,
+		HttpOnly:    true,
+		SameSite:    http.SameSiteNoneMode,
+		Partitioned: true,
+		MaxAge:      -1,
+	})
+}
+
+// ReadSessionCookie returns the value of the kai-preview session cookie if
+// present on the request, or "" if absent or unreadable.
+func ReadSessionCookie(r *http.Request) string {
+	c, err := r.Cookie(SessionCookieName)
+	if err != nil || c == nil {
+		return ""
+	}
+	return c.Value
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
new file mode 100644
index 0000000000..3714588e46
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
@@ -0,0 +1,70 @@
+package kaipreview
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetSessionCookie_Attributes(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	clock := clockwork.NewFakeClock()
+	ttl := 4 * time.Hour
+
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", ttl)
+	require.NoError(t, err)
+
+	SetSessionCookie(w, jwt, ttl)
+
+	resp := w.Result()
+	cookies := resp.Cookies()
+	require.Len(t, cookies, 1)
+	c := cookies[0]
+
+	assert.Equal(t, SessionCookieName, c.Name)
+	assert.Equal(t, jwt, c.Value)
+	assert.Equal(t, "/", c.Path)
+	assert.True(t, c.Secure)
+	assert.True(t, c.HttpOnly)
+	assert.Equal(t, http.SameSiteNoneMode, c.SameSite)
+	assert.True(t, c.Partitioned)
+	assert.Empty(t, c.Domain, "must be host-only — no Domain attribute")
+	assert.Equal(t, int(ttl.Seconds()), c.MaxAge)
+}
+
+func TestReadSessionCookie_Present(t *testing.T) {
+	t.Parallel()
+	r := httptest.NewRequest("GET", "/", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: "the-jwt"})
+	got := ReadSessionCookie(r)
+	assert.Equal(t, "the-jwt", got)
+}
+
+func TestReadSessionCookie_Missing(t *testing.T) {
+	t.Parallel()
+	r := httptest.NewRequest("GET", "/", nil)
+	got := ReadSessionCookie(r)
+	assert.Empty(t, got)
+}
+
+func TestClearSessionCookie_Attributes(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	ClearSessionCookie(w)
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	c := cookies[0]
+	assert.Equal(t, SessionCookieName, c.Name)
+	assert.Empty(t, c.Value)
+	assert.Equal(t, -1, c.MaxAge, "clear cookie must use MaxAge=-1")
+	assert.True(t, c.Secure)
+	assert.True(t, c.HttpOnly)
+	assert.True(t, c.Partitioned)
+	assert.Equal(t, http.SameSiteNoneMode, c.SameSite)
+}

From d4352cf9d10a52692a9ead502cdfbce8649a51c9 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:42:08 +0200
Subject: [PATCH 08/49] fix(apps-proxy): kai-preview SetSessionCookie clears on
 non-positive ttl

---
 .../proxy/apphandler/authproxy/kaipreview/cookie.go    |  7 +++++--
 .../apphandler/authproxy/kaipreview/cookie_test.go     | 10 ++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
index 276f0a5afc..c3e4b92401 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
@@ -9,9 +9,12 @@ const SessionCookieName = "kbc-kai-preview-session"
 
 // SetSessionCookie writes the kai-preview session cookie on w. The cookie is
 // host-only (no Domain), Secure, HttpOnly, SameSite=None, Partitioned (CHIPS).
-// See docs/superpowers/specs/2026-05-14-dev-iframe-auth-design.md for the full
-// attribute rationale.
+// See the kai-preview design doc for the full attribute rationale.
 func SetSessionCookie(w http.ResponseWriter, jwt string, ttl time.Duration) {
+	if ttl <= 0 {
+		ClearSessionCookie(w)
+		return
+	}
 	http.SetCookie(w, &http.Cookie{
 		Name:        SessionCookieName,
 		Value:       jwt,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
index 3714588e46..704be0b027 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
@@ -53,6 +53,16 @@ func TestReadSessionCookie_Missing(t *testing.T) {
 	assert.Empty(t, got)
 }
 
+func TestSetSessionCookie_NonPositiveTTL_ClearsInstead(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	SetSessionCookie(w, "ignored-jwt", 0)
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.Equal(t, -1, cookies[0].MaxAge, "ttl=0 must invalidate, not create a session cookie")
+	assert.Empty(t, cookies[0].Value)
+}
+
 func TestClearSessionCookie_Attributes(t *testing.T) {
 	t.Parallel()
 	w := httptest.NewRecorder()

From 9e202761c533e93c73d7ee0fa37ecd3bcc20ae94 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:44:18 +0200
Subject: [PATCH 09/49] feat(apps-proxy): kai-preview CORS preflight + response
 headers

---
 .../apphandler/authproxy/kaipreview/cors.go   | 49 +++++++++++++++
 .../authproxy/kaipreview/cors_test.go         | 60 +++++++++++++++++++
 2 files changed, 109 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
new file mode 100644
index 0000000000..082974994d
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
@@ -0,0 +1,49 @@
+package kaipreview
+
+import (
+	"net/http"
+	"slices"
+)
+
+type CORS struct {
+	allowedOrigins []string
+}
+
+func NewCORS(allowedOrigins []string) *CORS {
+	return &CORS{allowedOrigins: allowedOrigins}
+}
+
+func (c *CORS) IsAllowed(origin string) bool {
+	return slices.Contains(c.allowedOrigins, origin)
+}
+
+// HandlePreflight returns true when the request was a preflight OPTIONS and was handled.
+// Caller should return immediately if true. Returns false for non-OPTIONS requests.
+func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request) bool {
+	if r.Method != http.MethodOptions {
+		return false
+	}
+	origin := r.Header.Get("Origin")
+	if !c.IsAllowed(origin) {
+		http.Error(w, "origin not allowed", http.StatusForbidden)
+		return true
+	}
+	w.Header().Set("Access-Control-Allow-Origin", origin)
+	w.Header().Set("Access-Control-Allow-Credentials", "true")
+	w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+	w.Header().Set("Access-Control-Allow-Headers", "X-StorageApi-Token, Content-Type")
+	w.Header().Set("Access-Control-Max-Age", "600")
+	w.WriteHeader(http.StatusNoContent)
+	return true
+}
+
+// WriteResponseHeaders sets the CORS response headers on a regular (non-preflight) response.
+// Call this from the actual handler before writing the body.
+func (c *CORS) WriteResponseHeaders(w http.ResponseWriter, origin string) {
+	if !c.IsAllowed(origin) {
+		return
+	}
+	w.Header().Set("Access-Control-Allow-Origin", origin)
+	w.Header().Set("Access-Control-Allow-Credentials", "true")
+	w.Header().Set("Vary", "Origin")
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
new file mode 100644
index 0000000000..0b39bd77f8
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
@@ -0,0 +1,60 @@
+package kaipreview
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCORS_AllowedOrigin_Preflight(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("Access-Control-Request-Method", "POST")
+	r.Header.Set("Access-Control-Request-Headers", "X-StorageApi-Token, Content-Type")
+	w := httptest.NewRecorder()
+
+	handled := cors.HandlePreflight(w, r)
+	assert.True(t, handled)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+	assert.Contains(t, w.Header().Get("Access-Control-Allow-Headers"), "X-StorageApi-Token")
+}
+
+func TestCORS_DisallowedOrigin_Preflight(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://evil.example.com")
+	w := httptest.NewRecorder()
+
+	handled := cors.HandlePreflight(w, r)
+	assert.True(t, handled)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"))
+}
+
+func TestCORS_WriteResponseHeaders(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	w := httptest.NewRecorder()
+	cors.WriteResponseHeaders(w, "https://connection.keboola.com")
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+}
+
+func TestCORS_NonPreflightPassesThrough(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	w := httptest.NewRecorder()
+	handled := cors.HandlePreflight(w, r)
+	assert.False(t, handled)
+}

From 7cdb3ee46122162245d481a3c62e37294d1b690e Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:47:17 +0200
Subject: [PATCH 10/49] feat(apps-proxy): kai-preview frame-ancestors CSP
 helper

---
 .../apphandler/authproxy/kaipreview/csp.go    | 17 +++++++++++++
 .../authproxy/kaipreview/csp_test.go          | 25 +++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go
new file mode 100644
index 0000000000..432b4641ae
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go
@@ -0,0 +1,17 @@
+package kaipreview
+
+import (
+	"net/http"
+	"strings"
+)
+
+// WriteFrameAncestorsCSP sets a Content-Security-Policy header with a single
+// frame-ancestors directive. Pass the allowed IDE origins; pass nil/empty to
+// fall back to 'none' (deny all embedding).
+func WriteFrameAncestorsCSP(w http.ResponseWriter, allowedOrigins []string) {
+	if len(allowedOrigins) == 0 {
+		w.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
+		return
+	}
+	w.Header().Set("Content-Security-Policy", "frame-ancestors "+strings.Join(allowedOrigins, " "))
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go
new file mode 100644
index 0000000000..a2f2ba47b8
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go
@@ -0,0 +1,25 @@
+package kaipreview
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestWriteFrameAncestorsCSP(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	WriteFrameAncestorsCSP(w, []string{"https://connection.keboola.com", "https://connection.eu-central-1.keboola.com"})
+	assert.Equal(t,
+		"frame-ancestors https://connection.keboola.com https://connection.eu-central-1.keboola.com",
+		w.Header().Get("Content-Security-Policy"),
+	)
+}
+
+func TestWriteFrameAncestorsCSP_Empty(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	WriteFrameAncestorsCSP(w, nil)
+	assert.Equal(t, "frame-ancestors 'none'", w.Header().Get("Content-Security-Policy"))
+}

From 79ee9e751079b472bb62fed29367e54d3b2f69fc Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:48:56 +0200
Subject: [PATCH 11/49] feat(apps-proxy): kai-preview iframe document-load
 detector

---
 .../authproxy/kaipreview/iframe_detect.go     | 22 +++++++++++
 .../kaipreview/iframe_detect_test.go          | 38 +++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect.go
new file mode 100644
index 0000000000..ffa27bd1e3
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect.go
@@ -0,0 +1,22 @@
+package kaipreview
+
+import (
+	"net/http"
+	"strings"
+)
+
+// IsIframeDocumentLoad heuristically detects a top-level iframe document load by
+// looking at the Sec-Fetch-Dest header and Accept header. Used as a routing
+// signal (not a security gate) to decide when to serve the bootstrap shim on a
+// dev-mode app with no valid session cookie.
+//
+// The signal is UX-only because Sec-Fetch-* is forgeable by non-browser clients.
+// The bootstrap shim itself is harmless without the postMessage handshake from a
+// trusted IDE origin.
+func IsIframeDocumentLoad(r *http.Request) bool {
+	dest := r.Header.Get("Sec-Fetch-Dest")
+	if dest != "iframe" && dest != "frame" {
+		return false
+	}
+	return strings.Contains(r.Header.Get("Accept"), "text/html")
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go
new file mode 100644
index 0000000000..8c3e328a07
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go
@@ -0,0 +1,38 @@
+package kaipreview
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsIframeDocumentLoad(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name   string
+		dest   string
+		accept string
+		want   bool
+	}{
+		{"iframe-html", "iframe", "text/html,*/*;q=0.8", true},
+		{"frame-html", "frame", "text/html", true},
+		{"document-html", "document", "text/html", false}, // top-level navigation, not iframe
+		{"xhr", "empty", "application/json", false},
+		{"image", "image", "image/*", false},
+		{"script", "script", "*/*", false},
+		{"iframe-but-json-accept", "iframe", "application/json", false},
+		{"no-sec-fetch-headers", "", "text/html", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("GET", "/some/path", nil)
+			if tc.dest != "" {
+				r.Header.Set("Sec-Fetch-Dest", tc.dest)
+			}
+			r.Header.Set("Accept", tc.accept)
+			assert.Equal(t, tc.want, IsIframeDocumentLoad(r))
+		})
+	}
+}

From e9447f8fb863f73c41b80e06b77d837b085e9f27 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:52:23 +0200
Subject: [PATCH 12/49] feat(apps-proxy): kai-preview bootstrap shim with
 postMessage handshake

---
 .../authproxy/kaipreview/bootstrap.go         | 48 +++++++++++
 .../authproxy/kaipreview/bootstrap_test.go    | 41 ++++++++++
 .../kaipreview/template/bootstrap.gohtml      | 82 +++++++++++++++++++
 3 files changed, 171 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
new file mode 100644
index 0000000000..3979684351
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
@@ -0,0 +1,48 @@
+package kaipreview
+
+import (
+	"embed"
+	"encoding/json"
+	"html/template"
+	"net/http"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+//go:embed template/bootstrap.gohtml
+var bootstrapFS embed.FS
+
+var bootstrapTmpl = template.Must(template.ParseFS(bootstrapFS, "template/bootstrap.gohtml"))
+
+type BootstrapHandler struct {
+	allowedIDEOrigins []string
+	originsJSON       template.JS
+}
+
+func NewBootstrapHandler(allowedIDEOrigins []string) *BootstrapHandler {
+	bs, _ := json.Marshal(allowedIDEOrigins) // []string round-trip never errors for []string
+	return &BootstrapHandler{
+		allowedIDEOrigins: allowedIDEOrigins,
+		originsJSON:       template.JS(bs),
+	}
+}
+
+func (h *BootstrapHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+	WriteFrameAncestorsCSP(w, h.allowedIDEOrigins)
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+
+	data := struct {
+		AllowedIDEOriginsJSON template.JS
+	}{
+		AllowedIDEOriginsJSON: h.originsJSON,
+	}
+	if err := bootstrapTmpl.Execute(w, data); err != nil {
+		return errors.Errorf("kai-preview: render bootstrap shim: %w", err)
+	}
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
new file mode 100644
index 0000000000..a2fca22624
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
@@ -0,0 +1,41 @@
+package kaipreview
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBootstrapHandler_ServesHTMLWithCSP(t *testing.T) {
+	t.Parallel()
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"})
+	r := httptest.NewRequest("GET", "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, 200, w.Code)
+	assert.Contains(t, w.Header().Get("Content-Type"), "text/html")
+	assert.Contains(t, w.Header().Get("Content-Security-Policy"), "frame-ancestors https://connection.keboola.com")
+
+	body := w.Body.String()
+	assert.Contains(t, body, "postMessage", "shim must postMessage")
+	assert.Contains(t, body, "kai-preview-ready", "shim must send 'kai-preview-ready' to parent")
+	assert.Contains(t, body, "/_proxy/kai-preview/exchange", "shim must POST to exchange")
+	assert.Contains(t, body, "https://connection.keboola.com", "shim must restrict postMessage targetOrigin")
+	assert.NotContains(t, body, `targetOrigin: "*"`, "shim must NEVER postMessage with wildcard targetOrigin")
+	assert.NotContains(t, strings.ToLower(body), "innerhtml", "shim must not write user-supplied data via innerHTML")
+}
+
+func TestBootstrapHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"})
+	r := httptest.NewRequest("POST", "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, 405, w.Code)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml
new file mode 100644
index 0000000000..6ccb2e9029
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml
@@ -0,0 +1,82 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Loading preview…</title>
+  <style>
+    html, body { margin: 0; padding: 0; background: #fff; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
+    .status { display: flex; align-items: center; justify-content: center; height: 100vh; color: #888; font-size: 14px; }
+  </style>
+</head>
+<body>
+<div class="status" id="status">Loading preview…</div>
+<script>
+(function () {
+  "use strict";
+
+  // Server-rendered: the list of IDE origins this preview is allowed to handshake with.
+  var ALLOWED_IDE_ORIGINS = {{ .AllowedIDEOriginsJSON }};
+
+  var EXCHANGE_PATH = "/_proxy/kai-preview/exchange";
+  var status = document.getElementById("status");
+  var didHandshake = false;
+  var readyInterval;
+
+  function setStatus(text) { if (status) { status.textContent = text; } }
+
+  function originAllowed(origin) {
+    for (var i = 0; i < ALLOWED_IDE_ORIGINS.length; i++) {
+      if (ALLOWED_IDE_ORIGINS[i] === origin) { return true; }
+    }
+    return false;
+  }
+
+  function broadcastReady() {
+    if (!window.parent || window.parent === window) {
+      setStatus("This preview only loads from the Keboola UI.");
+      return;
+    }
+    for (var i = 0; i < ALLOWED_IDE_ORIGINS.length; i++) {
+      try { window.parent.postMessage({ type: "kai-preview-ready" }, ALLOWED_IDE_ORIGINS[i]); }
+      catch (e) { /* targetOrigin mismatch is benign */ }
+    }
+  }
+
+  function onMessage(event) {
+    if (didHandshake) { return; }
+    if (!originAllowed(event.origin)) { return; }
+    if (!event.data || event.data.type !== "kai-preview-token" || typeof event.data.token !== "string") { return; }
+    didHandshake = true;
+    if (readyInterval) { clearInterval(readyInterval); readyInterval = null; }
+
+    fetch(EXCHANGE_PATH, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token: event.data.token })
+    }).then(function (r) {
+      if (!r.ok) {
+        setStatus("Preview authorization failed (" + r.status + "). Reload the parent page.");
+        return;
+      }
+      window.location.replace("/");
+    }).catch(function () {
+      setStatus("Preview authorization failed — network error.");
+    });
+  }
+
+  window.addEventListener("message", onMessage);
+  broadcastReady();
+  readyInterval = setInterval(broadcastReady, 500);
+  // Give up after ~10s if no parent responds.
+  setTimeout(function () {
+    if (!didHandshake && readyInterval) {
+      clearInterval(readyInterval);
+      readyInterval = null;
+      setStatus("This preview only loads from the Keboola UI.");
+    }
+  }, 10000);
+})();
+</script>
+</body>
+</html>

From 897fad1d255d5d7f841d571c7c62266f0367dccd Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 17:59:10 +0200
Subject: [PATCH 13/49] feat(apps-proxy): kai-preview embed-token endpoint
 (mint handshake JWT)

---
 .../authproxy/kaipreview/embed_token.go       |  92 +++++++++
 .../authproxy/kaipreview/embed_token_test.go  | 182 ++++++++++++++++++
 2 files changed, 274 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
new file mode 100644
index 0000000000..b7a820080d
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
@@ -0,0 +1,92 @@
+package kaipreview
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+// STATokenVerifier abstracts STAVerifier so tests can inject a stub without HTTP.
+type STATokenVerifier interface {
+	Verify(ctx context.Context, token string) (*STAVerifyResult, error)
+}
+
+// DevModeChecker tells the handler whether the current app is in dev mode.
+// Backed by the apps-proxy CRD watcher (AppInfo.DevMode).
+type DevModeChecker interface {
+	IsDevMode(appID string) bool
+}
+
+type EmbedTokenDeps struct {
+	Clock        clockwork.Clock
+	STA          STATokenVerifier
+	DevMode      DevModeChecker
+	CORS         *CORS
+	HandshakeKey string
+	AppID        string
+	AppProjectID string
+}
+
+type EmbedTokenHandler struct {
+	deps EmbedTokenDeps
+}
+
+func NewEmbedTokenHandler(deps EmbedTokenDeps) *EmbedTokenHandler {
+	return &EmbedTokenHandler{deps: deps}
+}
+
+func (h *EmbedTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if h.deps.CORS.HandlePreflight(w, r) {
+		return nil
+	}
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+
+	// Origin must be allowed even on the actual request (defence in depth).
+	origin := r.Header.Get("Origin")
+	if !h.deps.CORS.IsAllowed(origin) {
+		http.Error(w, "origin not allowed", http.StatusForbidden)
+		return nil
+	}
+
+	// Dev-mode gate first: pretend the endpoint doesn't exist on non-dev apps.
+	if !h.deps.DevMode.IsDevMode(h.deps.AppID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
+	staToken := r.Header.Get("X-StorageApi-Token")
+	if staToken == "" {
+		http.Error(w, "missing X-StorageApi-Token", http.StatusUnauthorized)
+		return nil
+	}
+
+	res, err := h.deps.STA.Verify(r.Context(), staToken)
+	if err != nil {
+		// Never echo the raw STA token in the error body or logs.
+		http.Error(w, "STA token invalid", http.StatusUnauthorized)
+		return nil
+	}
+	if res.ProjectID != h.deps.AppProjectID {
+		http.Error(w, "app belongs to a different project", http.StatusForbidden)
+		return nil
+	}
+
+	jwt, err := MintHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID)
+	if err != nil {
+		return errors.Errorf("kai-preview: mint handshake JWT: %w", err)
+	}
+
+	h.deps.CORS.WriteResponseHeaders(w, origin)
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(map[string]string{"token": jwt})
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
new file mode 100644
index 0000000000..a6a95df6c0
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
@@ -0,0 +1,182 @@
+package kaipreview
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type stubSTAVerifier struct {
+	projectID string
+	err       error
+}
+
+func (s *stubSTAVerifier) Verify(_ context.Context, _ string) (*STAVerifyResult, error) {
+	if s.err != nil {
+		return nil, s.err
+	}
+	return &STAVerifyResult{ProjectID: s.projectID}, nil
+}
+
+type stubDevModeChecker struct{ devMode bool }
+
+func (s *stubDevModeChecker) IsDevMode(_ string) bool { return s.devMode }
+
+var errStubUnauth = &stubErr{msg: "unauthorized"}
+
+type stubErr struct{ msg string }
+
+func (e *stubErr) Error() string { return e.msg }
+
+func newTestEmbedHandler(staOK bool, staProject string, devMode bool) *EmbedTokenHandler {
+	var sta STATokenVerifier
+	if staOK {
+		sta = &stubSTAVerifier{projectID: staProject}
+	} else {
+		sta = &stubSTAVerifier{err: errStubUnauth}
+	}
+	return NewEmbedTokenHandler(EmbedTokenDeps{
+		Clock:        clockwork.NewFakeClock(),
+		STA:          sta,
+		DevMode:      &stubDevModeChecker{devMode: devMode},
+		CORS:         NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey: testHandshakeKey,
+		AppID:        "app-123",
+		AppProjectID: "proj-456",
+	})
+}
+
+func TestEmbedTokenHandler_Success(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(true, "proj-456", true)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+
+	var body struct {
+		Token string `json:"token"`
+	}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &body))
+	require.NotEmpty(t, body.Token)
+}
+
+func TestEmbedTokenHandler_PreflightOptions(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(true, "proj-456", true)
+
+	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("Access-Control-Request-Method", "POST")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+}
+
+func TestEmbedTokenHandler_MissingSTAHeader(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(true, "proj-456", true)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
+func TestEmbedTokenHandler_STAInvalid(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(false, "", true)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "bad-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
+func TestEmbedTokenHandler_WrongProject(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(true, "different-project", true)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid-but-wrong-project")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestEmbedTokenHandler_AppNotInDevMode(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(true, "proj-456", false)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code, "must look like the endpoint doesn't exist when app isn't in dev mode")
+}
+
+func TestEmbedTokenHandler_DisallowedOrigin(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(true, "proj-456", true)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://evil.example.com")
+	r.Header.Set("X-StorageApi-Token", "valid-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestEmbedTokenHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(true, "proj-456", true)
+	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusMethodNotAllowed, w.Code)
+}
+
+func TestEmbedTokenHandler_NoTokenInErrorBody(t *testing.T) {
+	t.Parallel()
+	h := newTestEmbedHandler(false, "", true)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "secret-token-do-not-leak")
+	w := httptest.NewRecorder()
+	_ = h.ServeHTTPOrError(w, r)
+	assert.False(t, strings.Contains(w.Body.String(), "secret-token-do-not-leak"))
+}

From 505f4ab79a17a0b2cae16484f47550db4f738310 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:03:58 +0200
Subject: [PATCH 14/49] fix(apps-proxy): emit CORS headers on kai-preview
 embed-token auth failures

---
 .../proxy/apphandler/authproxy/kaipreview/embed_token.go  | 5 ++++-
 .../apphandler/authproxy/kaipreview/embed_token_test.go   | 8 ++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
index b7a820080d..5dc029fb96 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
@@ -54,6 +54,9 @@ func (h *EmbedTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Requ
 		http.Error(w, "origin not allowed", http.StatusForbidden)
 		return nil
 	}
+	// All remaining responses are to an allowed origin — emit CORS headers now so the
+	// SPA can read status codes and bodies of auth-failure responses, not just successes.
+	h.deps.CORS.WriteResponseHeaders(w, origin)
 
 	// Dev-mode gate first: pretend the endpoint doesn't exist on non-dev apps.
 	if !h.deps.DevMode.IsDevMode(h.deps.AppID) {
@@ -83,7 +86,7 @@ func (h *EmbedTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Requ
 		return errors.Errorf("kai-preview: mint handshake JWT: %w", err)
 	}
 
-	h.deps.CORS.WriteResponseHeaders(w, origin)
+	// CORS headers already set above.
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
index a6a95df6c0..06a193e040 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
@@ -99,6 +99,8 @@ func TestEmbedTokenHandler_MissingSTAHeader(t *testing.T) {
 	err := h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
 }
 
 func TestEmbedTokenHandler_STAInvalid(t *testing.T) {
@@ -113,6 +115,8 @@ func TestEmbedTokenHandler_STAInvalid(t *testing.T) {
 	err := h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
 }
 
 func TestEmbedTokenHandler_WrongProject(t *testing.T) {
@@ -127,6 +131,8 @@ func TestEmbedTokenHandler_WrongProject(t *testing.T) {
 	err := h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
 }
 
 func TestEmbedTokenHandler_AppNotInDevMode(t *testing.T) {
@@ -155,6 +161,8 @@ func TestEmbedTokenHandler_DisallowedOrigin(t *testing.T) {
 	err := h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"),
+		"disallowed origins must NOT receive CORS headers")
 }
 
 func TestEmbedTokenHandler_WrongMethod(t *testing.T) {

From fb97e3f54c234e5ccb4cba96f3127098a7a1195e Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:06:15 +0200
Subject: [PATCH 15/49] =?UTF-8?q?feat(apps-proxy):=20kai-preview=20exchang?=
 =?UTF-8?q?e=20endpoint=20(JWT=20=E2=86=92=20session=20cookie)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../authproxy/kaipreview/exchange.go          |  70 ++++++++++
 .../authproxy/kaipreview/exchange_test.go     | 131 ++++++++++++++++++
 2 files changed, 201 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
new file mode 100644
index 0000000000..a7f6b1ccc7
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
@@ -0,0 +1,70 @@
+package kaipreview
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+type ExchangeDeps struct {
+	Clock        clockwork.Clock
+	DevMode      DevModeChecker
+	HandshakeKey string
+	SessionKey   string
+	SessionTTL   time.Duration
+	AppID        string
+	AppProjectID string
+}
+
+type ExchangeHandler struct {
+	deps ExchangeDeps
+}
+
+func NewExchangeHandler(deps ExchangeDeps) *ExchangeHandler {
+	return &ExchangeHandler{deps: deps}
+}
+
+func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+
+	// Dev-mode gate: pretend the endpoint doesn't exist on non-dev apps.
+	if !h.deps.DevMode.IsDevMode(h.deps.AppID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
+	var body struct {
+		Token string `json:"token"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.Token == "" {
+		http.Error(w, "invalid body", http.StatusBadRequest)
+		return nil
+	}
+
+	claims, err := VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, body.Token)
+	if err != nil {
+		http.Error(w, "invalid handshake token", http.StatusUnauthorized)
+		return nil
+	}
+	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
+		http.Error(w, "handshake token scope mismatch", http.StatusForbidden)
+		return nil
+	}
+
+	sessionJWT, err := MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
+	if err != nil {
+		return errors.Errorf("kai-preview: mint session JWT: %w", err)
+	}
+
+	SetSessionCookie(w, sessionJWT, h.deps.SessionTTL)
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange_test.go
new file mode 100644
index 0000000000..45b271035b
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange_test.go
@@ -0,0 +1,131 @@
+package kaipreview
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestExchangeHandler(devMode bool) *ExchangeHandler {
+	return NewExchangeHandler(ExchangeDeps{
+		Clock:        clockwork.NewFakeClock(),
+		DevMode:      &stubDevModeChecker{devMode: devMode},
+		HandshakeKey: testHandshakeKey,
+		SessionKey:   testSessionKey,
+		SessionTTL:   4 * time.Hour,
+		AppID:        "app-123",
+		AppProjectID: "proj-456",
+	})
+}
+
+func mintForTest(t *testing.T, appID, projectID string) string {
+	t.Helper()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintHandshakeJWT(testHandshakeKey, clock, appID, projectID)
+	require.NoError(t, err)
+	return jwt
+}
+
+func TestExchangeHandler_Success(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	jwt := mintForTest(t, "app-123", "proj-456")
+
+	body, _ := json.Marshal(map[string]string{"token": jwt})
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	r.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, w.Code)
+
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.Equal(t, SessionCookieName, cookies[0].Name)
+	assert.True(t, cookies[0].Partitioned)
+}
+
+func TestExchangeHandler_InvalidJWT(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+
+	body, _ := json.Marshal(map[string]string{"token": "not-a-jwt"})
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
+func TestExchangeHandler_AppIDMismatch(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	jwt := mintForTest(t, "different-app", "proj-456")
+
+	body, _ := json.Marshal(map[string]string{"token": jwt})
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestExchangeHandler_ProjectMismatch(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	jwt := mintForTest(t, "app-123", "different-project")
+
+	body, _ := json.Marshal(map[string]string{"token": jwt})
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestExchangeHandler_DevModeOff(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(false)
+	jwt := mintForTest(t, "app-123", "proj-456")
+
+	body, _ := json.Marshal(map[string]string{"token": jwt})
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestExchangeHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/exchange", nil)
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusMethodNotAllowed, w.Code)
+}
+
+func TestExchangeHandler_EmptyBody(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader([]byte("{}")))
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}

From 2aee42101953deea49e0b864a7fdcc462e00fc97 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:10:36 +0200
Subject: [PATCH 16/49] feat(apps-proxy): kai-preview refresh endpoint (sliding
 session)

Add RefreshHandler that validates the session cookie JWT, mints a fresh
JWT (with random jti for uniqueness), and returns 204 with the new
session cookie set. CORS headers are emitted before auth checks so the
SPA can read failure status codes from allowed origins. Also adds a
random jti to MintSessionJWT to ensure each minted token is unique even
when the clock hasn't advanced.
---
 .../apphandler/authproxy/kaipreview/jwt.go    |   5 +
 .../authproxy/kaipreview/refresh.go           |  78 +++++++++
 .../authproxy/kaipreview/refresh_test.go      | 152 ++++++++++++++++++
 3 files changed, 235 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
index f9c9f8e977..71bb5647f6 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -87,12 +87,17 @@ func VerifyHandshakeJWT(key string, clock clockwork.Clock, raw string) (*Handsha
 
 func MintSessionJWT(key string, clock clockwork.Clock, appID, projectID string, ttl time.Duration) (string, error) {
 	now := clock.Now()
+	jti, err := randomHex(16)
+	if err != nil {
+		return "", errors.Errorf("kai-preview: generate jti: %w", err)
+	}
 	claims := SessionClaims{
 		AppID:     appID,
 		ProjectID: projectID,
 		Purpose:   purposeSession,
 		TTL:       int64(ttl.Seconds()),
 		RegisteredClaims: jwt.RegisteredClaims{
+			ID:        jti,
 			IssuedAt:  jwt.NewNumericDate(now),
 			ExpiresAt: jwt.NewNumericDate(now.Add(ttl)),
 		},
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
new file mode 100644
index 0000000000..5ff49c1f43
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
@@ -0,0 +1,78 @@
+package kaipreview
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+type RefreshDeps struct {
+	Clock        clockwork.Clock
+	DevMode      DevModeChecker
+	SessionKey   string
+	SessionTTL   time.Duration
+	CORS         *CORS
+	AppID        string
+	AppProjectID string
+}
+
+type RefreshHandler struct {
+	deps RefreshDeps
+}
+
+func NewRefreshHandler(deps RefreshDeps) *RefreshHandler {
+	return &RefreshHandler{deps: deps}
+}
+
+func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if h.deps.CORS.HandlePreflight(w, r) {
+		return nil
+	}
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+
+	origin := r.Header.Get("Origin")
+	if !h.deps.CORS.IsAllowed(origin) {
+		http.Error(w, "origin not allowed", http.StatusForbidden)
+		return nil
+	}
+	// All remaining responses are to an allowed origin — emit CORS headers now so the
+	// SPA can read status codes and bodies of auth-failure responses, not just successes.
+	h.deps.CORS.WriteResponseHeaders(w, origin)
+
+	if !h.deps.DevMode.IsDevMode(h.deps.AppID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
+	cookieValue := ReadSessionCookie(r)
+	if cookieValue == "" {
+		http.Error(w, "no session", http.StatusUnauthorized)
+		return nil
+	}
+
+	claims, err := VerifySessionJWT(h.deps.SessionKey, h.deps.Clock, cookieValue)
+	if err != nil {
+		http.Error(w, "session expired", http.StatusUnauthorized)
+		return nil
+	}
+	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
+		http.Error(w, "session scope mismatch", http.StatusForbidden)
+		return nil
+	}
+
+	newJWT, err := MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
+	if err != nil {
+		return errors.Errorf("kai-preview: re-mint session JWT: %w", err)
+	}
+	SetSessionCookie(w, newJWT, h.deps.SessionTTL)
+
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusNoContent)
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh_test.go
new file mode 100644
index 0000000000..027c9692d6
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh_test.go
@@ -0,0 +1,152 @@
+package kaipreview
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestRefreshHandler(devMode bool) (*RefreshHandler, *clockwork.FakeClock) {
+	clock := clockwork.NewFakeClock()
+	return NewRefreshHandler(RefreshDeps{
+		Clock:        clock,
+		DevMode:      &stubDevModeChecker{devMode: devMode},
+		SessionKey:   testSessionKey,
+		SessionTTL:   4 * time.Hour,
+		CORS:         NewCORS([]string{"https://connection.keboola.com"}),
+		AppID:        "app-123",
+		AppProjectID: "proj-456",
+	}), clock
+}
+
+func TestRefreshHandler_Success(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.Equal(t, SessionCookieName, cookies[0].Name)
+	assert.NotEqual(t, jwt, cookies[0].Value, "must be a fresh JWT, not the old one")
+}
+
+func TestRefreshHandler_PreflightOptions(t *testing.T) {
+	t.Parallel()
+	h, _ := newTestRefreshHandler(true)
+	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("Access-Control-Request-Method", "POST")
+	w := httptest.NewRecorder()
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+}
+
+func TestRefreshHandler_MissingCookie(t *testing.T) {
+	t.Parallel()
+	h, _ := newTestRefreshHandler(true)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers")
+}
+
+func TestRefreshHandler_ExpiredCookie(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+	clock.Advance(5 * time.Hour)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+}
+
+func TestRefreshHandler_DevModeOff(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(false)
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestRefreshHandler_ScopeMismatch(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestRefreshHandler_DisallowedOrigin(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://evil.example.com")
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"))
+}
+
+func TestRefreshHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h, _ := newTestRefreshHandler(true)
+	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusMethodNotAllowed, w.Code)
+}

From 59ed499375dbef05a913b59c2e90b6a272015fd3 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:15:13 +0200
Subject: [PATCH 17/49] feat(apps-proxy): kai-preview composite handler for
 /_proxy/kai-preview/*

---
 .../authproxy/kaipreview/handler.go           | 90 +++++++++++++++++++
 .../authproxy/kaipreview/handler_test.go      | 78 ++++++++++++++++
 2 files changed, 168 insertions(+)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
new file mode 100644
index 0000000000..939e39cd8a
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
@@ -0,0 +1,90 @@
+package kaipreview
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
+)
+
+// PathPrefix is the URL prefix all kai-preview endpoints live under.
+var PathPrefix = config.InternalPrefix + "/kai-preview"
+
+const (
+	pathEmbedToken = "/embed-token"
+	pathBootstrap  = "/bootstrap"
+	pathExchange   = "/exchange"
+	pathRefresh    = "/refresh"
+)
+
+// DevModeCheckerFunc adapts a plain function to the DevModeChecker interface.
+type DevModeCheckerFunc func(appID string) bool
+
+// IsDevMode implements DevModeChecker.
+func (f DevModeCheckerFunc) IsDevMode(appID string) bool { return f(appID) }
+
+type HandlerDeps struct {
+	Clock             clockwork.Clock
+	STA               STATokenVerifier
+	DevMode           DevModeChecker
+	CORS              *CORS
+	HandshakeKey      string
+	SessionKey        string
+	SessionTTL        time.Duration
+	AllowedIDEOrigins []string
+	AppID             string
+	AppProjectID      string
+}
+
+// Handler is the per-app composite handler that serves all four kai-preview
+// internal endpoints. One instance per app. Routes by URL path suffix.
+type Handler struct {
+	embedToken *EmbedTokenHandler
+	bootstrap  *BootstrapHandler
+	exchange   *ExchangeHandler
+	refresh    *RefreshHandler
+}
+
+func NewHandler(deps HandlerDeps) *Handler {
+	return &Handler{
+		embedToken: NewEmbedTokenHandler(EmbedTokenDeps{
+			Clock: deps.Clock, STA: deps.STA, DevMode: deps.DevMode, CORS: deps.CORS,
+			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
+		}),
+		bootstrap: NewBootstrapHandler(deps.AllowedIDEOrigins),
+		exchange: NewExchangeHandler(ExchangeDeps{
+			Clock: deps.Clock, DevMode: deps.DevMode,
+			HandshakeKey: deps.HandshakeKey, SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL,
+			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
+		}),
+		refresh: NewRefreshHandler(RefreshDeps{
+			Clock: deps.Clock, DevMode: deps.DevMode,
+			SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL, CORS: deps.CORS,
+			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
+		}),
+	}
+}
+
+func (h *Handler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if !strings.HasPrefix(r.URL.Path, PathPrefix) {
+		http.NotFound(w, r)
+		return nil
+	}
+	sub := r.URL.Path[len(PathPrefix):]
+	switch sub {
+	case pathEmbedToken:
+		return h.embedToken.ServeHTTPOrError(w, r)
+	case pathBootstrap:
+		return h.bootstrap.ServeHTTPOrError(w, r)
+	case pathExchange:
+		return h.exchange.ServeHTTPOrError(w, r)
+	case pathRefresh:
+		return h.refresh.ServeHTTPOrError(w, r)
+	default:
+		http.NotFound(w, r)
+		return nil
+	}
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
new file mode 100644
index 0000000000..575c336e52
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
@@ -0,0 +1,78 @@
+package kaipreview
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestCompositeHandler(devMode bool) *Handler {
+	return NewHandler(HandlerDeps{
+		Clock:             clockwork.NewFakeClock(),
+		STA:               &stubSTAVerifier{projectID: "proj-456"},
+		DevMode:           &stubDevModeChecker{devMode: devMode},
+		CORS:              NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey:      testHandshakeKey,
+		SessionKey:        testSessionKey,
+		SessionTTL:        4 * time.Hour,
+		AllowedIDEOrigins: []string{"https://connection.keboola.com"},
+		AppID:             "app-123",
+		AppProjectID:      "proj-456",
+	})
+}
+
+func TestCompositeHandler_RoutesEmbedToken(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler(true)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid")
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusOK, w.Code)
+}
+
+func TestCompositeHandler_RoutesBootstrap(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler(true)
+	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(t, w.Header().Get("Content-Type"), "text/html")
+}
+
+func TestCompositeHandler_RoutesExchange(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler(true)
+	// Empty body — exchange should return 400 (handler reached, valid path)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", nil)
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
+
+func TestCompositeHandler_RoutesRefresh(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler(true)
+	// No cookie — refresh should return 401 (handler reached, valid path)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
+func TestCompositeHandler_UnknownSubpath404(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler(true)
+	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/does-not-exist", nil)
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}

From 4ff5aee25c8ae7ca63db1c745bddd248bd564dde Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:18:01 +0200
Subject: [PATCH 18/49] feat(apps-proxy): kai-preview ValidateSessionCookie
 helper

---
 .../apphandler/authproxy/kaipreview/cookie.go | 21 +++++++
 .../authproxy/kaipreview/cookie_test.go       | 60 +++++++++++++++++++
 2 files changed, 81 insertions(+)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
index c3e4b92401..d66a14ebe7 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
@@ -3,6 +3,8 @@ package kaipreview
 import (
 	"net/http"
 	"time"
+
+	"github.com/jonboulle/clockwork"
 )
 
 const SessionCookieName = "kbc-kai-preview-session"
@@ -52,3 +54,22 @@ func ReadSessionCookie(r *http.Request) string {
 	}
 	return c.Value
 }
+
+// ValidateSessionCookie reads the kai-preview session cookie from the request,
+// verifies the signature, expiry, and (app_id, project) scope. Returns claims
+// + true on success, nil + false on any failure. Stateless — relies only on the
+// signing key.
+func ValidateSessionCookie(r *http.Request, sessionKey string, clock clockwork.Clock, appID, projectID string) (*SessionClaims, bool) {
+	raw := ReadSessionCookie(r)
+	if raw == "" {
+		return nil, false
+	}
+	claims, err := VerifySessionJWT(sessionKey, clock, raw)
+	if err != nil {
+		return nil, false
+	}
+	if claims.AppID != appID || claims.ProjectID != projectID {
+		return nil, false
+	}
+	return claims, true
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
index 704be0b027..4e2e2b4117 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
@@ -78,3 +78,63 @@ func TestClearSessionCookie_Attributes(t *testing.T) {
 	assert.True(t, c.Partitioned)
 	assert.Equal(t, http.SameSiteNoneMode, c.SameSite)
 }
+
+func TestValidateSessionCookie_Valid(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequest("GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	claims, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.True(t, ok)
+	require.NotNil(t, claims)
+	assert.Equal(t, "app-123", claims.AppID)
+}
+
+func TestValidateSessionCookie_Missing(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	r := httptest.NewRequest("GET", "/anything", nil)
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}
+
+func TestValidateSessionCookie_AppMismatch(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+	r := httptest.NewRequest("GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}
+
+func TestValidateSessionCookie_Expired(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+	clock.Advance(5 * time.Hour)
+	r := httptest.NewRequest("GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}
+
+func TestValidateSessionCookie_ProjectMismatch(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "different-project", 4*time.Hour)
+	require.NoError(t, err)
+	r := httptest.NewRequest("GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}

From f944fe9b528f80714c57df9855dddfca3e38f7e4 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:28:02 +0200
Subject: [PATCH 19/49] feat(apps-proxy): wire kai-preview into apphandler
 routing

- Add StorageAPIURL to config.Config (required field, defaults to
  connection.keboola.com) so the STA verifier can be constructed.
- Add clock and staVerifier to apphandler.Manager; constructed in
  NewManager using d.Clock() and kaipreview.NewSTAVerifier().
- Add kaiPreview field to appHandler; constructed per-app in
  newAppHandler with a DevModeCheckerFunc backed by the live K8s
  state watcher.
- Insert kai-preview routing decisions in serveHTTPOrError (between
  the hostname-redirect and the existing internal URL routing):
    1. /_proxy/kai-preview/* -> kai-preview composite handler
    2. Valid session cookie -> forward to upstream, skip AuthRules
       (TODO T15: sliding refresh)
    3. Sec-Fetch-Dest=iframe with no session -> serve bootstrap shim
  - Falls through to existing AuthRules when DevMode is false.
- Add isDevMode() helper that re-reads live K8s cache per request.
- Update mocked dependency scope to auto-populate StorageAPIURL and
  KaiPreview signing keys for test configurations.
- Add scaffolded integration test (t.Skip) in apphandler package.
- Add three real integration tests to proxy_test.go: bootstrap on
  dev-mode app, fall-through on non-dev-mode app, and iframe
  bootstrap fallback detection.
---
 .../pkg/service/appsproxy/config/config.go    |  5 ++
 .../service/appsproxy/dependencies/mocked.go  | 14 +++
 .../appsproxy/proxy/apphandler/apphandler.go  | 49 +++++++++++
 .../apphandler/kaipreview_integration_test.go | 33 +++++++
 .../appsproxy/proxy/apphandler/manager.go     | 17 +++-
 .../pkg/service/appsproxy/proxy/proxy_test.go | 85 +++++++++++++++++++
 6 files changed, 202 insertions(+), 1 deletion(-)
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index e557060fa8..8e9e8f90fd 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -24,6 +24,7 @@ type Config struct {
 	Upstream         Upstream          `configKey:"-" configUsage:"Configuration options for upstream"`
 	SandboxesAPI     SandboxesAPI      `configKey:"sandboxesAPI"`
 	CsrfTokenSalt    string            `configKey:"csrfTokenSalt" configUsage:"Salt used for generating CSRF tokens" validate:"required" sensitive:"true"`
+	StorageAPIURL    *url.URL          `configKey:"storageApiUrl" configUsage:"Base URL of the Keboola Storage API used for STA token verification (kai-preview flow). E.g. https://connection.keboola.com" validate:"required"`
 	KaiPreview       KaiPreview        `configKey:"kaiPreview" configUsage:"kai-preview iframe-auth configuration."`
 	K8s              K8s               `configKey:"k8s" configUsage:"Kubernetes configuration."`
 	E2bWebhook       E2BWebhook        `configKey:"e2bWebhook"`
@@ -86,6 +87,10 @@ func New() Config {
 		KaiPreview: KaiPreview{
 			SessionTTL: 4 * time.Hour,
 		},
+		StorageAPIURL: &url.URL{
+			Scheme: "https",
+			Host:   "connection.keboola.com",
+		},
 	}
 }
 
diff --git a/internal/pkg/service/appsproxy/dependencies/mocked.go b/internal/pkg/service/appsproxy/dependencies/mocked.go
index d857f0b688..5f7ca5a006 100644
--- a/internal/pkg/service/appsproxy/dependencies/mocked.go
+++ b/internal/pkg/service/appsproxy/dependencies/mocked.go
@@ -77,6 +77,20 @@ func newMockedServiceScope(tb testing.TB, ctx context.Context, cfg config.Config
 	if cfg.SandboxesAPI.Token == "" {
 		cfg.SandboxesAPI.Token = "my-token"
 	}
+	if cfg.StorageAPIURL == nil {
+		var err error
+		cfg.StorageAPIURL, err = url.Parse("https://connection.keboola.com")
+		require.NoError(tb, err)
+	}
+	if cfg.KaiPreview.HandshakeSigningKey == "" {
+		cfg.KaiPreview.HandshakeSigningKey = "test-handshake-signing-key-for-mocked-scope"
+	}
+	if cfg.KaiPreview.SessionSigningKey == "" {
+		cfg.KaiPreview.SessionSigningKey = "test-session-signing-key-for-mocked-scope"
+	}
+	if len(cfg.KaiPreview.AllowedIDEOrigins) == 0 {
+		cfg.KaiPreview.AllowedIDEOrigins = []string{"https://connection.keboola.com"}
+	}
 	if cfg.K8s.AppsNamespace == "" {
 		cfg.K8s.AppsNamespace = "keboola"
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 5c2ec57699..e5bdf633b0 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -3,6 +3,7 @@
 package apphandler
 
 import (
+	"context"
 	"net/http"
 	"net/url"
 	"strings"
@@ -13,6 +14,7 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/api"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/auth/provider"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/selector"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/chain"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/common/ctxattr"
@@ -29,11 +31,18 @@ type appHandler struct {
 	upstream           chain.Handler
 	allAuthHandlers    chain.Handler
 	authHandlerPerRule map[ruleIndex]chain.Handler
+	kaiPreview         *kaipreview.Handler
 }
 
 type ruleIndex int
 
 func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handler, authHandlers map[provider.ID]selector.Handler) (http.Handler, error) {
+	// DevModeChecker is backed by the live K8s state watcher: re-evaluates on every request.
+	devModeChecker := kaipreview.DevModeCheckerFunc(func(appID string) bool {
+		info, ok := manager.upstreamManager.AppInfo(context.Background(), api.AppID(appID))
+		return ok && info.DevMode
+	})
+
 	handler := &appHandler{
 		manager:            manager,
 		app:                app,
@@ -41,6 +50,18 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 		attrs:              app.Telemetry(),
 		upstream:           appUpstream,
 		authHandlerPerRule: make(map[ruleIndex]chain.Handler),
+		kaiPreview: kaipreview.NewHandler(kaipreview.HandlerDeps{
+			Clock:             manager.clock,
+			STA:               manager.staVerifier,
+			DevMode:           devModeChecker,
+			CORS:              kaipreview.NewCORS(manager.config.KaiPreview.AllowedIDEOrigins),
+			HandshakeKey:      manager.config.KaiPreview.HandshakeSigningKey,
+			SessionKey:        manager.config.KaiPreview.SessionSigningKey,
+			SessionTTL:        manager.config.KaiPreview.SessionTTL,
+			AllowedIDEOrigins: manager.config.KaiPreview.AllowedIDEOrigins,
+			AppID:             string(app.ID),
+			AppProjectID:      app.ProjectID,
+		}),
 	}
 
 	// Create handler with all auth handlers, to route internal URLs
@@ -146,6 +167,26 @@ func (h *appHandler) serveHTTPOrError(w http.ResponseWriter, req *http.Request)
 		return nil
 	}
 
+	// kai-preview: dev-mode iframe-auth path.
+	// (routing decision documented in spec § "apps-proxy: routing decision for dev-mode apps")
+	if h.isDevMode(req.Context()) {
+		// 1. /_proxy/kai-preview/* routes go to the kai-preview composite handler.
+		if strings.HasPrefix(req.URL.Path, kaipreview.PathPrefix) {
+			return h.kaiPreview.ServeHTTPOrError(w, req)
+		}
+		// 2. Valid session cookie → forward to upstream, skip AuthRules.
+		if _, ok := kaipreview.ValidateSessionCookie(req, h.manager.config.KaiPreview.SessionSigningKey, h.manager.clock, string(h.app.ID), h.app.ProjectID); ok {
+			// TODO(T15): sliding refresh — re-mint when claims.NeedsRefresh(now) is true.
+			return h.upstream.ServeHTTPOrError(w, req)
+		}
+		// 3. Iframe document load on a dev-mode app with no session → serve bootstrap shim.
+		if kaipreview.IsIframeDocumentLoad(req) {
+			bootstrapReq := req.Clone(req.Context())
+			bootstrapReq.URL.Path = kaipreview.PathPrefix + "/bootstrap"
+			return h.kaiPreview.ServeHTTPOrError(w, bootstrapReq)
+		}
+	}
+
 	// Route internal URLs if there is at least one auth handler
 	if strings.HasPrefix(req.URL.Path, config.InternalPrefix) && h.allAuthHandlers != nil {
 		return h.allAuthHandlers.ServeHTTPOrError(w, req)
@@ -173,3 +214,11 @@ func (h *appHandler) serveRule(w http.ResponseWriter, req *http.Request, index r
 	// Serve the request without authentication
 	return h.upstream.ServeHTTPOrError(w, req)
 }
+
+// isDevMode reports whether this app currently has DevMode enabled.
+// It reads from the live K8s state cache so toggling DevMode on the App CRD takes
+// effect on the next request without requiring handler recreation.
+func (h *appHandler) isDevMode(ctx context.Context) bool {
+	info, ok := h.manager.upstreamManager.AppInfo(ctx, h.app.ID)
+	return ok && info.DevMode
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go
new file mode 100644
index 0000000000..005a8c698e
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go
@@ -0,0 +1,33 @@
+package apphandler_test
+
+import (
+	"testing"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+)
+
+// TestApphandler_KaiPreview_FullFlow is a scaffolded end-to-end integration test
+// for the kai-preview routing decisions wired into serveHTTPOrError.
+//
+// The full harness requires the complete proxy stack (Service scope, fake K8s client,
+// test HTTP server) which lives in proxy_test.go. The test scenarios below should be
+// migrated to proxy_test.go once the STA mock server is available alongside the test
+// app server (Task 16 / T15 follow-up).
+//
+// Scenarios to implement:
+//  1. Dev-mode app: GET /_proxy/kai-preview/bootstrap → 200 with shim HTML.
+//  2. Dev-mode app: GET /_proxy/kai-preview/embed-token (OPTIONS preflight, allowed origin) → 204.
+//  3. Dev-mode app: GET / with valid session cookie → upstream (no OAuth redirect).
+//  4. Dev-mode app: GET / without cookie, Sec-Fetch-Dest=iframe, Accept=text/html → bootstrap shim (200).
+//  5. Dev-mode app: GET / without cookie, Sec-Fetch-Dest=document → falls through to AuthRules.
+//  6. Non-dev-mode app: GET /_proxy/kai-preview/bootstrap → 404 (dev-mode gate inside kaipreview handler).
+//  7. Flip DevMode=false on live app: all /_proxy/kai-preview/* return 404; stale cookie → AuthRules.
+//
+// See proxy_test.go testCase harness and the "devmode" app fixture for the integration pattern.
+func TestApphandler_KaiPreview_FullFlow(t *testing.T) {
+	t.Parallel()
+	t.Skip("Scaffolded — fill in alongside the full-flow test in T15/T16 once STA mock server is available. See proxy_test.go for the test harness pattern and the 'devmode' app fixture.")
+
+	// Satisfy the import so the file compiles cleanly.
+	_ = kaipreview.SessionCookieName
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index 9359ead14d..7839bdecd8 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -6,12 +6,16 @@ import (
 	"encoding/hex"
 	"net/http"
 	"sync"
+	"time"
+
+	"github.com/jonboulle/clockwork"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/api"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/appconfig"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/k8sapp"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/upstream"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/pagewriter"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/syncmap"
@@ -29,6 +33,8 @@ type Manager struct {
 	authProxyManager *authproxy.Manager
 	pageWriter       *pagewriter.Writer
 	handlers         *syncmap.SyncMap[api.AppID, appHandlerWrapper]
+	clock            clockwork.Clock
+	staVerifier      kaipreview.STATokenVerifier
 }
 
 type appHandlerWrapper struct {
@@ -39,6 +45,7 @@ type appHandlerWrapper struct {
 }
 
 type dependencies interface {
+	Clock() clockwork.Clock
 	Config() config.Config
 	Telemetry() telemetry.Telemetry
 	PageWriter() *pagewriter.Writer
@@ -48,8 +55,14 @@ type dependencies interface {
 }
 
 func NewManager(d dependencies) *Manager {
+	cfg := d.Config()
+	var storageAPIURL string
+	if cfg.StorageAPIURL != nil {
+		storageAPIURL = cfg.StorageAPIURL.String()
+	}
+	staHTTPClient := &http.Client{Timeout: 5 * time.Second}
 	return &Manager{
-		config:           d.Config(),
+		config:           cfg,
 		telemetry:        d.Telemetry(),
 		configLoader:     d.AppConfigLoader(),
 		upstreamManager:  d.UpstreamManager(),
@@ -58,6 +71,8 @@ func NewManager(d dependencies) *Manager {
 		handlers: syncmap.New[api.AppID, appHandlerWrapper](func(api.AppID) *appHandlerWrapper {
 			return &appHandlerWrapper{lock: &sync.Mutex{}}
 		}),
+		clock:       d.Clock(),
+		staVerifier: kaipreview.NewSTAVerifier(storageAPIURL, staHTTPClient),
 	}
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/proxy_test.go b/internal/pkg/service/appsproxy/proxy/proxy_test.go
index 9c6ef20c03..9e690bb021 100644
--- a/internal/pkg/service/appsproxy/proxy/proxy_test.go
+++ b/internal/pkg/service/appsproxy/proxy/proxy_test.go
@@ -2429,6 +2429,91 @@ func TestAppProxyRouter(t *testing.T) {
 			},
 			expectedNotifications: map[string]int{},
 		},
+		{
+			// kai-preview: GET /_proxy/kai-preview/bootstrap on a dev-mode app (Running) → 200 with HTML shim.
+			name: "kai-preview-bootstrap-dev-mode-running",
+			setupK8s: func(t *testing.T, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				patch := []byte(`{"spec":{"devMode":{"enabled":true}},"status":{"currentState":"Running"}}`)
+				_, err := fakeClient.Resource(k8sapp.AppGVR()).Namespace("keboola").Patch(
+					t.Context(), "app-devmode", k8stypes.MergePatchType, patch, metav1.PatchOptions{},
+				)
+				require.NoError(t, err)
+				require.Eventually(t, func() bool {
+					info, ok := watcher.GetState(t.Context(), api.AppID("devmode"))
+					return ok && info.DevMode && info.ActualState == k8sapp.AppActualStateRunning
+				}, 5*time.Second, 50*time.Millisecond)
+			},
+			run: func(t *testing.T, client *http.Client, m []*mockoidc.MockOIDC, appServer *testutil.AppServer, service *testutil.DataAppsAPI, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://dev-devmode.hub.keboola.local/_proxy/kai-preview/bootstrap", nil)
+				require.NoError(t, err)
+				response, err := client.Do(request)
+				require.NoError(t, err)
+				require.Equal(t, http.StatusOK, response.StatusCode)
+				body, err := io.ReadAll(response.Body)
+				require.NoError(t, err)
+				// The bootstrap shim is an HTML page with postMessage logic.
+				assert.Contains(t, response.Header.Get("Content-Type"), "text/html")
+				// The bootstrap shim references the exchange path.
+				assert.Contains(t, string(body), "/_proxy/kai-preview/exchange")
+			},
+			expectedNotifications: map[string]int{},
+		},
+		{
+			// kai-preview: GET /_proxy/kai-preview/bootstrap on a non-dev-mode app falls through to
+			// AuthRules. The "devmode" app has AuthRequired=false, so the upstream is reached — the
+			// kai-preview bootstrap shim is NOT served.
+			name: "kai-preview-bootstrap-non-dev-mode",
+			run: func(t *testing.T, client *http.Client, m []*mockoidc.MockOIDC, appServer *testutil.AppServer, service *testutil.DataAppsAPI, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				// "devmode" app has DevMode=false by default (makeDefaultK8sObjects does not set devMode).
+				request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://dev-devmode.hub.keboola.local/_proxy/kai-preview/bootstrap", nil)
+				require.NoError(t, err)
+				response, err := client.Do(request)
+				require.NoError(t, err)
+				// With DevMode=false the request falls through to the AuthRules path.
+				// The "devmode" app is public (AuthRequired=false), so the upstream responds directly.
+				require.Equal(t, http.StatusOK, response.StatusCode)
+				body, err := io.ReadAll(response.Body)
+				require.NoError(t, err)
+				// Upstream app returns its response; the bootstrap shim is NOT served.
+				assert.Equal(t, "Hello, client", string(body))
+			},
+			expectedNotifications: map[string]int{
+				"devmode": 1,
+			},
+		},
+		{
+			// kai-preview: GET / with Sec-Fetch-Dest=iframe on a dev-mode Running app and no session cookie
+			// → proxy serves the bootstrap shim (iframe document load detection).
+			name: "kai-preview-iframe-bootstrap-fallback",
+			setupK8s: func(t *testing.T, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				patch := []byte(`{"spec":{"devMode":{"enabled":true}},"status":{"currentState":"Running"}}`)
+				_, err := fakeClient.Resource(k8sapp.AppGVR()).Namespace("keboola").Patch(
+					t.Context(), "app-devmode", k8stypes.MergePatchType, patch, metav1.PatchOptions{},
+				)
+				require.NoError(t, err)
+				require.Eventually(t, func() bool {
+					info, ok := watcher.GetState(t.Context(), api.AppID("devmode"))
+					return ok && info.DevMode && info.ActualState == k8sapp.AppActualStateRunning
+				}, 5*time.Second, 50*time.Millisecond)
+			},
+			run: func(t *testing.T, client *http.Client, m []*mockoidc.MockOIDC, appServer *testutil.AppServer, service *testutil.DataAppsAPI, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://dev-devmode.hub.keboola.local/", nil)
+				require.NoError(t, err)
+				// Simulate an iframe document load (Sec-Fetch-Dest=iframe + Accept=text/html).
+				request.Header.Set("Sec-Fetch-Dest", "iframe")
+				request.Header.Set("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
+				response, err := client.Do(request)
+				require.NoError(t, err)
+				require.Equal(t, http.StatusOK, response.StatusCode)
+				body, err := io.ReadAll(response.Body)
+				require.NoError(t, err)
+				// Should be the bootstrap shim HTML, not the upstream app response.
+				assert.Contains(t, response.Header.Get("Content-Type"), "text/html")
+				assert.NotEqual(t, "Hello, client", strings.TrimSpace(string(body)))
+				assert.NotEmpty(t, string(body))
+			},
+			expectedNotifications: map[string]int{},
+		},
 	}
 
 	publicAppTestCaseFactory := func(method string) testCase {

From acfdcdbf17717801c82df3eca77965a727d2d7f3 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:40:00 +0200
Subject: [PATCH 20/49] fix(apps-proxy): thread context through DevModeChecker;
 assert StorageAPIURL at startup

Extend DevModeChecker.IsDevMode to accept a context.Context so that request
trace IDs propagate through to AppInfo log lines instead of being dropped via
context.Background(). Update DevModeCheckerFunc, all three endpoint handlers
(embed_token, exchange, refresh), their test stubs, and the apphandler closure.

Replace the StorageAPIURL nil-guard in manager.NewManager with an explicit
panic so misconfiguration surfaces at startup rather than silently producing
an empty URL.

Delete the scaffolded kaipreview_integration_test.go; real integration tests
belong in proxy_test.go alongside the existing kai-preview fixtures.
---
 .../appsproxy/proxy/apphandler/apphandler.go  |  4 +--
 .../authproxy/kaipreview/embed_token.go       |  4 +--
 .../authproxy/kaipreview/embed_token_test.go  |  2 +-
 .../authproxy/kaipreview/exchange.go          |  2 +-
 .../authproxy/kaipreview/handler.go           |  5 +--
 .../authproxy/kaipreview/refresh.go           |  2 +-
 .../apphandler/kaipreview_integration_test.go | 33 -------------------
 .../appsproxy/proxy/apphandler/manager.go     |  6 ++--
 8 files changed, 13 insertions(+), 45 deletions(-)
 delete mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index e5bdf633b0..11879c8159 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -38,8 +38,8 @@ type ruleIndex int
 
 func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handler, authHandlers map[provider.ID]selector.Handler) (http.Handler, error) {
 	// DevModeChecker is backed by the live K8s state watcher: re-evaluates on every request.
-	devModeChecker := kaipreview.DevModeCheckerFunc(func(appID string) bool {
-		info, ok := manager.upstreamManager.AppInfo(context.Background(), api.AppID(appID))
+	devModeChecker := kaipreview.DevModeCheckerFunc(func(ctx context.Context, appID string) bool {
+		info, ok := manager.upstreamManager.AppInfo(ctx, api.AppID(appID))
 		return ok && info.DevMode
 	})
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
index 5dc029fb96..585f515822 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
@@ -18,7 +18,7 @@ type STATokenVerifier interface {
 // DevModeChecker tells the handler whether the current app is in dev mode.
 // Backed by the apps-proxy CRD watcher (AppInfo.DevMode).
 type DevModeChecker interface {
-	IsDevMode(appID string) bool
+	IsDevMode(ctx context.Context, appID string) bool
 }
 
 type EmbedTokenDeps struct {
@@ -59,7 +59,7 @@ func (h *EmbedTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Requ
 	h.deps.CORS.WriteResponseHeaders(w, origin)
 
 	// Dev-mode gate first: pretend the endpoint doesn't exist on non-dev apps.
-	if !h.deps.DevMode.IsDevMode(h.deps.AppID) {
+	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
 		http.NotFound(w, r)
 		return nil
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
index 06a193e040..65d4a7a348 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
@@ -27,7 +27,7 @@ func (s *stubSTAVerifier) Verify(_ context.Context, _ string) (*STAVerifyResult,
 
 type stubDevModeChecker struct{ devMode bool }
 
-func (s *stubDevModeChecker) IsDevMode(_ string) bool { return s.devMode }
+func (s *stubDevModeChecker) IsDevMode(_ context.Context, _ string) bool { return s.devMode }
 
 var errStubUnauth = &stubErr{msg: "unauthorized"}
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
index a7f6b1ccc7..2c62552a63 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
@@ -35,7 +35,7 @@ func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reques
 	}
 
 	// Dev-mode gate: pretend the endpoint doesn't exist on non-dev apps.
-	if !h.deps.DevMode.IsDevMode(h.deps.AppID) {
+	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
 		http.NotFound(w, r)
 		return nil
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
index 939e39cd8a..a02cba9027 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
@@ -1,6 +1,7 @@
 package kaipreview
 
 import (
+	"context"
 	"net/http"
 	"strings"
 	"time"
@@ -21,10 +22,10 @@ const (
 )
 
 // DevModeCheckerFunc adapts a plain function to the DevModeChecker interface.
-type DevModeCheckerFunc func(appID string) bool
+type DevModeCheckerFunc func(ctx context.Context, appID string) bool
 
 // IsDevMode implements DevModeChecker.
-func (f DevModeCheckerFunc) IsDevMode(appID string) bool { return f(appID) }
+func (f DevModeCheckerFunc) IsDevMode(ctx context.Context, appID string) bool { return f(ctx, appID) }
 
 type HandlerDeps struct {
 	Clock             clockwork.Clock
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
index 5ff49c1f43..8305e3573c 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
@@ -45,7 +45,7 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 	// SPA can read status codes and bodies of auth-failure responses, not just successes.
 	h.deps.CORS.WriteResponseHeaders(w, origin)
 
-	if !h.deps.DevMode.IsDevMode(h.deps.AppID) {
+	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
 		http.NotFound(w, r)
 		return nil
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go
deleted file mode 100644
index 005a8c698e..0000000000
--- a/internal/pkg/service/appsproxy/proxy/apphandler/kaipreview_integration_test.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package apphandler_test
-
-import (
-	"testing"
-
-	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
-)
-
-// TestApphandler_KaiPreview_FullFlow is a scaffolded end-to-end integration test
-// for the kai-preview routing decisions wired into serveHTTPOrError.
-//
-// The full harness requires the complete proxy stack (Service scope, fake K8s client,
-// test HTTP server) which lives in proxy_test.go. The test scenarios below should be
-// migrated to proxy_test.go once the STA mock server is available alongside the test
-// app server (Task 16 / T15 follow-up).
-//
-// Scenarios to implement:
-//  1. Dev-mode app: GET /_proxy/kai-preview/bootstrap → 200 with shim HTML.
-//  2. Dev-mode app: GET /_proxy/kai-preview/embed-token (OPTIONS preflight, allowed origin) → 204.
-//  3. Dev-mode app: GET / with valid session cookie → upstream (no OAuth redirect).
-//  4. Dev-mode app: GET / without cookie, Sec-Fetch-Dest=iframe, Accept=text/html → bootstrap shim (200).
-//  5. Dev-mode app: GET / without cookie, Sec-Fetch-Dest=document → falls through to AuthRules.
-//  6. Non-dev-mode app: GET /_proxy/kai-preview/bootstrap → 404 (dev-mode gate inside kaipreview handler).
-//  7. Flip DevMode=false on live app: all /_proxy/kai-preview/* return 404; stale cookie → AuthRules.
-//
-// See proxy_test.go testCase harness and the "devmode" app fixture for the integration pattern.
-func TestApphandler_KaiPreview_FullFlow(t *testing.T) {
-	t.Parallel()
-	t.Skip("Scaffolded — fill in alongside the full-flow test in T15/T16 once STA mock server is available. See proxy_test.go for the test harness pattern and the 'devmode' app fixture.")
-
-	// Satisfy the import so the file compiles cleanly.
-	_ = kaipreview.SessionCookieName
-}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index 7839bdecd8..3898efe1af 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -56,10 +56,10 @@ type dependencies interface {
 
 func NewManager(d dependencies) *Manager {
 	cfg := d.Config()
-	var storageAPIURL string
-	if cfg.StorageAPIURL != nil {
-		storageAPIURL = cfg.StorageAPIURL.String()
+	if cfg.StorageAPIURL == nil {
+		panic("appsproxy: StorageAPIURL is required for kai-preview STA verification")
 	}
+	storageAPIURL := cfg.StorageAPIURL.String()
 	staHTTPClient := &http.Client{Timeout: 5 * time.Second}
 	return &Manager{
 		config:           cfg,

From 73a66180464f3cd4933362f875b907035f3671d2 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:47:08 +0200
Subject: [PATCH 21/49] feat(apps-proxy): kai-preview sliding session refresh
 on midpoint

When a request arrives with a valid kai-preview session cookie whose age
has passed the TTL midpoint (NeedsRefresh == true), the proxy mints a
fresh JWT and emits Set-Cookie on the response before forwarding to
upstream. Replaces the TODO(T15) stub added in T14.

Adds TestKaiPreviewSlidingRefresh: a focused regression test that injects
a FakeClock, asserts no Set-Cookie before midpoint (t+1h / 4h TTL), and
confirms Set-Cookie with a valid fresh JWT appears after midpoint (t+3h).
---
 .../appsproxy/proxy/apphandler/apphandler.go  |  24 ++-
 .../pkg/service/appsproxy/proxy/proxy_test.go | 148 ++++++++++++++++++
 2 files changed, 169 insertions(+), 3 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 11879c8159..171308dfbc 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -174,9 +174,27 @@ func (h *appHandler) serveHTTPOrError(w http.ResponseWriter, req *http.Request)
 		if strings.HasPrefix(req.URL.Path, kaipreview.PathPrefix) {
 			return h.kaiPreview.ServeHTTPOrError(w, req)
 		}
-		// 2. Valid session cookie → forward to upstream, skip AuthRules.
-		if _, ok := kaipreview.ValidateSessionCookie(req, h.manager.config.KaiPreview.SessionSigningKey, h.manager.clock, string(h.app.ID), h.app.ProjectID); ok {
-			// TODO(T15): sliding refresh — re-mint when claims.NeedsRefresh(now) is true.
+		// 2. Valid session cookie → forward to upstream (skip AuthRules), with sliding refresh.
+		if claims, ok := kaipreview.ValidateSessionCookie(
+			req,
+			h.manager.config.KaiPreview.SessionSigningKey,
+			h.manager.clock,
+			string(h.app.ID),
+			h.app.ProjectID,
+		); ok {
+			if claims.NeedsRefresh(h.manager.clock.Now()) {
+				newJWT, err := kaipreview.MintSessionJWT(
+					h.manager.config.KaiPreview.SessionSigningKey,
+					h.manager.clock,
+					string(h.app.ID),
+					h.app.ProjectID,
+					h.manager.config.KaiPreview.SessionTTL,
+				)
+				if err == nil {
+					kaipreview.SetSessionCookie(w, newJWT, h.manager.config.KaiPreview.SessionTTL)
+				}
+				// If mint fails, just forward without refresh — the existing cookie is still valid.
+			}
 			return h.upstream.ServeHTTPOrError(w, req)
 		}
 		// 3. Iframe document load on a dev-mode app with no session → serve bootstrap shim.
diff --git a/internal/pkg/service/appsproxy/proxy/proxy_test.go b/internal/pkg/service/appsproxy/proxy/proxy_test.go
index 9e690bb021..ead3d7eb30 100644
--- a/internal/pkg/service/appsproxy/proxy/proxy_test.go
+++ b/internal/pkg/service/appsproxy/proxy/proxy_test.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/coder/websocket"
 	"github.com/coder/websocket/wsjson"
+	"github.com/jonboulle/clockwork"
 	"github.com/keboola/go-utils/pkg/wildcards"
 	"github.com/oauth2-proxy/mockoidc"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
@@ -47,6 +48,7 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/k8sapp"
 	proxyDependencies "github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dependencies"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/oauthproxy/logging"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/pagewriter"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/testutil"
@@ -3156,6 +3158,152 @@ func registerDefaultK8sApps(t *testing.T, watcher *k8sapp.StateWatcher) {
 	require.True(t, watcher.WaitForCacheSync(t.Context()), "App CRD informer cache sync timed out")
 }
 
+// TestKaiPreviewSlidingRefresh is a focused regression test for the sliding-refresh path in
+// apphandler.serveHTTPOrError. It boots a dev-mode app via the standard harness but injects a
+// FakeClock so that time can be advanced deterministically.
+//
+//   - At t+1h (before midpoint of 4h TTL) → no Set-Cookie on the response.
+//   - At t+3h (past midpoint) → Set-Cookie: kbc-kai-preview-session=… appears and the new JWT
+//     validates as fresh (NeedsRefresh==false immediately after issuance).
+func TestKaiPreviewSlidingRefresh(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	const sessionTTL = 4 * time.Hour
+
+	fakeClock := clockwork.NewFakeClock()
+
+	// Create testing apps API and upstream.
+	tmpDir := t.TempDir()
+	pm, _ := server.NewPortManager(t, tmpDir, "appsproxy")
+	appsAPI := testutil.StartDataAppsAPI(t, pm)
+	t.Cleanup(func() { appsAPI.Close() })
+	appServer := testutil.StartAppServer(t, pm)
+	t.Cleanup(func() { appServer.Close() })
+
+	providers := testAuthProviders(t, pm)
+	appURL := testutil.AppServerURL(t, appServer)
+	apps := testDataApps(appURL, providers)
+	appsAPI.Register(apps)
+
+	// Build the service scope with an injected FakeClock so the proxy sees our
+	// controlled notion of "now".
+	secret := make([]byte, 32)
+	_, err := rand.Read(secret)
+	require.NoError(t, err)
+	csrfSecret := make([]byte, 32)
+	_, err = rand.Read(csrfSecret)
+	require.NoError(t, err)
+
+	cfg := config.New()
+	cfg.API.PublicURL, _ = url.Parse("https://hub.keboola.local")
+	cfg.CookieSecretSalt = string(secret)
+	cfg.CsrfTokenSalt = string(csrfSecret)
+	cfg.SandboxesAPI.URL = appsAPI.URL
+	cfg.KaiPreview.SessionTTL = sessionTTL
+
+	d, mocked := proxyDependencies.NewMockedServiceScopeWithK8sObjects(
+		t, ctx, cfg,
+		makeDefaultK8sObjects(apps, appURL.String()),
+		dependencies.WithRealHTTPClient(),
+		dependencies.WithClock(fakeClock),
+	)
+	defer func() {
+		d.Process().Shutdown(ctx, errors.New("bye bye"))
+		d.Process().WaitForShutdown()
+	}()
+
+	// Wire logging the same way as createProxyHandler.
+	loggerWriter := logging.NewLoggerWriter(d.Logger(), "info")
+	logger.SetOutput(loggerWriter)
+	logger.SetErrOutput(loggerWriter)
+	handler := proxy.NewHandler(ctx, d)
+
+	// Boot a TLS proxy server.
+	port := pm.GetFreePort()
+	var lc net.ListenConfig
+	l, err := lc.Listen(ctx, "tcp", fmt.Sprintf("127.0.0.1:%d", port))
+	require.NoError(t, err)
+	proxySrv := &httptest.Server{
+		Listener: l,
+		Config:   &http.Server{Handler: handler, ReadHeaderTimeout: 5 * time.Second, ErrorLog: log.NewStdErrorLogger(d.Logger())},
+	}
+	proxySrv.StartTLS()
+	t.Cleanup(func() { proxySrv.Close() })
+
+	proxyURL, err := url.Parse(proxySrv.URL)
+	require.NoError(t, err)
+	client := createHTTPClient(t, proxyURL)
+
+	// Wait for K8s informer to sync, then enable DevMode=Running for the "devmode" app.
+	registerDefaultK8sApps(t, d.AppStateWatcher())
+	patch := []byte(`{"spec":{"devMode":{"enabled":true}},"status":{"currentState":"Running"}}`)
+	_, err = mocked.TestFakeK8sClient().Resource(k8sapp.AppGVR()).Namespace("keboola").Patch(
+		ctx, "app-devmode", k8stypes.MergePatchType, patch, metav1.PatchOptions{},
+	)
+	require.NoError(t, err)
+	require.Eventually(t, func() bool {
+		info, ok := d.AppStateWatcher().GetState(ctx, api.AppID("devmode"))
+		return ok && info.DevMode && info.ActualState == k8sapp.AppActualStateRunning
+	}, 5*time.Second, 50*time.Millisecond)
+
+	// Retrieve the session signing key that the mocked scope auto-filled.
+	sessionKey := mocked.TestConfig().KaiPreview.SessionSigningKey
+
+	// Mint a session JWT anchored at FakeClock's current time (t=0).
+	rawJWT, err := kaipreview.MintSessionJWT(sessionKey, fakeClock, "devmode", "123", sessionTTL)
+	require.NoError(t, err)
+
+	sendRequest := func(t *testing.T) *http.Response {
+		t.Helper()
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://dev-devmode.hub.keboola.local/", nil)
+		require.NoError(t, err)
+		req.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: rawJWT})
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		return resp
+	}
+
+	// --- t+1h: before midpoint — no refresh expected ---
+	fakeClock.Advance(1 * time.Hour)
+	resp := sendRequest(t)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	_, _ = io.ReadAll(resp.Body)
+	resp.Body.Close()
+
+	var setCookieHeader string
+	for _, c := range resp.Cookies() {
+		if c.Name == kaipreview.SessionCookieName {
+			setCookieHeader = c.Value
+		}
+	}
+	assert.Empty(t, setCookieHeader, "expected no Set-Cookie at t+1h (before midpoint)")
+
+	// --- t+3h: past midpoint (3h > 4h/2) — refresh expected ---
+	fakeClock.Advance(2 * time.Hour) // total 3h elapsed
+	resp = sendRequest(t)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	_, _ = io.ReadAll(resp.Body)
+	resp.Body.Close()
+
+	var refreshedJWT string
+	for _, c := range resp.Cookies() {
+		if c.Name == kaipreview.SessionCookieName {
+			refreshedJWT = c.Value
+		}
+	}
+	require.NotEmpty(t, refreshedJWT, "expected Set-Cookie with refreshed JWT at t+3h")
+
+	// Verify the new JWT is valid and immediately fresh (NeedsRefresh should be false right now).
+	newClaims, err := kaipreview.VerifySessionJWT(sessionKey, fakeClock, refreshedJWT)
+	require.NoError(t, err)
+	assert.Equal(t, "devmode", newClaims.AppID)
+	assert.Equal(t, "123", newClaims.ProjectID)
+	assert.False(t, newClaims.NeedsRefresh(fakeClock.Now()), "newly minted JWT should not need refresh immediately")
+
+	assert.Empty(t, mocked.DebugLogger().ErrorMessages())
+}
+
 // makeDefaultK8sObjects converts a slice of app configs into K8s unstructured App CRD objects
 // with Running state and the given upstream URL. Pass the result to NewMockedServiceScopeWithK8sObjects
 // so the fake client is pre-populated before the informer starts.

From 5142e6cacdfdb4c039b10b348d903feebe280dcf Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:51:53 +0200
Subject: [PATCH 22/49] docs(apps-proxy): kai-preview operator overview +
 smoke-test runbook

Add operator-facing documentation for the kai-preview iframe-auth flow,
covering endpoint reference, config keys, routing decision tree,
multi-replica stateless behavior, and a step-by-step smoke-test runbook
(Tasks 16 + 17).
---
 docs/apps-proxy/kai-preview.md | 343 +++++++++++++++++++++++++++++++++
 1 file changed, 343 insertions(+)
 create mode 100644 docs/apps-proxy/kai-preview.md

diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
new file mode 100644
index 0000000000..c00432e0b6
--- /dev/null
+++ b/docs/apps-proxy/kai-preview.md
@@ -0,0 +1,343 @@
+# Kai-Preview Iframe-Auth: Operator Guide
+
+## 1. Overview
+
+apps-proxy exposes a dev-mode-only authentication path that lets the kbc-ui SPA
+embed a running data app inside an `<iframe>` without prompting the user with the
+app's configured OAuth or Basic auth flow. The flow uses a short-lived HMAC
+handshake JWT (60 s) that the SPA mints via a Storage API token and then exchanges
+for a host-only session cookie. Direct (non-iframe) access to the app still goes
+through the configured `AuthRules` as before; the kai-preview path is invisible to
+end-users browsing directly.
+
+---
+
+## 2. When Does It Activate?
+
+The kai-preview path is active only when **both** of the following are true:
+
+1. The app's `App` CRD has `spec.devMode.enabled: true`.
+2. The kbc-ui SPA calls `POST /_proxy/kai-preview/embed-token` with a valid
+   Storage API token in the `X-StorageApi-Token` header.
+
+When `spec.devMode.enabled` is `false` (or absent) every kai-preview endpoint
+returns `404`. No config flag disables the path at the proxy level — dev-mode on
+the CRD is the single gate.
+
+---
+
+## 3. Endpoints
+
+All endpoints live under the prefix `/_proxy/kai-preview`. They return `404` on
+apps that do not have dev-mode enabled.
+
+| Endpoint | Method | Auth | Notes |
+|---|---|---|---|
+| `/_proxy/kai-preview/embed-token` | `POST` | `X-StorageApi-Token` header (CORS) | Mint a 60 s handshake JWT after verifying the STA token against Storage API |
+| `/_proxy/kai-preview/bootstrap`   | `GET`  | none | Return the postMessage handshake shim HTML; sets `Content-Security-Policy: frame-ancestors <allowed-origins>` |
+| `/_proxy/kai-preview/exchange`    | `POST` | JWT in JSON body `{"token":"..."}` | Verify handshake JWT, set the `kbc-kai-preview-session` session cookie |
+| `/_proxy/kai-preview/refresh`     | `POST` | session cookie (CORS) | Re-mint and slide the session cookie; returns `204 No Content` |
+
+**CORS note.** `embed-token` and `refresh` enforce an origin allowlist
+(`kaiPreview.allowedIdeOrigins`). Requests from origins not in the list are
+rejected with `403` before any business logic runs. `bootstrap` and `exchange` are
+not cross-origin calls (they are frame navigations / same-origin fetch from inside
+the frame).
+
+---
+
+## 4. Configuration
+
+### 4.1 Config keys
+
+| Key | Default | Notes |
+|---|---|---|
+| `kaiPreview.handshakeSigningKey` | *(required)* | HMAC-SHA256 key for the 60 s handshake JWT |
+| `kaiPreview.sessionSigningKey`   | *(required)* | HMAC-SHA256 key for the session cookie JWT |
+| `kaiPreview.sessionTTL`          | `4h`          | Sliding session cookie lifetime |
+| `kaiPreview.allowedIdeOrigins`   | *(required)* | Origins permitted to call `embed-token` and `refresh`, e.g. `https://connection.keboola.com` |
+| `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify STA tokens in `embed-token` |
+
+### 4.2 Provisioning new signing keys
+
+Two new Kubernetes / Helm secrets must be provisioned **per stack**. Generate each
+key with:
+
+```bash
+openssl rand -hex 32   # run once for handshakeSigningKey
+openssl rand -hex 32   # run once for sessionSigningKey
+```
+
+Store the output as separate secret values and mount them via the appropriate Helm
+values path. Do **not** share keys between stacks or between the two key roles.
+
+---
+
+## 5. Routing Decision Tree
+
+The following shows the order in which `appHandler.ServeHTTP` evaluates an
+incoming request. Earlier steps short-circuit; later steps are only reached if
+all prior steps pass.
+
+```
+Incoming request
+│
+├─1─ Host != canonical host?
+│       └─ YES → 308 redirect to canonical URL
+│
+├─2─ App has dev-mode enabled?
+│     │
+│     ├─ YES + path starts with /_proxy/kai-preview/*
+│     │       └─ kai-preview composite handler (embed-token / bootstrap / exchange / refresh)
+│     │
+│     ├─ YES + request has a valid kbc-kai-preview-session cookie
+│     │       └─ forward to upstream app
+│     │             (if cookie is past its midpoint TTL, slide the cookie on the way out)
+│     │
+│     └─ YES + Sec-Fetch-Dest=iframe|frame, Accept=text/html, no valid session cookie
+│               └─ serve bootstrap shim (rewrites path to /_proxy/kai-preview/bootstrap)
+│
+├─3─ Path starts with /_proxy/* (internal auth URLs)?
+│       └─ existing auth handler (OAuth2 Proxy / Basic)
+│
+└─4─ AuthRules matching
+        └─ matching rule found → apply configured auth (OAuth / Basic / none), forward to upstream
+           no match → 404
+```
+
+---
+
+## 6. Multi-Replica Behavior
+
+All JWTs (both handshake and session cookie) are **stateless HMAC**. There is no
+shared cache, Redis, or database involved. Any replica that holds the same signing
+key can verify a token minted by any other replica. This means:
+
+- Mint (`embed-token`) and exchange can land on different replicas — no affinity
+  required.
+- Cookie validation is fully per-request and stateless — works identically across
+  all replicas.
+- Sliding refresh (`refresh`) re-mints a fresh JWT on every call — also stateless
+  and replica-agnostic.
+
+The only operational requirement is that **all replicas share the same signing
+keys** (injected via Kubernetes secret).
+
+---
+
+## 7. Smoke-Test Runbook
+
+Use this runbook to verify that a fresh stack deployment is wired correctly. Each
+step is designed to be copy-paste runnable. Substitute the environment variables at
+the top for your target environment.
+
+### 7.0 Environment variables
+
+```bash
+export APP_HOST="myapp.data-apps.keboola.com"   # FQDN of the data app
+export IDE_ORIGIN="https://connection.keboola.com"
+export STA_TOKEN="<your-storage-api-token>"
+
+# Signing keys — use the same values provisioned to the stack
+export HANDSHAKE_KEY="$(openssl rand -hex 32)"
+export SESSION_KEY="$(openssl rand -hex 32)"
+```
+
+### 7.1 Boot apps-proxy locally with kai-preview config
+
+```bash
+KBC_APPS_PROXY_KAI_PREVIEW_HANDSHAKE_SIGNING_KEY="${HANDSHAKE_KEY}" \
+KBC_APPS_PROXY_KAI_PREVIEW_SESSION_SIGNING_KEY="${SESSION_KEY}" \
+KBC_APPS_PROXY_KAI_PREVIEW_SESSION_TTL="4h" \
+KBC_APPS_PROXY_KAI_PREVIEW_ALLOWED_IDE_ORIGINS="${IDE_ORIGIN}" \
+KBC_APPS_PROXY_STORAGE_API_URL="https://connection.keboola.com" \
+  ./apps-proxy
+```
+
+Expected: proxy starts, logs `kai-preview enabled` (or similar), no startup errors.
+
+### 7.2 Mint an embed token
+
+```bash
+EMBED_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/embed-token" \
+  -H "Origin: ${IDE_ORIGIN}" \
+  -H "X-StorageApi-Token: ${STA_TOKEN}" \
+  -H "Content-Type: application/json" \
+  | jq -r '.token')
+
+echo "embed token: ${EMBED_TOKEN}"
+```
+
+**Expected:**
+- HTTP `200`
+- Response body: `{"token":"<jwt>"}`
+- `Access-Control-Allow-Origin: ${IDE_ORIGIN}` response header present
+- `Cache-Control: no-store` response header present
+
+### 7.3 Fetch the bootstrap shim
+
+```bash
+curl -sI "https://${APP_HOST}/_proxy/kai-preview/bootstrap"
+```
+
+**Expected:**
+- HTTP `200`
+- `Content-Type: text/html; charset=utf-8`
+- `Content-Security-Policy` header contains `frame-ancestors ${IDE_ORIGIN}`
+- `Cache-Control: no-store`
+
+To inspect the body:
+
+```bash
+curl -s "https://${APP_HOST}/_proxy/kai-preview/bootstrap" | head -20
+```
+
+Expected: HTML containing a `<script>` block that performs the postMessage
+handshake.
+
+### 7.4 Exchange the handshake token for a session cookie
+
+```bash
+SESSION_COOKIE=$(curl -s -c - -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
+  -H "Content-Type: application/json" \
+  -d "{\"token\":\"${EMBED_TOKEN}\"}" \
+  -D - \
+  | grep -i 'set-cookie')
+
+echo "${SESSION_COOKIE}"
+```
+
+**Expected:**
+- HTTP `200`
+- `Set-Cookie` header present with:
+  - name `kbc-kai-preview-session`
+  - `SameSite=None`
+  - `Partitioned`
+  - `Secure`
+  - `HttpOnly`
+  - `Max-Age=14400` (or the configured `sessionTTL` in seconds)
+- `Cache-Control: no-store`
+
+Save the cookie for subsequent steps:
+
+```bash
+curl -s -c /tmp/kai-preview-cookies.txt -X POST \
+  "https://${APP_HOST}/_proxy/kai-preview/exchange" \
+  -H "Content-Type: application/json" \
+  -d "{\"token\":\"${EMBED_TOKEN}\"}" > /dev/null
+```
+
+### 7.5 Make an authenticated request using the session cookie
+
+```bash
+curl -s -b /tmp/kai-preview-cookies.txt \
+  "https://${APP_HOST}/"
+```
+
+**Expected:**
+- HTTP `200` with the upstream app's response body (not an OAuth redirect or login
+  page).
+- No `Location:` header redirecting to an auth provider.
+
+### 7.6 Refresh the session cookie
+
+```bash
+curl -s -b /tmp/kai-preview-cookies.txt \
+     -c /tmp/kai-preview-cookies.txt \
+     -X POST "https://${APP_HOST}/_proxy/kai-preview/refresh" \
+     -H "Origin: ${IDE_ORIGIN}" \
+     -D -
+```
+
+**Expected:**
+- HTTP `204 No Content`
+- Fresh `Set-Cookie: kbc-kai-preview-session=...` header (new JWT, new `Max-Age`)
+- `Access-Control-Allow-Origin: ${IDE_ORIGIN}` header present
+
+### 7.7 Verify 404 when dev-mode is off
+
+Flip the app CRD to disable dev-mode:
+
+```bash
+kubectl edit app/<app-name> -n <apps-namespace>
+# Set spec.devMode.enabled: false, save and quit
+```
+
+Then re-run the mint step:
+
+```bash
+curl -s -o /dev/null -w "%{http_code}" \
+  -X POST "https://${APP_HOST}/_proxy/kai-preview/embed-token" \
+  -H "Origin: ${IDE_ORIGIN}" \
+  -H "X-StorageApi-Token: ${STA_TOKEN}"
+```
+
+**Expected:** `404`. All four kai-preview endpoints should return `404`.
+
+Re-enable dev-mode before continuing:
+
+```bash
+kubectl edit app/<app-name> -n <apps-namespace>
+# Set spec.devMode.enabled: true
+```
+
+### 7.8 Multi-replica stateless check
+
+Scale apps-proxy to two replicas:
+
+```bash
+kubectl scale deployment apps-proxy --replicas=2 -n <apps-namespace>
+kubectl rollout status deployment/apps-proxy -n <apps-namespace>
+```
+
+Mint a token (this will land on an arbitrary replica):
+
+```bash
+EMBED_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/embed-token" \
+  -H "Origin: ${IDE_ORIGIN}" \
+  -H "X-StorageApi-Token: ${STA_TOKEN}" \
+  | jq -r '.token')
+```
+
+Exchange it (may land on a different replica due to load-balancer round-robin):
+
+```bash
+curl -s -c /tmp/kai-preview-cookies-mr.txt \
+  -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
+  -H "Content-Type: application/json" \
+  -d "{\"token\":\"${EMBED_TOKEN}\"}" \
+  -o /dev/null -w "%{http_code}\n"
+```
+
+**Expected:** `200`. The exchange succeeds regardless of which replica handles it,
+proving stateless JWT validation.
+
+---
+
+## 8. Known Limitations
+
+- **No user identity headers.** Apps that read `X-Kbc-User-*` headers to determine
+  the acting user will not receive them in kai-preview iframe sessions — the session
+  cookie carries only an app-scoped JWT with no user identity. Apps should fall back
+  to `KBC_TOKEN` (the app's own service token) for user identity, or implement their
+  own identity resolution via the Storage API.
+
+- **Safari ITP.** Safari's Intelligent Tracking Prevention may purge partitioned
+  cookies aggressively under low-traffic conditions. The SPA's sliding-refresh
+  heartbeat (the `/_proxy/kai-preview/refresh` call made periodically by kbc-ui)
+  compensates by re-minting the cookie before it is evicted. Operators should
+  ensure the heartbeat interval in kbc-ui is shorter than the Safari ITP eviction
+  window (typically 7 days for partitioned cookies, but may vary).
+
+- **Dev-mode only.** The entire kai-preview path is disabled for production apps
+  (`spec.devMode.enabled: false`). There is no override. Do not rely on this path
+  for production embedding scenarios.
+
+---
+
+## 9. Reference
+
+The full design rationale (threat model, cookie attribute choices, multi-replica
+analysis, and kbc-ui SPA side) is captured in the internal design spec recorded
+separately from this repository. Refer to your team's design documentation archive
+for the `2026-05-14-dev-iframe-auth-design` specification.

From 7643bb6311909413405ea1ac07ed7415c844e750 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 18:56:44 +0200
Subject: [PATCH 23/49] docs(apps-proxy): correct env var prefix in kai-preview
 smoke-test runbook

---
 docs/apps-proxy/kai-preview.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
index c00432e0b6..3a20ab9e8b 100644
--- a/docs/apps-proxy/kai-preview.md
+++ b/docs/apps-proxy/kai-preview.md
@@ -146,11 +146,11 @@ export SESSION_KEY="$(openssl rand -hex 32)"
 ### 7.1 Boot apps-proxy locally with kai-preview config
 
 ```bash
-KBC_APPS_PROXY_KAI_PREVIEW_HANDSHAKE_SIGNING_KEY="${HANDSHAKE_KEY}" \
-KBC_APPS_PROXY_KAI_PREVIEW_SESSION_SIGNING_KEY="${SESSION_KEY}" \
-KBC_APPS_PROXY_KAI_PREVIEW_SESSION_TTL="4h" \
-KBC_APPS_PROXY_KAI_PREVIEW_ALLOWED_IDE_ORIGINS="${IDE_ORIGIN}" \
-KBC_APPS_PROXY_STORAGE_API_URL="https://connection.keboola.com" \
+APPS_PROXY_KAI_PREVIEW_HANDSHAKE_SIGNING_KEY="${HANDSHAKE_KEY}" \
+APPS_PROXY_KAI_PREVIEW_SESSION_SIGNING_KEY="${SESSION_KEY}" \
+APPS_PROXY_KAI_PREVIEW_SESSION_TTL="4h" \
+APPS_PROXY_KAI_PREVIEW_ALLOWED_IDE_ORIGINS="${IDE_ORIGIN}" \
+APPS_PROXY_STORAGE_API_URL="https://connection.keboola.com" \
   ./apps-proxy
 ```
 

From e8aa8ba8fc015c5c5e955f117b7cb459bbb210df Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Thu, 14 May 2026 19:07:41 +0200
Subject: [PATCH 24/49] fix(apps-proxy): kai-preview normalize allowed origins;
 add bootstrap dev-mode gate

Strip trailing slashes from AllowedIDEOrigins in KaiPreview.Normalize() to
prevent silent CORS failures when operators configure origins with a trailing
slash (browsers send Origin headers without one). Add an internal IsDevMode
guard to BootstrapHandler matching the pattern of the other three handlers.
---
 .../pkg/service/appsproxy/config/config.go     |  7 +++++++
 .../service/appsproxy/config/config_test.go    | 18 ++++++++++++++++++
 .../authproxy/kaipreview/bootstrap.go          | 13 ++++++++++++-
 .../authproxy/kaipreview/bootstrap_test.go     | 15 +++++++++++++--
 .../apphandler/authproxy/kaipreview/handler.go |  2 +-
 5 files changed, 51 insertions(+), 4 deletions(-)

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index 8e9e8f90fd..06f03e3d56 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -2,6 +2,7 @@ package config
 
 import (
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/telemetry/datadog"
@@ -97,6 +98,12 @@ func New() Config {
 func (c *Config) Normalize() {
 }
 
+func (c *KaiPreview) Normalize() {
+	for i, o := range c.AllowedIDEOrigins {
+		c.AllowedIDEOrigins[i] = strings.TrimRight(o, "/")
+	}
+}
+
 func (c *API) Normalize() {
 	if c.PublicURL != nil {
 		c.PublicURL.Host = strhelper.NormalizeHost(c.PublicURL.Host)
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
index 6baaaa1687..c229abf9ed 100644
--- a/internal/pkg/service/appsproxy/config/config_test.go
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -28,3 +28,21 @@ func TestKaiPreviewConfig_RequiresSigningKeys(t *testing.T) {
 	assert.Contains(t, err.Error(), "kaiPreview.handshakeSigningKey")
 	assert.Contains(t, err.Error(), "kaiPreview.sessionSigningKey")
 }
+
+func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	cfg.CookieSecretSalt = "x"
+	cfg.CsrfTokenSalt = "x"
+	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
+	cfg.K8s = config.K8s{AppsNamespace: "ns"}
+	cfg.KaiPreview = config.KaiPreview{
+		HandshakeSigningKey: "k1",
+		SessionSigningKey:   "k2",
+		AllowedIDEOrigins:   []string{"https://connection.keboola.com/", "https://staging.keboola.com"},
+	}
+	err := configmap.ValidateAndNormalize(&cfg)
+	require.NoError(t, err)
+	assert.Equal(t, "https://connection.keboola.com", cfg.KaiPreview.AllowedIDEOrigins[0])
+	assert.Equal(t, "https://staging.keboola.com", cfg.KaiPreview.AllowedIDEOrigins[1])
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
index 3979684351..872dd7d7c1 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
@@ -17,13 +17,17 @@ var bootstrapTmpl = template.Must(template.ParseFS(bootstrapFS, "template/bootst
 type BootstrapHandler struct {
 	allowedIDEOrigins []string
 	originsJSON       template.JS
+	devMode           DevModeChecker
+	appID             string
 }
 
-func NewBootstrapHandler(allowedIDEOrigins []string) *BootstrapHandler {
+func NewBootstrapHandler(allowedIDEOrigins []string, devMode DevModeChecker, appID string) *BootstrapHandler {
 	bs, _ := json.Marshal(allowedIDEOrigins) // []string round-trip never errors for []string
 	return &BootstrapHandler{
 		allowedIDEOrigins: allowedIDEOrigins,
 		originsJSON:       template.JS(bs),
+		devMode:           devMode,
+		appID:             appID,
 	}
 }
 
@@ -32,6 +36,13 @@ func (h *BootstrapHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reque
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		return nil
 	}
+
+	// Dev-mode gate: pretend the endpoint doesn't exist on non-dev apps.
+	if !h.devMode.IsDevMode(r.Context(), h.appID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
 	WriteFrameAncestorsCSP(w, h.allowedIDEOrigins)
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
index a2fca22624..85e007f0e8 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
@@ -1,6 +1,7 @@
 package kaipreview
 
 import (
+	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
@@ -11,7 +12,7 @@ import (
 
 func TestBootstrapHandler_ServesHTMLWithCSP(t *testing.T) {
 	t.Parallel()
-	h := NewBootstrapHandler([]string{"https://connection.keboola.com"})
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: true}, "app-123")
 	r := httptest.NewRequest("GET", "/_proxy/kai-preview/bootstrap", nil)
 	w := httptest.NewRecorder()
 
@@ -32,10 +33,20 @@ func TestBootstrapHandler_ServesHTMLWithCSP(t *testing.T) {
 
 func TestBootstrapHandler_WrongMethod(t *testing.T) {
 	t.Parallel()
-	h := NewBootstrapHandler([]string{"https://connection.keboola.com"})
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: true}, "app-123")
 	r := httptest.NewRequest("POST", "/_proxy/kai-preview/bootstrap", nil)
 	w := httptest.NewRecorder()
 	err := h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, 405, w.Code)
 }
+
+func TestBootstrapHandler_NonDevModeReturns404(t *testing.T) {
+	t.Parallel()
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: false}, "app-123")
+	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
index a02cba9027..e659beae44 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
@@ -55,7 +55,7 @@ func NewHandler(deps HandlerDeps) *Handler {
 			Clock: deps.Clock, STA: deps.STA, DevMode: deps.DevMode, CORS: deps.CORS,
 			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
-		bootstrap: NewBootstrapHandler(deps.AllowedIDEOrigins),
+		bootstrap: NewBootstrapHandler(deps.AllowedIDEOrigins, deps.DevMode, deps.AppID),
 		exchange: NewExchangeHandler(ExchangeDeps{
 			Clock: deps.Clock, DevMode: deps.DevMode,
 			HandshakeKey: deps.HandshakeKey, SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL,

From 76c9289d158eee8bad99fa791ab467abf8bd61a1 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 06:48:41 +0200
Subject: [PATCH 25/49] refactor(apps-proxy): rename kai-preview
 AllowedIDEOrigins to AllowedOrigins

---
 docs/apps-proxy/kai-preview.md                |  6 ++---
 .../pkg/service/appsproxy/config/config.go    |  6 ++---
 .../service/appsproxy/config/config_test.go   |  6 ++---
 .../service/appsproxy/dependencies/mocked.go  |  4 +--
 .../appsproxy/proxy/apphandler/apphandler.go  |  4 +--
 .../authproxy/kaipreview/bootstrap.go         | 26 +++++++++----------
 .../authproxy/kaipreview/handler.go           |  4 +--
 .../authproxy/kaipreview/handler_test.go      |  2 +-
 .../kaipreview/template/bootstrap.gohtml      | 10 +++----
 9 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
index 3a20ab9e8b..c4f18a00f3 100644
--- a/docs/apps-proxy/kai-preview.md
+++ b/docs/apps-proxy/kai-preview.md
@@ -39,7 +39,7 @@ apps that do not have dev-mode enabled.
 | `/_proxy/kai-preview/refresh`     | `POST` | session cookie (CORS) | Re-mint and slide the session cookie; returns `204 No Content` |
 
 **CORS note.** `embed-token` and `refresh` enforce an origin allowlist
-(`kaiPreview.allowedIdeOrigins`). Requests from origins not in the list are
+(`kaiPreview.allowedOrigins`). Requests from origins not in the list are
 rejected with `403` before any business logic runs. `bootstrap` and `exchange` are
 not cross-origin calls (they are frame navigations / same-origin fetch from inside
 the frame).
@@ -55,7 +55,7 @@ the frame).
 | `kaiPreview.handshakeSigningKey` | *(required)* | HMAC-SHA256 key for the 60 s handshake JWT |
 | `kaiPreview.sessionSigningKey`   | *(required)* | HMAC-SHA256 key for the session cookie JWT |
 | `kaiPreview.sessionTTL`          | `4h`          | Sliding session cookie lifetime |
-| `kaiPreview.allowedIdeOrigins`   | *(required)* | Origins permitted to call `embed-token` and `refresh`, e.g. `https://connection.keboola.com` |
+| `kaiPreview.allowedOrigins`      | *(required)* | Origins permitted to call `embed-token` and `refresh`, e.g. `https://connection.keboola.com` |
 | `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify STA tokens in `embed-token` |
 
 ### 4.2 Provisioning new signing keys
@@ -149,7 +149,7 @@ export SESSION_KEY="$(openssl rand -hex 32)"
 APPS_PROXY_KAI_PREVIEW_HANDSHAKE_SIGNING_KEY="${HANDSHAKE_KEY}" \
 APPS_PROXY_KAI_PREVIEW_SESSION_SIGNING_KEY="${SESSION_KEY}" \
 APPS_PROXY_KAI_PREVIEW_SESSION_TTL="4h" \
-APPS_PROXY_KAI_PREVIEW_ALLOWED_IDE_ORIGINS="${IDE_ORIGIN}" \
+APPS_PROXY_KAI_PREVIEW_ALLOWED_ORIGINS="${IDE_ORIGIN}" \
 APPS_PROXY_STORAGE_API_URL="https://connection.keboola.com" \
   ./apps-proxy
 ```
diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index 06f03e3d56..8604505752 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -36,7 +36,7 @@ type KaiPreview struct {
 	HandshakeSigningKey string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
 	SessionSigningKey   string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
 	SessionTTL          time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)."`
-	AllowedIDEOrigins   []string      `configKey:"allowedIdeOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
+	AllowedOrigins      []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
 }
 
 type API struct {
@@ -99,8 +99,8 @@ func (c *Config) Normalize() {
 }
 
 func (c *KaiPreview) Normalize() {
-	for i, o := range c.AllowedIDEOrigins {
-		c.AllowedIDEOrigins[i] = strings.TrimRight(o, "/")
+	for i, o := range c.AllowedOrigins {
+		c.AllowedOrigins[i] = strings.TrimRight(o, "/")
 	}
 }
 
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
index c229abf9ed..aa5c6571e3 100644
--- a/internal/pkg/service/appsproxy/config/config_test.go
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -39,10 +39,10 @@ func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
 	cfg.KaiPreview = config.KaiPreview{
 		HandshakeSigningKey: "k1",
 		SessionSigningKey:   "k2",
-		AllowedIDEOrigins:   []string{"https://connection.keboola.com/", "https://staging.keboola.com"},
+		AllowedOrigins:      []string{"https://connection.keboola.com/", "https://staging.keboola.com"},
 	}
 	err := configmap.ValidateAndNormalize(&cfg)
 	require.NoError(t, err)
-	assert.Equal(t, "https://connection.keboola.com", cfg.KaiPreview.AllowedIDEOrigins[0])
-	assert.Equal(t, "https://staging.keboola.com", cfg.KaiPreview.AllowedIDEOrigins[1])
+	assert.Equal(t, "https://connection.keboola.com", cfg.KaiPreview.AllowedOrigins[0])
+	assert.Equal(t, "https://staging.keboola.com", cfg.KaiPreview.AllowedOrigins[1])
 }
diff --git a/internal/pkg/service/appsproxy/dependencies/mocked.go b/internal/pkg/service/appsproxy/dependencies/mocked.go
index 5f7ca5a006..86df586638 100644
--- a/internal/pkg/service/appsproxy/dependencies/mocked.go
+++ b/internal/pkg/service/appsproxy/dependencies/mocked.go
@@ -88,8 +88,8 @@ func newMockedServiceScope(tb testing.TB, ctx context.Context, cfg config.Config
 	if cfg.KaiPreview.SessionSigningKey == "" {
 		cfg.KaiPreview.SessionSigningKey = "test-session-signing-key-for-mocked-scope"
 	}
-	if len(cfg.KaiPreview.AllowedIDEOrigins) == 0 {
-		cfg.KaiPreview.AllowedIDEOrigins = []string{"https://connection.keboola.com"}
+	if len(cfg.KaiPreview.AllowedOrigins) == 0 {
+		cfg.KaiPreview.AllowedOrigins = []string{"https://connection.keboola.com"}
 	}
 	if cfg.K8s.AppsNamespace == "" {
 		cfg.K8s.AppsNamespace = "keboola"
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 171308dfbc..9f2e383657 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -54,11 +54,11 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 			Clock:             manager.clock,
 			STA:               manager.staVerifier,
 			DevMode:           devModeChecker,
-			CORS:              kaipreview.NewCORS(manager.config.KaiPreview.AllowedIDEOrigins),
+			CORS:              kaipreview.NewCORS(manager.config.KaiPreview.AllowedOrigins),
 			HandshakeKey:      manager.config.KaiPreview.HandshakeSigningKey,
 			SessionKey:        manager.config.KaiPreview.SessionSigningKey,
 			SessionTTL:        manager.config.KaiPreview.SessionTTL,
-			AllowedIDEOrigins: manager.config.KaiPreview.AllowedIDEOrigins,
+			AllowedOrigins:    manager.config.KaiPreview.AllowedOrigins,
 			AppID:             string(app.ID),
 			AppProjectID:      app.ProjectID,
 		}),
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
index 872dd7d7c1..05599b1b23 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
@@ -15,19 +15,19 @@ var bootstrapFS embed.FS
 var bootstrapTmpl = template.Must(template.ParseFS(bootstrapFS, "template/bootstrap.gohtml"))
 
 type BootstrapHandler struct {
-	allowedIDEOrigins []string
-	originsJSON       template.JS
-	devMode           DevModeChecker
-	appID             string
+	allowedOrigins []string
+	originsJSON    template.JS
+	devMode        DevModeChecker
+	appID          string
 }
 
-func NewBootstrapHandler(allowedIDEOrigins []string, devMode DevModeChecker, appID string) *BootstrapHandler {
-	bs, _ := json.Marshal(allowedIDEOrigins) // []string round-trip never errors for []string
+func NewBootstrapHandler(allowedOrigins []string, devMode DevModeChecker, appID string) *BootstrapHandler {
+	bs, _ := json.Marshal(allowedOrigins) // []string round-trip never errors for []string
 	return &BootstrapHandler{
-		allowedIDEOrigins: allowedIDEOrigins,
-		originsJSON:       template.JS(bs),
-		devMode:           devMode,
-		appID:             appID,
+		allowedOrigins: allowedOrigins,
+		originsJSON:    template.JS(bs),
+		devMode:        devMode,
+		appID:          appID,
 	}
 }
 
@@ -43,14 +43,14 @@ func (h *BootstrapHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reque
 		return nil
 	}
 
-	WriteFrameAncestorsCSP(w, h.allowedIDEOrigins)
+	WriteFrameAncestorsCSP(w, h.allowedOrigins)
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")
 
 	data := struct {
-		AllowedIDEOriginsJSON template.JS
+		AllowedOriginsJSON template.JS
 	}{
-		AllowedIDEOriginsJSON: h.originsJSON,
+		AllowedOriginsJSON: h.originsJSON,
 	}
 	if err := bootstrapTmpl.Execute(w, data); err != nil {
 		return errors.Errorf("kai-preview: render bootstrap shim: %w", err)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
index e659beae44..679556cc3b 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
@@ -35,7 +35,7 @@ type HandlerDeps struct {
 	HandshakeKey      string
 	SessionKey        string
 	SessionTTL        time.Duration
-	AllowedIDEOrigins []string
+	AllowedOrigins []string
 	AppID             string
 	AppProjectID      string
 }
@@ -55,7 +55,7 @@ func NewHandler(deps HandlerDeps) *Handler {
 			Clock: deps.Clock, STA: deps.STA, DevMode: deps.DevMode, CORS: deps.CORS,
 			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
-		bootstrap: NewBootstrapHandler(deps.AllowedIDEOrigins, deps.DevMode, deps.AppID),
+		bootstrap: NewBootstrapHandler(deps.AllowedOrigins, deps.DevMode, deps.AppID),
 		exchange: NewExchangeHandler(ExchangeDeps{
 			Clock: deps.Clock, DevMode: deps.DevMode,
 			HandshakeKey: deps.HandshakeKey, SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
index 575c336e52..66d9053947 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
@@ -20,7 +20,7 @@ func newTestCompositeHandler(devMode bool) *Handler {
 		HandshakeKey:      testHandshakeKey,
 		SessionKey:        testSessionKey,
 		SessionTTL:        4 * time.Hour,
-		AllowedIDEOrigins: []string{"https://connection.keboola.com"},
+		AllowedOrigins: []string{"https://connection.keboola.com"},
 		AppID:             "app-123",
 		AppProjectID:      "proj-456",
 	})
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml
index 6ccb2e9029..0fb59b4273 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml
@@ -15,7 +15,7 @@
   "use strict";
 
   // Server-rendered: the list of IDE origins this preview is allowed to handshake with.
-  var ALLOWED_IDE_ORIGINS = {{ .AllowedIDEOriginsJSON }};
+  var ALLOWED_ORIGINS = {{ .AllowedOriginsJSON }};
 
   var EXCHANGE_PATH = "/_proxy/kai-preview/exchange";
   var status = document.getElementById("status");
@@ -25,8 +25,8 @@
   function setStatus(text) { if (status) { status.textContent = text; } }
 
   function originAllowed(origin) {
-    for (var i = 0; i < ALLOWED_IDE_ORIGINS.length; i++) {
-      if (ALLOWED_IDE_ORIGINS[i] === origin) { return true; }
+    for (var i = 0; i < ALLOWED_ORIGINS.length; i++) {
+      if (ALLOWED_ORIGINS[i] === origin) { return true; }
     }
     return false;
   }
@@ -36,8 +36,8 @@
       setStatus("This preview only loads from the Keboola UI.");
       return;
     }
-    for (var i = 0; i < ALLOWED_IDE_ORIGINS.length; i++) {
-      try { window.parent.postMessage({ type: "kai-preview-ready" }, ALLOWED_IDE_ORIGINS[i]); }
+    for (var i = 0; i < ALLOWED_ORIGINS.length; i++) {
+      try { window.parent.postMessage({ type: "kai-preview-ready" }, ALLOWED_ORIGINS[i]); }
       catch (e) { /* targetOrigin mismatch is benign */ }
     }
   }

From b04c303a850e644299b32c06da619b24eb16814d Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 06:54:23 +0200
Subject: [PATCH 26/49] refactor(apps-proxy): rename kai-preview embed-token to
 handshake-token

Unifies endpoint, handler, and constant naming with the existing
HandshakeClaims/MintHandshakeJWT/purposeHandshake symbols. The purpose
claim value changes from "kai-preview-embed" to "kai-preview-handshake".
---
 docs/apps-proxy/kai-preview.md                | 30 +++++-----
 .../authproxy/kaipreview/cors_test.go         |  6 +-
 .../authproxy/kaipreview/handler.go           | 22 +++----
 .../authproxy/kaipreview/handler_test.go      |  4 +-
 .../{embed_token.go => handshake_token.go}    | 12 ++--
 ..._token_test.go => handshake_token_test.go} | 58 +++++++++----------
 .../apphandler/authproxy/kaipreview/jwt.go    |  2 +-
 .../authproxy/kaipreview/jwt_test.go          |  2 +-
 8 files changed, 68 insertions(+), 68 deletions(-)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{embed_token.go => handshake_token.go} (88%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{embed_token_test.go => handshake_token_test.go} (77%)

diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
index c4f18a00f3..28122a061b 100644
--- a/docs/apps-proxy/kai-preview.md
+++ b/docs/apps-proxy/kai-preview.md
@@ -17,7 +17,7 @@ end-users browsing directly.
 The kai-preview path is active only when **both** of the following are true:
 
 1. The app's `App` CRD has `spec.devMode.enabled: true`.
-2. The kbc-ui SPA calls `POST /_proxy/kai-preview/embed-token` with a valid
+2. The kbc-ui SPA calls `POST /_proxy/kai-preview/handshake-token` with a valid
    Storage API token in the `X-StorageApi-Token` header.
 
 When `spec.devMode.enabled` is `false` (or absent) every kai-preview endpoint
@@ -33,12 +33,12 @@ apps that do not have dev-mode enabled.
 
 | Endpoint | Method | Auth | Notes |
 |---|---|---|---|
-| `/_proxy/kai-preview/embed-token` | `POST` | `X-StorageApi-Token` header (CORS) | Mint a 60 s handshake JWT after verifying the STA token against Storage API |
+| `/_proxy/kai-preview/handshake-token` | `POST` | `X-StorageApi-Token` header (CORS) | Mint a 60 s handshake JWT after verifying the STA token against Storage API |
 | `/_proxy/kai-preview/bootstrap`   | `GET`  | none | Return the postMessage handshake shim HTML; sets `Content-Security-Policy: frame-ancestors <allowed-origins>` |
 | `/_proxy/kai-preview/exchange`    | `POST` | JWT in JSON body `{"token":"..."}` | Verify handshake JWT, set the `kbc-kai-preview-session` session cookie |
 | `/_proxy/kai-preview/refresh`     | `POST` | session cookie (CORS) | Re-mint and slide the session cookie; returns `204 No Content` |
 
-**CORS note.** `embed-token` and `refresh` enforce an origin allowlist
+**CORS note.** `handshake-token` and `refresh` enforce an origin allowlist
 (`kaiPreview.allowedOrigins`). Requests from origins not in the list are
 rejected with `403` before any business logic runs. `bootstrap` and `exchange` are
 not cross-origin calls (they are frame navigations / same-origin fetch from inside
@@ -55,8 +55,8 @@ the frame).
 | `kaiPreview.handshakeSigningKey` | *(required)* | HMAC-SHA256 key for the 60 s handshake JWT |
 | `kaiPreview.sessionSigningKey`   | *(required)* | HMAC-SHA256 key for the session cookie JWT |
 | `kaiPreview.sessionTTL`          | `4h`          | Sliding session cookie lifetime |
-| `kaiPreview.allowedOrigins`      | *(required)* | Origins permitted to call `embed-token` and `refresh`, e.g. `https://connection.keboola.com` |
-| `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify STA tokens in `embed-token` |
+| `kaiPreview.allowedOrigins`      | *(required)* | Origins permitted to call `handshake-token` and `refresh`, e.g. `https://connection.keboola.com` |
+| `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify STA tokens in `handshake-token` |
 
 ### 4.2 Provisioning new signing keys
 
@@ -88,7 +88,7 @@ Incoming request
 ├─2─ App has dev-mode enabled?
 │     │
 │     ├─ YES + path starts with /_proxy/kai-preview/*
-│     │       └─ kai-preview composite handler (embed-token / bootstrap / exchange / refresh)
+│     │       └─ kai-preview composite handler (handshake-token / bootstrap / exchange / refresh)
 │     │
 │     ├─ YES + request has a valid kbc-kai-preview-session cookie
 │     │       └─ forward to upstream app
@@ -113,7 +113,7 @@ All JWTs (both handshake and session cookie) are **stateless HMAC**. There is no
 shared cache, Redis, or database involved. Any replica that holds the same signing
 key can verify a token minted by any other replica. This means:
 
-- Mint (`embed-token`) and exchange can land on different replicas — no affinity
+- Mint (`handshake-token`) and exchange can land on different replicas — no affinity
   required.
 - Cookie validation is fully per-request and stateless — works identically across
   all replicas.
@@ -156,16 +156,16 @@ APPS_PROXY_STORAGE_API_URL="https://connection.keboola.com" \
 
 Expected: proxy starts, logs `kai-preview enabled` (or similar), no startup errors.
 
-### 7.2 Mint an embed token
+### 7.2 Mint a handshake token
 
 ```bash
-EMBED_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/embed-token" \
+HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
   -H "Origin: ${IDE_ORIGIN}" \
   -H "X-StorageApi-Token: ${STA_TOKEN}" \
   -H "Content-Type: application/json" \
   | jq -r '.token')
 
-echo "embed token: ${EMBED_TOKEN}"
+echo "handshake token: ${HANDSHAKE_TOKEN}"
 ```
 
 **Expected:**
@@ -200,7 +200,7 @@ handshake.
 ```bash
 SESSION_COOKIE=$(curl -s -c - -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
   -H "Content-Type: application/json" \
-  -d "{\"token\":\"${EMBED_TOKEN}\"}" \
+  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" \
   -D - \
   | grep -i 'set-cookie')
 
@@ -224,7 +224,7 @@ Save the cookie for subsequent steps:
 curl -s -c /tmp/kai-preview-cookies.txt -X POST \
   "https://${APP_HOST}/_proxy/kai-preview/exchange" \
   -H "Content-Type: application/json" \
-  -d "{\"token\":\"${EMBED_TOKEN}\"}" > /dev/null
+  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" > /dev/null
 ```
 
 ### 7.5 Make an authenticated request using the session cookie
@@ -267,7 +267,7 @@ Then re-run the mint step:
 
 ```bash
 curl -s -o /dev/null -w "%{http_code}" \
-  -X POST "https://${APP_HOST}/_proxy/kai-preview/embed-token" \
+  -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
   -H "Origin: ${IDE_ORIGIN}" \
   -H "X-StorageApi-Token: ${STA_TOKEN}"
 ```
@@ -293,7 +293,7 @@ kubectl rollout status deployment/apps-proxy -n <apps-namespace>
 Mint a token (this will land on an arbitrary replica):
 
 ```bash
-EMBED_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/embed-token" \
+HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
   -H "Origin: ${IDE_ORIGIN}" \
   -H "X-StorageApi-Token: ${STA_TOKEN}" \
   | jq -r '.token')
@@ -305,7 +305,7 @@ Exchange it (may land on a different replica due to load-balancer round-robin):
 curl -s -c /tmp/kai-preview-cookies-mr.txt \
   -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
   -H "Content-Type: application/json" \
-  -d "{\"token\":\"${EMBED_TOKEN}\"}" \
+  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" \
   -o /dev/null -w "%{http_code}\n"
 ```
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
index 0b39bd77f8..414aad19e2 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
@@ -12,7 +12,7 @@ func TestCORS_AllowedOrigin_Preflight(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
 
-	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("Access-Control-Request-Method", "POST")
 	r.Header.Set("Access-Control-Request-Headers", "X-StorageApi-Token, Content-Type")
@@ -30,7 +30,7 @@ func TestCORS_DisallowedOrigin_Preflight(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
 
-	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://evil.example.com")
 	w := httptest.NewRecorder()
 
@@ -53,7 +53,7 @@ func TestCORS_WriteResponseHeaders(t *testing.T) {
 func TestCORS_NonPreflightPassesThrough(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	w := httptest.NewRecorder()
 	handled := cors.HandlePreflight(w, r)
 	assert.False(t, handled)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
index 679556cc3b..37ab33ed3a 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
@@ -15,10 +15,10 @@ import (
 var PathPrefix = config.InternalPrefix + "/kai-preview"
 
 const (
-	pathEmbedToken = "/embed-token"
-	pathBootstrap  = "/bootstrap"
-	pathExchange   = "/exchange"
-	pathRefresh    = "/refresh"
+	pathHandshakeToken = "/handshake-token"
+	pathBootstrap      = "/bootstrap"
+	pathExchange       = "/exchange"
+	pathRefresh        = "/refresh"
 )
 
 // DevModeCheckerFunc adapts a plain function to the DevModeChecker interface.
@@ -43,15 +43,15 @@ type HandlerDeps struct {
 // Handler is the per-app composite handler that serves all four kai-preview
 // internal endpoints. One instance per app. Routes by URL path suffix.
 type Handler struct {
-	embedToken *EmbedTokenHandler
-	bootstrap  *BootstrapHandler
-	exchange   *ExchangeHandler
-	refresh    *RefreshHandler
+	handshakeToken *HandshakeTokenHandler
+	bootstrap      *BootstrapHandler
+	exchange       *ExchangeHandler
+	refresh        *RefreshHandler
 }
 
 func NewHandler(deps HandlerDeps) *Handler {
 	return &Handler{
-		embedToken: NewEmbedTokenHandler(EmbedTokenDeps{
+		handshakeToken: NewHandshakeTokenHandler(HandshakeTokenDeps{
 			Clock: deps.Clock, STA: deps.STA, DevMode: deps.DevMode, CORS: deps.CORS,
 			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
@@ -76,8 +76,8 @@ func (h *Handler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error
 	}
 	sub := r.URL.Path[len(PathPrefix):]
 	switch sub {
-	case pathEmbedToken:
-		return h.embedToken.ServeHTTPOrError(w, r)
+	case pathHandshakeToken:
+		return h.handshakeToken.ServeHTTPOrError(w, r)
 	case pathBootstrap:
 		return h.bootstrap.ServeHTTPOrError(w, r)
 	case pathExchange:
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
index 66d9053947..bfb2097af7 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
@@ -26,10 +26,10 @@ func newTestCompositeHandler(devMode bool) *Handler {
 	})
 }
 
-func TestCompositeHandler_RoutesEmbedToken(t *testing.T) {
+func TestCompositeHandler_RoutesHandshakeToken(t *testing.T) {
 	t.Parallel()
 	h := newTestCompositeHandler(true)
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid")
 	w := httptest.NewRecorder()
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
similarity index 88%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
index 585f515822..c658133308 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
@@ -21,7 +21,7 @@ type DevModeChecker interface {
 	IsDevMode(ctx context.Context, appID string) bool
 }
 
-type EmbedTokenDeps struct {
+type HandshakeTokenDeps struct {
 	Clock        clockwork.Clock
 	STA          STATokenVerifier
 	DevMode      DevModeChecker
@@ -31,15 +31,15 @@ type EmbedTokenDeps struct {
 	AppProjectID string
 }
 
-type EmbedTokenHandler struct {
-	deps EmbedTokenDeps
+type HandshakeTokenHandler struct {
+	deps HandshakeTokenDeps
 }
 
-func NewEmbedTokenHandler(deps EmbedTokenDeps) *EmbedTokenHandler {
-	return &EmbedTokenHandler{deps: deps}
+func NewHandshakeTokenHandler(deps HandshakeTokenDeps) *HandshakeTokenHandler {
+	return &HandshakeTokenHandler{deps: deps}
 }
 
-func (h *EmbedTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
 	if h.deps.CORS.HandlePreflight(w, r) {
 		return nil
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
similarity index 77%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
index 65d4a7a348..a5ec36b121 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/embed_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
@@ -35,14 +35,14 @@ type stubErr struct{ msg string }
 
 func (e *stubErr) Error() string { return e.msg }
 
-func newTestEmbedHandler(staOK bool, staProject string, devMode bool) *EmbedTokenHandler {
+func newTestHandshakeHandler(staOK bool, staProject string, devMode bool) *HandshakeTokenHandler {
 	var sta STATokenVerifier
 	if staOK {
 		sta = &stubSTAVerifier{projectID: staProject}
 	} else {
 		sta = &stubSTAVerifier{err: errStubUnauth}
 	}
-	return NewEmbedTokenHandler(EmbedTokenDeps{
+	return NewHandshakeTokenHandler(HandshakeTokenDeps{
 		Clock:        clockwork.NewFakeClock(),
 		STA:          sta,
 		DevMode:      &stubDevModeChecker{devMode: devMode},
@@ -53,11 +53,11 @@ func newTestEmbedHandler(staOK bool, staProject string, devMode bool) *EmbedToke
 	})
 }
 
-func TestEmbedTokenHandler_Success(t *testing.T) {
+func TestHandshakeTokenHandler_Success(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(true, "proj-456", true)
+	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid-token")
 	w := httptest.NewRecorder()
@@ -74,11 +74,11 @@ func TestEmbedTokenHandler_Success(t *testing.T) {
 	require.NotEmpty(t, body.Token)
 }
 
-func TestEmbedTokenHandler_PreflightOptions(t *testing.T) {
+func TestHandshakeTokenHandler_PreflightOptions(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(true, "proj-456", true)
+	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("Access-Control-Request-Method", "POST")
 	w := httptest.NewRecorder()
@@ -88,11 +88,11 @@ func TestEmbedTokenHandler_PreflightOptions(t *testing.T) {
 	assert.Equal(t, http.StatusNoContent, w.Code)
 }
 
-func TestEmbedTokenHandler_MissingSTAHeader(t *testing.T) {
+func TestHandshakeTokenHandler_MissingSTAHeader(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(true, "proj-456", true)
+	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	w := httptest.NewRecorder()
 
@@ -103,11 +103,11 @@ func TestEmbedTokenHandler_MissingSTAHeader(t *testing.T) {
 		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
 }
 
-func TestEmbedTokenHandler_STAInvalid(t *testing.T) {
+func TestHandshakeTokenHandler_STAInvalid(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(false, "", true)
+	h := newTestHandshakeHandler(false, "", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "bad-token")
 	w := httptest.NewRecorder()
@@ -119,11 +119,11 @@ func TestEmbedTokenHandler_STAInvalid(t *testing.T) {
 		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
 }
 
-func TestEmbedTokenHandler_WrongProject(t *testing.T) {
+func TestHandshakeTokenHandler_WrongProject(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(true, "different-project", true)
+	h := newTestHandshakeHandler(true, "different-project", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid-but-wrong-project")
 	w := httptest.NewRecorder()
@@ -135,11 +135,11 @@ func TestEmbedTokenHandler_WrongProject(t *testing.T) {
 		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
 }
 
-func TestEmbedTokenHandler_AppNotInDevMode(t *testing.T) {
+func TestHandshakeTokenHandler_AppNotInDevMode(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(true, "proj-456", false)
+	h := newTestHandshakeHandler(true, "proj-456", false)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid-token")
 	w := httptest.NewRecorder()
@@ -149,11 +149,11 @@ func TestEmbedTokenHandler_AppNotInDevMode(t *testing.T) {
 	assert.Equal(t, http.StatusNotFound, w.Code, "must look like the endpoint doesn't exist when app isn't in dev mode")
 }
 
-func TestEmbedTokenHandler_DisallowedOrigin(t *testing.T) {
+func TestHandshakeTokenHandler_DisallowedOrigin(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(true, "proj-456", true)
+	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://evil.example.com")
 	r.Header.Set("X-StorageApi-Token", "valid-token")
 	w := httptest.NewRecorder()
@@ -165,10 +165,10 @@ func TestEmbedTokenHandler_DisallowedOrigin(t *testing.T) {
 		"disallowed origins must NOT receive CORS headers")
 }
 
-func TestEmbedTokenHandler_WrongMethod(t *testing.T) {
+func TestHandshakeTokenHandler_WrongMethod(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(true, "proj-456", true)
-	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/embed-token", nil)
+	h := newTestHandshakeHandler(true, "proj-456", true)
+	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	w := httptest.NewRecorder()
 
@@ -177,11 +177,11 @@ func TestEmbedTokenHandler_WrongMethod(t *testing.T) {
 	assert.Equal(t, http.StatusMethodNotAllowed, w.Code)
 }
 
-func TestEmbedTokenHandler_NoTokenInErrorBody(t *testing.T) {
+func TestHandshakeTokenHandler_NoTokenInErrorBody(t *testing.T) {
 	t.Parallel()
-	h := newTestEmbedHandler(false, "", true)
+	h := newTestHandshakeHandler(false, "", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/embed-token", nil)
+	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "secret-token-do-not-leak")
 	w := httptest.NewRecorder()
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
index 71bb5647f6..b439b07e93 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -15,7 +15,7 @@ import (
 )
 
 const (
-	purposeHandshake = "kai-preview-embed"
+	purposeHandshake = "kai-preview-handshake"
 	purposeSession   = "kai-preview-session"
 	handshakeTTL     = 60 * time.Second
 )
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
index e80ff9d16f..d743ef998d 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
@@ -26,7 +26,7 @@ func TestHandshakeJWT_RoundTrip(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "app-123", claims.AppID)
 	assert.Equal(t, "proj-456", claims.ProjectID)
-	assert.Equal(t, "kai-preview-embed", claims.Purpose)
+	assert.Equal(t, "kai-preview-handshake", claims.Purpose)
 	assert.NotEmpty(t, claims.ID)
 }
 

From 7b7c2650050110c830e14b4f32db8d29511bc460 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 07:02:30 +0200
Subject: [PATCH 27/49] refactor(apps-proxy): rename kai-preview STA to
 StorageToken
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the opaque "STA" prefix throughout the kai-preview feature with
the clearer "StorageToken" naming. The interface carries the canonical
name (StorageTokenVerifier), the HTTP-backed impl gets a kind-specific
name (HTTPStorageTokenVerifier), and all fields, locals, tests, error
strings, and docs are updated to match.

Files renamed via git mv:
  sta_verifier.go       → storage_token_verifier.go
  sta_verifier_test.go  → storage_token_verifier_test.go
---
 docs/apps-proxy/kai-preview.md                | 12 ++--
 .../pkg/service/appsproxy/config/config.go    |  2 +-
 .../appsproxy/proxy/apphandler/apphandler.go  |  2 +-
 .../authproxy/kaipreview/handler.go           | 22 +++----
 .../authproxy/kaipreview/handler_test.go      |  2 +-
 .../authproxy/kaipreview/handshake_token.go   | 30 ++++-----
 .../kaipreview/handshake_token_test.go        | 30 ++++-----
 .../authproxy/kaipreview/sta_verifier.go      | 61 -------------------
 .../kaipreview/storage_token_verifier.go      | 61 +++++++++++++++++++
 ...test.go => storage_token_verifier_test.go} | 26 ++++----
 .../appsproxy/proxy/apphandler/manager.go     | 10 +--
 11 files changed, 129 insertions(+), 129 deletions(-)
 delete mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go
 create mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{sta_verifier_test.go => storage_token_verifier_test.go} (72%)

diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
index 28122a061b..c619dfdacf 100644
--- a/docs/apps-proxy/kai-preview.md
+++ b/docs/apps-proxy/kai-preview.md
@@ -33,7 +33,7 @@ apps that do not have dev-mode enabled.
 
 | Endpoint | Method | Auth | Notes |
 |---|---|---|---|
-| `/_proxy/kai-preview/handshake-token` | `POST` | `X-StorageApi-Token` header (CORS) | Mint a 60 s handshake JWT after verifying the STA token against Storage API |
+| `/_proxy/kai-preview/handshake-token` | `POST` | `X-StorageApi-Token` header (CORS) | Mint a 60 s handshake JWT after verifying the Storage token against Storage API |
 | `/_proxy/kai-preview/bootstrap`   | `GET`  | none | Return the postMessage handshake shim HTML; sets `Content-Security-Policy: frame-ancestors <allowed-origins>` |
 | `/_proxy/kai-preview/exchange`    | `POST` | JWT in JSON body `{"token":"..."}` | Verify handshake JWT, set the `kbc-kai-preview-session` session cookie |
 | `/_proxy/kai-preview/refresh`     | `POST` | session cookie (CORS) | Re-mint and slide the session cookie; returns `204 No Content` |
@@ -56,7 +56,7 @@ the frame).
 | `kaiPreview.sessionSigningKey`   | *(required)* | HMAC-SHA256 key for the session cookie JWT |
 | `kaiPreview.sessionTTL`          | `4h`          | Sliding session cookie lifetime |
 | `kaiPreview.allowedOrigins`      | *(required)* | Origins permitted to call `handshake-token` and `refresh`, e.g. `https://connection.keboola.com` |
-| `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify STA tokens in `handshake-token` |
+| `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify Storage tokens in `handshake-token` |
 
 ### 4.2 Provisioning new signing keys
 
@@ -136,7 +136,7 @@ the top for your target environment.
 ```bash
 export APP_HOST="myapp.data-apps.keboola.com"   # FQDN of the data app
 export IDE_ORIGIN="https://connection.keboola.com"
-export STA_TOKEN="<your-storage-api-token>"
+export STORAGE_TOKEN="<your-storage-api-token>"
 
 # Signing keys — use the same values provisioned to the stack
 export HANDSHAKE_KEY="$(openssl rand -hex 32)"
@@ -161,7 +161,7 @@ Expected: proxy starts, logs `kai-preview enabled` (or similar), no startup erro
 ```bash
 HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
   -H "Origin: ${IDE_ORIGIN}" \
-  -H "X-StorageApi-Token: ${STA_TOKEN}" \
+  -H "X-StorageApi-Token: ${STORAGE_TOKEN}" \
   -H "Content-Type: application/json" \
   | jq -r '.token')
 
@@ -269,7 +269,7 @@ Then re-run the mint step:
 curl -s -o /dev/null -w "%{http_code}" \
   -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
   -H "Origin: ${IDE_ORIGIN}" \
-  -H "X-StorageApi-Token: ${STA_TOKEN}"
+  -H "X-StorageApi-Token: ${STORAGE_TOKEN}"
 ```
 
 **Expected:** `404`. All four kai-preview endpoints should return `404`.
@@ -295,7 +295,7 @@ Mint a token (this will land on an arbitrary replica):
 ```bash
 HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
   -H "Origin: ${IDE_ORIGIN}" \
-  -H "X-StorageApi-Token: ${STA_TOKEN}" \
+  -H "X-StorageApi-Token: ${STORAGE_TOKEN}" \
   | jq -r '.token')
 ```
 
diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index 8604505752..591ff8c527 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -25,7 +25,7 @@ type Config struct {
 	Upstream         Upstream          `configKey:"-" configUsage:"Configuration options for upstream"`
 	SandboxesAPI     SandboxesAPI      `configKey:"sandboxesAPI"`
 	CsrfTokenSalt    string            `configKey:"csrfTokenSalt" configUsage:"Salt used for generating CSRF tokens" validate:"required" sensitive:"true"`
-	StorageAPIURL    *url.URL          `configKey:"storageApiUrl" configUsage:"Base URL of the Keboola Storage API used for STA token verification (kai-preview flow). E.g. https://connection.keboola.com" validate:"required"`
+	StorageAPIURL    *url.URL          `configKey:"storageApiUrl" configUsage:"Base URL of the Keboola Storage API used for Storage token verification (kai-preview flow). E.g. https://connection.keboola.com" validate:"required"`
 	KaiPreview       KaiPreview        `configKey:"kaiPreview" configUsage:"kai-preview iframe-auth configuration."`
 	K8s              K8s               `configKey:"k8s" configUsage:"Kubernetes configuration."`
 	E2bWebhook       E2BWebhook        `configKey:"e2bWebhook"`
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 9f2e383657..bbddbbf3b2 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -52,7 +52,7 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 		authHandlerPerRule: make(map[ruleIndex]chain.Handler),
 		kaiPreview: kaipreview.NewHandler(kaipreview.HandlerDeps{
 			Clock:             manager.clock,
-			STA:               manager.staVerifier,
+			StorageTokenVerifier: manager.storageTokenVerifier,
 			DevMode:           devModeChecker,
 			CORS:              kaipreview.NewCORS(manager.config.KaiPreview.AllowedOrigins),
 			HandshakeKey:      manager.config.KaiPreview.HandshakeSigningKey,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
index 37ab33ed3a..7657968aa3 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
@@ -28,16 +28,16 @@ type DevModeCheckerFunc func(ctx context.Context, appID string) bool
 func (f DevModeCheckerFunc) IsDevMode(ctx context.Context, appID string) bool { return f(ctx, appID) }
 
 type HandlerDeps struct {
-	Clock             clockwork.Clock
-	STA               STATokenVerifier
-	DevMode           DevModeChecker
-	CORS              *CORS
-	HandshakeKey      string
-	SessionKey        string
-	SessionTTL        time.Duration
-	AllowedOrigins []string
-	AppID             string
-	AppProjectID      string
+	Clock                clockwork.Clock
+	StorageTokenVerifier StorageTokenVerifier
+	DevMode              DevModeChecker
+	CORS                 *CORS
+	HandshakeKey         string
+	SessionKey           string
+	SessionTTL           time.Duration
+	AllowedOrigins       []string
+	AppID                string
+	AppProjectID         string
 }
 
 // Handler is the per-app composite handler that serves all four kai-preview
@@ -52,7 +52,7 @@ type Handler struct {
 func NewHandler(deps HandlerDeps) *Handler {
 	return &Handler{
 		handshakeToken: NewHandshakeTokenHandler(HandshakeTokenDeps{
-			Clock: deps.Clock, STA: deps.STA, DevMode: deps.DevMode, CORS: deps.CORS,
+			Clock: deps.Clock, StorageTokenVerifier: deps.StorageTokenVerifier, DevMode: deps.DevMode, CORS: deps.CORS,
 			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
 		bootstrap: NewBootstrapHandler(deps.AllowedOrigins, deps.DevMode, deps.AppID),
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
index bfb2097af7..6400537102 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
@@ -14,7 +14,7 @@ import (
 func newTestCompositeHandler(devMode bool) *Handler {
 	return NewHandler(HandlerDeps{
 		Clock:             clockwork.NewFakeClock(),
-		STA:               &stubSTAVerifier{projectID: "proj-456"},
+		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
 		DevMode:           &stubDevModeChecker{devMode: devMode},
 		CORS:              NewCORS([]string{"https://connection.keboola.com"}),
 		HandshakeKey:      testHandshakeKey,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
index c658133308..a569e15a60 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
@@ -10,9 +10,9 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
-// STATokenVerifier abstracts STAVerifier so tests can inject a stub without HTTP.
-type STATokenVerifier interface {
-	Verify(ctx context.Context, token string) (*STAVerifyResult, error)
+// StorageTokenVerifier abstracts HTTPStorageTokenVerifier so tests can inject a stub without HTTP.
+type StorageTokenVerifier interface {
+	Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error)
 }
 
 // DevModeChecker tells the handler whether the current app is in dev mode.
@@ -22,13 +22,13 @@ type DevModeChecker interface {
 }
 
 type HandshakeTokenDeps struct {
-	Clock        clockwork.Clock
-	STA          STATokenVerifier
-	DevMode      DevModeChecker
-	CORS         *CORS
-	HandshakeKey string
-	AppID        string
-	AppProjectID string
+	Clock                clockwork.Clock
+	StorageTokenVerifier StorageTokenVerifier
+	DevMode              DevModeChecker
+	CORS                 *CORS
+	HandshakeKey         string
+	AppID                string
+	AppProjectID         string
 }
 
 type HandshakeTokenHandler struct {
@@ -64,16 +64,16 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 		return nil
 	}
 
-	staToken := r.Header.Get("X-StorageApi-Token")
-	if staToken == "" {
+	storageToken := r.Header.Get("X-StorageApi-Token")
+	if storageToken == "" {
 		http.Error(w, "missing X-StorageApi-Token", http.StatusUnauthorized)
 		return nil
 	}
 
-	res, err := h.deps.STA.Verify(r.Context(), staToken)
+	res, err := h.deps.StorageTokenVerifier.Verify(r.Context(), storageToken)
 	if err != nil {
-		// Never echo the raw STA token in the error body or logs.
-		http.Error(w, "STA token invalid", http.StatusUnauthorized)
+		// Never echo the raw Storage token in the error body or logs.
+		http.Error(w, "Storage token invalid", http.StatusUnauthorized)
 		return nil
 	}
 	if res.ProjectID != h.deps.AppProjectID {
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
index a5ec36b121..f97b8f7167 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
@@ -13,16 +13,16 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-type stubSTAVerifier struct {
+type stubStorageTokenVerifier struct {
 	projectID string
 	err       error
 }
 
-func (s *stubSTAVerifier) Verify(_ context.Context, _ string) (*STAVerifyResult, error) {
+func (s *stubStorageTokenVerifier) Verify(_ context.Context, _ string) (*StorageTokenVerifyResult, error) {
 	if s.err != nil {
 		return nil, s.err
 	}
-	return &STAVerifyResult{ProjectID: s.projectID}, nil
+	return &StorageTokenVerifyResult{ProjectID: s.projectID}, nil
 }
 
 type stubDevModeChecker struct{ devMode bool }
@@ -35,21 +35,21 @@ type stubErr struct{ msg string }
 
 func (e *stubErr) Error() string { return e.msg }
 
-func newTestHandshakeHandler(staOK bool, staProject string, devMode bool) *HandshakeTokenHandler {
-	var sta STATokenVerifier
-	if staOK {
-		sta = &stubSTAVerifier{projectID: staProject}
+func newTestHandshakeHandler(tokenValid bool, storageTokenProject string, devMode bool) *HandshakeTokenHandler {
+	var verifier StorageTokenVerifier
+	if tokenValid {
+		verifier = &stubStorageTokenVerifier{projectID: storageTokenProject}
 	} else {
-		sta = &stubSTAVerifier{err: errStubUnauth}
+		verifier = &stubStorageTokenVerifier{err: errStubUnauth}
 	}
 	return NewHandshakeTokenHandler(HandshakeTokenDeps{
-		Clock:        clockwork.NewFakeClock(),
-		STA:          sta,
-		DevMode:      &stubDevModeChecker{devMode: devMode},
-		CORS:         NewCORS([]string{"https://connection.keboola.com"}),
-		HandshakeKey: testHandshakeKey,
-		AppID:        "app-123",
-		AppProjectID: "proj-456",
+		Clock:                clockwork.NewFakeClock(),
+		StorageTokenVerifier: verifier,
+		DevMode:              &stubDevModeChecker{devMode: devMode},
+		CORS:                 NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey:         testHandshakeKey,
+		AppID:                "app-123",
+		AppProjectID:         "proj-456",
 	})
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go
deleted file mode 100644
index f8e4d92843..0000000000
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package kaipreview
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-
-	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
-)
-
-// STAVerifyResult is the subset of Storage API's tokens/verify response that the
-// kai-preview flow consumes. We deliberately ignore email, name, roles — see
-// docs/superpowers/specs/2026-05-14-dev-iframe-auth-design.md "no identity in
-// transit".
-type STAVerifyResult struct {
-	ProjectID string
-}
-
-type STAVerifier struct {
-	baseURL string
-	client  *http.Client
-}
-
-func NewSTAVerifier(baseURL string, client *http.Client) *STAVerifier {
-	return &STAVerifier{baseURL: baseURL, client: client}
-}
-
-func (v *STAVerifier) Verify(ctx context.Context, token string) (*STAVerifyResult, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, v.baseURL+"/v2/storage/tokens/verify", nil)
-	if err != nil {
-		return nil, errors.Errorf("kai-preview: build STA verify request: %w", err)
-	}
-	req.Header.Set("X-StorageApi-Token", token)
-	req.Header.Set("Accept", "application/json")
-
-	resp, err := v.client.Do(req)
-	if err != nil {
-		return nil, errors.Errorf("kai-preview: STA verify call: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusUnauthorized {
-		return nil, errors.New("kai-preview: STA token unauthorized")
-	}
-	if resp.StatusCode != http.StatusOK {
-		return nil, errors.Errorf("kai-preview: STA verify returned %d", resp.StatusCode)
-	}
-
-	var body struct {
-		Owner struct {
-			ID string `json:"id"`
-		} `json:"owner"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
-		return nil, errors.Errorf("kai-preview: decode STA verify response: %w", err)
-	}
-	if body.Owner.ID == "" {
-		return nil, errors.New("kai-preview: STA verify response missing owner.id")
-	}
-	return &STAVerifyResult{ProjectID: body.Owner.ID}, nil
-}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
new file mode 100644
index 0000000000..cfa20fee6d
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
@@ -0,0 +1,61 @@
+package kaipreview
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+// StorageTokenVerifyResult is the subset of Storage API's tokens/verify response that the
+// kai-preview flow consumes. We deliberately ignore email, name, roles — see
+// docs/superpowers/specs/2026-05-14-dev-iframe-auth-design.md "no identity in
+// transit".
+type StorageTokenVerifyResult struct {
+	ProjectID string
+}
+
+type HTTPStorageTokenVerifier struct {
+	baseURL string
+	client  *http.Client
+}
+
+func NewHTTPStorageTokenVerifier(baseURL string, client *http.Client) *HTTPStorageTokenVerifier {
+	return &HTTPStorageTokenVerifier{baseURL: baseURL, client: client}
+}
+
+func (v *HTTPStorageTokenVerifier) Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, v.baseURL+"/v2/storage/tokens/verify", nil)
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: build Storage token verify request: %w", err)
+	}
+	req.Header.Set("X-StorageApi-Token", token)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := v.client.Do(req)
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: Storage token verify call: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		return nil, errors.New("kai-preview: Storage token unauthorized")
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.Errorf("kai-preview: Storage token verify returned %d", resp.StatusCode)
+	}
+
+	var body struct {
+		Owner struct {
+			ID string `json:"id"`
+		} `json:"owner"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return nil, errors.Errorf("kai-preview: decode Storage token verify response: %w", err)
+	}
+	if body.Owner.ID == "" {
+		return nil, errors.New("kai-preview: Storage token verify response missing owner.id")
+	}
+	return &StorageTokenVerifyResult{ProjectID: body.Owner.ID}, nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
similarity index 72%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
index 8ce61506d5..7355525cf1 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/sta_verifier_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestSTAVerifier_Success(t *testing.T) {
+func TestStorageTokenVerifier_Success(t *testing.T) {
 	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, "GET", r.Method)
@@ -24,33 +24,33 @@ func TestSTAVerifier_Success(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	v := NewSTAVerifier(srv.URL, srv.Client())
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
 	res, err := v.Verify(context.Background(), "test-token")
 	require.NoError(t, err)
 	assert.Equal(t, "proj-456", res.ProjectID)
 }
 
-func TestSTAVerifier_Unauthorized(t *testing.T) {
+func TestStorageTokenVerifier_Unauthorized(t *testing.T) {
 	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
 	}))
 	defer srv.Close()
 
-	v := NewSTAVerifier(srv.URL, srv.Client())
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
 	_, err := v.Verify(context.Background(), "bad-token")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "unauthorized")
 }
 
-func TestSTAVerifier_NetworkError(t *testing.T) {
+func TestStorageTokenVerifier_NetworkError(t *testing.T) {
 	t.Parallel()
-	v := NewSTAVerifier("http://127.0.0.1:1", http.DefaultClient) // port 1 = unreachable
+	v := NewHTTPStorageTokenVerifier("http://127.0.0.1:1", http.DefaultClient) // port 1 = unreachable
 	_, err := v.Verify(context.Background(), "token")
 	require.Error(t, err)
 }
 
-func TestSTAVerifier_MissingOwnerID(t *testing.T) {
+func TestStorageTokenVerifier_MissingOwnerID(t *testing.T) {
 	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
@@ -59,26 +59,26 @@ func TestSTAVerifier_MissingOwnerID(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	v := NewSTAVerifier(srv.URL, srv.Client())
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
 	_, err := v.Verify(context.Background(), "token")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "missing owner.id")
 }
 
-func TestSTAVerifier_ServerError(t *testing.T) {
+func TestStorageTokenVerifier_ServerError(t *testing.T) {
 	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 	}))
 	defer srv.Close()
 
-	v := NewSTAVerifier(srv.URL, srv.Client())
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
 	_, err := v.Verify(context.Background(), "token")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "500")
 }
 
-func TestSTAVerifier_MalformedJSON(t *testing.T) {
+func TestStorageTokenVerifier_MalformedJSON(t *testing.T) {
 	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -86,8 +86,8 @@ func TestSTAVerifier_MalformedJSON(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	v := NewSTAVerifier(srv.URL, srv.Client())
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
 	_, err := v.Verify(context.Background(), "token")
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "decode STA verify response")
+	assert.Contains(t, err.Error(), "decode Storage token verify response")
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index 3898efe1af..bd506b88c0 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -34,7 +34,7 @@ type Manager struct {
 	pageWriter       *pagewriter.Writer
 	handlers         *syncmap.SyncMap[api.AppID, appHandlerWrapper]
 	clock            clockwork.Clock
-	staVerifier      kaipreview.STATokenVerifier
+	storageTokenVerifier kaipreview.StorageTokenVerifier
 }
 
 type appHandlerWrapper struct {
@@ -57,10 +57,10 @@ type dependencies interface {
 func NewManager(d dependencies) *Manager {
 	cfg := d.Config()
 	if cfg.StorageAPIURL == nil {
-		panic("appsproxy: StorageAPIURL is required for kai-preview STA verification")
+		panic("appsproxy: StorageAPIURL is required for kai-preview Storage token verification")
 	}
 	storageAPIURL := cfg.StorageAPIURL.String()
-	staHTTPClient := &http.Client{Timeout: 5 * time.Second}
+	storageTokenHTTPClient := &http.Client{Timeout: 5 * time.Second}
 	return &Manager{
 		config:           cfg,
 		telemetry:        d.Telemetry(),
@@ -71,8 +71,8 @@ func NewManager(d dependencies) *Manager {
 		handlers: syncmap.New[api.AppID, appHandlerWrapper](func(api.AppID) *appHandlerWrapper {
 			return &appHandlerWrapper{lock: &sync.Mutex{}}
 		}),
-		clock:       d.Clock(),
-		staVerifier: kaipreview.NewSTAVerifier(storageAPIURL, staHTTPClient),
+		clock:                d.Clock(),
+		storageTokenVerifier: kaipreview.NewHTTPStorageTokenVerifier(storageAPIURL, storageTokenHTTPClient),
 	}
 }
 

From 9f4f8ebc18bc8bf1d8720d49b409f3284cdaeaf0 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 07:14:26 +0200
Subject: [PATCH 28/49] refactor(apps-proxy): inline kai-preview CSP helper
 into bootstrap handler

---
 .../authproxy/kaipreview/bootstrap.go         |  8 +++++-
 .../apphandler/authproxy/kaipreview/csp.go    | 17 -------------
 .../authproxy/kaipreview/csp_test.go          | 25 -------------------
 3 files changed, 7 insertions(+), 43 deletions(-)
 delete mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go
 delete mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
index 05599b1b23..38516a1daa 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"html/template"
 	"net/http"
+	"strings"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
@@ -43,7 +44,12 @@ func (h *BootstrapHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reque
 		return nil
 	}
 
-	WriteFrameAncestorsCSP(w, h.allowedOrigins)
+	csp := "frame-ancestors 'none'"
+	if len(h.allowedOrigins) > 0 {
+		csp = "frame-ancestors " + strings.Join(h.allowedOrigins, " ")
+	}
+
+	w.Header().Set("Content-Security-Policy", csp)
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.Header().Set("Cache-Control", "no-store")
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go
deleted file mode 100644
index 432b4641ae..0000000000
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package kaipreview
-
-import (
-	"net/http"
-	"strings"
-)
-
-// WriteFrameAncestorsCSP sets a Content-Security-Policy header with a single
-// frame-ancestors directive. Pass the allowed IDE origins; pass nil/empty to
-// fall back to 'none' (deny all embedding).
-func WriteFrameAncestorsCSP(w http.ResponseWriter, allowedOrigins []string) {
-	if len(allowedOrigins) == 0 {
-		w.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
-		return
-	}
-	w.Header().Set("Content-Security-Policy", "frame-ancestors "+strings.Join(allowedOrigins, " "))
-}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go
deleted file mode 100644
index a2f2ba47b8..0000000000
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/csp_test.go
+++ /dev/null
@@ -1,25 +0,0 @@
-package kaipreview
-
-import (
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestWriteFrameAncestorsCSP(t *testing.T) {
-	t.Parallel()
-	w := httptest.NewRecorder()
-	WriteFrameAncestorsCSP(w, []string{"https://connection.keboola.com", "https://connection.eu-central-1.keboola.com"})
-	assert.Equal(t,
-		"frame-ancestors https://connection.keboola.com https://connection.eu-central-1.keboola.com",
-		w.Header().Get("Content-Security-Policy"),
-	)
-}
-
-func TestWriteFrameAncestorsCSP_Empty(t *testing.T) {
-	t.Parallel()
-	w := httptest.NewRecorder()
-	WriteFrameAncestorsCSP(w, nil)
-	assert.Equal(t, "frame-ancestors 'none'", w.Header().Get("Content-Security-Policy"))
-}

From 7888c90702ed8c2cd649127dd4163bf6545a6036 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 07:29:34 +0200
Subject: [PATCH 29/49] refactor(apps-proxy): split kai-preview into endpoints
 sub-package and helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the four endpoint handlers (handshake-token, bootstrap, exchange,
refresh), the composite Handler, and routing symbols (PathPrefix,
DevModeChecker, DevModeCheckerFunc) into a new
internal/…/kaipreview/endpoints sub-package (package name "endpoints").
The parent kaipreview package retains the pure helpers: JWT minting/
verification, cookie helpers, CORS, IsIframeDocumentLoad, and the
StorageTokenVerifier interface (moved to storage_token_verifier.go).

External callers (apphandler.go) import both packages: kaipreview for
helpers and kpendpoints alias for the handler/routing surface.
---
 .../appsproxy/proxy/apphandler/apphandler.go  | 11 ++++----
 .../kaipreview/{ => endpoints}/bootstrap.go   |  2 +-
 .../{ => endpoints}/bootstrap_test.go         |  2 +-
 .../kaipreview/{ => endpoints}/exchange.go    |  9 +++---
 .../{ => endpoints}/exchange_test.go          |  8 ++++--
 .../kaipreview/{ => endpoints}/handler.go     |  7 +++--
 .../{ => endpoints}/handler_test.go           |  6 ++--
 .../{ => endpoints}/handshake_token.go        | 14 ++++------
 .../{ => endpoints}/handshake_token_test.go   | 17 +++++++----
 .../kaipreview/{ => endpoints}/refresh.go     | 13 +++++----
 .../{ => endpoints}/refresh_test.go           | 28 ++++++++++---------
 .../{ => endpoints}/template/bootstrap.gohtml |  0
 .../kaipreview/storage_token_verifier.go      |  5 ++++
 13 files changed, 70 insertions(+), 52 deletions(-)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/bootstrap.go (98%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/bootstrap_test.go (99%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/exchange.go (78%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/exchange_test.go (93%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/handler.go (92%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/handler_test.go (92%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/handshake_token.go (86%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/handshake_token_test.go (92%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/refresh.go (78%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/refresh_test.go (79%)
 rename internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/{ => endpoints}/template/bootstrap.gohtml (100%)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index bbddbbf3b2..c562b5d6f6 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -15,6 +15,7 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/api"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/auth/provider"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+	kpendpoints "github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/selector"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/chain"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/common/ctxattr"
@@ -31,14 +32,14 @@ type appHandler struct {
 	upstream           chain.Handler
 	allAuthHandlers    chain.Handler
 	authHandlerPerRule map[ruleIndex]chain.Handler
-	kaiPreview         *kaipreview.Handler
+	kaiPreview         *kpendpoints.Handler
 }
 
 type ruleIndex int
 
 func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handler, authHandlers map[provider.ID]selector.Handler) (http.Handler, error) {
 	// DevModeChecker is backed by the live K8s state watcher: re-evaluates on every request.
-	devModeChecker := kaipreview.DevModeCheckerFunc(func(ctx context.Context, appID string) bool {
+	devModeChecker := kpendpoints.DevModeCheckerFunc(func(ctx context.Context, appID string) bool {
 		info, ok := manager.upstreamManager.AppInfo(ctx, api.AppID(appID))
 		return ok && info.DevMode
 	})
@@ -50,7 +51,7 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 		attrs:              app.Telemetry(),
 		upstream:           appUpstream,
 		authHandlerPerRule: make(map[ruleIndex]chain.Handler),
-		kaiPreview: kaipreview.NewHandler(kaipreview.HandlerDeps{
+		kaiPreview: kpendpoints.NewHandler(kpendpoints.HandlerDeps{
 			Clock:             manager.clock,
 			StorageTokenVerifier: manager.storageTokenVerifier,
 			DevMode:           devModeChecker,
@@ -171,7 +172,7 @@ func (h *appHandler) serveHTTPOrError(w http.ResponseWriter, req *http.Request)
 	// (routing decision documented in spec § "apps-proxy: routing decision for dev-mode apps")
 	if h.isDevMode(req.Context()) {
 		// 1. /_proxy/kai-preview/* routes go to the kai-preview composite handler.
-		if strings.HasPrefix(req.URL.Path, kaipreview.PathPrefix) {
+		if strings.HasPrefix(req.URL.Path, kpendpoints.PathPrefix) {
 			return h.kaiPreview.ServeHTTPOrError(w, req)
 		}
 		// 2. Valid session cookie → forward to upstream (skip AuthRules), with sliding refresh.
@@ -200,7 +201,7 @@ func (h *appHandler) serveHTTPOrError(w http.ResponseWriter, req *http.Request)
 		// 3. Iframe document load on a dev-mode app with no session → serve bootstrap shim.
 		if kaipreview.IsIframeDocumentLoad(req) {
 			bootstrapReq := req.Clone(req.Context())
-			bootstrapReq.URL.Path = kaipreview.PathPrefix + "/bootstrap"
+			bootstrapReq.URL.Path = kpendpoints.PathPrefix + "/bootstrap"
 			return h.kaiPreview.ServeHTTPOrError(w, bootstrapReq)
 		}
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
similarity index 98%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
index 38516a1daa..5cae0eb3d9 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"embed"
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
similarity index 99%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
index 85e007f0e8..524a984697 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/bootstrap_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"net/http"
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
similarity index 78%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
index 2c62552a63..5a656e9491 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"encoding/json"
@@ -7,6 +7,7 @@ import (
 
 	"github.com/jonboulle/clockwork"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
@@ -48,7 +49,7 @@ func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reques
 		return nil
 	}
 
-	claims, err := VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, body.Token)
+	claims, err := kaipreview.VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, body.Token)
 	if err != nil {
 		http.Error(w, "invalid handshake token", http.StatusUnauthorized)
 		return nil
@@ -58,12 +59,12 @@ func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reques
 		return nil
 	}
 
-	sessionJWT, err := MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
+	sessionJWT, err := kaipreview.MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
 	if err != nil {
 		return errors.Errorf("kai-preview: mint session JWT: %w", err)
 	}
 
-	SetSessionCookie(w, sessionJWT, h.deps.SessionTTL)
+	kaipreview.SetSessionCookie(w, sessionJWT, h.deps.SessionTTL)
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
 	return nil
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
similarity index 93%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange_test.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
index 45b271035b..565af169ba 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/exchange_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"bytes"
@@ -11,6 +11,8 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
 func newTestExchangeHandler(devMode bool) *ExchangeHandler {
@@ -28,7 +30,7 @@ func newTestExchangeHandler(devMode bool) *ExchangeHandler {
 func mintForTest(t *testing.T, appID, projectID string) string {
 	t.Helper()
 	clock := clockwork.NewFakeClock()
-	jwt, err := MintHandshakeJWT(testHandshakeKey, clock, appID, projectID)
+	jwt, err := kaipreview.MintHandshakeJWT(testHandshakeKey, clock, appID, projectID)
 	require.NoError(t, err)
 	return jwt
 }
@@ -49,7 +51,7 @@ func TestExchangeHandler_Success(t *testing.T) {
 
 	cookies := w.Result().Cookies()
 	require.Len(t, cookies, 1)
-	assert.Equal(t, SessionCookieName, cookies[0].Name)
+	assert.Equal(t, kaipreview.SessionCookieName, cookies[0].Name)
 	assert.True(t, cookies[0].Partitioned)
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
similarity index 92%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
index 7657968aa3..3d05b923c9 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"context"
@@ -9,6 +9,7 @@ import (
 	"github.com/jonboulle/clockwork"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
 // PathPrefix is the URL prefix all kai-preview endpoints live under.
@@ -29,9 +30,9 @@ func (f DevModeCheckerFunc) IsDevMode(ctx context.Context, appID string) bool {
 
 type HandlerDeps struct {
 	Clock                clockwork.Clock
-	StorageTokenVerifier StorageTokenVerifier
+	StorageTokenVerifier kaipreview.StorageTokenVerifier
 	DevMode              DevModeChecker
-	CORS                 *CORS
+	CORS                 *kaipreview.CORS
 	HandshakeKey         string
 	SessionKey           string
 	SessionTTL           time.Duration
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
similarity index 92%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
index 6400537102..b35ca66e7f 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"net/http"
@@ -9,6 +9,8 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
 func newTestCompositeHandler(devMode bool) *Handler {
@@ -16,7 +18,7 @@ func newTestCompositeHandler(devMode bool) *Handler {
 		Clock:             clockwork.NewFakeClock(),
 		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
 		DevMode:           &stubDevModeChecker{devMode: devMode},
-		CORS:              NewCORS([]string{"https://connection.keboola.com"}),
+		CORS:              kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
 		HandshakeKey:      testHandshakeKey,
 		SessionKey:        testSessionKey,
 		SessionTTL:        4 * time.Hour,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
similarity index 86%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
index a569e15a60..35395f26c2 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"context"
@@ -7,14 +7,10 @@ import (
 
 	"github.com/jonboulle/clockwork"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
-// StorageTokenVerifier abstracts HTTPStorageTokenVerifier so tests can inject a stub without HTTP.
-type StorageTokenVerifier interface {
-	Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error)
-}
-
 // DevModeChecker tells the handler whether the current app is in dev mode.
 // Backed by the apps-proxy CRD watcher (AppInfo.DevMode).
 type DevModeChecker interface {
@@ -23,9 +19,9 @@ type DevModeChecker interface {
 
 type HandshakeTokenDeps struct {
 	Clock                clockwork.Clock
-	StorageTokenVerifier StorageTokenVerifier
+	StorageTokenVerifier kaipreview.StorageTokenVerifier
 	DevMode              DevModeChecker
-	CORS                 *CORS
+	CORS                 *kaipreview.CORS
 	HandshakeKey         string
 	AppID                string
 	AppProjectID         string
@@ -81,7 +77,7 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 		return nil
 	}
 
-	jwt, err := MintHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID)
+	jwt, err := kaipreview.MintHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID)
 	if err != nil {
 		return errors.Errorf("kai-preview: mint handshake JWT: %w", err)
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
similarity index 92%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
index f97b8f7167..6975d0da27 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/handshake_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"context"
@@ -11,6 +11,13 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+)
+
+const (
+	testHandshakeKey = "test-handshake-key-must-be-long-enough"
+	testSessionKey   = "test-session-key-also-long-enough"
 )
 
 type stubStorageTokenVerifier struct {
@@ -18,11 +25,11 @@ type stubStorageTokenVerifier struct {
 	err       error
 }
 
-func (s *stubStorageTokenVerifier) Verify(_ context.Context, _ string) (*StorageTokenVerifyResult, error) {
+func (s *stubStorageTokenVerifier) Verify(_ context.Context, _ string) (*kaipreview.StorageTokenVerifyResult, error) {
 	if s.err != nil {
 		return nil, s.err
 	}
-	return &StorageTokenVerifyResult{ProjectID: s.projectID}, nil
+	return &kaipreview.StorageTokenVerifyResult{ProjectID: s.projectID}, nil
 }
 
 type stubDevModeChecker struct{ devMode bool }
@@ -36,7 +43,7 @@ type stubErr struct{ msg string }
 func (e *stubErr) Error() string { return e.msg }
 
 func newTestHandshakeHandler(tokenValid bool, storageTokenProject string, devMode bool) *HandshakeTokenHandler {
-	var verifier StorageTokenVerifier
+	var verifier kaipreview.StorageTokenVerifier
 	if tokenValid {
 		verifier = &stubStorageTokenVerifier{projectID: storageTokenProject}
 	} else {
@@ -46,7 +53,7 @@ func newTestHandshakeHandler(tokenValid bool, storageTokenProject string, devMod
 		Clock:                clockwork.NewFakeClock(),
 		StorageTokenVerifier: verifier,
 		DevMode:              &stubDevModeChecker{devMode: devMode},
-		CORS:                 NewCORS([]string{"https://connection.keboola.com"}),
+		CORS:                 kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
 		HandshakeKey:         testHandshakeKey,
 		AppID:                "app-123",
 		AppProjectID:         "proj-456",
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
similarity index 78%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
index 8305e3573c..6bc69a823a 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"net/http"
@@ -6,6 +6,7 @@ import (
 
 	"github.com/jonboulle/clockwork"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
@@ -14,7 +15,7 @@ type RefreshDeps struct {
 	DevMode      DevModeChecker
 	SessionKey   string
 	SessionTTL   time.Duration
-	CORS         *CORS
+	CORS         *kaipreview.CORS
 	AppID        string
 	AppProjectID string
 }
@@ -50,13 +51,13 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 		return nil
 	}
 
-	cookieValue := ReadSessionCookie(r)
+	cookieValue := kaipreview.ReadSessionCookie(r)
 	if cookieValue == "" {
 		http.Error(w, "no session", http.StatusUnauthorized)
 		return nil
 	}
 
-	claims, err := VerifySessionJWT(h.deps.SessionKey, h.deps.Clock, cookieValue)
+	claims, err := kaipreview.VerifySessionJWT(h.deps.SessionKey, h.deps.Clock, cookieValue)
 	if err != nil {
 		http.Error(w, "session expired", http.StatusUnauthorized)
 		return nil
@@ -66,11 +67,11 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 		return nil
 	}
 
-	newJWT, err := MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
+	newJWT, err := kaipreview.MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
 	if err != nil {
 		return errors.Errorf("kai-preview: re-mint session JWT: %w", err)
 	}
-	SetSessionCookie(w, newJWT, h.deps.SessionTTL)
+	kaipreview.SetSessionCookie(w, newJWT, h.deps.SessionTTL)
 
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusNoContent)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
similarity index 79%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh_test.go
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
index 027c9692d6..0c75574a8f 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/refresh_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
@@ -1,4 +1,4 @@
-package kaipreview
+package endpoints
 
 import (
 	"net/http"
@@ -9,6 +9,8 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
 func newTestRefreshHandler(devMode bool) (*RefreshHandler, *clockwork.FakeClock) {
@@ -18,7 +20,7 @@ func newTestRefreshHandler(devMode bool) (*RefreshHandler, *clockwork.FakeClock)
 		DevMode:      &stubDevModeChecker{devMode: devMode},
 		SessionKey:   testSessionKey,
 		SessionTTL:   4 * time.Hour,
-		CORS:         NewCORS([]string{"https://connection.keboola.com"}),
+		CORS:         kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
 		AppID:        "app-123",
 		AppProjectID: "proj-456",
 	}), clock
@@ -27,12 +29,12 @@ func newTestRefreshHandler(devMode bool) (*RefreshHandler, *clockwork.FakeClock)
 func TestRefreshHandler_Success(t *testing.T) {
 	t.Parallel()
 	h, clock := newTestRefreshHandler(true)
-	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
 	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
-	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
 
 	err = h.ServeHTTPOrError(w, r)
@@ -42,7 +44,7 @@ func TestRefreshHandler_Success(t *testing.T) {
 
 	cookies := w.Result().Cookies()
 	require.Len(t, cookies, 1)
-	assert.Equal(t, SessionCookieName, cookies[0].Name)
+	assert.Equal(t, kaipreview.SessionCookieName, cookies[0].Name)
 	assert.NotEqual(t, jwt, cookies[0].Value, "must be a fresh JWT, not the old one")
 }
 
@@ -75,13 +77,13 @@ func TestRefreshHandler_MissingCookie(t *testing.T) {
 func TestRefreshHandler_ExpiredCookie(t *testing.T) {
 	t.Parallel()
 	h, clock := newTestRefreshHandler(true)
-	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 	clock.Advance(5 * time.Hour)
 
 	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
-	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
 
 	err = h.ServeHTTPOrError(w, r)
@@ -93,12 +95,12 @@ func TestRefreshHandler_ExpiredCookie(t *testing.T) {
 func TestRefreshHandler_DevModeOff(t *testing.T) {
 	t.Parallel()
 	h, clock := newTestRefreshHandler(false)
-	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
 	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
-	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
 
 	err = h.ServeHTTPOrError(w, r)
@@ -109,12 +111,12 @@ func TestRefreshHandler_DevModeOff(t *testing.T) {
 func TestRefreshHandler_ScopeMismatch(t *testing.T) {
 	t.Parallel()
 	h, clock := newTestRefreshHandler(true)
-	jwt, err := MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
 	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
-	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
 
 	err = h.ServeHTTPOrError(w, r)
@@ -125,12 +127,12 @@ func TestRefreshHandler_ScopeMismatch(t *testing.T) {
 func TestRefreshHandler_DisallowedOrigin(t *testing.T) {
 	t.Parallel()
 	h, clock := newTestRefreshHandler(true)
-	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
 	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://evil.example.com")
-	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
 
 	err = h.ServeHTTPOrError(w, r)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml
similarity index 100%
rename from internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/template/bootstrap.gohtml
rename to internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
index cfa20fee6d..9b3b6c4fb9 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
@@ -8,6 +8,11 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
+// StorageTokenVerifier abstracts HTTPStorageTokenVerifier so tests can inject a stub without HTTP.
+type StorageTokenVerifier interface {
+	Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error)
+}
+
 // StorageTokenVerifyResult is the subset of Storage API's tokens/verify response that the
 // kai-preview flow consumes. We deliberately ignore email, name, roles — see
 // docs/superpowers/specs/2026-05-14-dev-iframe-auth-design.md "no identity in

From ad52e54b1e50528620d8f1406ccf3dbec55fc68a Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 07:43:24 +0200
Subject: [PATCH 30/49] fix(apps-proxy): tidy go.mod sort order

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 4323a0bf3b..e3842ed53d 100644
--- a/go.mod
+++ b/go.mod
@@ -30,9 +30,9 @@ require (
 	github.com/go-playground/universal-translator v0.18.1
 	github.com/go-playground/validator/v10 v10.30.2
 	github.com/go-resty/resty/v2 v2.17.2
-	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/gofrs/flock v0.13.0
 	github.com/gofrs/uuid/v5 v5.4.0
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-jsonnet v0.22.0
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510

From e36805a6f8895fdc9c67c88731a6d7b74f18e0ae Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 09:10:27 +0200
Subject: [PATCH 31/49] fix(apps-proxy): satisfy linters on kai-preview branch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix all 52 golangci-lint failures reported by CI run 25903961499:

- noctx(25): replace httptest.NewRequest → NewRequestWithContext(t.Context(), …) in all kaipreview test files
- tagliatelle(3): rename JSON tags app_id → appId and ttl_s → ttlS in jwt.go (HandshakeClaims, SessionClaims)
- errchkjson(7): check errors from json.Marshal / json.NewEncoder().Encode() in bootstrap.go, handshake_token.go, exchange_test.go, storage_token_verifier_test.go
- nilerr(4): add //nolint:nilerr with explanation where HTTP handlers deliberately swallow errors
- gochecknoglobals(2): var PathPrefix → const PathPrefix in handler.go; //nolint:gochecknoglobals on bootstrapTmpl
- gci(4): fix struct-field alignment in manager.go / apphandler.go; add missing spaces after commas in cookie_test.go, cors_test.go
- contextcheck(2): add //nolint:contextcheck on the two false-positive req.Context() call sites in apphandler.go; extract serveKaiPreview helper to reduce nestif complexity
- paralleltest(1)+tparallel(1): add t.Parallel() to TestIsIframeDocumentLoad subtests
- testifylint(1): assert.False(strings.Contains(…)) → assert.NotContains(…)
- errname(1): rename stubErr → stubError in handshake_token_test.go
- gosec G203(1): //nolint:gosec on template.JS(bs) conversion in bootstrap.go
- unparam(1): remove unused devMode bool param from newTestCompositeHandler; inline true
- usetesting(6): context.Background() → t.Context() in storage_token_verifier_test.go
---
 .../appsproxy/proxy/apphandler/apphandler.go  | 99 +++++++++++--------
 .../authproxy/kaipreview/cookie_test.go       | 14 +--
 .../authproxy/kaipreview/cors_test.go         |  6 +-
 .../kaipreview/endpoints/bootstrap.go         | 10 +-
 .../kaipreview/endpoints/bootstrap_test.go    |  6 +-
 .../kaipreview/endpoints/exchange.go          |  4 +-
 .../kaipreview/endpoints/exchange_test.go     | 39 ++++----
 .../authproxy/kaipreview/endpoints/handler.go |  2 +-
 .../kaipreview/endpoints/handler_test.go      | 40 ++++----
 .../kaipreview/endpoints/handshake_token.go   |  6 +-
 .../endpoints/handshake_token_test.go         | 27 +++--
 .../authproxy/kaipreview/endpoints/refresh.go |  2 +-
 .../kaipreview/endpoints/refresh_test.go      | 16 +--
 .../kaipreview/iframe_detect_test.go          |  3 +-
 .../apphandler/authproxy/kaipreview/jwt.go    |  6 +-
 .../kaipreview/storage_token_verifier_test.go | 19 ++--
 .../appsproxy/proxy/apphandler/manager.go     | 16 +--
 17 files changed, 171 insertions(+), 144 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index c562b5d6f6..4c014ef191 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -52,16 +52,16 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 		upstream:           appUpstream,
 		authHandlerPerRule: make(map[ruleIndex]chain.Handler),
 		kaiPreview: kpendpoints.NewHandler(kpendpoints.HandlerDeps{
-			Clock:             manager.clock,
+			Clock:                manager.clock,
 			StorageTokenVerifier: manager.storageTokenVerifier,
-			DevMode:           devModeChecker,
-			CORS:              kaipreview.NewCORS(manager.config.KaiPreview.AllowedOrigins),
-			HandshakeKey:      manager.config.KaiPreview.HandshakeSigningKey,
-			SessionKey:        manager.config.KaiPreview.SessionSigningKey,
-			SessionTTL:        manager.config.KaiPreview.SessionTTL,
-			AllowedOrigins:    manager.config.KaiPreview.AllowedOrigins,
-			AppID:             string(app.ID),
-			AppProjectID:      app.ProjectID,
+			DevMode:              devModeChecker,
+			CORS:                 kaipreview.NewCORS(manager.config.KaiPreview.AllowedOrigins),
+			HandshakeKey:         manager.config.KaiPreview.HandshakeSigningKey,
+			SessionKey:           manager.config.KaiPreview.SessionSigningKey,
+			SessionTTL:           manager.config.KaiPreview.SessionTTL,
+			AllowedOrigins:       manager.config.KaiPreview.AllowedOrigins,
+			AppID:                string(app.ID),
+			AppProjectID:         app.ProjectID,
 		}),
 	}
 
@@ -170,39 +170,9 @@ func (h *appHandler) serveHTTPOrError(w http.ResponseWriter, req *http.Request)
 
 	// kai-preview: dev-mode iframe-auth path.
 	// (routing decision documented in spec § "apps-proxy: routing decision for dev-mode apps")
-	if h.isDevMode(req.Context()) {
-		// 1. /_proxy/kai-preview/* routes go to the kai-preview composite handler.
-		if strings.HasPrefix(req.URL.Path, kpendpoints.PathPrefix) {
-			return h.kaiPreview.ServeHTTPOrError(w, req)
-		}
-		// 2. Valid session cookie → forward to upstream (skip AuthRules), with sliding refresh.
-		if claims, ok := kaipreview.ValidateSessionCookie(
-			req,
-			h.manager.config.KaiPreview.SessionSigningKey,
-			h.manager.clock,
-			string(h.app.ID),
-			h.app.ProjectID,
-		); ok {
-			if claims.NeedsRefresh(h.manager.clock.Now()) {
-				newJWT, err := kaipreview.MintSessionJWT(
-					h.manager.config.KaiPreview.SessionSigningKey,
-					h.manager.clock,
-					string(h.app.ID),
-					h.app.ProjectID,
-					h.manager.config.KaiPreview.SessionTTL,
-				)
-				if err == nil {
-					kaipreview.SetSessionCookie(w, newJWT, h.manager.config.KaiPreview.SessionTTL)
-				}
-				// If mint fails, just forward without refresh — the existing cookie is still valid.
-			}
-			return h.upstream.ServeHTTPOrError(w, req)
-		}
-		// 3. Iframe document load on a dev-mode app with no session → serve bootstrap shim.
-		if kaipreview.IsIframeDocumentLoad(req) {
-			bootstrapReq := req.Clone(req.Context())
-			bootstrapReq.URL.Path = kpendpoints.PathPrefix + "/bootstrap"
-			return h.kaiPreview.ServeHTTPOrError(w, bootstrapReq)
+	if h.isDevMode(req.Context()) { //nolint:contextcheck // false positive: req.Context() is the correct context here
+		if handled, err := h.serveKaiPreview(w, req); handled {
+			return err
 		}
 	}
 
@@ -234,6 +204,51 @@ func (h *appHandler) serveRule(w http.ResponseWriter, req *http.Request, index r
 	return h.upstream.ServeHTTPOrError(w, req)
 }
 
+// serveKaiPreview handles the three dev-mode routing cases for the kai-preview iframe-auth path.
+// Returns (true, err) when it handled the request, or (false, nil) when the caller should continue routing.
+func (h *appHandler) serveKaiPreview(w http.ResponseWriter, req *http.Request) (bool, error) {
+	// 1. /_proxy/kai-preview/* routes go to the kai-preview composite handler.
+	if strings.HasPrefix(req.URL.Path, kpendpoints.PathPrefix) {
+		return true, h.kaiPreview.ServeHTTPOrError(w, req)
+	}
+	// 2. Valid session cookie → forward to upstream (skip AuthRules), with sliding refresh.
+	if claims, ok := kaipreview.ValidateSessionCookie(
+		req,
+		h.manager.config.KaiPreview.SessionSigningKey,
+		h.manager.clock,
+		string(h.app.ID),
+		h.app.ProjectID,
+	); ok {
+		h.maybeRefreshSessionCookie(w, claims)
+		return true, h.upstream.ServeHTTPOrError(w, req)
+	}
+	// 3. Iframe document load on a dev-mode app with no session → serve bootstrap shim.
+	if kaipreview.IsIframeDocumentLoad(req) {
+		bootstrapReq := req.Clone(req.Context()) //nolint:contextcheck // false positive: req.Context() is the correct context here
+		bootstrapReq.URL.Path = kpendpoints.PathPrefix + "/bootstrap"
+		return true, h.kaiPreview.ServeHTTPOrError(w, bootstrapReq)
+	}
+	return false, nil
+}
+
+// maybeRefreshSessionCookie re-mints the session JWT when the session has passed its midpoint.
+// If minting fails, the existing cookie is left in place (it is still valid).
+func (h *appHandler) maybeRefreshSessionCookie(w http.ResponseWriter, claims *kaipreview.SessionClaims) {
+	if !claims.NeedsRefresh(h.manager.clock.Now()) {
+		return
+	}
+	newJWT, err := kaipreview.MintSessionJWT(
+		h.manager.config.KaiPreview.SessionSigningKey,
+		h.manager.clock,
+		string(h.app.ID),
+		h.app.ProjectID,
+		h.manager.config.KaiPreview.SessionTTL,
+	)
+	if err == nil {
+		kaipreview.SetSessionCookie(w, newJWT, h.manager.config.KaiPreview.SessionTTL)
+	}
+}
+
 // isDevMode reports whether this app currently has DevMode enabled.
 // It reads from the live K8s state cache so toggling DevMode on the App CRD takes
 // effect on the next request without requiring handler recreation.
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
index 4e2e2b4117..2e560310f3 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
@@ -40,7 +40,7 @@ func TestSetSessionCookie_Attributes(t *testing.T) {
 
 func TestReadSessionCookie_Present(t *testing.T) {
 	t.Parallel()
-	r := httptest.NewRequest("GET", "/", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/", nil)
 	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: "the-jwt"})
 	got := ReadSessionCookie(r)
 	assert.Equal(t, "the-jwt", got)
@@ -48,7 +48,7 @@ func TestReadSessionCookie_Present(t *testing.T) {
 
 func TestReadSessionCookie_Missing(t *testing.T) {
 	t.Parallel()
-	r := httptest.NewRequest("GET", "/", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/", nil)
 	got := ReadSessionCookie(r)
 	assert.Empty(t, got)
 }
@@ -85,7 +85,7 @@ func TestValidateSessionCookie_Valid(t *testing.T) {
 	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
-	r := httptest.NewRequest("GET", "/anything", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
 	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
 
 	claims, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
@@ -97,7 +97,7 @@ func TestValidateSessionCookie_Valid(t *testing.T) {
 func TestValidateSessionCookie_Missing(t *testing.T) {
 	t.Parallel()
 	clock := clockwork.NewFakeClock()
-	r := httptest.NewRequest("GET", "/anything", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
 	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
 	assert.False(t, ok)
 }
@@ -107,7 +107,7 @@ func TestValidateSessionCookie_AppMismatch(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 	jwt, err := MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
-	r := httptest.NewRequest("GET", "/anything", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
 	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
 
 	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
@@ -120,7 +120,7 @@ func TestValidateSessionCookie_Expired(t *testing.T) {
 	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 	clock.Advance(5 * time.Hour)
-	r := httptest.NewRequest("GET", "/anything", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
 	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
 
 	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
@@ -132,7 +132,7 @@ func TestValidateSessionCookie_ProjectMismatch(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "different-project", 4*time.Hour)
 	require.NoError(t, err)
-	r := httptest.NewRequest("GET", "/anything", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
 	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
 
 	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
index 414aad19e2..c35c4f5fc2 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
@@ -12,7 +12,7 @@ func TestCORS_AllowedOrigin_Preflight(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
 
-	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("Access-Control-Request-Method", "POST")
 	r.Header.Set("Access-Control-Request-Headers", "X-StorageApi-Token, Content-Type")
@@ -30,7 +30,7 @@ func TestCORS_DisallowedOrigin_Preflight(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
 
-	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://evil.example.com")
 	w := httptest.NewRecorder()
 
@@ -53,7 +53,7 @@ func TestCORS_WriteResponseHeaders(t *testing.T) {
 func TestCORS_NonPreflightPassesThrough(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	w := httptest.NewRecorder()
 	handled := cors.HandlePreflight(w, r)
 	assert.False(t, handled)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
index 5cae0eb3d9..3698a2f8a1 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
@@ -13,7 +13,7 @@ import (
 //go:embed template/bootstrap.gohtml
 var bootstrapFS embed.FS
 
-var bootstrapTmpl = template.Must(template.ParseFS(bootstrapFS, "template/bootstrap.gohtml"))
+var bootstrapTmpl = template.Must(template.ParseFS(bootstrapFS, "template/bootstrap.gohtml")) //nolint:gochecknoglobals // template must be parsed at package init
 
 type BootstrapHandler struct {
 	allowedOrigins []string
@@ -23,10 +23,14 @@ type BootstrapHandler struct {
 }
 
 func NewBootstrapHandler(allowedOrigins []string, devMode DevModeChecker, appID string) *BootstrapHandler {
-	bs, _ := json.Marshal(allowedOrigins) // []string round-trip never errors for []string
+	bs, err := json.Marshal(allowedOrigins)
+	if err != nil {
+		// []string marshalling never fails; this is a safety guard.
+		bs = []byte("[]")
+	}
 	return &BootstrapHandler{
 		allowedOrigins: allowedOrigins,
-		originsJSON:    template.JS(bs),
+		originsJSON:    template.JS(bs), //nolint:gosec // G203: bs is json.Marshal output of config-supplied URL strings, safe to embed as JS literal
 		devMode:        devMode,
 		appID:          appID,
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
index 524a984697..c3c303b376 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
@@ -13,7 +13,7 @@ import (
 func TestBootstrapHandler_ServesHTMLWithCSP(t *testing.T) {
 	t.Parallel()
 	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: true}, "app-123")
-	r := httptest.NewRequest("GET", "/_proxy/kai-preview/bootstrap", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/_proxy/kai-preview/bootstrap", nil)
 	w := httptest.NewRecorder()
 
 	err := h.ServeHTTPOrError(w, r)
@@ -34,7 +34,7 @@ func TestBootstrapHandler_ServesHTMLWithCSP(t *testing.T) {
 func TestBootstrapHandler_WrongMethod(t *testing.T) {
 	t.Parallel()
 	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: true}, "app-123")
-	r := httptest.NewRequest("POST", "/_proxy/kai-preview/bootstrap", nil)
+	r := httptest.NewRequestWithContext(t.Context(), "POST", "/_proxy/kai-preview/bootstrap", nil)
 	w := httptest.NewRecorder()
 	err := h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
@@ -44,7 +44,7 @@ func TestBootstrapHandler_WrongMethod(t *testing.T) {
 func TestBootstrapHandler_NonDevModeReturns404(t *testing.T) {
 	t.Parallel()
 	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: false}, "app-123")
-	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
 	w := httptest.NewRecorder()
 	err := h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
index 5a656e9491..6e47b22416 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
@@ -46,13 +46,13 @@ func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reques
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.Token == "" {
 		http.Error(w, "invalid body", http.StatusBadRequest)
-		return nil
+		return nil //nolint:nilerr // intentional: decode error handled via HTTP 400 response
 	}
 
 	claims, err := kaipreview.VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, body.Token)
 	if err != nil {
 		http.Error(w, "invalid handshake token", http.StatusUnauthorized)
-		return nil
+		return nil //nolint:nilerr // intentional: invalid token handled via HTTP 401 response
 	}
 	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
 		http.Error(w, "handshake token scope mismatch", http.StatusForbidden)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
index 565af169ba..aaf2a9e8dc 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
@@ -40,12 +40,13 @@ func TestExchangeHandler_Success(t *testing.T) {
 	h := newTestExchangeHandler(true)
 	jwt := mintForTest(t, "app-123", "proj-456")
 
-	body, _ := json.Marshal(map[string]string{"token": jwt})
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
 	r.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()
 
-	err := h.ServeHTTPOrError(w, r)
+	err = h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusOK, w.Code)
 
@@ -59,11 +60,12 @@ func TestExchangeHandler_InvalidJWT(t *testing.T) {
 	t.Parallel()
 	h := newTestExchangeHandler(true)
 
-	body, _ := json.Marshal(map[string]string{"token": "not-a-jwt"})
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	body, err := json.Marshal(map[string]string{"token": "not-a-jwt"})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
 	w := httptest.NewRecorder()
 
-	err := h.ServeHTTPOrError(w, r)
+	err = h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusUnauthorized, w.Code)
 }
@@ -73,11 +75,12 @@ func TestExchangeHandler_AppIDMismatch(t *testing.T) {
 	h := newTestExchangeHandler(true)
 	jwt := mintForTest(t, "different-app", "proj-456")
 
-	body, _ := json.Marshal(map[string]string{"token": jwt})
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
 	w := httptest.NewRecorder()
 
-	err := h.ServeHTTPOrError(w, r)
+	err = h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusForbidden, w.Code)
 }
@@ -87,11 +90,12 @@ func TestExchangeHandler_ProjectMismatch(t *testing.T) {
 	h := newTestExchangeHandler(true)
 	jwt := mintForTest(t, "app-123", "different-project")
 
-	body, _ := json.Marshal(map[string]string{"token": jwt})
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
 	w := httptest.NewRecorder()
 
-	err := h.ServeHTTPOrError(w, r)
+	err = h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusForbidden, w.Code)
 }
@@ -101,11 +105,12 @@ func TestExchangeHandler_DevModeOff(t *testing.T) {
 	h := newTestExchangeHandler(false)
 	jwt := mintForTest(t, "app-123", "proj-456")
 
-	body, _ := json.Marshal(map[string]string{"token": jwt})
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
 	w := httptest.NewRecorder()
 
-	err := h.ServeHTTPOrError(w, r)
+	err = h.ServeHTTPOrError(w, r)
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
@@ -113,7 +118,7 @@ func TestExchangeHandler_DevModeOff(t *testing.T) {
 func TestExchangeHandler_WrongMethod(t *testing.T) {
 	t.Parallel()
 	h := newTestExchangeHandler(true)
-	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/exchange", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/exchange", nil)
 	w := httptest.NewRecorder()
 
 	err := h.ServeHTTPOrError(w, r)
@@ -124,7 +129,7 @@ func TestExchangeHandler_WrongMethod(t *testing.T) {
 func TestExchangeHandler_EmptyBody(t *testing.T) {
 	t.Parallel()
 	h := newTestExchangeHandler(true)
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader([]byte("{}")))
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader([]byte("{}")))
 	w := httptest.NewRecorder()
 
 	err := h.ServeHTTPOrError(w, r)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
index 3d05b923c9..6707059e0a 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
@@ -13,7 +13,7 @@ import (
 )
 
 // PathPrefix is the URL prefix all kai-preview endpoints live under.
-var PathPrefix = config.InternalPrefix + "/kai-preview"
+const PathPrefix = config.InternalPrefix + "/kai-preview"
 
 const (
 	pathHandshakeToken = "/handshake-token"
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
index b35ca66e7f..9327b267c7 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
@@ -13,25 +13,25 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
-func newTestCompositeHandler(devMode bool) *Handler {
+func newTestCompositeHandler() *Handler {
 	return NewHandler(HandlerDeps{
-		Clock:             clockwork.NewFakeClock(),
+		Clock:                clockwork.NewFakeClock(),
 		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
-		DevMode:           &stubDevModeChecker{devMode: devMode},
-		CORS:              kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
-		HandshakeKey:      testHandshakeKey,
-		SessionKey:        testSessionKey,
-		SessionTTL:        4 * time.Hour,
-		AllowedOrigins: []string{"https://connection.keboola.com"},
-		AppID:             "app-123",
-		AppProjectID:      "proj-456",
+		DevMode:              &stubDevModeChecker{devMode: true},
+		CORS:                 kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey:         testHandshakeKey,
+		SessionKey:           testSessionKey,
+		SessionTTL:           4 * time.Hour,
+		AllowedOrigins:       []string{"https://connection.keboola.com"},
+		AppID:                "app-123",
+		AppProjectID:         "proj-456",
 	})
 }
 
 func TestCompositeHandler_RoutesHandshakeToken(t *testing.T) {
 	t.Parallel()
-	h := newTestCompositeHandler(true)
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	h := newTestCompositeHandler()
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid")
 	w := httptest.NewRecorder()
@@ -41,8 +41,8 @@ func TestCompositeHandler_RoutesHandshakeToken(t *testing.T) {
 
 func TestCompositeHandler_RoutesBootstrap(t *testing.T) {
 	t.Parallel()
-	h := newTestCompositeHandler(true)
-	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
+	h := newTestCompositeHandler()
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
 	w := httptest.NewRecorder()
 	require.NoError(t, h.ServeHTTPOrError(w, r))
 	assert.Equal(t, http.StatusOK, w.Code)
@@ -51,9 +51,9 @@ func TestCompositeHandler_RoutesBootstrap(t *testing.T) {
 
 func TestCompositeHandler_RoutesExchange(t *testing.T) {
 	t.Parallel()
-	h := newTestCompositeHandler(true)
+	h := newTestCompositeHandler()
 	// Empty body — exchange should return 400 (handler reached, valid path)
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/exchange", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", nil)
 	w := httptest.NewRecorder()
 	require.NoError(t, h.ServeHTTPOrError(w, r))
 	assert.Equal(t, http.StatusBadRequest, w.Code)
@@ -61,9 +61,9 @@ func TestCompositeHandler_RoutesExchange(t *testing.T) {
 
 func TestCompositeHandler_RoutesRefresh(t *testing.T) {
 	t.Parallel()
-	h := newTestCompositeHandler(true)
+	h := newTestCompositeHandler()
 	// No cookie — refresh should return 401 (handler reached, valid path)
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	w := httptest.NewRecorder()
 	require.NoError(t, h.ServeHTTPOrError(w, r))
@@ -72,8 +72,8 @@ func TestCompositeHandler_RoutesRefresh(t *testing.T) {
 
 func TestCompositeHandler_UnknownSubpath404(t *testing.T) {
 	t.Parallel()
-	h := newTestCompositeHandler(true)
-	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/does-not-exist", nil)
+	h := newTestCompositeHandler()
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/does-not-exist", nil)
 	w := httptest.NewRecorder()
 	require.NoError(t, h.ServeHTTPOrError(w, r))
 	assert.Equal(t, http.StatusNotFound, w.Code)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
index 35395f26c2..f1041a7130 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
@@ -70,7 +70,7 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 	if err != nil {
 		// Never echo the raw Storage token in the error body or logs.
 		http.Error(w, "Storage token invalid", http.StatusUnauthorized)
-		return nil
+		return nil //nolint:nilerr // intentional: error is handled via HTTP response, not propagated
 	}
 	if res.ProjectID != h.deps.AppProjectID {
 		http.Error(w, "app belongs to a different project", http.StatusForbidden)
@@ -86,6 +86,8 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
-	_ = json.NewEncoder(w).Encode(map[string]string{"token": jwt})
+	if err := json.NewEncoder(w).Encode(map[string]string{"token": jwt}); err != nil {
+		return errors.Errorf("kai-preview: write handshake token response: %w", err)
+	}
 	return nil
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
index 6975d0da27..f69ce9c5eb 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
 	"github.com/jonboulle/clockwork"
@@ -36,11 +35,11 @@ type stubDevModeChecker struct{ devMode bool }
 
 func (s *stubDevModeChecker) IsDevMode(_ context.Context, _ string) bool { return s.devMode }
 
-var errStubUnauth = &stubErr{msg: "unauthorized"}
+var errStubUnauth = &stubError{msg: "unauthorized"}
 
-type stubErr struct{ msg string }
+type stubError struct{ msg string }
 
-func (e *stubErr) Error() string { return e.msg }
+func (e *stubError) Error() string { return e.msg }
 
 func newTestHandshakeHandler(tokenValid bool, storageTokenProject string, devMode bool) *HandshakeTokenHandler {
 	var verifier kaipreview.StorageTokenVerifier
@@ -64,7 +63,7 @@ func TestHandshakeTokenHandler_Success(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid-token")
 	w := httptest.NewRecorder()
@@ -85,7 +84,7 @@ func TestHandshakeTokenHandler_PreflightOptions(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("Access-Control-Request-Method", "POST")
 	w := httptest.NewRecorder()
@@ -99,7 +98,7 @@ func TestHandshakeTokenHandler_MissingSTAHeader(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	w := httptest.NewRecorder()
 
@@ -114,7 +113,7 @@ func TestHandshakeTokenHandler_STAInvalid(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(false, "", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "bad-token")
 	w := httptest.NewRecorder()
@@ -130,7 +129,7 @@ func TestHandshakeTokenHandler_WrongProject(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(true, "different-project", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid-but-wrong-project")
 	w := httptest.NewRecorder()
@@ -146,7 +145,7 @@ func TestHandshakeTokenHandler_AppNotInDevMode(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(true, "proj-456", false)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "valid-token")
 	w := httptest.NewRecorder()
@@ -160,7 +159,7 @@ func TestHandshakeTokenHandler_DisallowedOrigin(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(true, "proj-456", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://evil.example.com")
 	r.Header.Set("X-StorageApi-Token", "valid-token")
 	w := httptest.NewRecorder()
@@ -175,7 +174,7 @@ func TestHandshakeTokenHandler_DisallowedOrigin(t *testing.T) {
 func TestHandshakeTokenHandler_WrongMethod(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(true, "proj-456", true)
-	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	w := httptest.NewRecorder()
 
@@ -188,10 +187,10 @@ func TestHandshakeTokenHandler_NoTokenInErrorBody(t *testing.T) {
 	t.Parallel()
 	h := newTestHandshakeHandler(false, "", true)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("X-StorageApi-Token", "secret-token-do-not-leak")
 	w := httptest.NewRecorder()
 	_ = h.ServeHTTPOrError(w, r)
-	assert.False(t, strings.Contains(w.Body.String(), "secret-token-do-not-leak"))
+	assert.NotContains(t, w.Body.String(), "secret-token-do-not-leak")
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
index 6bc69a823a..3004389dd5 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
@@ -60,7 +60,7 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 	claims, err := kaipreview.VerifySessionJWT(h.deps.SessionKey, h.deps.Clock, cookieValue)
 	if err != nil {
 		http.Error(w, "session expired", http.StatusUnauthorized)
-		return nil
+		return nil //nolint:nilerr // intentional: invalid session handled via HTTP 401 response
 	}
 	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
 		http.Error(w, "session scope mismatch", http.StatusForbidden)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
index 0c75574a8f..fc8f328101 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
@@ -32,7 +32,7 @@ func TestRefreshHandler_Success(t *testing.T) {
 	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
@@ -51,7 +51,7 @@ func TestRefreshHandler_Success(t *testing.T) {
 func TestRefreshHandler_PreflightOptions(t *testing.T) {
 	t.Parallel()
 	h, _ := newTestRefreshHandler(true)
-	r := httptest.NewRequest(http.MethodOptions, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.Header.Set("Access-Control-Request-Method", "POST")
 	w := httptest.NewRecorder()
@@ -63,7 +63,7 @@ func TestRefreshHandler_PreflightOptions(t *testing.T) {
 func TestRefreshHandler_MissingCookie(t *testing.T) {
 	t.Parallel()
 	h, _ := newTestRefreshHandler(true)
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	w := httptest.NewRecorder()
 
@@ -81,7 +81,7 @@ func TestRefreshHandler_ExpiredCookie(t *testing.T) {
 	require.NoError(t, err)
 	clock.Advance(5 * time.Hour)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
@@ -98,7 +98,7 @@ func TestRefreshHandler_DevModeOff(t *testing.T) {
 	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
@@ -114,7 +114,7 @@ func TestRefreshHandler_ScopeMismatch(t *testing.T) {
 	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
@@ -130,7 +130,7 @@ func TestRefreshHandler_DisallowedOrigin(t *testing.T) {
 	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
 	require.NoError(t, err)
 
-	r := httptest.NewRequest(http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://evil.example.com")
 	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
 	w := httptest.NewRecorder()
@@ -144,7 +144,7 @@ func TestRefreshHandler_DisallowedOrigin(t *testing.T) {
 func TestRefreshHandler_WrongMethod(t *testing.T) {
 	t.Parallel()
 	h, _ := newTestRefreshHandler(true)
-	r := httptest.NewRequest(http.MethodGet, "/_proxy/kai-preview/refresh", nil)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/refresh", nil)
 	r.Header.Set("Origin", "https://connection.keboola.com")
 	w := httptest.NewRecorder()
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go
index 8c3e328a07..6b7d71573c 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go
@@ -27,7 +27,8 @@ func TestIsIframeDocumentLoad(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			r := httptest.NewRequest("GET", "/some/path", nil)
+			t.Parallel()
+			r := httptest.NewRequestWithContext(t.Context(), "GET", "/some/path", nil)
 			if tc.dest != "" {
 				r.Header.Set("Sec-Fetch-Dest", tc.dest)
 			}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
index b439b07e93..cddad8195b 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -22,7 +22,7 @@ const (
 
 // HandshakeClaims carries the authorization scope from mint to exchange.
 type HandshakeClaims struct {
-	AppID     string `json:"app_id"`
+	AppID     string `json:"appId"`
 	ProjectID string `json:"project"`
 	Purpose   string `json:"purpose"`
 	jwt.RegisteredClaims
@@ -30,10 +30,10 @@ type HandshakeClaims struct {
 
 // SessionClaims carries the authorization scope inside the session cookie.
 type SessionClaims struct {
-	AppID     string `json:"app_id"`
+	AppID     string `json:"appId"`
 	ProjectID string `json:"project"`
 	Purpose   string `json:"purpose"`
-	TTL       int64  `json:"ttl_s"` // total intended lifetime in seconds (for halfway-refresh detection)
+	TTL       int64  `json:"ttlS"` // total intended lifetime in seconds (for halfway-refresh detection)
 	jwt.RegisteredClaims
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
index 7355525cf1..56360149d8 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
@@ -1,7 +1,6 @@
 package kaipreview
 
 import (
-	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -18,14 +17,16 @@ func TestStorageTokenVerifier_Success(t *testing.T) {
 		assert.Equal(t, "/v2/storage/tokens/verify", r.URL.Path)
 		assert.Equal(t, "test-token", r.Header.Get("X-StorageApi-Token"))
 		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{
+		if err := json.NewEncoder(w).Encode(map[string]any{
 			"owner": map[string]any{"id": "proj-456", "name": "Test Project"},
-		})
+		}); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
 	}))
 	defer srv.Close()
 
 	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	res, err := v.Verify(context.Background(), "test-token")
+	res, err := v.Verify(t.Context(), "test-token")
 	require.NoError(t, err)
 	assert.Equal(t, "proj-456", res.ProjectID)
 }
@@ -38,7 +39,7 @@ func TestStorageTokenVerifier_Unauthorized(t *testing.T) {
 	defer srv.Close()
 
 	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(context.Background(), "bad-token")
+	_, err := v.Verify(t.Context(), "bad-token")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "unauthorized")
 }
@@ -46,7 +47,7 @@ func TestStorageTokenVerifier_Unauthorized(t *testing.T) {
 func TestStorageTokenVerifier_NetworkError(t *testing.T) {
 	t.Parallel()
 	v := NewHTTPStorageTokenVerifier("http://127.0.0.1:1", http.DefaultClient) // port 1 = unreachable
-	_, err := v.Verify(context.Background(), "token")
+	_, err := v.Verify(t.Context(), "token")
 	require.Error(t, err)
 }
 
@@ -60,7 +61,7 @@ func TestStorageTokenVerifier_MissingOwnerID(t *testing.T) {
 	defer srv.Close()
 
 	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(context.Background(), "token")
+	_, err := v.Verify(t.Context(), "token")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "missing owner.id")
 }
@@ -73,7 +74,7 @@ func TestStorageTokenVerifier_ServerError(t *testing.T) {
 	defer srv.Close()
 
 	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(context.Background(), "token")
+	_, err := v.Verify(t.Context(), "token")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "500")
 }
@@ -87,7 +88,7 @@ func TestStorageTokenVerifier_MalformedJSON(t *testing.T) {
 	defer srv.Close()
 
 	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(context.Background(), "token")
+	_, err := v.Verify(t.Context(), "token")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "decode Storage token verify response")
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index bd506b88c0..35d83c6a5a 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -26,14 +26,14 @@ import (
 )
 
 type Manager struct {
-	config           config.Config
-	telemetry        telemetry.Telemetry
-	configLoader     appconfig.Loader
-	upstreamManager  *upstream.Manager
-	authProxyManager *authproxy.Manager
-	pageWriter       *pagewriter.Writer
-	handlers         *syncmap.SyncMap[api.AppID, appHandlerWrapper]
-	clock            clockwork.Clock
+	config               config.Config
+	telemetry            telemetry.Telemetry
+	configLoader         appconfig.Loader
+	upstreamManager      *upstream.Manager
+	authProxyManager     *authproxy.Manager
+	pageWriter           *pagewriter.Writer
+	handlers             *syncmap.SyncMap[api.AppID, appHandlerWrapper]
+	clock                clockwork.Clock
 	storageTokenVerifier kaipreview.StorageTokenVerifier
 }
 

From 133daa0c5131e7902b8f2494d9fb9305d01f5602 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Fri, 15 May 2026 10:18:41 +0200
Subject: [PATCH 32/49] fix(apps-proxy): eliminate port race in
 TestKaiPreviewSlidingRefresh

Replace GetFreePort()+Listen() with a direct Listen("127.0.0.1:0") so
the OS assigns a free port atomically, removing the TOCTOU window where
a parallel test could steal the port between the two calls.
---
 internal/pkg/service/appsproxy/proxy/proxy_test.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/proxy_test.go b/internal/pkg/service/appsproxy/proxy/proxy_test.go
index ead3d7eb30..13cb5ad387 100644
--- a/internal/pkg/service/appsproxy/proxy/proxy_test.go
+++ b/internal/pkg/service/appsproxy/proxy/proxy_test.go
@@ -3219,10 +3219,10 @@ func TestKaiPreviewSlidingRefresh(t *testing.T) {
 	logger.SetErrOutput(loggerWriter)
 	handler := proxy.NewHandler(ctx, d)
 
-	// Boot a TLS proxy server.
-	port := pm.GetFreePort()
+	// Boot a TLS proxy server. Bind to :0 to let the OS assign a free port atomically,
+	// eliminating the TOCTOU race that occurs when GetFreePort() releases the port before Listen().
 	var lc net.ListenConfig
-	l, err := lc.Listen(ctx, "tcp", fmt.Sprintf("127.0.0.1:%d", port))
+	l, err := lc.Listen(ctx, "tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 	proxySrv := &httptest.Server{
 		Listener: l,

From 3e68036304506a0fd91210b3a5c9c5c3cdc6c200 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Tue, 19 May 2026 17:13:55 +0200
Subject: [PATCH 33/49] fix(apps-proxy): drop StorageAPIURL default; require
 explicit operator config

---
 .../pkg/service/appsproxy/config/config.go    |  9 ++++----
 .../service/appsproxy/config/config_test.go   | 23 +++++++++++++++++++
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index 591ff8c527..dd00d0acef 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -25,7 +25,7 @@ type Config struct {
 	Upstream         Upstream          `configKey:"-" configUsage:"Configuration options for upstream"`
 	SandboxesAPI     SandboxesAPI      `configKey:"sandboxesAPI"`
 	CsrfTokenSalt    string            `configKey:"csrfTokenSalt" configUsage:"Salt used for generating CSRF tokens" validate:"required" sensitive:"true"`
-	StorageAPIURL    *url.URL          `configKey:"storageApiUrl" configUsage:"Base URL of the Keboola Storage API used for Storage token verification (kai-preview flow). E.g. https://connection.keboola.com" validate:"required"`
+	StorageAPIURL    *url.URL          `configKey:"storageApiUrl" configUsage:"Base URL of the Keboola Storage API for this stack, used for Storage token verification (kai-preview flow). Must match the stack the proxy fronts — e.g. https://connection.eu-central-1.keboola.com for an EU stack. No default; required." validate:"required"`
 	KaiPreview       KaiPreview        `configKey:"kaiPreview" configUsage:"kai-preview iframe-auth configuration."`
 	K8s              K8s               `configKey:"k8s" configUsage:"Kubernetes configuration."`
 	E2bWebhook       E2BWebhook        `configKey:"e2bWebhook"`
@@ -88,10 +88,9 @@ func New() Config {
 		KaiPreview: KaiPreview{
 			SessionTTL: 4 * time.Hour,
 		},
-		StorageAPIURL: &url.URL{
-			Scheme: "https",
-			Host:   "connection.keboola.com",
-		},
+		// StorageAPIURL has no default — operator must set it explicitly per stack.
+		// A hardcoded default would silently mis-verify Storage tokens on every
+		// non-default stack, producing a clean 401 with no actionable error.
 	}
 }
 
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
index aa5c6571e3..28a2cc40ca 100644
--- a/internal/pkg/service/appsproxy/config/config_test.go
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -1,6 +1,7 @@
 package config_test
 
 import (
+	"net/url"
 	"testing"
 	"time"
 
@@ -36,6 +37,8 @@ func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
 	cfg.CsrfTokenSalt = "x"
 	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
 	cfg.K8s = config.K8s{AppsNamespace: "ns"}
+	storageURL, _ := url.Parse("https://connection.keboola.com")
+	cfg.StorageAPIURL = storageURL
 	cfg.KaiPreview = config.KaiPreview{
 		HandshakeSigningKey: "k1",
 		SessionSigningKey:   "k2",
@@ -46,3 +49,23 @@ func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
 	assert.Equal(t, "https://connection.keboola.com", cfg.KaiPreview.AllowedOrigins[0])
 	assert.Equal(t, "https://staging.keboola.com", cfg.KaiPreview.AllowedOrigins[1])
 }
+
+func TestConfig_RequiresStorageAPIURL(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	assert.Nil(t, cfg.StorageAPIURL, "default config must NOT set StorageAPIURL — operators must configure it per stack")
+
+	// Even with everything else valid, missing StorageAPIURL must fail validation.
+	cfg.CookieSecretSalt = "x"
+	cfg.CsrfTokenSalt = "x"
+	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
+	cfg.K8s = config.K8s{AppsNamespace: "ns"}
+	cfg.KaiPreview = config.KaiPreview{
+		HandshakeSigningKey: "k1",
+		SessionSigningKey:   "k2",
+		AllowedOrigins:      []string{"https://connection.keboola.com"},
+	}
+	err := configmap.ValidateAndNormalize(&cfg)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "storageApiUrl")
+}

From a59bd7a94629c3fedd8cdadbc6b1e486a5072302 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Tue, 19 May 2026 18:57:56 +0200
Subject: [PATCH 34/49] refactor(apps-proxy): use keboola-sdk-go for
 kai-preview Storage token verify

---
 .../kaipreview/storage_token_verifier.go      | 53 ++++-------
 .../kaipreview/storage_token_verifier_test.go | 94 -------------------
 .../appsproxy/proxy/apphandler/manager.go     |  4 +-
 3 files changed, 17 insertions(+), 134 deletions(-)
 delete mode 100644 internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
index 9b3b6c4fb9..b25f7f8fba 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
@@ -2,13 +2,14 @@ package kaipreview
 
 import (
 	"context"
-	"encoding/json"
-	"net/http"
+	"strconv"
+
+	"github.com/keboola/keboola-sdk-go/v2/pkg/keboola"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
-// StorageTokenVerifier abstracts HTTPStorageTokenVerifier so tests can inject a stub without HTTP.
+// StorageTokenVerifier abstracts SDKStorageTokenVerifier so tests can inject a stub without HTTP.
 type StorageTokenVerifier interface {
 	Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error)
 }
@@ -21,46 +22,24 @@ type StorageTokenVerifyResult struct {
 	ProjectID string
 }
 
-type HTTPStorageTokenVerifier struct {
-	baseURL string
-	client  *http.Client
+type SDKStorageTokenVerifier struct {
+	storageAPIHost string
 }
 
-func NewHTTPStorageTokenVerifier(baseURL string, client *http.Client) *HTTPStorageTokenVerifier {
-	return &HTTPStorageTokenVerifier{baseURL: baseURL, client: client}
+func NewSDKStorageTokenVerifier(storageAPIHost string) *SDKStorageTokenVerifier {
+	return &SDKStorageTokenVerifier{storageAPIHost: storageAPIHost}
 }
 
-func (v *HTTPStorageTokenVerifier) Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, v.baseURL+"/v2/storage/tokens/verify", nil)
+func (v *SDKStorageTokenVerifier) Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error) {
+	// NewPublicAPIFromIndex with nil index is safe for StorageAPI calls:
+	// the base URL is hardcoded as "v2/storage" and does not require the index.
+	publicAPI := keboola.NewPublicAPIFromIndex(v.storageAPIHost, nil)
+	result, err := publicAPI.VerifyTokenRequest(token).Send(ctx)
 	if err != nil {
-		return nil, errors.Errorf("kai-preview: build Storage token verify request: %w", err)
-	}
-	req.Header.Set("X-StorageApi-Token", token)
-	req.Header.Set("Accept", "application/json")
-
-	resp, err := v.client.Do(req)
-	if err != nil {
-		return nil, errors.Errorf("kai-preview: Storage token verify call: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusUnauthorized {
-		return nil, errors.New("kai-preview: Storage token unauthorized")
-	}
-	if resp.StatusCode != http.StatusOK {
-		return nil, errors.Errorf("kai-preview: Storage token verify returned %d", resp.StatusCode)
-	}
-
-	var body struct {
-		Owner struct {
-			ID string `json:"id"`
-		} `json:"owner"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
-		return nil, errors.Errorf("kai-preview: decode Storage token verify response: %w", err)
+		return nil, errors.Errorf("kai-preview: SDK Storage token verify: %w", err)
 	}
-	if body.Owner.ID == "" {
+	if result.Owner.ID == 0 {
 		return nil, errors.New("kai-preview: Storage token verify response missing owner.id")
 	}
-	return &StorageTokenVerifyResult{ProjectID: body.Owner.ID}, nil
+	return &StorageTokenVerifyResult{ProjectID: strconv.Itoa(result.Owner.ID)}, nil
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
deleted file mode 100644
index 56360149d8..0000000000
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
+++ /dev/null
@@ -1,94 +0,0 @@
-package kaipreview
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestStorageTokenVerifier_Success(t *testing.T) {
-	t.Parallel()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, "GET", r.Method)
-		assert.Equal(t, "/v2/storage/tokens/verify", r.URL.Path)
-		assert.Equal(t, "test-token", r.Header.Get("X-StorageApi-Token"))
-		w.Header().Set("Content-Type", "application/json")
-		if err := json.NewEncoder(w).Encode(map[string]any{
-			"owner": map[string]any{"id": "proj-456", "name": "Test Project"},
-		}); err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-		}
-	}))
-	defer srv.Close()
-
-	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	res, err := v.Verify(t.Context(), "test-token")
-	require.NoError(t, err)
-	assert.Equal(t, "proj-456", res.ProjectID)
-}
-
-func TestStorageTokenVerifier_Unauthorized(t *testing.T) {
-	t.Parallel()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
-	}))
-	defer srv.Close()
-
-	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(t.Context(), "bad-token")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "unauthorized")
-}
-
-func TestStorageTokenVerifier_NetworkError(t *testing.T) {
-	t.Parallel()
-	v := NewHTTPStorageTokenVerifier("http://127.0.0.1:1", http.DefaultClient) // port 1 = unreachable
-	_, err := v.Verify(t.Context(), "token")
-	require.Error(t, err)
-}
-
-func TestStorageTokenVerifier_MissingOwnerID(t *testing.T) {
-	t.Parallel()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"owner":{}}`))
-	}))
-	defer srv.Close()
-
-	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(t.Context(), "token")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "missing owner.id")
-}
-
-func TestStorageTokenVerifier_ServerError(t *testing.T) {
-	t.Parallel()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "internal error", http.StatusInternalServerError)
-	}))
-	defer srv.Close()
-
-	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(t.Context(), "token")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "500")
-}
-
-func TestStorageTokenVerifier_MalformedJSON(t *testing.T) {
-	t.Parallel()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte("not-json"))
-	}))
-	defer srv.Close()
-
-	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
-	_, err := v.Verify(t.Context(), "token")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "decode Storage token verify response")
-}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index 35d83c6a5a..04ec9a33ca 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -6,7 +6,6 @@ import (
 	"encoding/hex"
 	"net/http"
 	"sync"
-	"time"
 
 	"github.com/jonboulle/clockwork"
 
@@ -60,7 +59,6 @@ func NewManager(d dependencies) *Manager {
 		panic("appsproxy: StorageAPIURL is required for kai-preview Storage token verification")
 	}
 	storageAPIURL := cfg.StorageAPIURL.String()
-	storageTokenHTTPClient := &http.Client{Timeout: 5 * time.Second}
 	return &Manager{
 		config:           cfg,
 		telemetry:        d.Telemetry(),
@@ -72,7 +70,7 @@ func NewManager(d dependencies) *Manager {
 			return &appHandlerWrapper{lock: &sync.Mutex{}}
 		}),
 		clock:                d.Clock(),
-		storageTokenVerifier: kaipreview.NewHTTPStorageTokenVerifier(storageAPIURL, storageTokenHTTPClient),
+		storageTokenVerifier: kaipreview.NewSDKStorageTokenVerifier(storageAPIURL),
 	}
 }
 

From 60931bf81ef149cc42ecbdeb94291e0382774b66 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 08:16:50 +0200
Subject: [PATCH 35/49] docs(apps-proxy): drop stale storageApiUrl default;
 mark required
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

storageApiUrl has no default since 3e6803630 — the startup validator panics
when it is missing. Update the operator guide to reflect this: change the
Default cell from the old hardcoded URL to "(required)" and add a note that
the value must be set per stack.
---
 docs/apps-proxy/kai-preview.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
index c619dfdacf..9b37117cea 100644
--- a/docs/apps-proxy/kai-preview.md
+++ b/docs/apps-proxy/kai-preview.md
@@ -56,7 +56,7 @@ the frame).
 | `kaiPreview.sessionSigningKey`   | *(required)* | HMAC-SHA256 key for the session cookie JWT |
 | `kaiPreview.sessionTTL`          | `4h`          | Sliding session cookie lifetime |
 | `kaiPreview.allowedOrigins`      | *(required)* | Origins permitted to call `handshake-token` and `refresh`, e.g. `https://connection.keboola.com` |
-| `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify Storage tokens in `handshake-token` |
+| `storageApiUrl`                  | *(required)*                     | Storage API base URL used to verify Storage tokens in `handshake-token`. Must be set per stack — there is no default value and the proxy will refuse to start without it |
 
 ### 4.2 Provisioning new signing keys
 

From 9ca8017786d5acda782ce6138173932de4119a23 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 08:17:00 +0200
Subject: [PATCH 36/49] feat(apps-proxy): structured logging in kai-preview
 package
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add log.Logger to HandlerDeps, HandshakeTokenDeps, ExchangeDeps, and
RefreshDeps. Wire manager.logger through apphandler.go when constructing
the kai-preview composite handler.

Log lines added:
- INFO on successful handshake JWT mint and exchange (with jti, appID, projectID)
- WARN on STA verify failure, project mismatch, JWT verify failure, and scope mismatch
- WARN when any endpoint is called on a non-dev-mode app (aids "why 404?" debugging)
- DEBUG on refresh endpoint success and on sliding session refresh in apphandler

Raw STA tokens and JWT bodies are never logged — only jti, appID, projectID,
and sanitised error strings are included.

apphandler.Manager gains a Logger dependency and apphandler.go gains a
DEBUG log on the mid-request sliding cookie re-mint path.

Test stubs updated with Logger: log.NewNopLogger().
---
 .../appsproxy/proxy/apphandler/apphandler.go  |  9 +++++--
 .../kaipreview/endpoints/exchange.go          | 19 +++++++++++++
 .../kaipreview/endpoints/exchange_test.go     |  2 ++
 .../authproxy/kaipreview/endpoints/handler.go |  9 ++++---
 .../kaipreview/endpoints/handler_test.go      |  2 ++
 .../kaipreview/endpoints/handshake_token.go   | 27 +++++++++++++++++--
 .../endpoints/handshake_token_test.go         |  2 ++
 .../authproxy/kaipreview/endpoints/refresh.go | 18 +++++++++++++
 .../kaipreview/endpoints/refresh_test.go      |  2 ++
 .../appsproxy/proxy/apphandler/manager.go     |  4 +++
 10 files changed, 87 insertions(+), 7 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 4c014ef191..e69675ba75 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -52,6 +52,7 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 		upstream:           appUpstream,
 		authHandlerPerRule: make(map[ruleIndex]chain.Handler),
 		kaiPreview: kpendpoints.NewHandler(kpendpoints.HandlerDeps{
+			Logger:               manager.logger,
 			Clock:                manager.clock,
 			StorageTokenVerifier: manager.storageTokenVerifier,
 			DevMode:              devModeChecker,
@@ -219,7 +220,7 @@ func (h *appHandler) serveKaiPreview(w http.ResponseWriter, req *http.Request) (
 		string(h.app.ID),
 		h.app.ProjectID,
 	); ok {
-		h.maybeRefreshSessionCookie(w, claims)
+		h.maybeRefreshSessionCookie(w, req, claims)
 		return true, h.upstream.ServeHTTPOrError(w, req)
 	}
 	// 3. Iframe document load on a dev-mode app with no session → serve bootstrap shim.
@@ -233,7 +234,7 @@ func (h *appHandler) serveKaiPreview(w http.ResponseWriter, req *http.Request) (
 
 // maybeRefreshSessionCookie re-mints the session JWT when the session has passed its midpoint.
 // If minting fails, the existing cookie is left in place (it is still valid).
-func (h *appHandler) maybeRefreshSessionCookie(w http.ResponseWriter, claims *kaipreview.SessionClaims) {
+func (h *appHandler) maybeRefreshSessionCookie(w http.ResponseWriter, req *http.Request, claims *kaipreview.SessionClaims) {
 	if !claims.NeedsRefresh(h.manager.clock.Now()) {
 		return
 	}
@@ -246,6 +247,10 @@ func (h *appHandler) maybeRefreshSessionCookie(w http.ResponseWriter, claims *ka
 	)
 	if err == nil {
 		kaipreview.SetSessionCookie(w, newJWT, h.manager.config.KaiPreview.SessionTTL)
+		h.manager.logger.With(
+			attribute.String("appID", string(h.app.ID)),
+			attribute.String("projectID", h.app.ProjectID),
+		).Debug(req.Context(), "kai-preview: sliding session refresh")
 	}
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
index 6e47b22416..3beed23365 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
@@ -6,12 +6,15 @@ import (
 	"time"
 
 	"github.com/jonboulle/clockwork"
+	"go.opentelemetry.io/otel/attribute"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
 type ExchangeDeps struct {
+	Logger       log.Logger
 	Clock        clockwork.Clock
 	DevMode      DevModeChecker
 	HandshakeKey string
@@ -37,6 +40,8 @@ func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reques
 
 	// Dev-mode gate: pretend the endpoint doesn't exist on non-dev apps.
 	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
+		h.deps.Logger.With(attribute.String("appID", h.deps.AppID)).
+			Warn(r.Context(), "kai-preview: exchange requested on non-dev-mode app")
 		http.NotFound(w, r)
 		return nil
 	}
@@ -51,10 +56,18 @@ func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reques
 
 	claims, err := kaipreview.VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, body.Token)
 	if err != nil {
+		h.deps.Logger.With(
+			attribute.String("appID", h.deps.AppID),
+			attribute.String("error", err.Error()),
+		).Warn(r.Context(), "kai-preview: handshake JWT verify failed")
 		http.Error(w, "invalid handshake token", http.StatusUnauthorized)
 		return nil //nolint:nilerr // intentional: invalid token handled via HTTP 401 response
 	}
 	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
+		h.deps.Logger.With(
+			attribute.String("appID", h.deps.AppID),
+			attribute.String("jwtAppID", claims.AppID),
+		).Warn(r.Context(), "kai-preview: handshake JWT scope mismatch")
 		http.Error(w, "handshake token scope mismatch", http.StatusForbidden)
 		return nil
 	}
@@ -64,6 +77,12 @@ func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Reques
 		return errors.Errorf("kai-preview: mint session JWT: %w", err)
 	}
 
+	h.deps.Logger.With(
+		attribute.String("appID", h.deps.AppID),
+		attribute.String("projectID", h.deps.AppProjectID),
+		attribute.String("jti", claims.ID),
+	).Info(r.Context(), "kai-preview: exchanged handshake JWT for session cookie")
+
 	kaipreview.SetSessionCookie(w, sessionJWT, h.deps.SessionTTL)
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
index aaf2a9e8dc..64b2a25808 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
@@ -12,11 +12,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
 func newTestExchangeHandler(devMode bool) *ExchangeHandler {
 	return NewExchangeHandler(ExchangeDeps{
+		Logger:       log.NewNopLogger(),
 		Clock:        clockwork.NewFakeClock(),
 		DevMode:      &stubDevModeChecker{devMode: devMode},
 		HandshakeKey: testHandshakeKey,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
index 6707059e0a..6596ba111e 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/jonboulle/clockwork"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
@@ -29,6 +30,7 @@ type DevModeCheckerFunc func(ctx context.Context, appID string) bool
 func (f DevModeCheckerFunc) IsDevMode(ctx context.Context, appID string) bool { return f(ctx, appID) }
 
 type HandlerDeps struct {
+	Logger               log.Logger
 	Clock                clockwork.Clock
 	StorageTokenVerifier kaipreview.StorageTokenVerifier
 	DevMode              DevModeChecker
@@ -53,17 +55,18 @@ type Handler struct {
 func NewHandler(deps HandlerDeps) *Handler {
 	return &Handler{
 		handshakeToken: NewHandshakeTokenHandler(HandshakeTokenDeps{
-			Clock: deps.Clock, StorageTokenVerifier: deps.StorageTokenVerifier, DevMode: deps.DevMode, CORS: deps.CORS,
+			Logger: deps.Logger, Clock: deps.Clock, StorageTokenVerifier: deps.StorageTokenVerifier,
+			DevMode: deps.DevMode, CORS: deps.CORS,
 			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
 		bootstrap: NewBootstrapHandler(deps.AllowedOrigins, deps.DevMode, deps.AppID),
 		exchange: NewExchangeHandler(ExchangeDeps{
-			Clock: deps.Clock, DevMode: deps.DevMode,
+			Logger: deps.Logger, Clock: deps.Clock, DevMode: deps.DevMode,
 			HandshakeKey: deps.HandshakeKey, SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL,
 			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
 		refresh: NewRefreshHandler(RefreshDeps{
-			Clock: deps.Clock, DevMode: deps.DevMode,
+			Logger: deps.Logger, Clock: deps.Clock, DevMode: deps.DevMode,
 			SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL, CORS: deps.CORS,
 			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
index 9327b267c7..afe98c4380 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
@@ -10,11 +10,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
 func newTestCompositeHandler() *Handler {
 	return NewHandler(HandlerDeps{
+		Logger:               log.NewNopLogger(),
 		Clock:                clockwork.NewFakeClock(),
 		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
 		DevMode:              &stubDevModeChecker{devMode: true},
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
index f1041a7130..5d8b2eda11 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
@@ -6,7 +6,9 @@ import (
 	"net/http"
 
 	"github.com/jonboulle/clockwork"
+	"go.opentelemetry.io/otel/attribute"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
@@ -18,6 +20,7 @@ type DevModeChecker interface {
 }
 
 type HandshakeTokenDeps struct {
+	Logger               log.Logger
 	Clock                clockwork.Clock
 	StorageTokenVerifier kaipreview.StorageTokenVerifier
 	DevMode              DevModeChecker
@@ -56,6 +59,8 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 
 	// Dev-mode gate first: pretend the endpoint doesn't exist on non-dev apps.
 	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
+		h.deps.Logger.With(attribute.String("appID", h.deps.AppID)).
+			Warn(r.Context(), "kai-preview: handshake-token requested on non-dev-mode app")
 		http.NotFound(w, r)
 		return nil
 	}
@@ -69,24 +74,42 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 	res, err := h.deps.StorageTokenVerifier.Verify(r.Context(), storageToken)
 	if err != nil {
 		// Never echo the raw Storage token in the error body or logs.
+		h.deps.Logger.With(
+			attribute.String("appID", h.deps.AppID),
+			attribute.String("error", err.Error()),
+		).Warn(r.Context(), "kai-preview: Storage token verify failed")
 		http.Error(w, "Storage token invalid", http.StatusUnauthorized)
 		return nil //nolint:nilerr // intentional: error is handled via HTTP response, not propagated
 	}
 	if res.ProjectID != h.deps.AppProjectID {
+		h.deps.Logger.With(
+			attribute.String("appID", h.deps.AppID),
+			attribute.String("appProjectID", h.deps.AppProjectID),
+			attribute.String("tokenProjectID", res.ProjectID),
+		).Warn(r.Context(), "kai-preview: Storage token's project does not match app")
 		http.Error(w, "app belongs to a different project", http.StatusForbidden)
 		return nil
 	}
 
-	jwt, err := kaipreview.MintHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID)
+	mintedJWT, err := kaipreview.MintHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID)
 	if err != nil {
 		return errors.Errorf("kai-preview: mint handshake JWT: %w", err)
 	}
 
+	// Extract jti from the minted token for logging (non-sensitive).
+	if claims, parseErr := kaipreview.VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, mintedJWT); parseErr == nil {
+		h.deps.Logger.With(
+			attribute.String("appID", h.deps.AppID),
+			attribute.String("projectID", h.deps.AppProjectID),
+			attribute.String("jti", claims.ID),
+		).Info(r.Context(), "kai-preview: minted handshake JWT")
+	}
+
 	// CORS headers already set above.
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
-	if err := json.NewEncoder(w).Encode(map[string]string{"token": jwt}); err != nil {
+	if err := json.NewEncoder(w).Encode(map[string]string{"token": mintedJWT}); err != nil {
 		return errors.Errorf("kai-preview: write handshake token response: %w", err)
 	}
 	return nil
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
index f69ce9c5eb..dc7120812d 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
@@ -49,6 +50,7 @@ func newTestHandshakeHandler(tokenValid bool, storageTokenProject string, devMod
 		verifier = &stubStorageTokenVerifier{err: errStubUnauth}
 	}
 	return NewHandshakeTokenHandler(HandshakeTokenDeps{
+		Logger:               log.NewNopLogger(),
 		Clock:                clockwork.NewFakeClock(),
 		StorageTokenVerifier: verifier,
 		DevMode:              &stubDevModeChecker{devMode: devMode},
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
index 3004389dd5..8318d7797c 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
@@ -5,12 +5,15 @@ import (
 	"time"
 
 	"github.com/jonboulle/clockwork"
+	"go.opentelemetry.io/otel/attribute"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
 type RefreshDeps struct {
+	Logger       log.Logger
 	Clock        clockwork.Clock
 	DevMode      DevModeChecker
 	SessionKey   string
@@ -47,6 +50,8 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 	h.deps.CORS.WriteResponseHeaders(w, origin)
 
 	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
+		h.deps.Logger.With(attribute.String("appID", h.deps.AppID)).
+			Warn(r.Context(), "kai-preview: refresh requested on non-dev-mode app")
 		http.NotFound(w, r)
 		return nil
 	}
@@ -59,10 +64,18 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 
 	claims, err := kaipreview.VerifySessionJWT(h.deps.SessionKey, h.deps.Clock, cookieValue)
 	if err != nil {
+		h.deps.Logger.With(
+			attribute.String("appID", h.deps.AppID),
+			attribute.String("error", err.Error()),
+		).Warn(r.Context(), "kai-preview: session cookie verify failed")
 		http.Error(w, "session expired", http.StatusUnauthorized)
 		return nil //nolint:nilerr // intentional: invalid session handled via HTTP 401 response
 	}
 	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
+		h.deps.Logger.With(
+			attribute.String("appID", h.deps.AppID),
+			attribute.String("cookieAppID", claims.AppID),
+		).Warn(r.Context(), "kai-preview: session cookie scope mismatch")
 		http.Error(w, "session scope mismatch", http.StatusForbidden)
 		return nil
 	}
@@ -73,6 +86,11 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 	}
 	kaipreview.SetSessionCookie(w, newJWT, h.deps.SessionTTL)
 
+	h.deps.Logger.With(
+		attribute.String("appID", h.deps.AppID),
+		attribute.String("projectID", h.deps.AppProjectID),
+	).Debug(r.Context(), "kai-preview: refreshed session cookie")
+
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusNoContent)
 	return nil
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
index fc8f328101..434ca1c36b 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
@@ -10,12 +10,14 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 )
 
 func newTestRefreshHandler(devMode bool) (*RefreshHandler, *clockwork.FakeClock) {
 	clock := clockwork.NewFakeClock()
 	return NewRefreshHandler(RefreshDeps{
+		Logger:       log.NewNopLogger(),
 		Clock:        clock,
 		DevMode:      &stubDevModeChecker{devMode: devMode},
 		SessionKey:   testSessionKey,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index 04ec9a33ca..3eb3a73c0f 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/jonboulle/clockwork"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/log"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/api"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/appconfig"
@@ -25,6 +26,7 @@ import (
 )
 
 type Manager struct {
+	logger               log.Logger
 	config               config.Config
 	telemetry            telemetry.Telemetry
 	configLoader         appconfig.Loader
@@ -44,6 +46,7 @@ type appHandlerWrapper struct {
 }
 
 type dependencies interface {
+	Logger() log.Logger
 	Clock() clockwork.Clock
 	Config() config.Config
 	Telemetry() telemetry.Telemetry
@@ -60,6 +63,7 @@ func NewManager(d dependencies) *Manager {
 	}
 	storageAPIURL := cfg.StorageAPIURL.String()
 	return &Manager{
+		logger:           d.Logger(),
 		config:           cfg,
 		telemetry:        d.Telemetry(),
 		configLoader:     d.AppConfigLoader(),

From 53ee3471ddb8e1e44da8b5c9a2b000e081be20b7 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 08:59:34 +0200
Subject: [PATCH 37/49] feat(apps-proxy): split kai-preview
 AllowedFrameAncestors from AllowedOrigins
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AllowedOrigins feeds CORS (mint/refresh endpoints only). A new
AllowedFrameAncestors field controls the bootstrap CSP frame-ancestors
and the JS shim's ALLOWED_ORIGINS. When unset, Normalize() copies
AllowedOrigins for backward compatibility with existing operator deploys.

Rationale: CORS allow-list and frame-ancestors have different threat
boundaries — a future second IDE origin added to one should not
automatically gain rights in the other.

Adds TestKaiPreviewConfig_FrameAncestorsDefaultsToAllowedOrigins and
TestKaiPreviewConfig_FrameAncestorsIndependentWhenSet.
---
 .../pkg/service/appsproxy/config/config.go    | 25 ++++++++--
 .../service/appsproxy/config/config_test.go   | 46 +++++++++++++++++++
 .../appsproxy/proxy/apphandler/apphandler.go  |  4 +-
 .../authproxy/kaipreview/endpoints/handler.go | 13 ++++--
 .../kaipreview/endpoints/handler_test.go      | 14 +++---
 5 files changed, 85 insertions(+), 17 deletions(-)

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index dd00d0acef..cd2795dbd3 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -33,10 +33,17 @@ type Config struct {
 
 // KaiPreview configures the stateless iframe-auth path for the kai-preview flow.
 type KaiPreview struct {
-	HandshakeSigningKey string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
-	SessionSigningKey   string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
-	SessionTTL          time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)."`
-	AllowedOrigins      []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
+	HandshakeSigningKey   string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
+	SessionSigningKey     string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
+	SessionTTL            time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)." validate:"required,minDuration=1m"`
+	AllowedOrigins        []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
+	// AllowedFrameAncestors is the list of origins permitted in the bootstrap page's
+	// Content-Security-Policy frame-ancestors directive and in the JS shim's ALLOWED_ORIGINS.
+	// When empty (the common case), Normalize() copies AllowedOrigins here for backward
+	// compatibility with existing operator deployments that set only allowedOrigins.
+	// Operators that need a stricter CSP boundary (e.g. different IDE staging/prod origins)
+	// can set this independently.
+	AllowedFrameAncestors []string `configKey:"allowedFrameAncestors" configUsage:"Origins permitted as frame-ancestors in the bootstrap CSP (defaults to allowedOrigins when unset)."`
 }
 
 type API struct {
@@ -101,6 +108,16 @@ func (c *KaiPreview) Normalize() {
 	for i, o := range c.AllowedOrigins {
 		c.AllowedOrigins[i] = strings.TrimRight(o, "/")
 	}
+	for i, o := range c.AllowedFrameAncestors {
+		c.AllowedFrameAncestors[i] = strings.TrimRight(o, "/")
+	}
+	// Default AllowedFrameAncestors to AllowedOrigins so operators that set only
+	// allowedOrigins don't need to change their configuration.
+	if len(c.AllowedFrameAncestors) == 0 {
+		dst := make([]string, len(c.AllowedOrigins))
+		copy(dst, c.AllowedOrigins)
+		c.AllowedFrameAncestors = dst
+	}
 }
 
 func (c *API) Normalize() {
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
index 28a2cc40ca..7dae1ae210 100644
--- a/internal/pkg/service/appsproxy/config/config_test.go
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -42,6 +42,7 @@ func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
 	cfg.KaiPreview = config.KaiPreview{
 		HandshakeSigningKey: "k1",
 		SessionSigningKey:   "k2",
+		SessionTTL:          4 * time.Hour,
 		AllowedOrigins:      []string{"https://connection.keboola.com/", "https://staging.keboola.com"},
 	}
 	err := configmap.ValidateAndNormalize(&cfg)
@@ -50,6 +51,50 @@ func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
 	assert.Equal(t, "https://staging.keboola.com", cfg.KaiPreview.AllowedOrigins[1])
 }
 
+func TestKaiPreviewConfig_FrameAncestorsDefaultsToAllowedOrigins(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	cfg.CookieSecretSalt = "x"
+	cfg.CsrfTokenSalt = "x"
+	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
+	cfg.K8s = config.K8s{AppsNamespace: "ns"}
+	storageURL, _ := url.Parse("https://connection.keboola.com")
+	cfg.StorageAPIURL = storageURL
+	cfg.KaiPreview = config.KaiPreview{
+		HandshakeSigningKey: "k1",
+		SessionSigningKey:   "k2",
+		SessionTTL:          4 * time.Hour,
+		AllowedOrigins:      []string{"https://connection.keboola.com", "https://staging.keboola.com"},
+		// AllowedFrameAncestors intentionally left empty — must default to AllowedOrigins.
+	}
+	err := configmap.ValidateAndNormalize(&cfg)
+	require.NoError(t, err)
+	assert.Equal(t, cfg.KaiPreview.AllowedOrigins, cfg.KaiPreview.AllowedFrameAncestors,
+		"AllowedFrameAncestors must default to AllowedOrigins when unset")
+}
+
+func TestKaiPreviewConfig_FrameAncestorsIndependentWhenSet(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	cfg.CookieSecretSalt = "x"
+	cfg.CsrfTokenSalt = "x"
+	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
+	cfg.K8s = config.K8s{AppsNamespace: "ns"}
+	storageURL, _ := url.Parse("https://connection.keboola.com")
+	cfg.StorageAPIURL = storageURL
+	cfg.KaiPreview = config.KaiPreview{
+		HandshakeSigningKey:   "k1",
+		SessionSigningKey:     "k2",
+		SessionTTL:            4 * time.Hour,
+		AllowedOrigins:        []string{"https://connection.keboola.com", "https://staging.keboola.com"},
+		AllowedFrameAncestors: []string{"https://connection.keboola.com"},
+	}
+	err := configmap.ValidateAndNormalize(&cfg)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"https://connection.keboola.com"}, cfg.KaiPreview.AllowedFrameAncestors,
+		"AllowedFrameAncestors must remain independent when explicitly set")
+}
+
 func TestConfig_RequiresStorageAPIURL(t *testing.T) {
 	t.Parallel()
 	cfg := config.New()
@@ -63,6 +108,7 @@ func TestConfig_RequiresStorageAPIURL(t *testing.T) {
 	cfg.KaiPreview = config.KaiPreview{
 		HandshakeSigningKey: "k1",
 		SessionSigningKey:   "k2",
+		SessionTTL:          4 * time.Hour,
 		AllowedOrigins:      []string{"https://connection.keboola.com"},
 	}
 	err := configmap.ValidateAndNormalize(&cfg)
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index e69675ba75..8b757d1f93 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -60,7 +60,9 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 			HandshakeKey:         manager.config.KaiPreview.HandshakeSigningKey,
 			SessionKey:           manager.config.KaiPreview.SessionSigningKey,
 			SessionTTL:           manager.config.KaiPreview.SessionTTL,
-			AllowedOrigins:       manager.config.KaiPreview.AllowedOrigins,
+			// AllowedFrameAncestors drives the bootstrap CSP + shim origin list.
+			// AllowedOrigins is fed to CORS only (mint/refresh endpoints).
+			AllowedFrameAncestors: manager.config.KaiPreview.AllowedFrameAncestors,
 			AppID:                string(app.ID),
 			AppProjectID:         app.ProjectID,
 		}),
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
index 6596ba111e..5c3c9481d6 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
@@ -38,9 +38,11 @@ type HandlerDeps struct {
 	HandshakeKey         string
 	SessionKey           string
 	SessionTTL           time.Duration
-	AllowedOrigins       []string
-	AppID                string
-	AppProjectID         string
+	// AllowedFrameAncestors controls the bootstrap CSP frame-ancestors and shim origin list.
+	// Distinct from AllowedOrigins (which is fed to CORS) to allow different operator configs.
+	AllowedFrameAncestors []string
+	AppID                 string
+	AppProjectID          string
 }
 
 // Handler is the per-app composite handler that serves all four kai-preview
@@ -57,9 +59,10 @@ func NewHandler(deps HandlerDeps) *Handler {
 		handshakeToken: NewHandshakeTokenHandler(HandshakeTokenDeps{
 			Logger: deps.Logger, Clock: deps.Clock, StorageTokenVerifier: deps.StorageTokenVerifier,
 			DevMode: deps.DevMode, CORS: deps.CORS,
-			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
+			HandshakeKey: deps.HandshakeKey, SessionTTL: deps.SessionTTL,
+			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
-		bootstrap: NewBootstrapHandler(deps.AllowedOrigins, deps.DevMode, deps.AppID),
+		bootstrap: NewBootstrapHandler(deps.AllowedFrameAncestors, deps.DevMode, deps.AppID),
 		exchange: NewExchangeHandler(ExchangeDeps{
 			Logger: deps.Logger, Clock: deps.Clock, DevMode: deps.DevMode,
 			HandshakeKey: deps.HandshakeKey, SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
index afe98c4380..e387324a39 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
@@ -20,13 +20,13 @@ func newTestCompositeHandler() *Handler {
 		Clock:                clockwork.NewFakeClock(),
 		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
 		DevMode:              &stubDevModeChecker{devMode: true},
-		CORS:                 kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
-		HandshakeKey:         testHandshakeKey,
-		SessionKey:           testSessionKey,
-		SessionTTL:           4 * time.Hour,
-		AllowedOrigins:       []string{"https://connection.keboola.com"},
-		AppID:                "app-123",
-		AppProjectID:         "proj-456",
+		CORS:                  kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey:          testHandshakeKey,
+		SessionKey:            testSessionKey,
+		SessionTTL:            4 * time.Hour,
+		AllowedFrameAncestors: []string{"https://connection.keboola.com"},
+		AppID:                 "app-123",
+		AppProjectID:          "proj-456",
 	})
 }
 

From 00ec2cf5b308f360fde5b1cd8d2b881011c2af26 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 08:59:41 +0200
Subject: [PATCH 38/49] feat(apps-proxy): kai-preview JWT versioning + reserved
 identity fields

Add Ver:1 claim to HandshakeClaims and SessionClaims. A version field
lets old and new proxy pods coexist during rolling deploys when the JWT
shape changes.

Reserve Email, Name, Roles fields (omitempty, not populated today) per
the dev-iframe-auth design spec's "Possible future extensions" note.
Wire format is unchanged until a consumer is ready.
---
 .../apphandler/authproxy/kaipreview/jwt.go    | 22 +++++++++++++++++++
 .../authproxy/kaipreview/jwt_test.go          | 10 +++++++++
 2 files changed, 32 insertions(+)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
index cddad8195b..6b22d29583 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -22,18 +22,38 @@ const (
 
 // HandshakeClaims carries the authorization scope from mint to exchange.
 type HandshakeClaims struct {
+	// Ver is the JWT schema version. Always 1 for this iteration.
+	// A version field lets old and new proxies coexist during rolling deploys
+	// when the claim shape changes in a future release.
+	Ver       int    `json:"ver"`
 	AppID     string `json:"appId"`
 	ProjectID string `json:"project"`
 	Purpose   string `json:"purpose"`
+	// Reserved for future identity propagation per the dev-iframe-auth design spec
+	// ("Possible future extensions"). Not populated today; omitempty ensures
+	// wire format is unchanged until a consumer is ready.
+	Email string   `json:"email,omitempty"`
+	Name  string   `json:"name,omitempty"`
+	Roles []string `json:"roles,omitempty"`
 	jwt.RegisteredClaims
 }
 
 // SessionClaims carries the authorization scope inside the session cookie.
 type SessionClaims struct {
+	// Ver is the JWT schema version. Always 1 for this iteration.
+	// A version field lets old and new proxies coexist during rolling deploys
+	// when the claim shape changes in a future release.
+	Ver       int    `json:"ver"`
 	AppID     string `json:"appId"`
 	ProjectID string `json:"project"`
 	Purpose   string `json:"purpose"`
 	TTL       int64  `json:"ttlS"` // total intended lifetime in seconds (for halfway-refresh detection)
+	// Reserved for future identity propagation per the dev-iframe-auth design spec
+	// ("Possible future extensions"). Not populated today; omitempty ensures
+	// wire format is unchanged until a consumer is ready.
+	Email string   `json:"email,omitempty"`
+	Name  string   `json:"name,omitempty"`
+	Roles []string `json:"roles,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -53,6 +73,7 @@ func MintHandshakeJWT(key string, clock clockwork.Clock, appID, projectID string
 		return "", errors.Errorf("kai-preview: generate jti: %w", err)
 	}
 	claims := HandshakeClaims{
+		Ver:       1,
 		AppID:     appID,
 		ProjectID: projectID,
 		Purpose:   purposeHandshake,
@@ -92,6 +113,7 @@ func MintSessionJWT(key string, clock clockwork.Clock, appID, projectID string,
 		return "", errors.Errorf("kai-preview: generate jti: %w", err)
 	}
 	claims := SessionClaims{
+		Ver:       1,
 		AppID:     appID,
 		ProjectID: projectID,
 		Purpose:   purposeSession,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
index d743ef998d..d524d06338 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
@@ -24,10 +24,15 @@ func TestHandshakeJWT_RoundTrip(t *testing.T) {
 
 	claims, err := VerifyHandshakeJWT(testHandshakeKey, clock, token)
 	require.NoError(t, err)
+	assert.Equal(t, 1, claims.Ver)
 	assert.Equal(t, "app-123", claims.AppID)
 	assert.Equal(t, "proj-456", claims.ProjectID)
 	assert.Equal(t, "kai-preview-handshake", claims.Purpose)
 	assert.NotEmpty(t, claims.ID)
+	// Reserved identity fields must be empty by default.
+	assert.Empty(t, claims.Email)
+	assert.Empty(t, claims.Name)
+	assert.Empty(t, claims.Roles)
 }
 
 func TestHandshakeJWT_ExpiredAfter60s(t *testing.T) {
@@ -64,9 +69,14 @@ func TestSessionJWT_RoundTrip(t *testing.T) {
 
 	claims, err := VerifySessionJWT(testSessionKey, clock, token)
 	require.NoError(t, err)
+	assert.Equal(t, 1, claims.Ver)
 	assert.Equal(t, "app-123", claims.AppID)
 	assert.Equal(t, "proj-456", claims.ProjectID)
 	assert.Equal(t, "kai-preview-session", claims.Purpose)
+	// Reserved identity fields must be empty by default.
+	assert.Empty(t, claims.Email)
+	assert.Empty(t, claims.Name)
+	assert.Empty(t, claims.Roles)
 }
 
 func TestSessionJWT_ExpiredAfterTTL(t *testing.T) {

From 1288fb513cb03638f448752b05912eb1afcdfffa Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 08:59:51 +0200
Subject: [PATCH 39/49] feat(apps-proxy): kai-preview mint response includes
 jti + sessionTtlSeconds

Change handshake-token response from {token:string} to
{token, jti, sessionTtlSeconds}. The SPA divides sessionTtlSeconds by 2
to derive its heartbeat cadence, avoiding hardcoded 2h assumptions that
break when operators tune SessionTTL.

Also add validate:"required,minDuration=1m" to SessionTTL config field
so a misconfigured zero TTL is caught at startup.

Add jti to refresh success/failure log fields (M2) for cross-system
debugging across the handshake lifecycle.
---
 .../kaipreview/endpoints/handshake_token.go   | 29 +++++++++++++++----
 .../endpoints/handshake_token_test.go         | 13 ++++++++-
 .../authproxy/kaipreview/endpoints/refresh.go |  6 ++--
 3 files changed, 40 insertions(+), 8 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
index 5d8b2eda11..6b6fbd4089 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
+	"time"
 
 	"github.com/jonboulle/clockwork"
 	"go.opentelemetry.io/otel/attribute"
@@ -26,6 +27,7 @@ type HandshakeTokenDeps struct {
 	DevMode              DevModeChecker
 	CORS                 *kaipreview.CORS
 	HandshakeKey         string
+	SessionTTL           time.Duration
 	AppID                string
 	AppProjectID         string
 }
@@ -39,7 +41,8 @@ func NewHandshakeTokenHandler(deps HandshakeTokenDeps) *HandshakeTokenHandler {
 }
 
 func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
-	if h.deps.CORS.HandlePreflight(w, r) {
+	// Mint authenticates by X-StorageApi-Token header, not by cookie — no ACAC on preflight.
+	if h.deps.CORS.HandlePreflight(w, r, false) {
 		return nil
 	}
 	if r.Method != http.MethodPost {
@@ -55,7 +58,8 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 	}
 	// All remaining responses are to an allowed origin — emit CORS headers now so the
 	// SPA can read status codes and bodies of auth-failure responses, not just successes.
-	h.deps.CORS.WriteResponseHeaders(w, origin)
+	// Mint uses header auth; no credentials header needed on the actual response either.
+	h.deps.CORS.WriteResponseHeaders(w, origin, false)
 
 	// Dev-mode gate first: pretend the endpoint doesn't exist on non-dev apps.
 	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
@@ -96,12 +100,14 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 		return errors.Errorf("kai-preview: mint handshake JWT: %w", err)
 	}
 
-	// Extract jti from the minted token for logging (non-sensitive).
+	// Extract jti from the minted token for logging and response (non-sensitive).
+	var jti string
 	if claims, parseErr := kaipreview.VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, mintedJWT); parseErr == nil {
+		jti = claims.ID
 		h.deps.Logger.With(
 			attribute.String("appID", h.deps.AppID),
 			attribute.String("projectID", h.deps.AppProjectID),
-			attribute.String("jti", claims.ID),
+			attribute.String("jti", jti),
 		).Info(r.Context(), "kai-preview: minted handshake JWT")
 	}
 
@@ -109,8 +115,21 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("Cache-Control", "no-store")
 	w.WriteHeader(http.StatusOK)
-	if err := json.NewEncoder(w).Encode(map[string]string{"token": mintedJWT}); err != nil {
+	// Response shape: {token, jti, sessionTtlSeconds}.
+	// The SPA uses sessionTtlSeconds to derive its heartbeat cadence (divide by 2).
+	// jti is included so the SPA can correlate logs across the handshake.
+	resp := struct {
+		Token             string `json:"token"`
+		JTI               string `json:"jti"`
+		SessionTTLSeconds int    `json:"sessionTtlSeconds"`
+	}{
+		Token:             mintedJWT,
+		JTI:               jti,
+		SessionTTLSeconds: int(h.deps.SessionTTL.Seconds()),
+	}
+	if err := json.NewEncoder(w).Encode(resp); err != nil {
 		return errors.Errorf("kai-preview: write handshake token response: %w", err)
 	}
 	return nil
 }
+
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
index dc7120812d..0015d83177 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
@@ -56,6 +57,7 @@ func newTestHandshakeHandler(tokenValid bool, storageTokenProject string, devMod
 		DevMode:              &stubDevModeChecker{devMode: devMode},
 		CORS:                 kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
 		HandshakeKey:         testHandshakeKey,
+		SessionTTL:           4 * time.Hour,
 		AppID:                "app-123",
 		AppProjectID:         "proj-456",
 	})
@@ -74,12 +76,21 @@ func TestHandshakeTokenHandler_Success(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+	// Mint uses header auth — ACAC must NOT be set (C2: no credentials on mint preflight).
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Credentials"),
+		"mint response must NOT set Access-Control-Allow-Credentials (header-auth endpoint)")
 
+	// I2: response shape must be {token, jti, sessionTtlSeconds}.
 	var body struct {
-		Token string `json:"token"`
+		Token             string `json:"token"`
+		JTI               string `json:"jti"`
+		SessionTTLSeconds int    `json:"sessionTtlSeconds"`
 	}
 	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &body))
 	require.NotEmpty(t, body.Token)
+	assert.NotEmpty(t, body.JTI, "jti must be present so SPA can correlate logs")
+	assert.Equal(t, int((4*time.Hour).Seconds()), body.SessionTTLSeconds,
+		"sessionTtlSeconds must match configured SessionTTL so SPA can derive heartbeat cadence")
 }
 
 func TestHandshakeTokenHandler_PreflightOptions(t *testing.T) {
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
index 8318d7797c..82d7aea9f6 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
@@ -32,7 +32,8 @@ func NewRefreshHandler(deps RefreshDeps) *RefreshHandler {
 }
 
 func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
-	if h.deps.CORS.HandlePreflight(w, r) {
+	// Refresh authenticates by session cookie — emit ACAC so the SPA can send cookies cross-origin.
+	if h.deps.CORS.HandlePreflight(w, r, true) {
 		return nil
 	}
 	if r.Method != http.MethodPost {
@@ -47,7 +48,7 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 	}
 	// All remaining responses are to an allowed origin — emit CORS headers now so the
 	// SPA can read status codes and bodies of auth-failure responses, not just successes.
-	h.deps.CORS.WriteResponseHeaders(w, origin)
+	h.deps.CORS.WriteResponseHeaders(w, origin, true)
 
 	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
 		h.deps.Logger.With(attribute.String("appID", h.deps.AppID)).
@@ -89,6 +90,7 @@ func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request
 	h.deps.Logger.With(
 		attribute.String("appID", h.deps.AppID),
 		attribute.String("projectID", h.deps.AppProjectID),
+		attribute.String("jti", claims.ID),
 	).Debug(r.Context(), "kai-preview: refreshed session cookie")
 
 	w.Header().Set("Cache-Control", "no-store")

From 66de8be503142964128de9b56085f4d8dfb35f17 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 08:59:57 +0200
Subject: [PATCH 40/49] fix(apps-proxy): drop ACAC on kai-preview mint
 preflight (header auth)

HandlePreflight and WriteResponseHeaders now take a withCredentials bool.
Mint/handshake-token passes false (authenticates by X-StorageApi-Token
header, not cookie), so Access-Control-Allow-Credentials is omitted on
its preflights and responses. Refresh passes true (authenticates by
session cookie) and keeps the header as before.
---
 .../apphandler/authproxy/kaipreview/cors.go   | 18 ++++++--
 .../authproxy/kaipreview/cors_test.go         | 42 +++++++++++++++----
 2 files changed, 49 insertions(+), 11 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
index 082974994d..b62f0ade22 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
@@ -19,7 +19,10 @@ func (c *CORS) IsAllowed(origin string) bool {
 
 // HandlePreflight returns true when the request was a preflight OPTIONS and was handled.
 // Caller should return immediately if true. Returns false for non-OPTIONS requests.
-func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request) bool {
+// withCredentials controls whether Access-Control-Allow-Credentials: true is emitted.
+// Use false for endpoints authenticated by request header (e.g. mint/handshake-token which
+// uses X-StorageApi-Token), and true for cookie-authenticated endpoints (e.g. refresh).
+func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request, withCredentials bool) bool {
 	if r.Method != http.MethodOptions {
 		return false
 	}
@@ -29,7 +32,9 @@ func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request) bool {
 		return true
 	}
 	w.Header().Set("Access-Control-Allow-Origin", origin)
-	w.Header().Set("Access-Control-Allow-Credentials", "true")
+	if withCredentials {
+		w.Header().Set("Access-Control-Allow-Credentials", "true")
+	}
 	w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
 	w.Header().Set("Access-Control-Allow-Headers", "X-StorageApi-Token, Content-Type")
 	w.Header().Set("Access-Control-Max-Age", "600")
@@ -39,11 +44,16 @@ func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request) bool {
 
 // WriteResponseHeaders sets the CORS response headers on a regular (non-preflight) response.
 // Call this from the actual handler before writing the body.
-func (c *CORS) WriteResponseHeaders(w http.ResponseWriter, origin string) {
+// withCredentials controls whether Access-Control-Allow-Credentials: true is emitted.
+// Use false for endpoints authenticated by request header (e.g. mint/handshake-token), and
+// true for cookie-authenticated endpoints (e.g. refresh).
+func (c *CORS) WriteResponseHeaders(w http.ResponseWriter, origin string, withCredentials bool) {
 	if !c.IsAllowed(origin) {
 		return
 	}
 	w.Header().Set("Access-Control-Allow-Origin", origin)
-	w.Header().Set("Access-Control-Allow-Credentials", "true")
+	if withCredentials {
+		w.Header().Set("Access-Control-Allow-Credentials", "true")
+	}
 	w.Header().Set("Vary", "Origin")
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
index c35c4f5fc2..afe345b85f 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
@@ -8,7 +8,24 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestCORS_AllowedOrigin_Preflight(t *testing.T) {
+func TestCORS_AllowedOrigin_Preflight_WithCredentials(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("Access-Control-Request-Method", "POST")
+	r.Header.Set("Access-Control-Request-Headers", "Content-Type")
+	w := httptest.NewRecorder()
+
+	handled := cors.HandlePreflight(w, r, true)
+	assert.True(t, handled)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+}
+
+func TestCORS_AllowedOrigin_Preflight_NoCredentials(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
 
@@ -18,11 +35,12 @@ func TestCORS_AllowedOrigin_Preflight(t *testing.T) {
 	r.Header.Set("Access-Control-Request-Headers", "X-StorageApi-Token, Content-Type")
 	w := httptest.NewRecorder()
 
-	handled := cors.HandlePreflight(w, r)
+	// Mint endpoint: header auth, no ACAC.
+	handled := cors.HandlePreflight(w, r, false)
 	assert.True(t, handled)
 	assert.Equal(t, http.StatusNoContent, w.Code)
 	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
-	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Credentials"), "mint preflight must NOT emit ACAC")
 	assert.Contains(t, w.Header().Get("Access-Control-Allow-Headers"), "X-StorageApi-Token")
 }
 
@@ -34,27 +52,37 @@ func TestCORS_DisallowedOrigin_Preflight(t *testing.T) {
 	r.Header.Set("Origin", "https://evil.example.com")
 	w := httptest.NewRecorder()
 
-	handled := cors.HandlePreflight(w, r)
+	handled := cors.HandlePreflight(w, r, false)
 	assert.True(t, handled)
 	assert.Equal(t, http.StatusForbidden, w.Code)
 	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"))
 }
 
-func TestCORS_WriteResponseHeaders(t *testing.T) {
+func TestCORS_WriteResponseHeaders_WithCredentials(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
 
 	w := httptest.NewRecorder()
-	cors.WriteResponseHeaders(w, "https://connection.keboola.com")
+	cors.WriteResponseHeaders(w, "https://connection.keboola.com", true)
 	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
 	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
 }
 
+func TestCORS_WriteResponseHeaders_NoCredentials(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	w := httptest.NewRecorder()
+	cors.WriteResponseHeaders(w, "https://connection.keboola.com", false)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Credentials"), "must NOT emit ACAC when withCredentials=false")
+}
+
 func TestCORS_NonPreflightPassesThrough(t *testing.T) {
 	t.Parallel()
 	cors := NewCORS([]string{"https://connection.keboola.com"})
 	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
 	w := httptest.NewRecorder()
-	handled := cors.HandlePreflight(w, r)
+	handled := cors.HandlePreflight(w, r, false)
 	assert.False(t, handled)
 }

From f19d9726c57ef7f6c85fc7847aa98eeca350dda4 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 09:00:09 +0200
Subject: [PATCH 41/49] feat(apps-proxy): kai-preview bootstrap defenses + SDK
 nil-index TODO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

C3: add event.source === window.parent guard in onMessage — only accept
messages from the window that framed the bootstrap page (defence in depth
on top of origin check).

I3: loop detection via sessionStorage. If the browser silently blocks the
partitioned cookie (Safari ITP etc.) the iframe cycles: exchange → redirect
→ bootstrap → exchange → ∞. Counter is incremented before each exchange
attempt; after 3 attempts show a user-visible error and stop.

M1: replace setInterval(broadcastReady, 500) with exponential-backoff
scheduling (100ms → 300ms → 700ms → 1500ms → 2000ms cap). Total coverage
≈ 10s, same as before, but 20× fewer messages × origins at steady state.

M4: add TODO(SDK) comment on nil-index assumption in SDKStorageTokenVerifier
so a future SDK upgrade that changes that behaviour is caught at review time.
---
 .../endpoints/template/bootstrap.gohtml       | 52 +++++++++++++++----
 .../kaipreview/storage_token_verifier.go      |  8 ++-
 2 files changed, 47 insertions(+), 13 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml
index 0fb59b4273..4d354307bc 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml
@@ -20,7 +20,7 @@
   var EXCHANGE_PATH = "/_proxy/kai-preview/exchange";
   var status = document.getElementById("status");
   var didHandshake = false;
-  var readyInterval;
+  var broadcastTimer = null;
 
   function setStatus(text) { if (status) { status.textContent = text; } }
 
@@ -42,12 +42,50 @@
     }
   }
 
+  // Exponential-backoff broadcast: 100ms, 300ms, 700ms, 1500ms, then 2000ms cap.
+  // Total coverage ≈ 10s without flooding the parent with messages.
+  var BACKOFF_DELAYS = [100, 300, 700, 1500, 2000];
+  var broadcastAttempt = 0;
+
+  function scheduleBroadcast() {
+    var delay = BACKOFF_DELAYS[Math.min(broadcastAttempt, BACKOFF_DELAYS.length - 1)];
+    broadcastAttempt++;
+    broadcastTimer = setTimeout(function () {
+      if (didHandshake) { return; }
+      broadcastReady();
+      // Give up after ~10s (sum of all delays).
+      if (broadcastAttempt <= 6) {
+        scheduleBroadcast();
+      } else {
+        setStatus("This preview only loads from the Keboola UI.");
+      }
+    }, delay);
+  }
+
   function onMessage(event) {
     if (didHandshake) { return; }
+    // C3: only accept messages from the window that framed us (defence in depth).
+    if (event.source !== window.parent) { return; }
     if (!originAllowed(event.origin)) { return; }
     if (!event.data || event.data.type !== "kai-preview-token" || typeof event.data.token !== "string") { return; }
+
+    // I3: loop-detection — if the browser silently blocks the partitioned cookie
+    // (Safari ITP etc.) the iframe would cycle: exchange → redirect → bootstrap →
+    // exchange → … Detect this with sessionStorage and bail out early.
+    var LOOP_KEY = "kbc-kai-preview-attempts";
+    try {
+      var attempts = parseInt(sessionStorage.getItem(LOOP_KEY) || "0", 10);
+      if (attempts >= 3) {
+        setStatus("Preview unavailable — your browser may be blocking storage for embedded apps. Try disabling tracking protection for this site.");
+        return;
+      }
+      sessionStorage.setItem(LOOP_KEY, String(attempts + 1));
+    } catch (e) {
+      // sessionStorage blocked entirely (e.g. strict mode): treat as attempt 0 and continue.
+    }
+
     didHandshake = true;
-    if (readyInterval) { clearInterval(readyInterval); readyInterval = null; }
+    if (broadcastTimer) { clearTimeout(broadcastTimer); broadcastTimer = null; }
 
     fetch(EXCHANGE_PATH, {
       method: "POST",
@@ -67,15 +105,7 @@
 
   window.addEventListener("message", onMessage);
   broadcastReady();
-  readyInterval = setInterval(broadcastReady, 500);
-  // Give up after ~10s if no parent responds.
-  setTimeout(function () {
-    if (!didHandshake && readyInterval) {
-      clearInterval(readyInterval);
-      readyInterval = null;
-      setStatus("This preview only loads from the Keboola UI.");
-    }
-  }, 10000);
+  scheduleBroadcast();
 })();
 </script>
 </body>
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
index b25f7f8fba..0102e53d2f 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
@@ -31,8 +31,12 @@ func NewSDKStorageTokenVerifier(storageAPIHost string) *SDKStorageTokenVerifier
 }
 
 func (v *SDKStorageTokenVerifier) Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error) {
-	// NewPublicAPIFromIndex with nil index is safe for StorageAPI calls:
-	// the base URL is hardcoded as "v2/storage" and does not require the index.
+	// TODO(SDK): NewPublicAPIFromIndex is called with a nil index because
+	// VerifyTokenRequest only needs the Storage API base URL ("v2/storage"),
+	// which is constructed directly from the host and does not require the index.
+	// If the SDK ever changes so that a nil index causes a panic or incorrect
+	// base URL construction, this call will break silently — audit when upgrading
+	// the keboola-sdk-go dependency.
 	publicAPI := keboola.NewPublicAPIFromIndex(v.storageAPIHost, nil)
 	result, err := publicAPI.VerifyTokenRequest(token).Send(ctx)
 	if err != nil {

From d663d4b57e5d1e9ca99b1abb55e15bf76547db8a Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 09:34:08 +0200
Subject: [PATCH 42/49] fix(apps-proxy): satisfy gci + godox lints on
 kai-preview branch

Fix gci alignment in 5 files (config, apphandler, handshake_token,
handler_test, handshake_token_test) and reword the TODO(SDK) comment
in storage_token_verifier.go to a plain note to satisfy godox.
---
 internal/pkg/service/appsproxy/config/config.go        |  8 ++++----
 .../service/appsproxy/proxy/apphandler/apphandler.go   |  4 ++--
 .../authproxy/kaipreview/endpoints/handler_test.go     |  8 ++++----
 .../authproxy/kaipreview/endpoints/handshake_token.go  |  1 -
 .../kaipreview/endpoints/handshake_token_test.go       |  2 +-
 .../authproxy/kaipreview/storage_token_verifier.go     | 10 +++++-----
 6 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index cd2795dbd3..1339f9883a 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -33,10 +33,10 @@ type Config struct {
 
 // KaiPreview configures the stateless iframe-auth path for the kai-preview flow.
 type KaiPreview struct {
-	HandshakeSigningKey   string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
-	SessionSigningKey     string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
-	SessionTTL            time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)." validate:"required,minDuration=1m"`
-	AllowedOrigins        []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
+	HandshakeSigningKey string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
+	SessionSigningKey   string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
+	SessionTTL          time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)." validate:"required,minDuration=1m"`
+	AllowedOrigins      []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
 	// AllowedFrameAncestors is the list of origins permitted in the bootstrap page's
 	// Content-Security-Policy frame-ancestors directive and in the JS shim's ALLOWED_ORIGINS.
 	// When empty (the common case), Normalize() copies AllowedOrigins here for backward
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 8b757d1f93..898cd636f7 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -63,8 +63,8 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 			// AllowedFrameAncestors drives the bootstrap CSP + shim origin list.
 			// AllowedOrigins is fed to CORS only (mint/refresh endpoints).
 			AllowedFrameAncestors: manager.config.KaiPreview.AllowedFrameAncestors,
-			AppID:                string(app.ID),
-			AppProjectID:         app.ProjectID,
+			AppID:                 string(app.ID),
+			AppProjectID:          app.ProjectID,
 		}),
 	}
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
index e387324a39..52de1ccd84 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
@@ -16,10 +16,10 @@ import (
 
 func newTestCompositeHandler() *Handler {
 	return NewHandler(HandlerDeps{
-		Logger:               log.NewNopLogger(),
-		Clock:                clockwork.NewFakeClock(),
-		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
-		DevMode:              &stubDevModeChecker{devMode: true},
+		Logger:                log.NewNopLogger(),
+		Clock:                 clockwork.NewFakeClock(),
+		StorageTokenVerifier:  &stubStorageTokenVerifier{projectID: "proj-456"},
+		DevMode:               &stubDevModeChecker{devMode: true},
 		CORS:                  kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
 		HandshakeKey:          testHandshakeKey,
 		SessionKey:            testSessionKey,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
index 6b6fbd4089..8ded33f98e 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
@@ -132,4 +132,3 @@ func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.
 	}
 	return nil
 }
-
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
index 0015d83177..69a68ba0a7 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
@@ -89,7 +89,7 @@ func TestHandshakeTokenHandler_Success(t *testing.T) {
 	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &body))
 	require.NotEmpty(t, body.Token)
 	assert.NotEmpty(t, body.JTI, "jti must be present so SPA can correlate logs")
-	assert.Equal(t, int((4*time.Hour).Seconds()), body.SessionTTLSeconds,
+	assert.Equal(t, int((4 * time.Hour).Seconds()), body.SessionTTLSeconds,
 		"sessionTtlSeconds must match configured SessionTTL so SPA can derive heartbeat cadence")
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
index 0102e53d2f..6b00636103 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
@@ -31,11 +31,11 @@ func NewSDKStorageTokenVerifier(storageAPIHost string) *SDKStorageTokenVerifier
 }
 
 func (v *SDKStorageTokenVerifier) Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error) {
-	// TODO(SDK): NewPublicAPIFromIndex is called with a nil index because
-	// VerifyTokenRequest only needs the Storage API base URL ("v2/storage"),
-	// which is constructed directly from the host and does not require the index.
-	// If the SDK ever changes so that a nil index causes a panic or incorrect
-	// base URL construction, this call will break silently — audit when upgrading
+	// NewPublicAPIFromIndex is called with a nil index because VerifyTokenRequest
+	// only needs the Storage API base URL ("v2/storage"), which is constructed
+	// directly from the host and does not require the index.
+	// Note: if the SDK changes so that a nil index causes a panic or incorrect
+	// base URL construction, this call will break — audit when upgrading
 	// the keboola-sdk-go dependency.
 	publicAPI := keboola.NewPublicAPIFromIndex(v.storageAPIHost, nil)
 	result, err := publicAPI.VerifyTokenRequest(token).Send(ctx)

From 48b3b97614924078d89c639653436a36c4c38bc6 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 10:46:38 +0200
Subject: [PATCH 43/49] fix(apps-proxy): address remaining PR review comments

- cors: Vary header uses Add not Set (preserve upstream values)
- cookie: correct ClearSessionCookie docstring (no exchange caller)
- cookie test: consolidate per-attribute asserts into single Equal
- docker-compose: add APPS_PROXY_STORAGE_API_URL + KAI_PREVIEW_* env vars
---
 docker-compose.yml                            |  8 +++++++
 .../apphandler/authproxy/kaipreview/cookie.go |  4 ++--
 .../authproxy/kaipreview/cookie_test.go       | 24 +++++++++++--------
 .../apphandler/authproxy/kaipreview/cors.go   |  3 ++-
 4 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 356219d0dc..e7d4cfa87c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -56,6 +56,14 @@ services:
       - APPS_PROXY_API_PUBLIC_URL=https://hub.keboola.local
       - APPS_PROXY_SANDBOXES_API_URL=http://sandboxesmock:1080/
       - APPS_PROXY_COOKIE_SECRET_SALT=secret
+      # kai-preview: required config for the dev-mode iframe-auth flow.
+      # Storage API URL is per-stack in production; for local dev we point at the
+      # canonical default. Signing keys are throwaway local values.
+      - APPS_PROXY_STORAGE_API_URL=https://connection.keboola.com
+      - APPS_PROXY_KAI_PREVIEW_HANDSHAKE_SIGNING_KEY=local-dev-handshake-key
+      - APPS_PROXY_KAI_PREVIEW_SESSION_SIGNING_KEY=local-dev-session-key
+      - APPS_PROXY_KAI_PREVIEW_SESSION_TTL=4h
+      - APPS_PROXY_KAI_PREVIEW_ALLOWED_ORIGINS=https://localhost:3000
       # Disable DataDog integration
       - TEMPLATES_DATADOG_ENABLED=false
       - STREAM_DATADOG_ENABLED=false
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
index d66a14ebe7..f56658dc06 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
@@ -30,8 +30,8 @@ func SetSessionCookie(w http.ResponseWriter, jwt string, ttl time.Duration) {
 }
 
 // ClearSessionCookie writes a cookie that invalidates any existing kai-preview
-// session cookie on the same host. Used by the exchange endpoint on validation
-// failure and by future sign-out flows.
+// session cookie on the same host. Called by SetSessionCookie when ttl <= 0,
+// and available for future sign-out flows.
 func ClearSessionCookie(w http.ResponseWriter) {
 	http.SetCookie(w, &http.Cookie{
 		Name:        SessionCookieName,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
index 2e560310f3..32486392c0 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
@@ -26,16 +26,20 @@ func TestSetSessionCookie_Attributes(t *testing.T) {
 	cookies := resp.Cookies()
 	require.Len(t, cookies, 1)
 	c := cookies[0]
-
-	assert.Equal(t, SessionCookieName, c.Name)
-	assert.Equal(t, jwt, c.Value)
-	assert.Equal(t, "/", c.Path)
-	assert.True(t, c.Secure)
-	assert.True(t, c.HttpOnly)
-	assert.Equal(t, http.SameSiteNoneMode, c.SameSite)
-	assert.True(t, c.Partitioned)
-	assert.Empty(t, c.Domain, "must be host-only — no Domain attribute")
-	assert.Equal(t, int(ttl.Seconds()), c.MaxAge)
+	// Strip parser-populated fields so we can compare the cookie shape directly.
+	c.Raw = ""
+	c.Unparsed = nil
+
+	assert.Equal(t, &http.Cookie{
+		Name:        SessionCookieName,
+		Value:       jwt,
+		Path:        "/",
+		Secure:      true,
+		HttpOnly:    true,
+		SameSite:    http.SameSiteNoneMode,
+		Partitioned: true,
+		MaxAge:      int(ttl.Seconds()),
+	}, c)
 }
 
 func TestReadSessionCookie_Present(t *testing.T) {
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
index b62f0ade22..5fde8ce23e 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
@@ -55,5 +55,6 @@ func (c *CORS) WriteResponseHeaders(w http.ResponseWriter, origin string, withCr
 	if withCredentials {
 		w.Header().Set("Access-Control-Allow-Credentials", "true")
 	}
-	w.Header().Set("Vary", "Origin")
+	// Add (not Set) so we don't clobber any Vary value upstream middleware may have appended.
+	w.Header().Add("Vary", "Origin")
 }

From 35e5b926ba12a79ee63451d416ae41640ef4e509 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 11:00:22 +0200
Subject: [PATCH 44/49] docs(apps-proxy): trim kai-preview operator guide

- Drop the smoke-test runbook (section 7); flow is covered by tests and
  by the UI integration we use in practice.
- Drop the section pointing at the internal design spec; not useful to
  readers of this repo.
---
 docs/apps-proxy/kai-preview.md | 200 +--------------------------------
 1 file changed, 1 insertion(+), 199 deletions(-)

diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
index 9b37117cea..de43ce6e68 100644
--- a/docs/apps-proxy/kai-preview.md
+++ b/docs/apps-proxy/kai-preview.md
@@ -125,196 +125,7 @@ keys** (injected via Kubernetes secret).
 
 ---
 
-## 7. Smoke-Test Runbook
-
-Use this runbook to verify that a fresh stack deployment is wired correctly. Each
-step is designed to be copy-paste runnable. Substitute the environment variables at
-the top for your target environment.
-
-### 7.0 Environment variables
-
-```bash
-export APP_HOST="myapp.data-apps.keboola.com"   # FQDN of the data app
-export IDE_ORIGIN="https://connection.keboola.com"
-export STORAGE_TOKEN="<your-storage-api-token>"
-
-# Signing keys — use the same values provisioned to the stack
-export HANDSHAKE_KEY="$(openssl rand -hex 32)"
-export SESSION_KEY="$(openssl rand -hex 32)"
-```
-
-### 7.1 Boot apps-proxy locally with kai-preview config
-
-```bash
-APPS_PROXY_KAI_PREVIEW_HANDSHAKE_SIGNING_KEY="${HANDSHAKE_KEY}" \
-APPS_PROXY_KAI_PREVIEW_SESSION_SIGNING_KEY="${SESSION_KEY}" \
-APPS_PROXY_KAI_PREVIEW_SESSION_TTL="4h" \
-APPS_PROXY_KAI_PREVIEW_ALLOWED_ORIGINS="${IDE_ORIGIN}" \
-APPS_PROXY_STORAGE_API_URL="https://connection.keboola.com" \
-  ./apps-proxy
-```
-
-Expected: proxy starts, logs `kai-preview enabled` (or similar), no startup errors.
-
-### 7.2 Mint a handshake token
-
-```bash
-HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
-  -H "Origin: ${IDE_ORIGIN}" \
-  -H "X-StorageApi-Token: ${STORAGE_TOKEN}" \
-  -H "Content-Type: application/json" \
-  | jq -r '.token')
-
-echo "handshake token: ${HANDSHAKE_TOKEN}"
-```
-
-**Expected:**
-- HTTP `200`
-- Response body: `{"token":"<jwt>"}`
-- `Access-Control-Allow-Origin: ${IDE_ORIGIN}` response header present
-- `Cache-Control: no-store` response header present
-
-### 7.3 Fetch the bootstrap shim
-
-```bash
-curl -sI "https://${APP_HOST}/_proxy/kai-preview/bootstrap"
-```
-
-**Expected:**
-- HTTP `200`
-- `Content-Type: text/html; charset=utf-8`
-- `Content-Security-Policy` header contains `frame-ancestors ${IDE_ORIGIN}`
-- `Cache-Control: no-store`
-
-To inspect the body:
-
-```bash
-curl -s "https://${APP_HOST}/_proxy/kai-preview/bootstrap" | head -20
-```
-
-Expected: HTML containing a `<script>` block that performs the postMessage
-handshake.
-
-### 7.4 Exchange the handshake token for a session cookie
-
-```bash
-SESSION_COOKIE=$(curl -s -c - -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
-  -H "Content-Type: application/json" \
-  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" \
-  -D - \
-  | grep -i 'set-cookie')
-
-echo "${SESSION_COOKIE}"
-```
-
-**Expected:**
-- HTTP `200`
-- `Set-Cookie` header present with:
-  - name `kbc-kai-preview-session`
-  - `SameSite=None`
-  - `Partitioned`
-  - `Secure`
-  - `HttpOnly`
-  - `Max-Age=14400` (or the configured `sessionTTL` in seconds)
-- `Cache-Control: no-store`
-
-Save the cookie for subsequent steps:
-
-```bash
-curl -s -c /tmp/kai-preview-cookies.txt -X POST \
-  "https://${APP_HOST}/_proxy/kai-preview/exchange" \
-  -H "Content-Type: application/json" \
-  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" > /dev/null
-```
-
-### 7.5 Make an authenticated request using the session cookie
-
-```bash
-curl -s -b /tmp/kai-preview-cookies.txt \
-  "https://${APP_HOST}/"
-```
-
-**Expected:**
-- HTTP `200` with the upstream app's response body (not an OAuth redirect or login
-  page).
-- No `Location:` header redirecting to an auth provider.
-
-### 7.6 Refresh the session cookie
-
-```bash
-curl -s -b /tmp/kai-preview-cookies.txt \
-     -c /tmp/kai-preview-cookies.txt \
-     -X POST "https://${APP_HOST}/_proxy/kai-preview/refresh" \
-     -H "Origin: ${IDE_ORIGIN}" \
-     -D -
-```
-
-**Expected:**
-- HTTP `204 No Content`
-- Fresh `Set-Cookie: kbc-kai-preview-session=...` header (new JWT, new `Max-Age`)
-- `Access-Control-Allow-Origin: ${IDE_ORIGIN}` header present
-
-### 7.7 Verify 404 when dev-mode is off
-
-Flip the app CRD to disable dev-mode:
-
-```bash
-kubectl edit app/<app-name> -n <apps-namespace>
-# Set spec.devMode.enabled: false, save and quit
-```
-
-Then re-run the mint step:
-
-```bash
-curl -s -o /dev/null -w "%{http_code}" \
-  -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
-  -H "Origin: ${IDE_ORIGIN}" \
-  -H "X-StorageApi-Token: ${STORAGE_TOKEN}"
-```
-
-**Expected:** `404`. All four kai-preview endpoints should return `404`.
-
-Re-enable dev-mode before continuing:
-
-```bash
-kubectl edit app/<app-name> -n <apps-namespace>
-# Set spec.devMode.enabled: true
-```
-
-### 7.8 Multi-replica stateless check
-
-Scale apps-proxy to two replicas:
-
-```bash
-kubectl scale deployment apps-proxy --replicas=2 -n <apps-namespace>
-kubectl rollout status deployment/apps-proxy -n <apps-namespace>
-```
-
-Mint a token (this will land on an arbitrary replica):
-
-```bash
-HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
-  -H "Origin: ${IDE_ORIGIN}" \
-  -H "X-StorageApi-Token: ${STORAGE_TOKEN}" \
-  | jq -r '.token')
-```
-
-Exchange it (may land on a different replica due to load-balancer round-robin):
-
-```bash
-curl -s -c /tmp/kai-preview-cookies-mr.txt \
-  -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
-  -H "Content-Type: application/json" \
-  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" \
-  -o /dev/null -w "%{http_code}\n"
-```
-
-**Expected:** `200`. The exchange succeeds regardless of which replica handles it,
-proving stateless JWT validation.
-
----
-
-## 8. Known Limitations
+## 7. Known Limitations
 
 - **No user identity headers.** Apps that read `X-Kbc-User-*` headers to determine
   the acting user will not receive them in kai-preview iframe sessions — the session
@@ -332,12 +143,3 @@ proving stateless JWT validation.
 - **Dev-mode only.** The entire kai-preview path is disabled for production apps
   (`spec.devMode.enabled: false`). There is no override. Do not rely on this path
   for production embedding scenarios.
-
----
-
-## 9. Reference
-
-The full design rationale (threat model, cookie attribute choices, multi-replica
-analysis, and kbc-ui SPA side) is captured in the internal design spec recorded
-separately from this repository. Refer to your team's design documentation archive
-for the `2026-05-14-dev-iframe-auth-design` specification.

From e20c4cd644905e4b1c638ae301a18c95bcc257e4 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 11:34:09 +0200
Subject: [PATCH 45/49] refactor(apps-proxy): collapse kaiPreview
 AllowedFrameAncestors into AllowedOrigins
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The split was speculative — kbc-ui is the only embedder and the only CORS
caller, so the two lists are always equal in practice. Use a single
AllowedOrigins knob that feeds both the CORS allowlist (handshake-token,
refresh) and the bootstrap CSP frame-ancestors + JS shim origin list.

Also drop a now-obvious comment about StorageAPIURL having no default.
---
 .../pkg/service/appsproxy/config/config.go    | 22 +---------
 .../service/appsproxy/config/config_test.go   | 44 -------------------
 .../appsproxy/proxy/apphandler/apphandler.go  | 14 +++---
 .../authproxy/kaipreview/endpoints/handler.go | 12 ++---
 .../kaipreview/endpoints/handler_test.go      | 22 +++++-----
 5 files changed, 24 insertions(+), 90 deletions(-)

diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index 1339f9883a..d1406bcb1f 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -36,14 +36,7 @@ type KaiPreview struct {
 	HandshakeSigningKey string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
 	SessionSigningKey   string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
 	SessionTTL          time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)." validate:"required,minDuration=1m"`
-	AllowedOrigins      []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
-	// AllowedFrameAncestors is the list of origins permitted in the bootstrap page's
-	// Content-Security-Policy frame-ancestors directive and in the JS shim's ALLOWED_ORIGINS.
-	// When empty (the common case), Normalize() copies AllowedOrigins here for backward
-	// compatibility with existing operator deployments that set only allowedOrigins.
-	// Operators that need a stricter CSP boundary (e.g. different IDE staging/prod origins)
-	// can set this independently.
-	AllowedFrameAncestors []string `configKey:"allowedFrameAncestors" configUsage:"Origins permitted as frame-ancestors in the bootstrap CSP (defaults to allowedOrigins when unset)."`
+	AllowedOrigins      []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to embed apps via kai-preview and mint handshake tokens (e.g. https://connection.keboola.com). Drives both the CORS allowlist and the bootstrap CSP frame-ancestors directive." validate:"required,min=1,dive,http_url"`
 }
 
 type API struct {
@@ -95,9 +88,6 @@ func New() Config {
 		KaiPreview: KaiPreview{
 			SessionTTL: 4 * time.Hour,
 		},
-		// StorageAPIURL has no default — operator must set it explicitly per stack.
-		// A hardcoded default would silently mis-verify Storage tokens on every
-		// non-default stack, producing a clean 401 with no actionable error.
 	}
 }
 
@@ -108,16 +98,6 @@ func (c *KaiPreview) Normalize() {
 	for i, o := range c.AllowedOrigins {
 		c.AllowedOrigins[i] = strings.TrimRight(o, "/")
 	}
-	for i, o := range c.AllowedFrameAncestors {
-		c.AllowedFrameAncestors[i] = strings.TrimRight(o, "/")
-	}
-	// Default AllowedFrameAncestors to AllowedOrigins so operators that set only
-	// allowedOrigins don't need to change their configuration.
-	if len(c.AllowedFrameAncestors) == 0 {
-		dst := make([]string, len(c.AllowedOrigins))
-		copy(dst, c.AllowedOrigins)
-		c.AllowedFrameAncestors = dst
-	}
 }
 
 func (c *API) Normalize() {
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
index 7dae1ae210..8af570263d 100644
--- a/internal/pkg/service/appsproxy/config/config_test.go
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -51,50 +51,6 @@ func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
 	assert.Equal(t, "https://staging.keboola.com", cfg.KaiPreview.AllowedOrigins[1])
 }
 
-func TestKaiPreviewConfig_FrameAncestorsDefaultsToAllowedOrigins(t *testing.T) {
-	t.Parallel()
-	cfg := config.New()
-	cfg.CookieSecretSalt = "x"
-	cfg.CsrfTokenSalt = "x"
-	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
-	cfg.K8s = config.K8s{AppsNamespace: "ns"}
-	storageURL, _ := url.Parse("https://connection.keboola.com")
-	cfg.StorageAPIURL = storageURL
-	cfg.KaiPreview = config.KaiPreview{
-		HandshakeSigningKey: "k1",
-		SessionSigningKey:   "k2",
-		SessionTTL:          4 * time.Hour,
-		AllowedOrigins:      []string{"https://connection.keboola.com", "https://staging.keboola.com"},
-		// AllowedFrameAncestors intentionally left empty — must default to AllowedOrigins.
-	}
-	err := configmap.ValidateAndNormalize(&cfg)
-	require.NoError(t, err)
-	assert.Equal(t, cfg.KaiPreview.AllowedOrigins, cfg.KaiPreview.AllowedFrameAncestors,
-		"AllowedFrameAncestors must default to AllowedOrigins when unset")
-}
-
-func TestKaiPreviewConfig_FrameAncestorsIndependentWhenSet(t *testing.T) {
-	t.Parallel()
-	cfg := config.New()
-	cfg.CookieSecretSalt = "x"
-	cfg.CsrfTokenSalt = "x"
-	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
-	cfg.K8s = config.K8s{AppsNamespace: "ns"}
-	storageURL, _ := url.Parse("https://connection.keboola.com")
-	cfg.StorageAPIURL = storageURL
-	cfg.KaiPreview = config.KaiPreview{
-		HandshakeSigningKey:   "k1",
-		SessionSigningKey:     "k2",
-		SessionTTL:            4 * time.Hour,
-		AllowedOrigins:        []string{"https://connection.keboola.com", "https://staging.keboola.com"},
-		AllowedFrameAncestors: []string{"https://connection.keboola.com"},
-	}
-	err := configmap.ValidateAndNormalize(&cfg)
-	require.NoError(t, err)
-	assert.Equal(t, []string{"https://connection.keboola.com"}, cfg.KaiPreview.AllowedFrameAncestors,
-		"AllowedFrameAncestors must remain independent when explicitly set")
-}
-
 func TestConfig_RequiresStorageAPIURL(t *testing.T) {
 	t.Parallel()
 	cfg := config.New()
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 898cd636f7..f10cd4dcdb 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -57,14 +57,12 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 			StorageTokenVerifier: manager.storageTokenVerifier,
 			DevMode:              devModeChecker,
 			CORS:                 kaipreview.NewCORS(manager.config.KaiPreview.AllowedOrigins),
-			HandshakeKey:         manager.config.KaiPreview.HandshakeSigningKey,
-			SessionKey:           manager.config.KaiPreview.SessionSigningKey,
-			SessionTTL:           manager.config.KaiPreview.SessionTTL,
-			// AllowedFrameAncestors drives the bootstrap CSP + shim origin list.
-			// AllowedOrigins is fed to CORS only (mint/refresh endpoints).
-			AllowedFrameAncestors: manager.config.KaiPreview.AllowedFrameAncestors,
-			AppID:                 string(app.ID),
-			AppProjectID:          app.ProjectID,
+			HandshakeKey:   manager.config.KaiPreview.HandshakeSigningKey,
+			SessionKey:     manager.config.KaiPreview.SessionSigningKey,
+			SessionTTL:     manager.config.KaiPreview.SessionTTL,
+			AllowedOrigins: manager.config.KaiPreview.AllowedOrigins,
+			AppID:          string(app.ID),
+			AppProjectID:   app.ProjectID,
 		}),
 	}
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
index 5c3c9481d6..3cdb6cc8f0 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
@@ -38,11 +38,11 @@ type HandlerDeps struct {
 	HandshakeKey         string
 	SessionKey           string
 	SessionTTL           time.Duration
-	// AllowedFrameAncestors controls the bootstrap CSP frame-ancestors and shim origin list.
-	// Distinct from AllowedOrigins (which is fed to CORS) to allow different operator configs.
-	AllowedFrameAncestors []string
-	AppID                 string
-	AppProjectID          string
+	// AllowedOrigins drives both the CORS allowlist (mint/refresh) and the bootstrap
+	// CSP frame-ancestors + JS shim origin list.
+	AllowedOrigins []string
+	AppID          string
+	AppProjectID   string
 }
 
 // Handler is the per-app composite handler that serves all four kai-preview
@@ -62,7 +62,7 @@ func NewHandler(deps HandlerDeps) *Handler {
 			HandshakeKey: deps.HandshakeKey, SessionTTL: deps.SessionTTL,
 			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
 		}),
-		bootstrap: NewBootstrapHandler(deps.AllowedFrameAncestors, deps.DevMode, deps.AppID),
+		bootstrap: NewBootstrapHandler(deps.AllowedOrigins, deps.DevMode, deps.AppID),
 		exchange: NewExchangeHandler(ExchangeDeps{
 			Logger: deps.Logger, Clock: deps.Clock, DevMode: deps.DevMode,
 			HandshakeKey: deps.HandshakeKey, SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL,
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
index 52de1ccd84..afe98c4380 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
@@ -16,17 +16,17 @@ import (
 
 func newTestCompositeHandler() *Handler {
 	return NewHandler(HandlerDeps{
-		Logger:                log.NewNopLogger(),
-		Clock:                 clockwork.NewFakeClock(),
-		StorageTokenVerifier:  &stubStorageTokenVerifier{projectID: "proj-456"},
-		DevMode:               &stubDevModeChecker{devMode: true},
-		CORS:                  kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
-		HandshakeKey:          testHandshakeKey,
-		SessionKey:            testSessionKey,
-		SessionTTL:            4 * time.Hour,
-		AllowedFrameAncestors: []string{"https://connection.keboola.com"},
-		AppID:                 "app-123",
-		AppProjectID:          "proj-456",
+		Logger:               log.NewNopLogger(),
+		Clock:                clockwork.NewFakeClock(),
+		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
+		DevMode:              &stubDevModeChecker{devMode: true},
+		CORS:                 kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey:         testHandshakeKey,
+		SessionKey:           testSessionKey,
+		SessionTTL:           4 * time.Hour,
+		AllowedOrigins:       []string{"https://connection.keboola.com"},
+		AppID:                "app-123",
+		AppProjectID:         "proj-456",
 	})
 }
 

From 0e68e0722164e605bcb266025487b256e4f6c49c Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 11:46:59 +0200
Subject: [PATCH 46/49] refactor(apps-proxy): drop reserved identity fields
 from kai-preview JWT claims

Email/Name/Roles on HandshakeClaims and SessionClaims were carried as
placeholders for a future identity-propagation extension. No code reads
or sets them today. Removing them per YAGNI; if/when identity is needed
the wire format already has Ver=1 to allow a schema bump.
---
 .../proxy/apphandler/authproxy/kaipreview/jwt.go     | 12 ------------
 .../apphandler/authproxy/kaipreview/jwt_test.go      |  8 --------
 2 files changed, 20 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
index 6b22d29583..8679a9905e 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -29,12 +29,6 @@ type HandshakeClaims struct {
 	AppID     string `json:"appId"`
 	ProjectID string `json:"project"`
 	Purpose   string `json:"purpose"`
-	// Reserved for future identity propagation per the dev-iframe-auth design spec
-	// ("Possible future extensions"). Not populated today; omitempty ensures
-	// wire format is unchanged until a consumer is ready.
-	Email string   `json:"email,omitempty"`
-	Name  string   `json:"name,omitempty"`
-	Roles []string `json:"roles,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -48,12 +42,6 @@ type SessionClaims struct {
 	ProjectID string `json:"project"`
 	Purpose   string `json:"purpose"`
 	TTL       int64  `json:"ttlS"` // total intended lifetime in seconds (for halfway-refresh detection)
-	// Reserved for future identity propagation per the dev-iframe-auth design spec
-	// ("Possible future extensions"). Not populated today; omitempty ensures
-	// wire format is unchanged until a consumer is ready.
-	Email string   `json:"email,omitempty"`
-	Name  string   `json:"name,omitempty"`
-	Roles []string `json:"roles,omitempty"`
 	jwt.RegisteredClaims
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
index d524d06338..a947408b89 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
@@ -29,10 +29,6 @@ func TestHandshakeJWT_RoundTrip(t *testing.T) {
 	assert.Equal(t, "proj-456", claims.ProjectID)
 	assert.Equal(t, "kai-preview-handshake", claims.Purpose)
 	assert.NotEmpty(t, claims.ID)
-	// Reserved identity fields must be empty by default.
-	assert.Empty(t, claims.Email)
-	assert.Empty(t, claims.Name)
-	assert.Empty(t, claims.Roles)
 }
 
 func TestHandshakeJWT_ExpiredAfter60s(t *testing.T) {
@@ -73,10 +69,6 @@ func TestSessionJWT_RoundTrip(t *testing.T) {
 	assert.Equal(t, "app-123", claims.AppID)
 	assert.Equal(t, "proj-456", claims.ProjectID)
 	assert.Equal(t, "kai-preview-session", claims.Purpose)
-	// Reserved identity fields must be empty by default.
-	assert.Empty(t, claims.Email)
-	assert.Empty(t, claims.Name)
-	assert.Empty(t, claims.Roles)
 }
 
 func TestSessionJWT_ExpiredAfterTTL(t *testing.T) {

From 868184d34282df4c8176077699591c9ebb1da0c1 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 11:55:02 +0200
Subject: [PATCH 47/49] refactor(apps-proxy): use keboola.NewPublicAPI for
 kai-preview token verifier

The previous code used NewPublicAPIFromIndex(host, nil), which works only
because VerifyTokenRequest happens to not touch the SDK's index field.
Nothing in the SDK documents that nil is acceptable, so we'd break
quietly if the SDK starts requiring the index for token verify.

Switch to NewPublicAPI(ctx, host): one extra HTTP round-trip at startup
to load the Storage API index, then the same PublicAPI client is reused
across verifications. Thread ctx + error through apphandler.NewManager
so the index load failure surfaces during service bootstrap rather than
on the first verification.
---
 .../appsproxy/dependencies/dependencies.go    |  5 +++-
 .../kaipreview/storage_token_verifier.go      | 23 ++++++++++---------
 .../appsproxy/proxy/apphandler/manager.go     | 13 +++++++----
 3 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/internal/pkg/service/appsproxy/dependencies/dependencies.go b/internal/pkg/service/appsproxy/dependencies/dependencies.go
index b3f6be28e3..72908bf18a 100644
--- a/internal/pkg/service/appsproxy/dependencies/dependencies.go
+++ b/internal/pkg/service/appsproxy/dependencies/dependencies.go
@@ -210,7 +210,10 @@ func newServiceScope(ctx context.Context, parentScp parentScopes, cfg config.Con
 	d.wakeupManager = wakeup.NewManager(d)
 	d.authProxyManager = authproxy.NewManager(d)
 	d.upstreamManager = upstream.NewManager(d)
-	d.appHandlers = apphandler.NewManager(d)
+	d.appHandlers, err = apphandler.NewManager(ctx, d)
+	if err != nil {
+		return nil, err
+	}
 
 	return d, nil
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
index 6b00636103..34e62615e4 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
@@ -23,22 +23,23 @@ type StorageTokenVerifyResult struct {
 }
 
 type SDKStorageTokenVerifier struct {
-	storageAPIHost string
+	publicAPI *keboola.PublicAPI
 }
 
-func NewSDKStorageTokenVerifier(storageAPIHost string) *SDKStorageTokenVerifier {
-	return &SDKStorageTokenVerifier{storageAPIHost: storageAPIHost}
+// NewSDKStorageTokenVerifier loads the Storage API index once and reuses the
+// resulting PublicAPI client for all token verifications. We use NewPublicAPI
+// (not NewPublicAPIFromIndex with nil) so the SDK's documented invariants hold
+// for every method on the client, not just token verify.
+func NewSDKStorageTokenVerifier(ctx context.Context, storageAPIHost string) (*SDKStorageTokenVerifier, error) {
+	publicAPI, err := keboola.NewPublicAPI(ctx, storageAPIHost)
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: build Storage API client: %w", err)
+	}
+	return &SDKStorageTokenVerifier{publicAPI: publicAPI}, nil
 }
 
 func (v *SDKStorageTokenVerifier) Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error) {
-	// NewPublicAPIFromIndex is called with a nil index because VerifyTokenRequest
-	// only needs the Storage API base URL ("v2/storage"), which is constructed
-	// directly from the host and does not require the index.
-	// Note: if the SDK changes so that a nil index causes a panic or incorrect
-	// base URL construction, this call will break — audit when upgrading
-	// the keboola-sdk-go dependency.
-	publicAPI := keboola.NewPublicAPIFromIndex(v.storageAPIHost, nil)
-	result, err := publicAPI.VerifyTokenRequest(token).Send(ctx)
+	result, err := v.publicAPI.VerifyTokenRequest(token).Send(ctx)
 	if err != nil {
 		return nil, errors.Errorf("kai-preview: SDK Storage token verify: %w", err)
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index 3eb3a73c0f..7d5ab4e1e5 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -56,12 +56,15 @@ type dependencies interface {
 	AppConfigLoader() appconfig.Loader
 }
 
-func NewManager(d dependencies) *Manager {
+func NewManager(ctx context.Context, d dependencies) (*Manager, error) {
 	cfg := d.Config()
 	if cfg.StorageAPIURL == nil {
-		panic("appsproxy: StorageAPIURL is required for kai-preview Storage token verification")
+		return nil, errors.New("appsproxy: StorageAPIURL is required for kai-preview Storage token verification")
+	}
+	verifier, err := kaipreview.NewSDKStorageTokenVerifier(ctx, cfg.StorageAPIURL.String())
+	if err != nil {
+		return nil, err
 	}
-	storageAPIURL := cfg.StorageAPIURL.String()
 	return &Manager{
 		logger:           d.Logger(),
 		config:           cfg,
@@ -74,8 +77,8 @@ func NewManager(d dependencies) *Manager {
 			return &appHandlerWrapper{lock: &sync.Mutex{}}
 		}),
 		clock:                d.Clock(),
-		storageTokenVerifier: kaipreview.NewSDKStorageTokenVerifier(storageAPIURL),
-	}
+		storageTokenVerifier: verifier,
+	}, nil
 }
 
 func (m *Manager) HandlerFor(ctx context.Context, result appconfig.AppConfigResult) http.Handler {

From 883560e8362cc518ed60db6295e876180f767d03 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 12:08:14 +0200
Subject: [PATCH 48/49] style(apps-proxy): gofmt re-align HandlerDeps struct
 literal

---
 .../service/appsproxy/proxy/apphandler/apphandler.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index f10cd4dcdb..e69675ba75 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -57,12 +57,12 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 			StorageTokenVerifier: manager.storageTokenVerifier,
 			DevMode:              devModeChecker,
 			CORS:                 kaipreview.NewCORS(manager.config.KaiPreview.AllowedOrigins),
-			HandshakeKey:   manager.config.KaiPreview.HandshakeSigningKey,
-			SessionKey:     manager.config.KaiPreview.SessionSigningKey,
-			SessionTTL:     manager.config.KaiPreview.SessionTTL,
-			AllowedOrigins: manager.config.KaiPreview.AllowedOrigins,
-			AppID:          string(app.ID),
-			AppProjectID:   app.ProjectID,
+			HandshakeKey:         manager.config.KaiPreview.HandshakeSigningKey,
+			SessionKey:           manager.config.KaiPreview.SessionSigningKey,
+			SessionTTL:           manager.config.KaiPreview.SessionTTL,
+			AllowedOrigins:       manager.config.KaiPreview.AllowedOrigins,
+			AppID:                string(app.ID),
+			AppProjectID:         app.ProjectID,
 		}),
 	}
 

From e92fd6d58bb7569784c23acfdd4ad86628fbc7a2 Mon Sep 17 00:00:00 2001
From: Pepa Martinec <josef.martinec@keboola.com>
Date: Wed, 20 May 2026 14:19:40 +0200
Subject: [PATCH 49/49] refactor(apps-proxy): use idgenerator for JWT jti;
 harden CORS error path

- Replace the local randomHex helper with internal/pkg/idgenerator.Random,
  per repo convention (and CLAUDE.md prohibition on direct gonanoid).
  Drops crypto/rand + encoding/hex imports; jti retains ~119 bits of
  entropy. The Mint funcs no longer have a jti-generation error branch.

- CORS: emit Vary: Origin unconditionally on both HandlePreflight and
  WriteResponseHeaders so shared caches keyed on URL alone can't pin a
  403 response from one origin against a request from a different
  origin. Add Cache-Control: no-store on the 403 preflight path.
---
 .../apphandler/authproxy/kaipreview/cors.go   | 10 ++++++--
 .../apphandler/authproxy/kaipreview/jwt.go    | 23 +++----------------
 2 files changed, 11 insertions(+), 22 deletions(-)

diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
index 5fde8ce23e..849b45c93a 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
@@ -26,8 +26,12 @@ func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request, withCrede
 	if r.Method != http.MethodOptions {
 		return false
 	}
+	// Emit Vary: Origin on every response (allowed or 403) so shared caches don't
+	// key only on URL and serve a 403 cached for one origin to a different origin.
+	w.Header().Add("Vary", "Origin")
 	origin := r.Header.Get("Origin")
 	if !c.IsAllowed(origin) {
+		w.Header().Set("Cache-Control", "no-store")
 		http.Error(w, "origin not allowed", http.StatusForbidden)
 		return true
 	}
@@ -48,6 +52,10 @@ func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request, withCrede
 // Use false for endpoints authenticated by request header (e.g. mint/handshake-token), and
 // true for cookie-authenticated endpoints (e.g. refresh).
 func (c *CORS) WriteResponseHeaders(w http.ResponseWriter, origin string, withCredentials bool) {
+	// Vary: Origin is emitted unconditionally — the response can depend on the Origin
+	// header regardless of whether this particular origin is allowed, so caches must
+	// key by it. Add (not Set) so we don't clobber any Vary upstream middleware appended.
+	w.Header().Add("Vary", "Origin")
 	if !c.IsAllowed(origin) {
 		return
 	}
@@ -55,6 +63,4 @@ func (c *CORS) WriteResponseHeaders(w http.ResponseWriter, origin string, withCr
 	if withCredentials {
 		w.Header().Set("Access-Control-Allow-Credentials", "true")
 	}
-	// Add (not Set) so we don't clobber any Vary value upstream middleware may have appended.
-	w.Header().Add("Vary", "Origin")
 }
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
index 8679a9905e..b4ca7102a4 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -4,13 +4,12 @@
 package kaipreview
 
 import (
-	"crypto/rand"
-	"encoding/hex"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/jonboulle/clockwork"
 
+	"github.com/keboola/keboola-as-code/internal/pkg/idgenerator"
 	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
 )
 
@@ -56,17 +55,13 @@ func (c SessionClaims) NeedsRefresh(now time.Time) bool {
 
 func MintHandshakeJWT(key string, clock clockwork.Clock, appID, projectID string) (string, error) {
 	now := clock.Now()
-	jti, err := randomHex(16)
-	if err != nil {
-		return "", errors.Errorf("kai-preview: generate jti: %w", err)
-	}
 	claims := HandshakeClaims{
 		Ver:       1,
 		AppID:     appID,
 		ProjectID: projectID,
 		Purpose:   purposeHandshake,
 		RegisteredClaims: jwt.RegisteredClaims{
-			ID:        jti,
+			ID:        idgenerator.Random(20),
 			IssuedAt:  jwt.NewNumericDate(now),
 			ExpiresAt: jwt.NewNumericDate(now.Add(handshakeTTL)),
 		},
@@ -96,10 +91,6 @@ func VerifyHandshakeJWT(key string, clock clockwork.Clock, raw string) (*Handsha
 
 func MintSessionJWT(key string, clock clockwork.Clock, appID, projectID string, ttl time.Duration) (string, error) {
 	now := clock.Now()
-	jti, err := randomHex(16)
-	if err != nil {
-		return "", errors.Errorf("kai-preview: generate jti: %w", err)
-	}
 	claims := SessionClaims{
 		Ver:       1,
 		AppID:     appID,
@@ -107,7 +98,7 @@ func MintSessionJWT(key string, clock clockwork.Clock, appID, projectID string,
 		Purpose:   purposeSession,
 		TTL:       int64(ttl.Seconds()),
 		RegisteredClaims: jwt.RegisteredClaims{
-			ID:        jti,
+			ID:        idgenerator.Random(20),
 			IssuedAt:  jwt.NewNumericDate(now),
 			ExpiresAt: jwt.NewNumericDate(now.Add(ttl)),
 		},
@@ -134,11 +125,3 @@ func VerifySessionJWT(key string, clock clockwork.Clock, raw string) (*SessionCl
 	}
 	return claims, nil
 }
-
-func randomHex(n int) (string, error) {
-	b := make([]byte, n)
-	if _, err := rand.Read(b); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(b), nil
-}