Embedding Databricks Apps w/o SSO

// 1. Fetch a short-lived JWT from better-auth (requires session cookie).
const tokenResult = await authClient.token();
if (tokenResult.error || !tokenResult.data?.token) {
  setStatus("error");
  return;
}

// 2. POST { jwt, toolId, orgId } to the Go proxy /start-session endpoint.
//    The proxy validates the JWT via JWKS, looks up the tool + SPN in
//    the database, fetches a Databricks bearer token, and sets the session cookie.
const res = await fetch(`${proxyBaseUrl}/start-session`, {
  method: "POST",
  credentials: "include",         // send/receive cookies cross-origin
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ jwt: tokenResult.data.token, toolId, orgId }),
});

// 3. Once the cookie is set, render the iframe.
//    All subsequent requests to /app-proxy/{toolId}/ carry the cookie automatically.
if (res.ok) setStatus("ready");

CREATE TABLE proxy_sessions (
    id               TEXT        PRIMARY KEY,  -- hex(SHA-256(cookie_value))
    user_id          TEXT        NOT NULL,
    user_email       TEXT        NOT NULL,
    tool_id          TEXT        NOT NULL,
    org_id           TEXT        NOT NULL,
    app_url          TEXT        NOT NULL,     -- validated against ALLOWED_APEX_DOMAIN
    workspace_url    TEXT        NOT NULL,
    spn_client_id    TEXT        NOT NULL,
    spn_client_secret TEXT       NOT NULL,
    access_token     TEXT        NOT NULL,     -- Databricks bearer token (never in browser)
    token_expires_at TIMESTAMPTZ NOT NULL,
    expires_at       TIMESTAMPTZ NOT NULL,     -- session TTL (1 hour)
    created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Fast lookup by hash, cleanup by expiry, session list by tool+user
CREATE INDEX proxy_sessions_expires_at_idx  ON proxy_sessions (expires_at);
CREATE INDEX proxy_sessions_tool_user_idx   ON proxy_sessions (tool_id, user_id);

Pattern:
  app-{toolId}.firefly-analytics.com  →  Go proxy for that tool

Examples:
  app-code-editor.firefly-analytics.com
  app-notebook-1234.firefly-analytics.com
  app-sql-dashboard.firefly-analytics.com

DNS:
  *.firefly-analytics.com  →  A record → reverse proxy (nginx / Cloudflare / ALB)
  Reverse proxy extracts toolId from hostname, routes to Go proxy.

Name:     proxy_sid
Domain:   app-{toolId}.firefly-analytics.com   ← exact subdomain, not wildcard
SameSite: Strict                                ← or Lax if frontend is same registrable domain
Secure:   true
HttpOnly: true
MaxAge:   3600

// WebSocket requests are detected by the Upgrade header.
func isWebSocketRequest(r *http.Request) bool {
  return strings.ToLower(r.Header.Get("Connection")) == "upgrade" &&
         strings.ToLower(r.Header.Get("Upgrade")) == "websocket"
}

// In the main proxy handler — session cookie provides the auth token.
if isWebSocketRequest(r) {
  // Session already validated; accessToken retrieved from proxy_sessions.
  wsURL := strings.Replace(targetURL, "https://", "wss://", 1) + remainingPath
  handleWebSocketProxy(w, r, wsURL, accessToken)
} else {
  handleHTTPProxy(w, r, targetURL, accessToken, remainingPath)
}