fix: pin parent origin in iframe-bridge to block cross-frame postMessage

components/providers/embedded-bridge-provider.tsx

@@ -12,6 +12,14 @@ export function EmbeddedBridgeProvider({ children }: { children: React.ReactNode
 
   useEffect(() => {
     if (!embeddedMode || !isEmbedded()) return;
+    // Refuse to attach the listener without a pinned parent origin —
+    // otherwise any cross-origin frame could forge sso:trigger-logout.
+    if (!parentOrigin) {
+      console.error(
+        "[embedded-bridge] embeddedMode is enabled but parentOrigin is not configured; refusing to attach message listener",
+      );
+      return;
+    }
 
     const unsubscribe = listenFromParent((msg) => {
       switch (msg.type) {
@@ -26,7 +34,7 @@ export function EmbeddedBridgeProvider({ children }: { children: React.ReactNode
           logout();
           break;
       }
-    }, parentOrigin || undefined);
+    }, parentOrigin);
 
     return unsubscribe;
   }, [embeddedMode, parentOrigin, logout]);