trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix OAuth callback returnTo after settings split

Browse source 
The connect loader was setting state to a raw user.id, but the callback
parses state as base64-JSON via decodeOAuthState and falls back to {}
when the parse fails. That sent users back to /settings, which now
redirects to /settings/profile, hiding the freshly saved connection on
a different tab.

Encode the state as a proper PushOAuthState with returnTo set to
/settings/connections so the callback lands on the page that initiated
the flow.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Ullrich Schäfer 2026-05-01 09:20:19 +02:00
parent b0f8be2765
commit 70a1387998
No known key found for this signature in database
GPG key ID: A32FF691A0F752D9
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apps/journal/app/routes/api.sync.connect.$provider.ts
View file

@ -2,6 +2,7 @@ import { redirect, data } from "react-router";
import type { Route } from "./+types/api.sync.connect.$provider"; import type { Route } from "./+types/api.sync.connect.$provider";
import { getSessionUser } from "~/lib/auth.server"; import { getSessionUser } from "~/lib/auth.server";
import { getProvider } from "~/lib/sync/registry"; import { getProvider } from "~/lib/sync/registry";
import { encodeOAuthState } from "~/lib/sync/pushes.server";
export async function loader({ params, request }: Route.LoaderArgs) { export async function loader({ params, request }: Route.LoaderArgs) {
const user = await getSessionUser(request); const user = await getSessionUser(request);
@ -12,7 +13,7 @@ export async function loader({ params, request }: Route.LoaderArgs) {
const origin = process.env.ORIGIN ?? "http://localhost:3000"; const origin = process.env.ORIGIN ?? "http://localhost:3000";
const redirectUri = `${origin}/api/sync/callback/${params.provider}`; const redirectUri = `${origin}/api/sync/callback/${params.provider}`;
const state = user.id; // Simple state — could use a CSRF token for production const state = encodeOAuthState({ returnTo: "/settings/connections" });
return redirect(provider.getAuthUrl(redirectUri, state)); return redirect(provider.getAuthUrl(redirectUri, state));
} }