Cross-repo request from MendysRobotics (consumer of the wrapped Security API). Relates to #238 / #254.
Context
MendysRobotics #217 (mendys-datasets marketplace, chart 1.9.0) delegates sign-in entirely to FuzeFront's brokered social sign-in — there is no marketplace sign-in form. The flow is:
- SPA (no token) → full-page redirect to
GET /api/v1/security/social/{provider}/start?redirectTo=<path>
- broker → Google →
social/callback
- callback 302s back to
${appBaseUrl}${redirectTo}?code=<opaque>
- SPA calls
POST /api/v1/security/session/exchange {code} → SessionResult{token}
The ask
For step 3 to return the one-time code to the mendys origins (not a fixed app.fuzefront.com), the broker's appBaseUrl must resolve to — or the return-origin allowlist must include — both:
https://marketplace.mendysrobotics.comhttps://live.mendysrobotics.com
Per-request resolution of appBaseUrl (from the request origin / an allowlisted returnTo host), or an explicit allowlist entry for these two hosts, either works.
Why it matters / ordering
This is the gating dependency for interim Google sign-in on the mendys marketplace. Both mendys SPAs already proxy /api/v1/security/* same-origin to fuzefront-security:3002, so once these origins are allowlisted the brokered round-trip completes. Password sign-in is expected to arrive with the hosted themed page (#238); this request is only about the social-broker return origin.
Refs: MendysRobotics #217, #216/#215; FuzeFront #238/#254.
Cross-repo request from MendysRobotics (consumer of the wrapped Security API). Relates to #238 / #254.
Context
MendysRobotics #217 (
mendys-datasetsmarketplace, chart1.9.0) delegates sign-in entirely to FuzeFront's brokered social sign-in — there is no marketplace sign-in form. The flow is:GET /api/v1/security/social/{provider}/start?redirectTo=<path>social/callback${appBaseUrl}${redirectTo}?code=<opaque>POST /api/v1/security/session/exchange {code}→SessionResult{token}The ask
For step 3 to return the one-time code to the mendys origins (not a fixed
app.fuzefront.com), the broker'sappBaseUrlmust resolve to — or the return-origin allowlist must include — both:https://marketplace.mendysrobotics.comhttps://live.mendysrobotics.comPer-request resolution of
appBaseUrl(from the request origin / an allowlistedreturnTohost), or an explicit allowlist entry for these two hosts, either works.Why it matters / ordering
This is the gating dependency for interim Google sign-in on the mendys marketplace. Both mendys SPAs already proxy
/api/v1/security/*same-origin tofuzefront-security:3002, so once these origins are allowlisted the brokered round-trip completes. Password sign-in is expected to arrive with the hosted themed page (#238); this request is only about the social-broker return origin.Refs: MendysRobotics #217, #216/#215; FuzeFront #238/#254.