mirror of
https://github.com/h44z/wg-portal.git
synced 2026-08-13 11:16:19 +00:00
62e7f9d8b9
* fix: build OAuth return URL from the live location, not the Vite base On base_path deployments, OAuth/OIDC login failed with a 400 "invalid return URL" before the user ever reached the IdP. LoginView and the router derived the app's runtime URL mount from import.meta.env.BASE_URL, which is Vite's build-time *asset* base. Since #711 set `base: './'` to fix relative asset loading (#710), BASE_URL is "./", so `base_path: /wg` produced the return URL https://host/wg./#/login. isValidReturnUrl() requires <base_path>/app, so every external-auth user on a base_path deployment was locked out. Derive the return URL from window.location instead: the app is mounted at {base_path}/app/ in production and at / under `npm run dev`, so the live document location is the only reliable source. Likewise drop the explicit base from createWebHashHistory(), which then defaults to `location.pathname + location.search` -- correct in every deployment. This leaves the relative asset base from #711 untouched, so #710 stays fixed, and it removes the last two readers of import.meta.env.BASE_URL under frontend/src so the asset base can no longer affect routing. Fixes #719 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Dan Berg <dan@webinargeek.com> * fix: log rejected OAuth return URLs The isValidReturnUrl() rejection was the only failure branch in handleOauthInitiateGet without a slog call, and the 400 response body reveals neither what was received nor what was expected. That is what made #719 hard to diagnose. Log both at Debug level, matching the neighbouring branches. The response body is unchanged -- the URL is not echoed to the client. Also note on the base-path test that the URL shape it pins is produced by externalLogin() in frontend/src/views/LoginView.vue, so a future frontend change has a breadcrumb back to the contract. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Dan Berg <dan@webinargeek.com> --------- Signed-off-by: Dan Berg <dan@webinargeek.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>