fix(web): auth callback redirects to public origin + failure-reason surfacing (#212)

Behind nginx + Cloudflare Tunnel, request.url resolves to http://0.0.0.0:3000,
so every redirect out of /auth/callback (success AND failure) sent users to a
dead address. Google OAuth (enabled in Supabase 2026-07-11) surfaced it:
sign-in ended at 0.0.0.0:3000/login?error=auth_callback_failed.

- redirect via NEXT_PUBLIC_APP_URL (deploy-time config), request origin only
  as local-dev fallback; open-redirect guard on ?next=
- forward the exchange failure reason (?reason=<code>) and render it on the
  login page so the next field failure self-diagnoses from the URL bar
- surface Supabase error params (error_code/error_description) when the
  provider flow lands here without a code
- tolerate duplicate callback hits: if the code is already consumed but a
  session exists, proceed as success instead of erroring an authed user
- nginx: also forward X-Forwarded-Host

Author: stevenfackley

docker/nginx.prod.conf

@@ -18,6 +18,7 @@ http {
 
     proxy_http_version 1.1;
     proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;

src/StackAlchemist.Web/__tests__/auth/login-callback-error.test.tsx

@@ -1,9 +1,11 @@
 import { describe, it, expect, vi } from "vitest";
 import { render, screen, fireEvent } from "@testing-library/react";
 
-// Stub useSearchParams to inject ?error=auth_callback_failed
+// Stub useSearchParams to inject ?error=auth_callback_failed (mutable so
+// individual tests can add ?reason=)
+const mockParams = vi.hoisted(() => ({ value: "error=auth_callback_failed" }));
 vi.mock("next/navigation", () => ({
-  useSearchParams: () => new URLSearchParams("error=auth_callback_failed"),
+  useSearchParams: () => new URLSearchParams(mockParams.value),
   useRouter: () => ({ push: vi.fn() }),
 }));
 
@@ -21,6 +23,13 @@ describe("Login — ?error=auth_callback_failed", () => {
     expect(screen.getByText(/sign-in link expired or invalid/i)).toBeInTheDocument();
   });
 
+  it("shows the failure reason when /auth/callback forwards one", () => {
+    mockParams.value = "error=auth_callback_failed&reason=flow_state_not_found";
+    render(<LoginPage />);
+    expect(screen.getByText(/flow_state_not_found/)).toBeInTheDocument();
+    mockParams.value = "error=auth_callback_failed";
+  });
+
   it("clicking 'send a new magic link' switches to magic mode", () => {
     render(<LoginPage />);
     fireEvent.click(screen.getByRole("button", { name: /send a new magic link/i }));

src/StackAlchemist.Web/src/app/auth/callback/route.ts

@@ -8,46 +8,81 @@ import { NextResponse, type NextRequest } from "next/server";
  * Handles the PKCE code-exchange step for:
  *  - Magic-link sign-ins  (Supabase sends ?code=... after OTP verification)
  *  - Email confirmations  (new accounts click the confirmation email)
- *  - OAuth providers      (future: GitHub, Google)
+ *  - OAuth providers      (Google enabled 2026-07-11; Apple)
  *
  * The `emailRedirectTo` option in signInWithOtp() and signUp() must point here,
  * e.g. `${origin}/auth/callback?next=/dashboard`.
  */
 export async function GET(request: NextRequest) {
   const { searchParams, origin } = new URL(request.url);
   const code = searchParams.get("code");
-  const next = searchParams.get("next") ?? "/";
-
-  if (code) {
-    const cookieStore = await cookies();
-
-    const supabase = createServerClient(
-      process.env.NEXT_PUBLIC_SUPABASE_URL!,
-      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
-      {
-        cookies: {
-          getAll() {
-            return cookieStore.getAll();
-          },
-          setAll(cookiesToSet: { name: string; value: string; options: CookieOptions }[]) {
-            cookiesToSet.forEach(({ name, value, options }) =>
-              cookieStore.set(name, value, options)
-            );
-          },
-        },
-      }
+
+  // Behind nginx + Cloudflare Tunnel the request's own origin resolves to the
+  // container bind address (http://0.0.0.0:3000) — never a valid browser
+  // destination. The public origin is deploy-time config; the request origin
+  // is only a fallback for local dev, where the two match.
+  const publicOrigin =
+    process.env.NEXT_PUBLIC_APP_URL?.replace(/\/+$/, "") || origin;
+
+  // Open-redirect guard: `next` must be an app-internal absolute path.
+  const rawNext = searchParams.get("next") ?? "/";
+  const next =
+    rawNext.startsWith("/") && !rawNext.startsWith("//") ? rawNext : "/";
+
+  const fail = (reason: string) =>
+    NextResponse.redirect(
+      `${publicOrigin}/login?error=auth_callback_failed&reason=${encodeURIComponent(reason)}`
     );
 
-    const { error } = await supabase.auth.exchangeCodeForSession(code);
+  if (!code) {
+    // Supabase redirects here with error params instead of a code when the
+    // provider flow itself failed (e.g. ?error=access_denied&error_code=
+    // otp_expired). Surface the most specific one instead of a generic hint.
+    const reason =
+      searchParams.get("error_code") ??
+      searchParams.get("error_description") ??
+      searchParams.get("error") ??
+      "missing_code";
+    return fail(reason);
+  }
+
+  const cookieStore = await cookies();
 
-    if (!error) {
-      // Successful exchange — redirect to the intended destination.
-      return NextResponse.redirect(`${origin}${next}`);
+  const supabase = createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        getAll() {
+          return cookieStore.getAll();
+        },
+        setAll(cookiesToSet: { name: string; value: string; options: CookieOptions }[]) {
+          cookiesToSet.forEach(({ name, value, options }) =>
+            cookieStore.set(name, value, options)
+          );
+        },
+      },
     }
+  );
+
+  const { error } = await supabase.auth.exchangeCodeForSession(code);
+
+  if (!error) {
+    // Successful exchange — redirect to the intended destination.
+    return NextResponse.redirect(`${publicOrigin}${next}`);
+  }
 
-    console.error("[auth/callback] Code exchange failed:", error.message);
+  // A duplicate hit on this route (browser preload, back/forward retry)
+  // consumes the one-time code on the first pass and fails the second with
+  // "invalid flow state". If a session already exists the sign-in actually
+  // succeeded — proceed instead of bouncing an authed user to an error.
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
+  if (user) {
+    return NextResponse.redirect(`${publicOrigin}${next}`);
   }
 
-  // No code param or exchange failure — send back to login with an error hint.
-  return NextResponse.redirect(`${origin}/login?error=auth_callback_failed`);
+  console.error("[auth/callback] Code exchange failed:", error.message);
+  return fail(error.code ?? error.message);
 }

src/StackAlchemist.Web/src/app/login/LoginPageClient.tsx

@@ -16,6 +16,7 @@ function LoginPageContent() {
   const searchParams = useSearchParams();
   const returnTo = searchParams?.get("returnTo") ?? "/";
   const callbackError = searchParams?.get("error") === "auth_callback_failed";
+  const callbackReason = searchParams?.get("reason");
 
   const emailRef = useRef<HTMLInputElement>(null);
   const [email, setEmail] = useState("");
@@ -82,7 +83,11 @@ function LoginPageContent() {
           {/* Callback error — shown when /auth/callback redirects here with ?error= */}
           {callbackError && (
             <Alert variant="error" data-testid="login-callback-error">
-              Sign-in link expired or invalid.{" "}
+              Sign-in link expired or invalid
+              {callbackReason ? (
+                <span className="font-mono text-xs"> ({callbackReason})</span>
+              ) : null}
+              .{" "}
               <button
                 type="button"
                 className="underline underline-offset-2 hover:no-underline"