mirror of
https://github.com/hanzoai/id.git
synced 2026-10-26 20:59:52 +00:00
zeekay
27fbc58e38
The provider hop sent redirect_uri=${origin}/callback (= hanzo.id/callback),
which the shared Google/GitHub OAuth client does NOT accept — verified live the
Google client accepts ONLY https://iam.hanzo.ai/callback (every other URI →
redirect_uri_mismatch). It also used the invalid authorize endpoint
accounts.google.com/signin/oauth.
- social.ts: Google endpoint → https://accounts.google.com/o/oauth2/v2/auth
(canonical/stable); add callbackOrigin param to buildProviderAuthUrl/
startProviderLogin (defaults to origin — local/single-host unchanged).
- TenantConfig.oauthCallbackOrigin (catalog-driven; defaults to publicOrigin);
SocialButtons passes it so the hop returns to the provider's REGISTERED
/callback. iam.hanzo.ai serves the same @hanzo/id SPA: the headless Callback
completes the exchange and forwards to the originating app.
- tests: lock the registered-callback override + canonical Google endpoint.
bump id 0.1.1→0.1.22, id-auth/id-shared 0.1.0→0.1.1
25 lines
625 B
JSON
25 lines
625 B
JSON
{
|
|
"name": "@hanzo/id-shared",
|
|
"version": "0.1.1",
|
|
"description": "Shared types + tenant resolver for the Hanzo ID portal. No UI deps.",
|
|
"license": "BSD-3-Clause",
|
|
"type": "module",
|
|
"main": "./src/index.ts",
|
|
"types": "./src/index.ts",
|
|
"exports": {
|
|
".": "./src/index.ts",
|
|
"./tenant": "./src/tenant.ts",
|
|
"./brand": "./src/brand.ts",
|
|
"./package.json": "./package.json"
|
|
},
|
|
"files": ["src"],
|
|
"scripts": {
|
|
"tc": "tsc --noEmit",
|
|
"build": "tsc --noEmit",
|
|
"test": "node --test --experimental-strip-types 'src/**/*.test.ts'"
|
|
},
|
|
"devDependencies": {
|
|
"typescript": "^5.9.3"
|
|
}
|
|
}
|