From 59362737cf599b12950b94f14f84bef92164d5d5 Mon Sep 17 00:00:00 2001 From: Bryan Brooks Date: Sun, 22 Feb 2026 12:45:37 -0600 Subject: [PATCH] fix: register OIDC/forward-auth redirect URIs in NodeOAuthClient The NodeOAuthClient validates that redirect_uri is in its registered redirect_uris before sending to the PDS. The /client-metadata.json endpoint correctly listed OIDC and forward-auth callback URIs, but the internal NodeOAuthClient instance only had the primary auth callback and proxy callback registered. This caused "TypeError: Invalid redirect_uri" when the OIDC authorize flow called generateAuthUrl with the OIDC callback URI, resulting in 500 errors for all OIDC-dependent apps (mdeditor, mydrawings). Fix: Pass additional redirect URIs (OIDC callback, forward-auth proxy callback) to OAuthService.initialize() so they're registered in the NodeOAuthClient's clientMetadata.redirect_uris array. Co-Authored-By: Claude Opus 4.6 --- gateway/src/index.ts | 11 ++++++++++- gateway/src/services/oauth.ts | 14 ++++++++++++-- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/gateway/src/index.ts b/gateway/src/index.ts index 2c29aea..02612a2 100644 --- a/gateway/src/index.ts +++ b/gateway/src/index.ts @@ -112,8 +112,17 @@ async function main(): Promise { const db = new DatabaseService(config.dbPath); const oauth = new OAuthService(db, config.clientId, config.redirectUri); + // Collect additional redirect URIs needed by OIDC and forward-auth + const additionalRedirectUris: string[] = []; + if (config.oidc.enabled && config.oidc.issuer) { + additionalRedirectUris.push(`${config.oidc.issuer}/oauth/callback`); + } + if (config.forwardAuth.enabled && config.oidc.issuer) { + additionalRedirectUris.push(`${config.oidc.issuer}/auth/proxy/callback`); + } + try { - await oauth.initialize(); + await oauth.initialize(additionalRedirectUris); console.log('OAuth client initialized'); } catch (error) { console.error('Failed to initialize OAuth client:', error); diff --git a/gateway/src/services/oauth.ts b/gateway/src/services/oauth.ts index 3734213..c45b141 100644 --- a/gateway/src/services/oauth.ts +++ b/gateway/src/services/oauth.ts @@ -34,17 +34,27 @@ export class OAuthService { this.redirectUri = redirectUri; } - async initialize(): Promise { + async initialize(additionalRedirectUris?: string[]): Promise { // Derive proxy callback from the primary redirect URI's base const baseUrl = this.redirectUri.replace(/\/[^/]*$/, ''); const proxyCallbackUri = `${baseUrl}/proxy/callback`; + // Collect all redirect URIs: primary, proxy, and any additional (e.g. OIDC callback) + const redirectUris: [string, ...string[]] = [this.redirectUri, proxyCallbackUri]; + if (additionalRedirectUris) { + for (const uri of additionalRedirectUris) { + if (!redirectUris.includes(uri)) { + redirectUris.push(uri); + } + } + } + this.client = new NodeOAuthClient({ clientMetadata: { client_id: this.clientId, client_name: 'ATAuth Gateway', client_uri: this.clientId, - redirect_uris: [this.redirectUri, proxyCallbackUri], + redirect_uris: redirectUris, grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], scope: 'atproto transition:generic', -- knotmirror 0.0.1