From 803c95f47eea95e734a58f8eb0f4d41d90af8302 Mon Sep 17 00:00:00 2001 From: Bryan Brooks Date: Fri, 20 Feb 2026 20:02:03 -0600 Subject: [PATCH] fix: add sentinel proxy-auth app for forward-auth OAuth flows The oauth_states table has a FK constraint on apps(id). The forward-auth proxy uses app_id 'proxy-auth' which didn't exist, causing SQLITE_CONSTRAINT_FOREIGNKEY errors on login. --- gateway/src/services/database.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gateway/src/services/database.ts b/gateway/src/services/database.ts index 6685dcb..946c8e6 100644 --- a/gateway/src/services/database.ts +++ b/gateway/src/services/database.ts @@ -292,6 +292,15 @@ export class DatabaseService { expires_at INTEGER NOT NULL ); `); + + // Ensure sentinel proxy-auth app exists for forward-auth OAuth flows + const proxyApp = this.db.prepare('SELECT 1 FROM apps WHERE id = ?').get('proxy-auth'); + if (!proxyApp) { + this.db.prepare( + `INSERT INTO apps (id, name, hmac_secret, callback_url, client_type) + VALUES (?, ?, ?, ?, ?)` + ).run('proxy-auth', 'Forward-Auth Proxy', 'internal-not-used', '', 'internal'); + } } // App configuration methods -- knotmirror 0.0.1