Blaž Dular 7b0f98b1d6 fix(wise): redirect after token submission instead of rendering inline (#2730) ...

* fix(wise): redirect after token submission instead of rendering inline

The success path in create rendered select_profiles directly (200 OK),
which Turbo rejects for standard form submissions ('Form responses must
redirect to another location'). Now it redirects, carrying the encrypted
token through the session. Session-expired fallbacks now point at
settings_providers_path instead of new_wise_item_path, which has no view.

* test(wise): update controller specs for redirect-based create flow

* fix(wise): read pending token from session, not client params

link_profiles decrypted params[:encrypted_pending_token], even though create
already stores the encrypted token server-side in the session. The client
round-trip was unnecessary and untrusted; now link_profiles reads directly
from session[:wise_pending_encrypted_token].

2026-07-21 01:28:53 +02:00

3.8 KiB

Raw Blame History

View Raw