@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.3

package/packages/identity/.agentsam/features/oauth-login-portal/providers.json

@@ -0,0 +1,96 @@
+{
+  "schema": "agentsam.feature.provider-catalog.v1",
+  "feature": "identity.oauth-login-portal",
+  "default_provider": "inneranimalmedia",
+  "providers": [
+    {
+      "id": "inneranimalmedia",
+      "aliases": ["iam"],
+      "oauth_provider_key": "iam",
+      "kind": "oidc",
+      "status": "ready",
+      "title": "Inner Animal Media platform identity",
+      "implementation": "src/providers/iam",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "IAM_CLIENT_ID",
+        "IAM_CLIENT_SECRET"
+      ],
+      "notes": "Protocol/selection id is inneranimalmedia. OAuth/DB provider key remains iam."
+    },
+    {
+      "id": "google",
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/google",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GOOGLE_CLIENT_ID",
+        "GOOGLE_CLIENT_SECRET"
+      ]
+    },
+    {
+      "id": "github",
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/github",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GITHUB_CLIENT_ID",
+        "GITHUB_CLIENT_SECRET"
+      ]
+    },
+    {
+      "id": "gcp",
+      "kind": "oauth",
+      "status": "scaffold",
+      "implementation": "src/providers/gcp",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.profile.resolve"
+      ],
+      "notes": "Contract + authorize URL only — exchange not implemented."
+    },
+    {
+      "id": "email",
+      "kind": "password",
+      "status": "scaffold",
+      "implementation": "src/providers/email",
+      "capabilities": [
+        "identity.profile.resolve"
+      ],
+      "notes": "Password verification not yet implemented by the portable provider."
+    },
+    {
+      "id": "cloudflare",
+      "kind": "oauth",
+      "status": "ready",
+      "registered": true,
+      "implementation": "src/providers/cloudflare",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "CLOUDFLARE_OAUTH_CLIENT_ID"
+      ],
+      "optional_configuration": [
+        "CLOUDFLARE_OAUTH_CLIENT_SECRET"
+      ],
+      "notes": "Registered in identityProviders. Client secret optional for PKCE-only clients."
+    }
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/resources.json

@@ -0,0 +1,47 @@
+{
+  "schema": "agentsam.feature.resources.v1",
+  "feature": "identity.oauth-login-portal",
+  "engine": "d1",
+  "migration_sources": [
+    "src/migrations/0001_identity_core.sql",
+    "src/migrations/0002_company.sql"
+  ],
+  "notes": "Migration files remain the schema authority. This JSON is an index/contract only.",
+  "tables": [
+    {
+      "name": "auth_users",
+      "purpose": "canonical user identity",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "auth_sessions",
+      "purpose": "authenticated browser/session state",
+      "owner_column": "user_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "account_identities",
+      "purpose": "external identity/provider mapping",
+      "owner_column": "account_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "oauth_states",
+      "purpose": "short-lived OAuth/PKCE transaction state",
+      "sensitive": true,
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "password_reset_tokens",
+      "purpose": "password recovery token state",
+      "sensitive": true,
+      "owner_column": "user_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "company",
+      "purpose": "auth portal/company branding",
+      "source": "src/migrations/0002_company.sql"
+    }
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/routes.json

@@ -0,0 +1,74 @@
+{
+  "schema": "agentsam.feature.routes.v1",
+  "feature": "identity.oauth-login-portal",
+  "router": "src/server/worker-router.js",
+  "routes": [
+    {
+      "path": "/auth/login",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/auth/signup",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/auth/reset",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/api/auth/login",
+      "method": "POST",
+      "kind": "api",
+      "access": "public"
+    },
+    {
+      "path": "/api/auth/signup",
+      "method": "POST",
+      "kind": "api",
+      "access": "public"
+    },
+    {
+      "path": "/api/oauth/google/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "google"
+    },
+    {
+      "path": "/api/oauth/github/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "github"
+    },
+    {
+      "path": "/api/oauth/iam/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "inneranimalmedia",
+      "oauth_provider_key": "iam"
+    },
+    {
+      "path": "/api/oauth/cloudflare/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "cloudflare"
+    },
+    {
+      "path": "/api/oauth/cloudflare/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "cloudflare"
+    }
+  ],
+  "sources": [
+    "src/frontend/auth-portal/README.md",
+    "src/oauth/README.md",
+    "src/oauth/redirect-paths.js",
+    "src/server/worker-router.js"
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/ui.json

@@ -0,0 +1,35 @@
+{
+  "schema": "agentsam.feature.ui.v1",
+  "feature": "identity.oauth-login-portal",
+  "surface": "auth-portal",
+  "assets": [
+    "src/frontend/auth-portal/pages/login.html",
+    "src/frontend/auth-portal/pages/signup.html",
+    "src/frontend/auth-portal/pages/reset.html",
+    "src/frontend/auth-portal/shared/company-branding.js"
+  ],
+  "customizable": [
+    "logo",
+    "colors",
+    "support info",
+    "company branding"
+  ],
+  "customizable_fields": [
+    "company.name",
+    "company.logo_url",
+    "company.favicon_url",
+    "company.primary_color",
+    "company.auth_bg_color",
+    "company.support_email",
+    "company.website_url",
+    "company.tagline"
+  ],
+  "behavior": {
+    "implementation": "packages/identity",
+    "host_supplies": "brand/runtime config"
+  },
+  "ownership": {
+    "implementation": "packages/identity",
+    "branding": "host"
+  }
+}

package/packages/identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "private": true,
   "type": "module",
   "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
@@ -28,7 +28,8 @@
     "./contracts/external-identity": "./src/contracts/external-identity.js",
     "./contracts/auth-config": "./src/contracts/auth-config.js",
     "./oauth/callback": "./src/oauth/callback.js",
-    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*"
+    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
+    "./providers/cloudflare": "./src/providers/cloudflare/index.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",

package/packages/identity/src/adapters/cloudflare-d1/ids.js

@@ -10,6 +10,10 @@ export function newSessionId() {
   return crypto.randomUUID();
 }
 
+export function newAuthEventId() {
+  return `aev_${crypto.randomUUID().replace(/-/g, '')}`;
+}
+
 export function nowUnix() {
   return Math.floor(Date.now() / 1000);
 }

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -1,4 +1,4 @@
-import { newAccountIdentityId, newAuthUserId, newSessionId, nowUnix } from './ids.js';
+import { newAccountIdentityId, newAuthUserId, newSessionId, newAuthEventId, nowUnix } from './ids.js';
 import { AUTH_SESSION_TTL_SECONDS } from '../../core/constants.js';
 import { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from '../../contracts/company.js';
 
@@ -12,6 +12,14 @@ import { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from '.
  * @param {D1Database} db
  * @param {{ sessionTtlSeconds?: number }} [options]
  */
+async function hashValue(value) {
+  const v = String(value || '').trim();
+  if (!v) return null;
+  const bytes = new TextEncoder().encode(v);
+  const digest = await crypto.subtle.digest('SHA-256', bytes);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
 export function createCloudflareD1Adapter(db, options = {}) {
   if (!db?.prepare) {
     throw new Error('cloudflare_d1_adapter_requires_db_binding');
@@ -21,6 +29,36 @@ export function createCloudflareD1Adapter(db, options = {}) {
   return Object.freeze({
     sessionTtlSeconds,
 
+    /**
+     * Append-only login/logout/failed-attempt audit trail (auth_event_log).
+     * Never throws -- an observability write must not break a real auth flow.
+     * ip/userAgent are hashed (SHA-256) before storage, matching the
+     * ip_hash/user_agent_hash column names -- raw values are never persisted.
+     */
+    async logAuthEvent({ userId, eventType, status = 'ok', provider, metadata, request }) {
+      try {
+        const ip = request?.headers?.get?.('cf-connecting-ip') || request?.headers?.get?.('x-forwarded-for') || '';
+        const ua = request?.headers?.get?.('user-agent') || '';
+        const [ipHash, uaHash] = await Promise.all([hashValue(ip), hashValue(ua)]);
+        await db.prepare(
+          `INSERT INTO auth_event_log
+           (id, user_id, event_type, status, provider, metadata_json, ip_hash, user_agent_hash)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+        ).bind(
+          newAuthEventId(),
+          userId || null,
+          eventType,
+          status,
+          provider || null,
+          metadata ? JSON.stringify(metadata) : '{}',
+          ipHash,
+          uaHash,
+        ).run();
+      } catch {
+        // Never let audit logging break a real login/OAuth flow.
+      }
+    },
+
     async findUserByEmail(email) {
       const row = await db.prepare(
         `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at

package/packages/identity/src/contracts/provider.js

@@ -1,9 +1,10 @@
-/** External identity provider contract. */
+/** External identity provider contract — registry order is intentional. */
 
 export const IdentityProviders = Object.freeze([
   'email',
   'google',
   'github',
   'gcp',
-  'iam',
+  'inneranimalmedia',
+  'cloudflare',
 ]);

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -412,6 +412,9 @@
                 <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
                 Sign in with GitHub
             </a>
+            <a id="cloudflareSignIn" href="/api/oauth/cloudflare/start?next=/dashboard/agent" class="btn-primary" style="background: #F6821F; color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+                Sign in with Cloudflare
+            </a>
         </div>
 
         <p class="signup-prompt">
@@ -479,6 +482,10 @@
     if (githubLink) {
         githubLink.href = '/api/oauth/github/start?next=' + encodeURIComponent(oauthDest);
     }
+    var cloudflareLink = document.getElementById('cloudflareSignIn');
+    if (cloudflareLink) {
+        cloudflareLink.href = '/api/oauth/cloudflare/start?next=' + encodeURIComponent(oauthDest);
+    }
     if (new URLSearchParams(window.location.search).get('cf_connect') === '1') {
         var cfN = document.getElementById('cfConnectNotice');
         if (cfN) cfN.style.display = 'block';

package/packages/identity/src/index.js

@@ -20,6 +20,7 @@ import {
   IamProvider,
   GcpProvider,
   EmailProvider,
+  CloudflareProvider,
 } from './providers/index.js';
 
 export {
@@ -38,6 +39,7 @@ export {
   IamProvider,
   GcpProvider,
   EmailProvider,
+  CloudflareProvider,
 };
 
 export * from './core/index.js';

package/packages/identity/src/oauth/credentials.js

@@ -82,6 +82,19 @@ export function resolveOAuthCredentialLane(env, provider) {
     }
   }
 
+  if (provider === 'cloudflare') {
+    // Reuses the same Worker secrets as the Local Studio Cloudflare resource
+    // connector (packages/connectors/cloudflare). clientSecret may be empty
+    // if that client is configured as PKCE-only (Token Authentication
+    // Method = None) — exchangeCloudflareCode() omits it in that case.
+    const clientId = String(env?.CLOUDFLARE_OAUTH_CLIENT_ID || '').trim();
+    const clientSecret = String(env?.CLOUDFLARE_OAUTH_CLIENT_SECRET || '').trim();
+    if (clientId) {
+      return { lane: 'byok_cloudflare', clientId, clientSecret, provider };
+    }
+    return null;
+  }
+
   // Default: Google/GitHub buttons route through IAM platform when minted.
   const iam = resolveIamPlatformCredentials(env);
   if (iam) {

package/packages/identity/src/oauth/iam-platform.js

@@ -19,7 +19,7 @@ import { normalizeIamIdentity } from '../providers/iam/mapper.js';
  * @param {Record<string, unknown>} env
  * @param {import('../adapters/cloudflare-d1/index.js').CloudflareD1Adapter} adapter
  */
-export async function iamPlatformOAuthStart(request, env, adapter) {
+export async function iamPlatformOAuthStart(request, env, adapter, identity) {
   const creds = resolveIamPlatformCredentials(env);
   if (!creds) {
     return Response.json({ ok: false, error: 'iam_oauth_not_configured' }, 503);
@@ -29,9 +29,9 @@ export async function iamPlatformOAuthStart(request, env, adapter) {
   const state = randomOAuthState();
   const codeVerifier = pkceVerifier();
   const codeChallenge = await pkceChallenge(codeVerifier);
-  const redirectTo = url.searchParams.get('next')
-    || url.searchParams.get('return_to')
-    || '/dashboard/cms';
+  const redirectTo = identity?.resolvePostLoginPath(
+    url.searchParams.get('next') || url.searchParams.get('return_to'),
+  ) || '/';
 
   await adapter.saveOAuthState({
     state,
@@ -107,7 +107,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     displayName: normalized.name || normalized.email.split('@')[0] || 'User',
   });
 
-  const redirectTo = saved.redirect_to || '/dashboard/cms';
+  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
   const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {

package/packages/identity/src/providers/cloudflare/index.js

@@ -0,0 +1,19 @@
+import { createIdentityProvider } from '../../provider-contract.js';
+import { exchangeCloudflareCode, getCloudflareAuthUrl } from './oauth.js';
+import { fetchCloudflareProfile } from './profile.js';
+import { normalizeCloudflareIdentity } from './mapper.js';
+
+export const CloudflareProvider = createIdentityProvider({
+  id: 'cloudflare',
+  authorizeUrl: getCloudflareAuthUrl,
+  exchangeCode: exchangeCloudflareCode,
+  getProfile: fetchCloudflareProfile,
+  normalizeIdentity: normalizeCloudflareIdentity,
+});
+
+export {
+  getCloudflareAuthUrl,
+  exchangeCloudflareCode,
+  fetchCloudflareProfile,
+  normalizeCloudflareIdentity,
+};

package/packages/identity/src/providers/cloudflare/mapper.js

@@ -0,0 +1,21 @@
+import { normalizeExternalIdentity } from '../../contracts/external-identity.js';
+
+/**
+ * @param {Record<string, unknown>|null|undefined} profile
+ */
+export function normalizeCloudflareIdentity(profile) {
+  const raw = profile && typeof profile === 'object' ? profile : {};
+  const subject = String(raw.sub || raw.id || raw.user_id || raw.account_id || '').trim();
+  if (!subject) {
+    throw new Error('cloudflare_identity_requires_subject');
+  }
+  return normalizeExternalIdentity({
+    provider: 'cloudflare',
+    subject,
+    email: typeof raw.email === 'string' ? raw.email : null,
+    emailVerified: Boolean(raw.email),
+    name: typeof raw.name === 'string' ? raw.name : (typeof raw.display_name === 'string' ? raw.display_name : null),
+    avatar: null,
+    raw,
+  });
+}

package/packages/identity/src/providers/cloudflare/oauth.js

@@ -0,0 +1,48 @@
+const CLOUDFLARE_AUTH_URL = 'https://dash.cloudflare.com/oauth2/auth';
+const CLOUDFLARE_TOKEN_URL = 'https://dash.cloudflare.com/oauth2/token';
+
+// Identity-only login should not request the full resource-access scope set
+// used elsewhere for the Local Studio Cloudflare *connection* (deploy/d1/r2/etc).
+// account-settings.read is enough to resolve the account for userinfo.
+const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read offline_access';
+
+/** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
+export function getCloudflareAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {
+  const url = new URL(CLOUDFLARE_AUTH_URL);
+  url.searchParams.set('client_id', clientId || '');
+  url.searchParams.set('redirect_uri', redirectUri || '');
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('scope', scope || CLOUDFLARE_LOGIN_SCOPE);
+  url.searchParams.set('state', state || '');
+  if (codeChallenge) {
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+  }
+  return url.toString();
+}
+
+/** @param {import('../../provider-contract.js').OAuthExchangeInput} input */
+export async function exchangeCloudflareCode({ code, codeVerifier, clientId, clientSecret, redirectUri }) {
+  try {
+    const body = new URLSearchParams();
+    body.set('grant_type', 'authorization_code');
+    body.set('code', code || '');
+    body.set('code_verifier', codeVerifier || '');
+    body.set('client_id', clientId || '');
+    // client_secret is only sent when configured — the client may be a
+    // PKCE-only public client (Token Authentication Method = None), same
+    // pattern as the Local Studio resource connector.
+    if (clientSecret) body.set('client_secret', clientSecret);
+    body.set('redirect_uri', redirectUri || '');
+
+    const res = await fetch(CLOUDFLARE_TOKEN_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body,
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}

package/packages/identity/src/providers/cloudflare/profile.js

@@ -0,0 +1,28 @@
+const CLOUDFLARE_USERINFO_URL = 'https://dash.cloudflare.com/oauth2/userinfo';
+
+/**
+ * Fetch the authenticated Cloudflare user's identity.
+ * Response shape not fully verified against a live token yet — this reads
+ * defensively (sub/id/user_id, email, name) rather than assuming Cloudflare's
+ * exact OIDC field names. Confirm the real shape on first live login and
+ * tighten this if fields differ.
+ * @param {string} accessToken
+ */
+export async function fetchCloudflareProfile(accessToken) {
+  try {
+    const res = await fetch(CLOUDFLARE_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data) return null;
+    return {
+      sub: data.sub || data.id || data.user_id || data.account_id || null,
+      email: data.email || null,
+      name: data.name || data.display_name || null,
+      raw: data,
+    };
+  } catch {
+    return null;
+  }
+}

package/packages/identity/src/providers/index.js

@@ -4,19 +4,28 @@ import { GithubProvider } from './github/index.js';
 import { GcpProvider } from './gcp/index.js';
 import { EmailProvider } from './email/index.js';
 import { IamProvider } from './iam/index.js';
+import { CloudflareProvider } from './cloudflare/index.js';
 
-/** @type {Record<string, import('../provider-contract.js').IdentityProvider>} */
+/**
+ * Active identity provider registry.
+ * `inneranimalmedia` is the canonical platform template id; `iam` remains a
+ * legacy lookup alias (OAuth/DB provider key on platform identities).
+ * @type {Record<string, import('../provider-contract.js').IdentityProvider>}
+ */
 export const identityProviders = Object.freeze({
   google: GoogleProvider,
   github: GithubProvider,
   gcp: GcpProvider,
   email: EmailProvider,
+  inneranimalmedia: IamProvider,
   iam: IamProvider,
+  cloudflare: CloudflareProvider,
 });
 
 /** @param {string} id */
 export function getIdentityProvider(id) {
   const key = String(id || '').trim().toLowerCase();
+  if (key === 'iam') return identityProviders.inneranimalmedia || identityProviders.iam || null;
   return identityProviders[key] || null;
 }
 
@@ -24,4 +33,11 @@ export function listIdentityProviders() {
   return IdentityProviders.map((id) => identityProviders[id]).filter(Boolean);
 }
 
-export { GoogleProvider, GithubProvider, GcpProvider, EmailProvider, IamProvider };
+export {
+  GoogleProvider,
+  GithubProvider,
+  GcpProvider,
+  EmailProvider,
+  IamProvider,
+  CloudflareProvider,
+};

package/packages/identity/src/server/identity-service.js

@@ -1,4 +1,4 @@
-import { AUTH_COOKIE_NAME, AUTH_SESSION_TTL_SECONDS, DASHBOARD_AFTER_LOGIN_PATH } from '../core/constants.js';
+import { AUTH_COOKIE_NAME, AUTH_SESSION_TTL_SECONDS } from '../core/constants.js';
 import { hashPassword, verifyPassword } from '../core/password-crypto.js';
 import { jsonResponse } from '../core/http-json.js';
 import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
@@ -16,7 +16,16 @@ export function createIdentityService(config) {
   const adapter = config.adapter;
   if (!adapter) throw new Error('identity_service_requires_adapter');
   const cookieName = config.cookieName || AUTH_COOKIE_NAME;
-  const defaultRedirect = config.defaultRedirect || DASHBOARD_AFTER_LOGIN_PATH;
+  // Direct sign-in has no navigation intent to restore. Land at the site root;
+  // protected routes always provide their own validated `next` path.
+  const defaultRedirect = sanitizeBrowserNextPath(config.defaultRedirect) || '/';
+
+  // OAuth state is durable and may outlive a deployment. Normalize both the
+  // incoming request value and a value read back from prior state so an old or
+  // malformed value can never become an open redirect.
+  function resolvePostLoginPath(nextPath) {
+    return sanitizeBrowserNextPath(nextPath) || defaultRedirect;
+  }
 
   function sessionCookieHeader(sessionId, requestUrl, maxAge = AUTH_SESSION_TTL_SECONDS) {
     const secure = new URL(requestUrl).protocol === 'https:';
@@ -127,7 +136,7 @@ export function createIdentityService(config) {
     },
 
     buildLoginSuccessResponse(request, sessionId, nextPath) {
-      const redirect = sanitizeBrowserNextPath(nextPath) || defaultRedirect;
+      const redirect = resolvePostLoginPath(nextPath);
       return jsonResponse(
         { ok: true, redirect },
         200,
@@ -150,6 +159,7 @@ export function createIdentityService(config) {
 
     parseSessionId,
     sessionCookieHeader,
+    resolvePostLoginPath,
   });
 }