fix(broker): allow cloudfunctions.net in csp and harden broker diagnostics

[spandreou]

Summary

Resolves the root cause of [BROKER_CREATE_INTERNAL] occurring during post-login redirect on Production (https://shiftoryx.gr/login).

Root Cause

1. vercel.json defined a strict Content Security Policy (connect-src) that omitted https://*.cloudfunctions.net and https://*.run.app. When the client browser invoked createTenantAuthTicketRedirect via httpsCallable, the browser intercepted and blocked the network request with a CSP violation (Failed to fetch).
2. Firebase Functions JS SDK mapped the blocked fetch (HTTP status 0) into FunctionsError('internal', 'internal').
3. classifyBrokerError collapsed unrecognized error codes into generic BROKER_CREATE_INTERNAL, ignoring server details, existing error categories, and client redirect errors.
4. Login UI had no direct recovery link to /stores when central session succeeded but broker transfer failed.

Key Changes

• vercel.json: Added https://*.cloudfunctions.net and https://*.run.app to CSP connect-src.
• scripts/validate-security-hardening.mjs: Updated CSP validation assertion.
• src/firebase/authBrokerService.js: Hardened classifyBrokerError to preserve existing categories, inspect err?.details?.reason, distinguish fetch/CSP blocks, and handle custom redirect errors.
• src/components/auth/LoginPage.jsx: Added direct recovery button to /stores.

Verification

• npm run qa:auth-broker PASS
• npm run qa:auth-broker-negative PASS (16 tests)
• npm run qa:multi-tenant PASS (7 tests)
• npm run security:hardening PASS
• npm run qa:vercel-spa-routing PASS
• npm run build PASS (2.62s)

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
shiftoryx	Ready	Preview	Sep 5, 2026 3:09pm UTC