Fix: form-action CSP blocked atproto login form submission (v0.4.2)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startup-api/cloudflare",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

src/auth/AtprotoProvider.ts

@@ -304,10 +304,12 @@ export class AtprotoProvider extends OAuthProvider {
       status,
       headers: {
         'Content-Type': 'text/html; charset=utf-8',
-        // Same hardening as the auth error page: only same-origin styles/form, never framed, never cached
-        // (the re-rendered form reflects the user-supplied handle).
-        'Content-Security-Policy':
-          "default-src 'none'; style-src 'self' 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+        // Hardening: same-origin styles only, never framed, never cached (the form reflects the
+        // user-supplied handle). NOTE: deliberately NO `form-action` directive — submitting this form
+        // hits our endpoint, which 302-redirects to the user's *own* authorization server (any PDS).
+        // `form-action` is enforced across the whole redirect chain, so `'self'` (or any fixed list)
+        // would block that cross-origin redirect and the login would silently fail.
+        'Content-Security-Policy': "default-src 'none'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'",
         'X-Content-Type-Options': 'nosniff',
         'Referrer-Policy': 'no-referrer',
         'Cache-Control': 'no-store',

test/atproto.spec.ts

@@ -101,6 +101,9 @@ describe('atproto provider', () => {
     // Auth page hardening: not framable, not cached (it can reflect the user's handle).
     expect(res.headers.get('Content-Security-Policy')).toContain("frame-ancestors 'none'");
     expect(res.headers.get('Cache-Control')).toBe('no-store');
+    // Must NOT set form-action: submitting this form 302-redirects to the user's own auth server
+    // (any PDS), and form-action is enforced across the redirect chain — restricting it breaks login.
+    expect(res.headers.get('Content-Security-Policy')).not.toContain('form-action');
     const html = await res.text();
     expect(html).toContain('name="handle"');
   });