fix(auth): require a same-origin call on the loopback bridge callback

[deepme987]

What

The loopback sign-in bridge's POST /callback accepts a signed-in Firebase user and injects it into the app session. Its only validation was that the request arrived on the loopback socket.

That check can't do the job it looks like it's doing: every page in every browser on the machine also reaches the server from 127.0.0.1. So it cannot distinguish the bridge page we serve from any other page the user happens to have open. The handler read no Origin, no Sec-Fetch-Site, and never enforced a content-type — readJsonBody parses the body regardless.

This makes the endpoint require positive proof that the caller is the page we served: a same-origin JSON fetch, which is exactly what the bridge page already sends.

The checks

• Content-Type: application/json — the load-bearing one. A cross-site caller can only reach a loopback server without a CORS preflight by staying inside the "simple" content-types (text/plain, form-encoded, multipart). We serve no OPTIONS handler, so demanding JSON forces a preflight that cannot succeed.
• Sec-Fetch-Site: same-origin when present — a forbidden header, so a page cannot forge it.
• Origin must be our own loopback origin when present.

Fails closed when neither Origin nor Sec-Fetch-Site attests same-origin.

No behaviour change for the real flow: the bridge page's fetch('/callback', {method:'POST', headers:{'Content-Type':'application/json'}}) already satisfies all three.

Testing

Tests drive the real server over raw node:http — undici strips Origin, so fetch can't express these cases:

Request	Result
Cross-site form POST (text/plain)	403, no sign-in
JSON POST from a foreign origin	403, no sign-in
POST with neither Origin nor Sec-Fetch-Site	403, no sign-in
Genuine same-origin JSON call	204, resolves

Each asserts the sign-in flow did not complete, not just the status code. Removing the guard fails all three. Full src/main/auth suite green (41), typecheck + lint clean.

Notes

Found while reviewing #1222. Independent of that PR — this hardens the existing bridge, which #1222 keeps as its fallback path.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5cdb1c72-602e-4fc5-9bd9-4ed75682fefb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deepme987/desktop/bridge-callback-origin

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch deepme987/desktop/bridge-callback-origin

---

_{Comment @coderabbitai help to get the list of available commands.}