fix(auth): cloud login SPA follows the oauth2/authorize redirect (env→cloud SSO)#2008
Merged
Conversation
The cloud login SPA (LoginPage/RegisterPage) replayed the OIDC authorize
request with `window.location.assign('/oauth2/authorize'+search)`.
@better-auth/oauth-provider answers a same-origin *fetch* with
`200 { redirect: true, url }` and only emits a 302 for a top-level
navigation, so an environment federating login via "Continue with
ObjectStack" received 200-JSON the SPA never followed — the infinite
"Signing you in…" spinner.
Fetch /oauth2/authorize and navigate to the returned `url` (new
followAuthorize helper, mirroring OAuthConsentPage), guarded by a ref so
the post-login effect can't double-fire; fall back to a top-level
navigation when the response isn't the expected JSON shape.
Verified end-to-end locally (curl + browser): the SPA now carries the
browser through the cloud OP to the env callback, which JIT-provisions
the env user and mints the env session (lands on /_console/home).
Requires framework#2333 (sys_verification.value unique:false) for the
authorize endpoint to stop 503-ing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
"Continue with ObjectStack" (env → cloud OIDC SSO, ADR-0024 D3) never completes — the cloud login lands on
/_console/login?<oidc params>and shows "Signing you in…" forever.Root cause: the post-login hand-off used a full-page navigation:
@better-auth/oauth-provider'sauthorize.mjs → handleRedirectanswers a browser-fetch-shaped request with200 { redirect: true, url }and only emits a real302for a top-level navigation. So the SPA's request comes back as a 200-JSON body that nothing follows → the spinner loops. (Manually copying thaturlout of the loop replays a stale single-use code → the misleading "redirects back to authorize".)Fix
Fetch the authorize endpoint and navigate to the
urlit returns — the same patternOAuthConsentPagealready uses:apps/console/src/pages/auth/followAuthorize.ts—fetch('/oauth2/authorize'+search)thenwindow.location.href = data.url(url/redirect_uri/redirectURI); falls back to a top-level navigation if the response isn't the expected JSON.LoginPage.tsx+RegisterPage.tsxcall it behind a once-guard ref (the post-login effect re-runs as org state settles).Verification (local, full stack)
/sign-in/oauth2→ cloud authorize (fetch-shape →200 {redirect,url}; top-level →302) → env/oauth2/callback/objectstack-cloudexchanges the code, JIT-provisions the envsys_user+sys_account(provider_id='objectstack-cloud'), mints the env session.localhost:4200/_console/login?<oidc>to the env callback host; the full flow lands authenticated on the env/_console/home(env DB shows asys_sessionwith a real browser UA).The env-runtime callback itself is not broken — no env-side change was needed.
Companion
Requires framework#2333 (
sys_verification.valueunique:true→false) so the cloud authorize endpoint stops returning503 UNIQUE constraint failed: sys_verification.value.🤖 Generated with Claude Code