Skip to content

Conversation

@bokelley
Copy link
Contributor

@bokelley bokelley commented Jan 3, 2026

Summary

  • Enhanced the admin domain health page to show which organizations users already belong to when viewing "unlinked corporate domains"
  • Instead of only offering "Create Prospect" for domains like magnite.com, admins now see existing orgs and can link the domain or merge duplicates
  • Fixed XSS vulnerabilities by using data attributes instead of inline onclick handlers

Changes

  • Backend: Enhanced orphan domains API query to include existing_orgs showing which organizations users belong to
  • Frontend: Updated "Unlinked Corporate Domains" section to show "Existing Organizations" column with links to orgs
  • Actions: Added "Link to org" dropdown when multiple orgs exist, plus "Merge orgs" button with full merge modal
  • Security: Replaced inline onclick handlers with data attributes and event listeners to prevent XSS
  • Validation: Added domain format validation for link_domain query parameter
  • UX: Added button disabling during merge operations to prevent race conditions

Test plan

  • Create test organizations with users from same corporate domain
  • Verify domain health page shows existing orgs instead of just "Create Prospect"
  • Test "Link to org" dropdown navigates to org detail with domain pre-filled
  • Test merge modal shows both orgs with selection and preview
  • Verify merge execution moves membership records correctly

🤖 Generated with Claude Code

bokelley and others added 2 commits January 3, 2026 17:21
…spects

When viewing unlinked corporate domains, admins can now see which
organizations users already belong to, with options to:
- Link the domain to an existing organization
- Merge duplicate organizations for the same domain

Changes:
- Enhanced orphan domains API query to include existing_orgs data
- Updated UI to show "Existing Organizations" column with links
- Added "Link to org" dropdown when multiple orgs exist
- Added merge modal with org selection and preview
- Fixed XSS vulnerabilities by using data attributes instead of inline onclick
- Added domain validation for link_domain query parameter
- Added button disabling to prevent race conditions during merge

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Keep both the Escape key handler from main and the link_domain
query parameter handler from this branch.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>
@bokelley bokelley merged commit 958545e into main Jan 3, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants