stack/apps/backend
aadesh18 409ac117e9 fix(account-settings): decode URL-encoded city in active sessions (#1503)
## Summary

The **Active Sessions** table in account settings showed locations like
`San%20Francisco` instead of `San Francisco`.

Vercel percent-encodes its geolocation headers (e.g.
`x-vercel-ip-city`), so a multi-word city arrives URL-encoded. The city
name was being stored verbatim, so the raw `%20` leaked into the UI.

The fix decodes the city name where the Vercel geo header is read, so
recorded sessions store the human-readable name. This also benefits any
other consumer of the location data. It falls back to the raw value if
it isn't valid percent-encoding, so a stray `%` can't break things.

## Test plan

- [ ] Unit tests (in-source, `apps/backend/src/lib/end-users.tsx`):
simulating Vercel headers with `x-vercel-ip-city: San%20Francisco` now
yields `cityName: "San Francisco"`; an invalid-encoding value (`100%
Real City`) passes through unchanged instead of throwing. All 8 tests in
the file pass.
- [ ] In a Vercel-deployed environment, sign in and open Account
Settings → Active Sessions; confirm the Location column shows a plain
city name (e.g. `San Francisco`) with no `%20`.

> Note: this can't be reproduced on localhost because there's no Vercel
proxy supplying geo headers (the location shows `Unknown`). The behavior
is covered by the unit tests, which feed the exact headers Vercel sends.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Corrected handling of city name data from hosting-provided location
headers so multi-word city names display correctly and invalid
percent-encoding no longer causes errors.

* **Tests**
* Added tests to verify URL-decoded city names from location headers and
to ensure malformed encodings are safely preserved.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/hexclave/stack-auth/pull/1503?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-02 15:22:13 -05:00
..
prisma feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-06-02 15:22:13 -05:00
scripts feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-06-02 15:22:13 -05:00
src fix(account-settings): decode URL-encoded city in active sessions (#1503) 2026-06-02 15:22:13 -05:00
.env feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-06-02 15:22:13 -05:00
.env.development feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-06-02 15:22:13 -05:00
.eslintrc.cjs tsup for stack-shared (#647) 2025-04-28 21:26:52 -07:00
.gitignore private files n sm build shit (#1276) 2026-03-23 12:31:36 -07:00
instrumentation-client.ts Upgrade backend to Next.js 16 2025-12-12 16:59:07 -08:00
LICENSE Split backend and dashboard (#83) 2024-06-18 15:49:31 +02:00
next.config.mjs private files n sm build shit (#1276) 2026-03-23 12:31:36 -07:00
package.json feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-06-02 15:22:13 -05:00
prisma.config.ts [Fix]: Assortment of Bugs with Timefold Table and Payments (#1348) 2026-04-18 14:17:24 -07:00
tsconfig.json Fix lint 2026-02-27 09:59:26 -08:00
vercel.json External db sync (#1036) 2026-02-05 12:04:31 -08:00
vitest.config.ts Fix flaky tests and preexisting CI failures (#1443) 2026-05-20 10:00:11 -07:00
vitest.setup.ts Customizable ports (#962) 2025-10-20 15:24:47 -07:00