fix(auth): single-source Console page-URL building; fix SMS + OAuth-callback landing paths#2869
Merged
Merged
Conversation
…allback paths
Root-cause hardening after the invitation-link fixes. The correct URL of a
Console page (${origin}${uiBasePath}${path}) was hand-composed at every call
site, which is exactly how the scheme / /_console prefix kept getting dropped
one link at a time.
plugin-auth:
- Add single-source getConsolePageUrl(path); route loginPage, consentPage,
device verificationUri and the invitation accept URL through it so new page
links can't drift.
- Phone-invite SMS links to the real Console sign-in page via a new
{{loginUrl}} variable instead of the bare origin; {{baseUrl}} kept for
backward-compat with tenant-overridden templates.
client:
- signInWithProvider defaults callbackURL to window.location.href (current
page) instead of a hard-coded origin + '/login'. The SDK can't know the
app's mount path, so returning to the originating page is the only
base-path-correct default; mirrors linkSocial.
Tests: getConsolePageUrl-backed links, SMS login-page target, and the client
callbackURL default (+ explicit override). plugin-auth 406, client 109 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NT4mx1fHXtkxery6MtLTsp
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 17 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
…ent-page default Matches the SDK change: the default callbackURL is now window.location.href (base-path-correct) rather than a hard-coded origin + '/login'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NT4mx1fHXtkxery6MtLTsp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Third and final follow-up to the invitation-link fixes (#2847, #2865). Those patched one link at a time; this PR removes the root cause and closes the two remaining known cases.
Root cause
The correct URL of a Console page is always
${origin}${uiBasePath}${path}, but that composition was hand-written at every call site. That's exactly how the scheme //_consoleprefix kept getting dropped one link at a time.Changes
@objectstack/plugin-authgetConsolePageUrl(path)helper.loginPage,consentPage, deviceverificationUri, and the invitation accept URL all compose through it. Future page links can't drift (no more hand-concatenated${baseUrl}${uiBase}/...).${origin}${uiBasePath}/login) via a new{{loginUrl}}template variable, instead of the bare origin (which relied on a root redirect that may not exist).{{baseUrl}}is still provided for backward-compat with tenant-overridden templates.@objectstack/clientsignInWithProvidernow defaultscallbackURLto the current page (window.location.href) instead of a hard-codedorigin + '/login'. The SDK cannot know the app's mount path (Console lives under/_console, others differ), so returning the user to where they started is the only base-path-correct default — and it mirrors the neighbouringlinkSocial. Callers can still pass an explicitcallbackURL.Tests
getConsolePageUrl-backed links keep the/_consoleprefix + absolute origin (existing invitation/issuer tests).…/_console/login(both en + zh).signInWithProvider: defaultcallbackURL= current page; explicit override respected.@objectstack/plugin-auth406 pass;@objectstack/client109 pass.Changeset
@objectstack/plugin-auth: patch,@objectstack/client: patch.🤖 Generated with Claude Code