@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.4

package/packages/identity/src/oauth/redirect-paths.js

@@ -1,29 +1,35 @@
 /**
  * Post-OAuth redirect helpers — portable path policy with host injectables.
+ * Hosts MUST pass loginPath from their route projection (never hardcode).
  */
 
-const DEFAULT_DASHBOARD_FALLBACK = '/dashboard/agent';
+import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 
 /**
  * @typedef {object} OAuthRedirectPathOptions
  * @property {string} [authCookieName]
- * @property {string} [dashboardFallback]
+ * @property {string} loginPath concrete projection of identity.login
+ * @property {string} [fallback] only used when isAllowedLoginResumePath rejects; prefer omit
  * @property {(path: string) => boolean} [isAllowedLoginResumePath]
  * @property {(env: unknown, rawCookie: string) => Promise<string|null>} [resolveSessionIdFromCookie]
  * @property {(env: unknown, sessionId: string, reason: string, userId: string|null) => Promise<void>} [revokeAuthSession]
  */
 
-/**
- * @param {OAuthRedirectPathOptions} options
- */
 export function createOAuthRedirectHelpers(options = {}) {
   const authCookieName = options.authCookieName ?? 'iam_session';
-  const dashboardFallback = options.dashboardFallback ?? DEFAULT_DASHBOARD_FALLBACK;
-  const isAllowedLoginResumePath = options.isAllowedLoginResumePath ?? (() => false);
+  const loginPath = options.loginPath;
+  if (!loginPath || !String(loginPath).startsWith('/')) {
+    throw new IdentityRoutingError(
+      'AUTH_ROUTE_MISSING',
+      'createOAuthRedirectHelpers requires loginPath from route projection',
+    );
+  }
+  const isAllowedLoginResumePath = options.isAllowedLoginResumePath
+    ?? ((path) => Boolean(sanitizeBrowserNextPath(path)));
   const resolveSessionIdFromCookie = options.resolveSessionIdFromCookie;
   const revokeAuthSession = options.revokeAuthSession;
 
-  /** Revoke browser cookie session before issuing a new login session. */
   async function revokeIncomingCookieSession(request, env, reason = 'oauth_login_replaced') {
     const cookie = request.headers.get('Cookie') || '';
     const match = cookie.match(new RegExp(`(?:^|;\\s*)${authCookieName}=([^;]+)`));
@@ -45,48 +51,33 @@ export function createOAuthRedirectHelpers(options = {}) {
     }
   }
 
-  function safeDashboardLoginRedirectPath(originBase, returnTo) {
-    if (!returnTo || typeof returnTo !== 'string') return dashboardFallback;
-    const t = returnTo.trim();
-    if (!t) return dashboardFallback;
-    if (t.startsWith('/') && !t.startsWith('//') && !t.includes('://')) {
-      if (isAllowedLoginResumePath(t)) return t;
-      if (t.startsWith('/dashboard/settings/integrations')) return dashboardFallback;
-      if (!t.startsWith('/dashboard')) return dashboardFallback;
-      return t;
+  function safeLoginRedirectPath(_originBase, returnTo) {
+    const cleaned = sanitizeBrowserNextPath(returnTo);
+    if (!cleaned) {
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'return_to missing/invalid');
     }
-    try {
-      const u = new URL(t);
-      const ob = new URL(originBase);
-      if (u.origin !== ob.origin) return dashboardFallback;
-      const p = u.pathname + (u.search || '');
-      if (p.startsWith('/dashboard/settings/integrations')) return dashboardFallback;
-      if (!p.startsWith('/dashboard')) return dashboardFallback;
-      return p;
-    } catch {
-      return dashboardFallback;
+    if (!isAllowedLoginResumePath(cleaned)) {
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'return_to not allowed', { returnTo: cleaned });
     }
+    return cleaned;
   }
 
   function oauthPostLoginGlobeRedirectUrl(originBase, returnToFullUrl) {
-    let path = dashboardFallback;
+    let path;
     try {
       const u = new URL(returnToFullUrl);
       path = u.pathname + (u.search || '');
     } catch {
-      /* keep default */
-    }
-    if (!path.startsWith('/') || path.startsWith('//')) path = dashboardFallback;
-    if (path.startsWith('/dashboard/settings/integrations')) path = dashboardFallback;
-    if (!isAllowedLoginResumePath(path) && !path.startsWith('/dashboard')) {
-      path = dashboardFallback;
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'invalid returnToFullUrl');
     }
-    return `${originBase}/auth/login?globe_exit=1&next=${encodeURIComponent(path)}`;
+    path = safeLoginRedirectPath(originBase, path);
+    return `${originBase}${loginPath}?globe_exit=1&next=${encodeURIComponent(path)}`;
   }
 
   return {
     revokeIncomingCookieSession,
-    safeDashboardLoginRedirectPath,
+    safeDashboardLoginRedirectPath: safeLoginRedirectPath,
+    safeLoginRedirectPath,
     oauthPostLoginGlobeRedirectUrl,
   };
 }

package/packages/identity/src/server/identity-service.js

@@ -1,33 +1,48 @@
-import { AUTH_COOKIE_NAME, AUTH_SESSION_TTL_SECONDS } from '../core/constants.js';
+import { AUTH_COOKIE_NAME, SESSION_POLICY } from '../core/constants.js';
 import { hashPassword, verifyPassword } from '../core/password-crypto.js';
 import { jsonResponse } from '../core/http-json.js';
-import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+import { resolvePostAuthDestination } from './post-auth.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { newAuthUserId } from '../adapters/cloudflare-d1/ids.js';
 
 /**
- * @typedef {ReturnType<import('../adapters/cloudflare-d1/index.js').createCloudflareD1Adapter>} IdentityStorageAdapter
+ * @typedef {import('../contracts/identity-store.js').IdentityStore} IdentityStore
  */
 
 /**
  * Server-side identity orchestration (Worker / Node). No secrets in client bundle.
- * @param {{ adapter: IdentityStorageAdapter, cookieName?: string, defaultRedirect?: string }} config
+ * Hosts must supply `app` + `routeRegistry` — no platform "/" fallback.
+ *
+ * @param {{
+ *   adapter: IdentityStore,
+ *   cookieName?: string,
+ *   app: { id: string },
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ * }} config
  */
 export function createIdentityService(config) {
   const adapter = config.adapter;
   if (!adapter) throw new Error('identity_service_requires_adapter');
   const cookieName = config.cookieName || AUTH_COOKIE_NAME;
-  // Direct sign-in has no navigation intent to restore. Land at the site root;
-  // protected routes always provide their own validated `next` path.
-  const defaultRedirect = sanitizeBrowserNextPath(config.defaultRedirect) || '/';
+  const app = config.app || null;
+  const routeRegistry = config.routeRegistry || null;
+  if (!app?.id || !routeRegistry) {
+    throw new IdentityRoutingError(
+      'AUTH_APP_UNRESOLVED',
+      'createIdentityService requires app + routeRegistry (no platform fallback)',
+    );
+  }
+  routeRegistry.assertAuthCapable(app.id);
 
-  // OAuth state is durable and may outlive a deployment. Normalize both the
-  // incoming request value and a value read back from prior state so an old or
-  // malformed value can never become an open redirect.
   function resolvePostLoginPath(nextPath) {
-    return sanitizeBrowserNextPath(nextPath) || defaultRedirect;
+    return resolvePostAuthDestination({
+      transaction: { return_to: nextPath, app_id: app.id },
+      app,
+      routeRegistry,
+    });
   }
 
-  function sessionCookieHeader(sessionId, requestUrl, maxAge = AUTH_SESSION_TTL_SECONDS) {
+  function sessionCookieHeader(sessionId, requestUrl, maxAge = SESSION_POLICY.browser.ttlSeconds) {
     const secure = new URL(requestUrl).protocol === 'https:';
     const parts = [
       `${cookieName}=${sessionId}`,
@@ -48,7 +63,9 @@ export function createIdentityService(config) {
 
   return Object.freeze({
     cookieName,
-    defaultRedirect,
+    app,
+    routeRegistry,
+    defaultRedirect: resolvePostLoginPath(null),
 
     async signup({ email, password, displayName }) {
       const normalized = String(email || '').trim().toLowerCase();

package/packages/identity/src/server/mount-policy.js

@@ -0,0 +1,30 @@
+/**
+ * Mount-level auth policy helpers (host applies; identity does not invent mounts).
+ */
+
+/**
+ * @typedef {{ path: string, auth?: 'required'|'optional'|'public', spa?: boolean, shell?: string }} AppMount
+ */
+
+export function pathMatchesMount(pathname, mount) {
+  const base = String(mount?.path || '');
+  if (!base) return false;
+  const path = String(pathname || '');
+  return path === base || path.startsWith(`${base}/`);
+}
+
+export function resolveMountForPath(pathname, app) {
+  const mounts = Array.isArray(app?.routes?.mounts) ? app.routes.mounts : [];
+  let best = null;
+  for (const mount of mounts) {
+    if (!pathMatchesMount(pathname, mount)) continue;
+    if (!best || String(mount.path).length > String(best.path).length) best = mount;
+  }
+  return best;
+}
+
+export function mountRequiresAuth(pathname, app) {
+  const mount = resolveMountForPath(pathname, app);
+  if (!mount) return false;
+  return (mount.auth || 'public') === 'required';
+}

package/packages/identity/src/server/post-auth.js

@@ -0,0 +1,79 @@
+/**
+ * Fail-closed post-auth destination resolver.
+ * Never redirects to "/" / marketing / invented dashboard paths.
+ */
+
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
+
+/**
+ * @typedef {{ app_id?: string|null, return_to?: string|null }} AuthTransaction
+ */
+
+/**
+ * @param {{
+ *   transaction?: AuthTransaction|null,
+ *   app?: { id: string }|null,
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ * }} opts
+ * @returns {string}
+ */
+export function resolvePostAuthDestination({ transaction, app, routeRegistry }) {
+  if (!routeRegistry) {
+    throw new IdentityRoutingError('AUTH_ROUTE_REGISTRY_REQUIRED');
+  }
+  if (!app?.id) {
+    throw new IdentityRoutingError('AUTH_APP_UNRESOLVED');
+  }
+
+  routeRegistry.assertAuthCapable(app.id);
+
+  const returnTo = routeRegistry.resolveReturnTo({
+    appId: app.id,
+    value: transaction?.return_to,
+  });
+  if (returnTo) return returnTo;
+
+  const entry = routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.APP_AUTHENTICATED)
+    || routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.APP_HOME);
+  if (entry) return entry;
+
+  const recovery = routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.RECOVERY)
+    || routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.LOGIN);
+  if (recovery) {
+    return `${recovery}?error=missing_authenticated_entry`;
+  }
+
+  throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', undefined, {
+    appId: app.id,
+    returnTo: transaction?.return_to || null,
+  });
+}
+
+/**
+ * Begin login redirect URL for an unauthenticated request into an app mount.
+ * @param {{
+ *   appId: string,
+ *   returnTo: string,
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ *   origin: string,
+ * }} opts
+ */
+export function beginLoginRedirect({ appId, returnTo, routeRegistry, origin }) {
+  routeRegistry.assertAuthCapable(appId);
+  const login = routeRegistry.resolve(appId, IDENTITY_ROUTE_IDS.LOGIN);
+  if (!login) {
+    throw new IdentityRoutingError('AUTH_ROUTE_MISSING', 'identity.login projection missing', { appId });
+  }
+  const safeReturn = routeRegistry.resolveReturnTo({ appId, value: returnTo }) || '';
+  const url = new URL(login, origin);
+  if (safeReturn) url.searchParams.set('next', safeReturn);
+  return url.toString();
+}
+
+/** @deprecated Mount helpers moved with host registry — kept for host gate wiring. */
+export {
+  pathMatchesMount,
+  resolveMountForPath,
+  mountRequiresAuth,
+} from './mount-policy.js';

package/packages/identity/src/server/worker-router.js

@@ -9,7 +9,8 @@ import { getGithubAuthUrl, exchangeGithubCode } from '../providers/github/oauth.
 import { fetchGithubProfile } from '../providers/github/profile.js';
 import { getCloudflareAuthUrl, exchangeCloudflareCode } from '../providers/cloudflare/oauth.js';
 import { fetchCloudflareProfile } from '../providers/cloudflare/profile.js';
-import { AUTH_LOGIN_PATH } from '../core/constants.js';
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { resolveOAuthCredentialLane } from '../oauth/credentials.js';
 import { iamPlatformOAuthCallback, iamPlatformOAuthStart } from '../oauth/iam-platform.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from '../oauth/pkce.js';
@@ -80,7 +81,22 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   const method = request.method.toUpperCase();
 
   const adapter = createCloudflareD1Adapter(env.DB);
-  const identity = options.identity || createIdentityService({ adapter });
+  if (!options.identity && (!options.app?.id || !options.routeRegistry)) {
+    throw new IdentityRoutingError(
+      'AUTH_APP_UNRESOLVED',
+      'handleIdentityWorkerRequest requires options.app + options.routeRegistry',
+    );
+  }
+  const identity = options.identity || createIdentityService({
+    adapter,
+    app: options.app,
+    routeRegistry: options.routeRegistry,
+  });
+  const loginPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN);
+  const signupPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.SIGNUP)
+    || loginPath();
+  const resetPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.RESET)
+    || loginPath();
   const passwordReset = buildPasswordResetService(env, adapter, options);
 
   // ── API: email auth ─────────────────────────────────────────────────────
@@ -198,43 +214,48 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!result.ok) {
       return jsonResponse({ error: result.error }, result.status || 400);
     }
-    return jsonResponse({ ok: true, redirect: `${AUTH_LOGIN_PATH}?reset=success` });
+    return jsonResponse({ ok: true, redirect: `${loginPath()}?reset=success` });
   }
 
   // ── OAuth ────────────────────────────────────────────────────────────────
   // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_* take the
   // matching /api/oauth/{provider}/start button when set.
-  if (path === '/api/oauth/iam/callback' && method === 'GET') {
-    return iamPlatformOAuthCallback(request, env, adapter, identity);
+  // Canonical platform id = inneranimalmedia (legacy /api/oauth/iam/* still accepted).
+  if (path === '/api/oauth/inneranimalmedia/callback' || path === '/api/oauth/iam/callback') {
+    if (method === 'GET') {
+      return iamPlatformOAuthCallback(request, env, adapter, identity);
+    }
   }
-  if (path === '/api/oauth/iam/start' && method === 'GET') {
-    const lane = resolveOAuthCredentialLane(env, 'iam');
-    if (!lane) return jsonResponse({ ok: false, error: 'iam_oauth_not_configured' }, 503);
-    return iamPlatformOAuthStart(request, env, adapter, identity);
+  if (path === '/api/oauth/inneranimalmedia/start' || path === '/api/oauth/iam/start') {
+    if (method === 'GET') {
+      const lane = resolveOAuthCredentialLane(env, 'inneranimalmedia');
+      if (!lane) return jsonResponse({ ok: false, error: 'inneranimalmedia_oauth_not_configured' }, 503);
+      return iamPlatformOAuthStart(request, env, adapter, identity);
+    }
   }
 
   if (path === '/api/oauth/google/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
     if (!lane) return jsonResponse({ ok: false, error: 'google_oauth_not_configured' }, 503);
     if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
-    return oauthStart(request, env, adapter, 'google', lane);
+    return oauthStart(request, env, identity, adapter, 'google', lane);
   }
   if (path === '/api/oauth/github/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'github');
     if (!lane) return jsonResponse({ ok: false, error: 'github_oauth_not_configured' }, 503);
     if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
-    return oauthStart(request, env, adapter, 'github', lane);
+    return oauthStart(request, env, identity, adapter, 'github', lane);
   }
   if (path === '/api/oauth/cloudflare/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'cloudflare');
     if (!lane) return jsonResponse({ ok: false, error: 'cloudflare_oauth_not_configured' }, 503);
-    return oauthStart(request, env, adapter, 'cloudflare', lane);
+    return oauthStart(request, env, identity, adapter, 'cloudflare', lane);
   }
 
   if (path === '/api/oauth/google/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     if (lane.lane === 'iam_platform') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -244,7 +265,7 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   if (path === '/api/oauth/github/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'github');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     if (lane.lane === 'iam_platform') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -254,37 +275,28 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   if (path === '/api/oauth/cloudflare/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'cloudflare');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     return oauthCallback(request, env, identity, adapter, 'cloudflare', lane);
   }
 
-  // Auth HTML shells — use extensionless paths; assets serves foo.html at /foo.
-  const authPageMap = {
-    '/auth/login': '/auth/login',
-    '/auth/signup': '/auth/signup',
-    '/auth/reset': '/auth/reset',
-  };
+  // Auth HTML shells — identity pages only (Worker ASSETS binding, not R2).
+  const authPages = new Set([
+    loginPath(),
+    signupPath(),
+    resetPath(),
+  ]);
 
-  if (method === 'GET' && authPageMap[path]) {
+  if (method === 'GET' && authPages.has(path)) {
     if (env.ASSETS?.fetch) {
-      const assetUrl = new URL(authPageMap[path], url.origin);
+      const assetUrl = new URL(path, url.origin);
       return env.ASSETS.fetch(new Request(assetUrl, request));
     }
     return jsonResponse({ error: 'assets_binding_required', path }, 500);
   }
 
-  if (method === 'GET' && (path === '/dashboard' || path.startsWith('/dashboard/'))) {
-    const ctx = await identity.sessionFromRequest(request);
-    if (!ctx) {
-      const next = encodeURIComponent(path + url.search);
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?next=${next}`, 302);
-    }
-    if (env.ASSETS?.fetch) {
-      const assetUrl = new URL('/dashboard/index.html', url.origin);
-      return env.ASSETS.fetch(new Request(assetUrl, request));
-    }
-  }
+  // Product SPA mounts (/agentsam, /admin, /cad, …) are owned by the host app
+  // registry — identity does not invent or gate those routes here.
 
   if (env.ASSETS?.fetch) {
     return env.ASSETS.fetch(request);
@@ -293,44 +305,64 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   return jsonResponse({ error: 'not_found', path }, 404);
 }
 
-async function oauthStart(request, env, adapter, provider, creds) {
+async function oauthStart(request, env, identity, adapter, provider, creds) {
   const url = new URL(request.url);
   if (!creds.clientId) {
     return jsonResponse({ ok: false, error: `${provider}_oauth_not_configured` }, 503);
   }
-  const state = randomOAuthState();
-  const codeVerifier = pkceVerifier();
-  const codeChallenge = await pkceChallenge(codeVerifier);
-  const redirectTo = identity.resolvePostLoginPath(
-    url.searchParams.get('next') || url.searchParams.get('return_to'),
-  );
-  await adapter.saveOAuthState({ state, provider, codeVerifier, redirectTo });
-
-  const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
-  let authUrl;
-  if (provider === 'google') {
-    authUrl = getGoogleAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
+  try {
+    const state = randomOAuthState();
+    const codeVerifier = pkceVerifier();
+    const codeChallenge = await pkceChallenge(codeVerifier);
+    const redirectTo = identity.resolvePostLoginPath(
+      url.searchParams.get('next') || url.searchParams.get('return_to'),
+    );
+    await adapter.saveOAuthState({
       state,
-      codeChallenge,
-    });
-  } else if (provider === 'cloudflare') {
-    authUrl = getCloudflareAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
-    });
-  } else {
-    authUrl = getGithubAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
+      provider,
+      codeVerifier,
+      redirectTo,
+      appId: identity.app?.id || null,
     });
+
+    const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
+    let authUrl;
+    if (provider === 'google') {
+      authUrl = getGoogleAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    } else if (provider === 'cloudflare') {
+      authUrl = getCloudflareAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    } else {
+      authUrl = getGithubAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    }
+    return Response.redirect(authUrl, 302);
+  } catch (error) {
+    const message = String(error?.message || error || 'oauth_start_failed');
+    console.error('oauth_start_failed', provider, message);
+    // Prefer redirect to login with error over bare Worker 1101 for browsers.
+    const lp = identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN);
+    const login = new URL(lp, url.origin);
+    login.searchParams.set('error', 'oauth_start_failed');
+    login.searchParams.set('provider', provider);
+    login.searchParams.set('detail', message.slice(0, 120));
+    const next = url.searchParams.get('next') || url.searchParams.get('return_to');
+    if (next) login.searchParams.set('next', next);
+    return Response.redirect(login.toString(), 302);
   }
-  return Response.redirect(authUrl, 302);
 }
 
 async function oauthCallback(request, env, identity, adapter, provider, creds) {
@@ -340,12 +372,12 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
   const err = url.searchParams.get('error');
   if (err || !code || !state) {
     await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_failed`, 302);
+    return Response.redirect(`${url.origin}${loginPath()}?error=oauth_failed`, 302);
   }
   const saved = await adapter.consumeOAuthState(state);
   if (!saved || saved.provider !== provider) {
     await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=state_mismatch`, 302);
+    return Response.redirect(`${url.origin}${loginPath()}?error=state_mismatch`, 302);
   }
   const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
   let token;
@@ -359,7 +391,7 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
       redirectUri,
     });
     if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
     }
     profile = await fetchGoogleProfile(token.access_token);
   } else if (provider === 'cloudflare') {
@@ -371,7 +403,7 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
       redirectUri,
     });
     if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
     }
     profile = await fetchCloudflareProfile(token.access_token);
   } else {
@@ -383,12 +415,12 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
       redirectUri,
     });
     if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
     }
     profile = await fetchGithubProfile(token.access_token);
   }
   if (!profile) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=userinfo_failed`, 302);
+    return Response.redirect(`${url.origin}${loginPath()}?error=userinfo_failed`, 302);
   }
 
   let normalized;
@@ -412,7 +444,7 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
 
   const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+  const globeUrl = `${url.origin}${loginPath()}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {
     status: 302,
     headers: {

package/packages/identity/tests/finalize-inbound-oauth.test.mjs

@@ -99,16 +99,16 @@ test('createFinalizeInboundOAuth fails closed when identity plane fails for new
   assert.deepEqual(result, { ok: false, error: 'provision_failed' });
 });
 
-test('createOAuthRedirectHelpers blocks integrations return path', () => {
-  const { safeDashboardLoginRedirectPath } = createOAuthRedirectHelpers({
+test('createOAuthRedirectHelpers rejects disallowed return paths', () => {
+  const { safeLoginRedirectPath } = createOAuthRedirectHelpers({
+    loginPath: '/auth/login',
     isAllowedLoginResumePath: (p) => p.startsWith('/mcp-oauth'),
   });
-  assert.equal(
-    safeDashboardLoginRedirectPath('https://inneranimalmedia.com', '/dashboard/settings/integrations'),
-    '/dashboard/agent',
+  assert.throws(
+    () => safeLoginRedirectPath('https://inneranimalmedia.com', '/dashboard/settings/integrations'),
   );
   assert.equal(
-    safeDashboardLoginRedirectPath('https://inneranimalmedia.com', '/mcp-oauth/resume'),
+    safeLoginRedirectPath('https://inneranimalmedia.com', '/mcp-oauth/resume'),
     '/mcp-oauth/resume',
   );
 });

package/packages/identity/tests/iam-provider.test.mjs

@@ -16,7 +16,7 @@ describe('iam identity provider', () => {
       getIamAuthUrl({
         issuer: 'https://inneranimalmedia.com',
         clientId: 'iam_identity_test',
-        redirectUri: 'https://legendary.example/api/oauth/iam/callback',
+        redirectUri: 'https://legendary.example/api/oauth/inneranimalmedia/callback',
         state: 'st_test',
         codeChallenge: 'challenge',
         scope: IAM_DEFAULT_OIDC_SCOPE,