Merge pull request #895 from objectstack-ai/copilot/fix-auth-endpoint-paths

Author: hotlong

ROADMAP.md

@@ -331,6 +331,7 @@ business/custom objects, aligning with industry best practices (e.g., ServiceNow
 - v3.x: The `@objectstack/plugin-auth` ObjectQL adapter now includes `AUTH_MODEL_TO_PROTOCOL` mapping to translate better-auth's hardcoded model names (`user`, `session`, `account`, `verification`) to protocol names (`sys_user`, `sys_session`, `sys_account`, `sys_verification`). Custom adapters must adopt the same mapping.
 - v3.x: **Bug fix** — `AuthManager.createDatabaseConfig()` now wraps the ObjectQL adapter as a `DBAdapterInstance` factory function (`(options) => DBAdapter`). Previously the raw adapter object was passed, which fell through to the Kysely adapter path and failed silently. `AuthManager.handleRequest()` and `AuthPlugin.registerAuthRoutes()` now inspect `response.status >= 500` and log the error body, since better-auth catches internal errors and returns 500 Responses without throwing.
 - v3.x: **Bug fix** — `AuthPlugin` now defers HTTP route registration to a `kernel:ready` hook instead of doing it synchronously in `start()`. This makes the plugin resilient to plugin loading order — the `http-server` service is guaranteed to be available after all plugins complete their init/start phases. The CLI `serve` command also registers `HonoServerPlugin` before config plugins (with duplicate detection) for the same reason.
+- v3.x: **Bug fix** — Studio `useApiDiscovery` hook no longer hardcodes auth endpoints as `/api/auth/...`. The `discover()` callback now fetches `/api/v1/discovery` and reads `routes.auth` to dynamically construct auth endpoint paths (falling back to `/api/v1/auth`). The session endpoint is corrected from `/session` to `/get-session` to align with better-auth's `AuthEndpointPaths.getSession`.
 - v4.0: Legacy un-prefixed aliases will be fully removed.
 
 ---

apps/studio/src/hooks/use-api-discovery.ts

@@ -33,12 +33,15 @@ const SYSTEM_ENDPOINTS: EndpointDef[] = [
   { method: 'GET', path: '/api/v1/health', desc: 'Health check', group: 'System' },
 ];
 
-const AUTH_ENDPOINTS: EndpointDef[] = [
-  { method: 'POST', path: '/api/auth/sign-in/email', desc: 'Sign in (email)', group: 'Auth', bodyTemplate: { email: 'user@example.com', password: '' } },
-  { method: 'POST', path: '/api/auth/sign-up/email', desc: 'Sign up (email)', group: 'Auth', bodyTemplate: { email: '', password: '', name: '' } },
-  { method: 'POST', path: '/api/auth/sign-out', desc: 'Sign out', group: 'Auth' },
-  { method: 'GET', path: '/api/auth/session', desc: 'Get session', group: 'Auth' },
-];
+/** Build auth endpoints from the discovered auth base path. */
+function buildAuthEndpoints(authBase: string): EndpointDef[] {
+  return [
+    { method: 'POST', path: `${authBase}/sign-in/email`, desc: 'Sign in (email)', group: 'Auth', bodyTemplate: { email: 'user@example.com', password: '' } },
+    { method: 'POST', path: `${authBase}/sign-up/email`, desc: 'Sign up (email)', group: 'Auth', bodyTemplate: { email: '', password: '', name: '' } },
+    { method: 'POST', path: `${authBase}/sign-out`, desc: 'Sign out', group: 'Auth' },
+    { method: 'GET', path: `${authBase}/get-session`, desc: 'Get session', group: 'Auth' },
+  ];
+}
 
 // ─── Hook ───────────────────────────────────────────────────────────
 
@@ -54,7 +57,20 @@ export function useApiDiscovery() {
     setError(null);
 
     try {
-      // 1. Fetch metadata types
+      // 1. Resolve auth base path from discovery
+      let authBase = '/api/v1/auth';
+      try {
+        const discRes = await fetch('/api/v1/discovery');
+        if (discRes.ok) {
+          const discData = await discRes.json();
+          const routes = discData?.data?.routes ?? discData?.routes;
+          if (routes?.auth) authBase = routes.auth;
+        }
+      } catch {
+        // Keep default /api/v1/auth
+      }
+
+      // 2. Fetch metadata types
       let metaTypes: string[] = [];
       try {
         const typesResult = await client.meta.getTypes();
@@ -67,7 +83,7 @@ export function useApiDiscovery() {
         // Meta types may not be available
       }
 
-      // 2. Fetch object names from metadata
+      // 3. Fetch object names from metadata
       let objectNames: string[] = [];
       try {
         const objectType = metaTypes.includes('objects') ? 'objects' : metaTypes.includes('object') ? 'object' : null;
@@ -83,7 +99,7 @@ export function useApiDiscovery() {
         // Objects may not be available
       }
 
-      // 3. Build dynamic data endpoints for each object
+      // 4. Build dynamic data endpoints for each object
       const dataEndpoints: EndpointDef[] = objectNames.flatMap(name => [
         { method: 'GET' as HttpMethod, path: `/api/v1/data/${name}`, desc: `List ${name}`, group: `Data: ${name}` },
         { method: 'POST' as HttpMethod, path: `/api/v1/data/${name}`, desc: `Create ${name}`, group: `Data: ${name}`, bodyTemplate: { name: 'example' } },
@@ -92,7 +108,7 @@ export function useApiDiscovery() {
         { method: 'DELETE' as HttpMethod, path: `/api/v1/data/${name}/:id`, desc: `Delete ${name}`, group: `Data: ${name}` },
       ]);
 
-      // 4. Build metadata endpoints for each type
+      // 5. Build metadata endpoints for each type
       const metaEndpoints: EndpointDef[] = metaTypes
         .filter(t => !EXCLUDED_META_TYPES.includes(t))
         .map(type => ({
@@ -102,24 +118,24 @@ export function useApiDiscovery() {
           group: 'Metadata',
         }));
 
-      // 5. Build per-object schema endpoints
+      // 6. Build per-object schema endpoints
       const schemaEndpoints: EndpointDef[] = objectNames.map(name => ({
         method: 'GET' as HttpMethod,
         path: `/api/v1/meta/object/${name}`,
         desc: `${name} schema`,
         group: 'Metadata',
       }));
 
-      // 6. Combine all endpoints
+      // 7. Combine all endpoints
       const all = [
         ...SYSTEM_ENDPOINTS,
-        ...AUTH_ENDPOINTS,
+        ...buildAuthEndpoints(authBase),
         ...metaEndpoints,
         ...schemaEndpoints,
         ...dataEndpoints,
       ];
 
-      // 7. Group endpoints
+      // 8. Group endpoints
       const groupMap = new Map<string, EndpointDef[]>();
       for (const ep of all) {
         const existing = groupMap.get(ep.group) || [];