[waleedlatif1]

Summary

• GET /api/auth/instagram/authorize?workspaceId=… creates a connection draft from the query alone, the same pattern fix(oauth): reject cross-site workspace OAuth launches #9772 closed on /api/auth/oauth2/authorize, but this sibling route had no cross-site check
• Refuse the no-draft workspace launch when Sec-Fetch-Site is cross-site, using the same isCrossSiteSessionRequest helper; the draftId path is unchanged
• In-app Instagram chips open the URL from the app (same-origin) and desktop uses draftId, so neither changes behavior

Type of Change

• Bug fix

Testing

• New route test refusing a cross-site launch, red on the pre-fix route and green after
• instagram/authorize and oauth2/authorize route tests (48 passing), test:scripts, biome
• Test calls now pass a route context, so the file's check:test-types baseline entry is removed

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 7, 2026 9:38pm UTC

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the new check blocks the targeted launch without changing draft-backed flows.

Summary

Blocks cross-site Instagram workspace launches before they create a connection draft.

• Instagram workspace launches now reject cross-site requests before making a draft.

_{Reviews (1) · Last reviewed commit: "fix(oauth): reject cross-site Instagram ..." · Reviewed by Greptile}