@camstack/addon-auth 1.2.131 → 1.2.133

package/dist/hub-browser-origin-DohQUFPz.js

@@ -0,0 +1,16 @@
+//#region src/hub-browser-origin.ts
+async function hubBrowserOrigin(localNetwork, logger) {
+	try {
+		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
+	} catch (err) {
+		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	}
+}
+//#endregion
+Object.defineProperty(exports, "hubBrowserOrigin", {
+	enumerable: true,
+	get: function() {
+		return hubBrowserOrigin;
+	}
+});

package/dist/hub-browser-origin-LBBO5r05.mjs

@@ -0,0 +1,11 @@
+//#region src/hub-browser-origin.ts
+async function hubBrowserOrigin(localNetwork, logger) {
+	try {
+		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
+	} catch (err) {
+		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	}
+}
+//#endregion
+export { hubBrowserOrigin as t };

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_hub_browser_origin = require("../hub-browser-origin-CCWSbHYb.js");
+const require_dist = require("../dist-D5CZYR3c.js");
+const require_hub_browser_origin = require("../hub-browser-origin-DohQUFPz.js");
 //#region src/magic-link/retire-enabled-flag.ts
 /** The retired settings key. */
 var RETIRED_ENABLED_KEY = "enabled";
@@ -83,7 +84,7 @@ var DEFAULT_CONFIG = {
 	defaultRole: "viewer",
 	ttlSec: 600
 };
-var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
+var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 	enabledFlagRetired = false;
 	retirementTimer = null;
 	shuttingDown = false;
@@ -101,7 +102,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routeProvider = require_hub_browser_origin.buildAddonRouteProvider("auth-magic-link", [
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -130,15 +131,15 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 		this.attemptEnabledFlagRetirement(0);
 		return [
 			{
-				capability: require_hub_browser_origin.authProviderCapability,
+				capability: require_dist.authProviderCapability,
 				provider: authProvider
 			},
 			{
-				capability: require_hub_browser_origin.addonRoutesCapability,
+				capability: require_dist.addonRoutesCapability,
 				provider: routeProvider
 			},
 			{
-				capability: require_hub_browser_origin.loginMethodCapability,
+				capability: require_dist.loginMethodCapability,
 				provider: loginMethodProvider
 			}
 		];
@@ -149,7 +150,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 			kind: "redirect",
 			id: "auth-magic-link",
 			label: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: require_hub_browser_origin.isDisplayIconKey(this.config.icon) ? this.config.icon : DEFAULT_CONFIG.icon,
+			icon: require_dist.isDisplayIconKey(this.config.icon) ? this.config.icon : DEFAULT_CONFIG.icon,
 			startUrl: "/addon/auth-magic-link/start",
 			stage: "primary"
 		}];
@@ -184,7 +185,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 		} catch (err) {
 			outcome = {
 				kind: "deferred",
-				reason: require_hub_browser_origin.errMsg(err)
+				reason: require_dist.errMsg(err)
 			};
 		}
 		if (outcome.kind !== "deferred") {
@@ -282,7 +283,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 		try {
 			users = await this.ctx.api.userManagement.listUsers.query();
 		} catch (err) {
-			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
+			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_dist.errMsg(err) } });
 			return null;
 		}
 		const needle = email.trim().toLowerCase();
@@ -326,7 +327,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
   <input id="email" name="email" type="email" autocomplete="email" required autofocus placeholder="you@example.com">
   <button id="b" type="submit">Send login link</button>
   <div class="msg" id="m" hidden></div>
-  <p style="margin-top:1rem"><a href="/admin/login">Back to sign in</a></p>
+  <p style="margin-top:1rem"><a href="/login">Back to sign in</a></p>
 </form>
 <script>
   var f=document.getElementById('f'),b=document.getElementById('b'),m=document.getElementById('m');
@@ -371,7 +372,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 					ttlSec: this.config.ttlSec || DEFAULT_CONFIG.ttlSec
 				}));
 			} catch (err) {
-				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_hub_browser_origin.errMsg(err) } });
+				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_dist.errMsg(err) } });
 				reply.code(503);
 				reply.send({ error: "sso-bridge capability unavailable" });
 				return;
@@ -392,7 +393,7 @@ var AuthMagicLinkAddon = class extends require_hub_browser_origin.BaseAddon {
 			reply.code(500);
 			reply.send({
 				error: "Magic-link request failed",
-				message: require_hub_browser_origin.errMsg(err)
+				message: require_dist.errMsg(err)
 			});
 		}
 	}

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,5 @@
-import { a as buildAddonRouteProvider, i as authProviderCapability, l as errMsg, n as addonRoutesCapability, o as isDisplayIconKey, s as loginMethodCapability, t as hubBrowserOrigin, u as BaseAddon } from "../hub-browser-origin-BRU-HVqq.mjs";
+import { a as isDisplayIconKey, c as errMsg, i as buildAddonRouteProvider, l as BaseAddon, o as loginMethodCapability, r as authProviderCapability, t as addonRoutesCapability } from "../dist-aH7jUuvS.mjs";
+import { t as hubBrowserOrigin } from "../hub-browser-origin-LBBO5r05.mjs";
 //#region src/magic-link/retire-enabled-flag.ts
 /** The retired settings key. */
 var RETIRED_ENABLED_KEY = "enabled";
@@ -321,7 +322,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
   <input id="email" name="email" type="email" autocomplete="email" required autofocus placeholder="you@example.com">
   <button id="b" type="submit">Send login link</button>
   <div class="msg" id="m" hidden></div>
-  <p style="margin-top:1rem"><a href="/admin/login">Back to sign in</a></p>
+  <p style="margin-top:1rem"><a href="/login">Back to sign in</a></p>
 </form>
 <script>
   var f=document.getElementById('f'),b=document.getElementById('b'),m=document.getElementById('m');

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_hub_browser_origin = require("../hub-browser-origin-CCWSbHYb.js");
+const require_dist = require("../dist-D5CZYR3c.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -705,6 +705,82 @@ function createRemoteJWKSet(url, options) {
 	});
 }
 //#endregion
+//#region src/oidc/request-origin.ts
+/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
+var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
+var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+var MAX_PREFIX_LENGTH = 512;
+/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
+function firstValue(value) {
+	if (value === void 0) return null;
+	const first = value.split(",")[0]?.trim() ?? "";
+	return first.length === 0 ? null : first;
+}
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+function normalizeOrigin(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+		if (url.username !== "" || url.password !== "") return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+function requestMountPrefix(headers) {
+	const raw = headers["x-forwarded-prefix"];
+	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
+	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
+	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
+	return trimmed;
+}
+/**
+* The origins the request CLAIMS, most specific first: the proxy's
+* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+* then http when none is named (the hub terminates TLS itself on 4443).
+*/
+function claimedRequestOrigins(headers) {
+	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
+	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
+	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
+	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
+	const out = [];
+	for (const scheme of schemes) {
+		const origin = normalizeOrigin(`${scheme}://${authority}`);
+		if (origin !== null) out.push(origin);
+	}
+	return out;
+}
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+function advertisedHubOrigins(book) {
+	const candidates = [];
+	for (const row of book.rows) {
+		if (row.kind === "app-link" || row.kind === "loopback") continue;
+		candidates.push(row.baseUrl);
+	}
+	const { publicEndpoint, internal, appConnections } = book.roles;
+	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
+	if (internal.resolved !== null) candidates.push(internal.resolved);
+	candidates.push(...appConnections.resolved);
+	const out = /* @__PURE__ */ new Set();
+	for (const candidate of candidates) {
+		const origin = normalizeOrigin(candidate);
+		if (origin !== null) out.add(origin);
+	}
+	return out;
+}
+/**
+* The origin to send the browser back to: the first claimed origin that is in
+* `allowed`, or `null` (the caller then uses its default address).
+*/
+function pickRequestOrigin(headers, allowed) {
+	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
+	return null;
+}
+//#endregion
 //#region src/oidc/auth-oidc.addon.ts
 /**
 * Generic OpenID Connect (OIDC) authentication provider.
@@ -771,7 +847,20 @@ var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
 var INSTANCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
 /** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
 var MAX_PENDING_STATES = 1e3;
-var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
+/**
+* Origin + mount prefix of a pinned `redirect_uri`: the part before the
+* callback path when it ends with it, else just its origin.
+*/
+function returnBaseOf(redirectUri, callbackPath) {
+	try {
+		const url = new URL(redirectUri);
+		const prefix = url.pathname.endsWith(callbackPath) ? url.pathname.slice(0, -callbackPath.length) : "";
+		return `${url.origin}${prefix.replace(/\/+$/, "")}`;
+	} catch {
+		return "";
+	}
+}
+var AuthOidcAddon = class extends require_dist.BaseAddon {
 	/** Per-provider runtime state, keyed by `provider.id`. */
 	instances = /* @__PURE__ */ new Map();
 	/** Pending OAuth states across ALL providers. The pending entry
@@ -797,7 +886,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routeProvider = require_hub_browser_origin.buildAddonRouteProvider("auth-oidc", [{
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -814,15 +903,15 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
 		return [
 			{
-				capability: require_hub_browser_origin.authProviderCapability,
+				capability: require_dist.authProviderCapability,
 				provider: authProvider
 			},
 			{
-				capability: require_hub_browser_origin.addonRoutesCapability,
+				capability: require_dist.addonRoutesCapability,
 				provider: routeProvider
 			},
 			{
-				capability: require_hub_browser_origin.loginMethodCapability,
+				capability: require_dist.loginMethodCapability,
 				provider: loginMethodProvider
 			}
 		];
@@ -840,7 +929,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				kind: "redirect",
 				id: `auth-oidc/${id}`,
 				label: inst.config.displayName || DEFAULT_PROVIDER.displayName,
-				icon: require_hub_browser_origin.isDisplayIconKey(inst.config.icon) ? inst.config.icon : DEFAULT_PROVIDER.icon,
+				icon: require_dist.isDisplayIconKey(inst.config.icon) ? inst.config.icon : DEFAULT_PROVIDER.icon,
 				startUrl: `/addon/auth-oidc/${id}/start`,
 				stage: "primary",
 				linkable: true
@@ -905,7 +994,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 						type: "text",
 						key: "redirectUri",
 						label: "Redirect URI override",
-						description: "Optional. Default uses the hub address from Network (public tunnel, then mesh, then LAN) + the instance id.",
+						description: "Optional — leave empty. Empty: a sign-in returns to the hub address it was started from (LAN, mesh or public, as listed on the Network page), so register one callback per address you sign in from at the IdP. Set: it PINS that one callback — every sign-in returns to its address, wherever it started.",
 						default: ""
 					},
 					{
@@ -983,21 +1072,60 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 		}
 		return doc;
 	}
-	async buildRedirectUri(providerId) {
+	/** The hub's Network-page address book, or `null` when `local-network` is unreachable. */
+	async addressBook() {
+		try {
+			return await this.ctx.api.localNetwork.getAddresses.query({ scheme: "https" });
+		} catch (err) {
+			this.ctx.logger.warn("OIDC: hub addresses unavailable from local-network", { meta: { error: require_dist.errMsg(err) } });
+			return null;
+		}
+	}
+	/**
+	* The `redirect_uri` of one sign-in, and the base the browser returns to
+	* after the callback (D791). Precedence:
+	*
+	*  1. The instance's "Redirect URI override", when set: it PINS one origin —
+	*     every sign-in returns there, wherever it started.
+	*  2. The origin the `/start` request was made at (Host / X-Forwarded-Host /
+	*     -Proto + mount prefix), ONLY when the hub advertises that origin
+	*     (`request-origin.ts`) — a forged Host never reaches the IdP.
+	*  3. The Network page's public endpoint (`roles.publicEndpoint`), else the
+	*     development default.
+	*/
+	async resolveRedirect(providerId, headers) {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
+		const callbackPath = `/addon/auth-oidc/${providerId}/callback`;
 		const configured = inst.config.redirectUri?.trim();
-		if (configured) return configured;
-		return `${await require_hub_browser_origin.hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443"}/addon/auth-oidc/${providerId}/callback`;
+		if (configured) return {
+			redirectUri: configured,
+			returnBase: returnBaseOf(configured, callbackPath)
+		};
+		const book = await this.addressBook();
+		const fromRequest = headers !== null && book !== null ? pickRequestOrigin(headers, advertisedHubOrigins(book)) : null;
+		if (fromRequest !== null) {
+			const base = `${fromRequest}${requestMountPrefix(headers ?? {})}`;
+			return {
+				redirectUri: `${base}${callbackPath}`,
+				returnBase: base
+			};
+		}
+		const fallback = (book !== null ? normalizeOrigin(book.roles.publicEndpoint.resolved ?? "") : null) ?? "https://localhost:4443";
+		return {
+			redirectUri: `${fallback}${callbackPath}`,
+			returnBase: fallback
+		};
 	}
-	async buildLoginUrl(providerId, state, linkIntent) {
+	async buildLoginUrl(providerId, state, options = {}) {
+		const { linkIntent } = options;
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
 		const doc = await this.getDiscovery(providerId);
 		const codeVerifier = node_crypto.randomBytes(32).toString("base64url");
 		const codeChallenge = node_crypto.createHash("sha256").update(codeVerifier).digest("base64url");
 		const nonce = node_crypto.randomBytes(16).toString("base64url");
-		const redirectUri = await this.buildRedirectUri(providerId);
+		const { redirectUri, returnBase } = await this.resolveRedirect(providerId, options.headers ?? null);
 		this.pruneExpiredStates();
 		while (this.pendingStates.size >= MAX_PENDING_STATES) {
 			const oldest = this.pendingStates.keys().next();
@@ -1009,6 +1137,8 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			nonce,
 			providerId,
 			redirectUri,
+			returnBase,
+			popup: options.popup === true,
 			createdAt: Date.now(),
 			...linkIntent !== void 0 ? { linkIntent } : {}
 		});
@@ -1065,7 +1195,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				audience: inst.config.clientId
 			})).payload;
 		} catch (err) {
-			throw new Error(`OIDC id_token verification failed: ${require_hub_browser_origin.errMsg(err)}`, { cause: err });
+			throw new Error(`OIDC id_token verification failed: ${require_dist.errMsg(err)}`, { cause: err });
 		}
 		if (typeof payload["nonce"] !== "string" || payload["nonce"] !== pending.nonce) throw new Error("OIDC id_token nonce mismatch — possible replay attack");
 		const sub = typeof payload.sub === "string" ? payload.sub : null;
@@ -1083,7 +1213,9 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			isAdmin: false,
 			...pending.linkIntent !== void 0 ? { linkIntent: pending.linkIntent } : {},
 			issuer: doc.issuer,
-			providerId
+			providerId,
+			returnBase: pending.returnBase,
+			popup: pending.popup
 		};
 	}
 	validateLocalSessionToken(_token) {
@@ -1102,9 +1234,14 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			reply.send({ error: "Malformed link request" });
 			return;
 		}
+		const popupParam = req.query["popup"];
 		const state = node_crypto.randomBytes(16).toString("base64url");
 		try {
-			const url = await this.buildLoginUrl(providerId, state, linkParam);
+			const url = await this.buildLoginUrl(providerId, state, {
+				...linkParam !== void 0 ? { linkIntent: linkParam } : {},
+				headers: req.headers,
+				popup: popupParam === "1"
+			});
 			reply.code(302);
 			reply.header("Location", url);
 			reply.send("");
@@ -1112,7 +1249,7 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 			reply.code(500);
 			reply.send({
 				error: "OIDC start failed",
-				message: require_hub_browser_origin.errMsg(err)
+				message: require_dist.errMsg(err)
 			});
 		}
 	}
@@ -1158,14 +1295,16 @@ var AuthOidcAddon = class extends require_hub_browser_origin.BaseAddon {
 				...result.linkIntent !== void 0 ? { linkIntent: result.linkIntent } : {},
 				issuer: result.issuer
 			} });
+			const finish = new URLSearchParams({ bridge: bridgeToken });
+			if (result.popup) finish.set("popup", "1");
 			reply.code(302);
-			reply.header("Location", `/api/auth/sso/finish?bridge=${encodeURIComponent(bridgeToken)}`);
+			reply.header("Location", `${result.returnBase}/api/auth/sso/finish?${finish.toString()}`);
 			reply.send("");
 		} catch (err) {
 			reply.code(500);
 			reply.send({
 				error: "OIDC callback failed",
-				message: require_hub_browser_origin.errMsg(err)
+				message: require_dist.errMsg(err)
 			});
 		}
 	}

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as buildAddonRouteProvider, i as authProviderCapability, l as errMsg, n as addonRoutesCapability, o as isDisplayIconKey, s as loginMethodCapability, t as hubBrowserOrigin, u as BaseAddon } from "../hub-browser-origin-BRU-HVqq.mjs";
+import { a as isDisplayIconKey, c as errMsg, i as buildAddonRouteProvider, l as BaseAddon, o as loginMethodCapability, r as authProviderCapability, t as addonRoutesCapability } from "../dist-aH7jUuvS.mjs";
 import * as crypto$1 from "node:crypto";
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -699,6 +699,82 @@ function createRemoteJWKSet(url, options) {
 	});
 }
 //#endregion
+//#region src/oidc/request-origin.ts
+/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
+var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
+var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+var MAX_PREFIX_LENGTH = 512;
+/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
+function firstValue(value) {
+	if (value === void 0) return null;
+	const first = value.split(",")[0]?.trim() ?? "";
+	return first.length === 0 ? null : first;
+}
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+function normalizeOrigin(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+		if (url.username !== "" || url.password !== "") return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+function requestMountPrefix(headers) {
+	const raw = headers["x-forwarded-prefix"];
+	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
+	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
+	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
+	return trimmed;
+}
+/**
+* The origins the request CLAIMS, most specific first: the proxy's
+* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+* then http when none is named (the hub terminates TLS itself on 4443).
+*/
+function claimedRequestOrigins(headers) {
+	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
+	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
+	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
+	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
+	const out = [];
+	for (const scheme of schemes) {
+		const origin = normalizeOrigin(`${scheme}://${authority}`);
+		if (origin !== null) out.push(origin);
+	}
+	return out;
+}
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+function advertisedHubOrigins(book) {
+	const candidates = [];
+	for (const row of book.rows) {
+		if (row.kind === "app-link" || row.kind === "loopback") continue;
+		candidates.push(row.baseUrl);
+	}
+	const { publicEndpoint, internal, appConnections } = book.roles;
+	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
+	if (internal.resolved !== null) candidates.push(internal.resolved);
+	candidates.push(...appConnections.resolved);
+	const out = /* @__PURE__ */ new Set();
+	for (const candidate of candidates) {
+		const origin = normalizeOrigin(candidate);
+		if (origin !== null) out.add(origin);
+	}
+	return out;
+}
+/**
+* The origin to send the browser back to: the first claimed origin that is in
+* `allowed`, or `null` (the caller then uses its default address).
+*/
+function pickRequestOrigin(headers, allowed) {
+	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
+	return null;
+}
+//#endregion
 //#region src/oidc/auth-oidc.addon.ts
 /**
 * Generic OpenID Connect (OIDC) authentication provider.
@@ -765,6 +841,19 @@ var LINK_INTENT_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
 var INSTANCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
 /** Bound on in-flight logins: `/start` is public, so a flood must not grow the map. */
 var MAX_PENDING_STATES = 1e3;
+/**
+* Origin + mount prefix of a pinned `redirect_uri`: the part before the
+* callback path when it ends with it, else just its origin.
+*/
+function returnBaseOf(redirectUri, callbackPath) {
+	try {
+		const url = new URL(redirectUri);
+		const prefix = url.pathname.endsWith(callbackPath) ? url.pathname.slice(0, -callbackPath.length) : "";
+		return `${url.origin}${prefix.replace(/\/+$/, "")}`;
+	} catch {
+		return "";
+	}
+}
 var AuthOidcAddon = class extends BaseAddon {
 	/** Per-provider runtime state, keyed by `provider.id`. */
 	instances = /* @__PURE__ */ new Map();
@@ -899,7 +988,7 @@ var AuthOidcAddon = class extends BaseAddon {
 						type: "text",
 						key: "redirectUri",
 						label: "Redirect URI override",
-						description: "Optional. Default uses the hub address from Network (public tunnel, then mesh, then LAN) + the instance id.",
+						description: "Optional — leave empty. Empty: a sign-in returns to the hub address it was started from (LAN, mesh or public, as listed on the Network page), so register one callback per address you sign in from at the IdP. Set: it PINS that one callback — every sign-in returns to its address, wherever it started.",
 						default: ""
 					},
 					{
@@ -977,21 +1066,60 @@ var AuthOidcAddon = class extends BaseAddon {
 		}
 		return doc;
 	}
-	async buildRedirectUri(providerId) {
+	/** The hub's Network-page address book, or `null` when `local-network` is unreachable. */
+	async addressBook() {
+		try {
+			return await this.ctx.api.localNetwork.getAddresses.query({ scheme: "https" });
+		} catch (err) {
+			this.ctx.logger.warn("OIDC: hub addresses unavailable from local-network", { meta: { error: errMsg(err) } });
+			return null;
+		}
+	}
+	/**
+	* The `redirect_uri` of one sign-in, and the base the browser returns to
+	* after the callback (D791). Precedence:
+	*
+	*  1. The instance's "Redirect URI override", when set: it PINS one origin —
+	*     every sign-in returns there, wherever it started.
+	*  2. The origin the `/start` request was made at (Host / X-Forwarded-Host /
+	*     -Proto + mount prefix), ONLY when the hub advertises that origin
+	*     (`request-origin.ts`) — a forged Host never reaches the IdP.
+	*  3. The Network page's public endpoint (`roles.publicEndpoint`), else the
+	*     development default.
+	*/
+	async resolveRedirect(providerId, headers) {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
+		const callbackPath = `/addon/auth-oidc/${providerId}/callback`;
 		const configured = inst.config.redirectUri?.trim();
-		if (configured) return configured;
-		return `${await hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443"}/addon/auth-oidc/${providerId}/callback`;
+		if (configured) return {
+			redirectUri: configured,
+			returnBase: returnBaseOf(configured, callbackPath)
+		};
+		const book = await this.addressBook();
+		const fromRequest = headers !== null && book !== null ? pickRequestOrigin(headers, advertisedHubOrigins(book)) : null;
+		if (fromRequest !== null) {
+			const base = `${fromRequest}${requestMountPrefix(headers ?? {})}`;
+			return {
+				redirectUri: `${base}${callbackPath}`,
+				returnBase: base
+			};
+		}
+		const fallback = (book !== null ? normalizeOrigin(book.roles.publicEndpoint.resolved ?? "") : null) ?? "https://localhost:4443";
+		return {
+			redirectUri: `${fallback}${callbackPath}`,
+			returnBase: fallback
+		};
 	}
-	async buildLoginUrl(providerId, state, linkIntent) {
+	async buildLoginUrl(providerId, state, options = {}) {
+		const { linkIntent } = options;
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
 		const doc = await this.getDiscovery(providerId);
 		const codeVerifier = crypto$1.randomBytes(32).toString("base64url");
 		const codeChallenge = crypto$1.createHash("sha256").update(codeVerifier).digest("base64url");
 		const nonce = crypto$1.randomBytes(16).toString("base64url");
-		const redirectUri = await this.buildRedirectUri(providerId);
+		const { redirectUri, returnBase } = await this.resolveRedirect(providerId, options.headers ?? null);
 		this.pruneExpiredStates();
 		while (this.pendingStates.size >= MAX_PENDING_STATES) {
 			const oldest = this.pendingStates.keys().next();
@@ -1003,6 +1131,8 @@ var AuthOidcAddon = class extends BaseAddon {
 			nonce,
 			providerId,
 			redirectUri,
+			returnBase,
+			popup: options.popup === true,
 			createdAt: Date.now(),
 			...linkIntent !== void 0 ? { linkIntent } : {}
 		});
@@ -1077,7 +1207,9 @@ var AuthOidcAddon = class extends BaseAddon {
 			isAdmin: false,
 			...pending.linkIntent !== void 0 ? { linkIntent: pending.linkIntent } : {},
 			issuer: doc.issuer,
-			providerId
+			providerId,
+			returnBase: pending.returnBase,
+			popup: pending.popup
 		};
 	}
 	validateLocalSessionToken(_token) {
@@ -1096,9 +1228,14 @@ var AuthOidcAddon = class extends BaseAddon {
 			reply.send({ error: "Malformed link request" });
 			return;
 		}
+		const popupParam = req.query["popup"];
 		const state = crypto$1.randomBytes(16).toString("base64url");
 		try {
-			const url = await this.buildLoginUrl(providerId, state, linkParam);
+			const url = await this.buildLoginUrl(providerId, state, {
+				...linkParam !== void 0 ? { linkIntent: linkParam } : {},
+				headers: req.headers,
+				popup: popupParam === "1"
+			});
 			reply.code(302);
 			reply.header("Location", url);
 			reply.send("");
@@ -1152,8 +1289,10 @@ var AuthOidcAddon = class extends BaseAddon {
 				...result.linkIntent !== void 0 ? { linkIntent: result.linkIntent } : {},
 				issuer: result.issuer
 			} });
+			const finish = new URLSearchParams({ bridge: bridgeToken });
+			if (result.popup) finish.set("popup", "1");
 			reply.code(302);
-			reply.header("Location", `/api/auth/sso/finish?bridge=${encodeURIComponent(bridgeToken)}`);
+			reply.header("Location", `${result.returnBase}/api/auth/sso/finish?${finish.toString()}`);
 			reply.send("");
 		} catch (err) {
 			reply.code(500);