@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/identity/src/server/post-auth.js

@@ -0,0 +1,79 @@
+/**
+ * Fail-closed post-auth destination resolver.
+ * Never redirects to "/" / marketing / invented dashboard paths.
+ */
+
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
+
+/**
+ * @typedef {{ app_id?: string|null, return_to?: string|null }} AuthTransaction
+ */
+
+/**
+ * @param {{
+ *   transaction?: AuthTransaction|null,
+ *   app?: { id: string }|null,
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ * }} opts
+ * @returns {string}
+ */
+export function resolvePostAuthDestination({ transaction, app, routeRegistry }) {
+  if (!routeRegistry) {
+    throw new IdentityRoutingError('AUTH_ROUTE_REGISTRY_REQUIRED');
+  }
+  if (!app?.id) {
+    throw new IdentityRoutingError('AUTH_APP_UNRESOLVED');
+  }
+
+  routeRegistry.assertAuthCapable(app.id);
+
+  const returnTo = routeRegistry.resolveReturnTo({
+    appId: app.id,
+    value: transaction?.return_to,
+  });
+  if (returnTo) return returnTo;
+
+  const entry = routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.APP_AUTHENTICATED)
+    || routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.APP_HOME);
+  if (entry) return entry;
+
+  const recovery = routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.RECOVERY)
+    || routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.LOGIN);
+  if (recovery) {
+    return `${recovery}?error=missing_authenticated_entry`;
+  }
+
+  throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', undefined, {
+    appId: app.id,
+    returnTo: transaction?.return_to || null,
+  });
+}
+
+/**
+ * Begin login redirect URL for an unauthenticated request into an app mount.
+ * @param {{
+ *   appId: string,
+ *   returnTo: string,
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ *   origin: string,
+ * }} opts
+ */
+export function beginLoginRedirect({ appId, returnTo, routeRegistry, origin }) {
+  routeRegistry.assertAuthCapable(appId);
+  const login = routeRegistry.resolve(appId, IDENTITY_ROUTE_IDS.LOGIN);
+  if (!login) {
+    throw new IdentityRoutingError('AUTH_ROUTE_MISSING', 'identity.login projection missing', { appId });
+  }
+  const safeReturn = routeRegistry.resolveReturnTo({ appId, value: returnTo }) || '';
+  const url = new URL(login, origin);
+  if (safeReturn) url.searchParams.set('next', safeReturn);
+  return url.toString();
+}
+
+/** @deprecated Mount helpers moved with host registry — kept for host gate wiring. */
+export {
+  pathMatchesMount,
+  resolveMountForPath,
+  mountRequiresAuth,
+} from './mount-policy.js';

package/packages/identity/src/server/worker-router.js

@@ -9,8 +9,10 @@ import { getGithubAuthUrl, exchangeGithubCode } from '../providers/github/oauth.
 import { fetchGithubProfile } from '../providers/github/profile.js';
 import { getCloudflareAuthUrl, exchangeCloudflareCode } from '../providers/cloudflare/oauth.js';
 import { fetchCloudflareProfile } from '../providers/cloudflare/profile.js';
-import { AUTH_LOGIN_PATH } from '../core/constants.js';
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { resolveOAuthCredentialLane } from '../oauth/credentials.js';
+import { handleGoogleDesktopExchangeRequest } from '../oauth/google-desktop-exchange.js';
 import { iamPlatformOAuthCallback, iamPlatformOAuthStart } from '../oauth/iam-platform.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from '../oauth/pkce.js';
 
@@ -22,6 +24,10 @@ function escapeHtml(value) {
     .replace(/"/g, '"');
 }
 
+function resolveLoginPath(identity) {
+  return identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN) || '/auth/login';
+}
+
 function resolveKv(env) {
   return env?.SESSION_CACHE || env?.KV || null;
 }
@@ -80,7 +86,22 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   const method = request.method.toUpperCase();
 
   const adapter = createCloudflareD1Adapter(env.DB);
-  const identity = options.identity || createIdentityService({ adapter });
+  if (!options.identity && (!options.app?.id || !options.routeRegistry)) {
+    throw new IdentityRoutingError(
+      'AUTH_APP_UNRESOLVED',
+      'handleIdentityWorkerRequest requires options.app + options.routeRegistry',
+    );
+  }
+  const identity = options.identity || createIdentityService({
+    adapter,
+    app: options.app,
+    routeRegistry: options.routeRegistry,
+  });
+  const loginPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN);
+  const signupPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.SIGNUP)
+    || loginPath();
+  const resetPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.RESET)
+    || loginPath();
   const passwordReset = buildPasswordResetService(env, adapter, options);
 
   // ── API: email auth ─────────────────────────────────────────────────────
@@ -99,6 +120,9 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     await adapter.logAuthEvent({
       userId: result.user.id, eventType: 'login', status: 'ok', provider: 'email', request,
     });
+    if (identity.isNativeSessionRequest(request)) {
+      return identity.buildNativeLoginSuccessResponse(result, body.next);
+    }
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -112,6 +136,9 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!result.ok) {
       return jsonResponse({ ok: false, error: result.error }, 400);
     }
+    if (identity.isNativeSessionRequest(request)) {
+      return identity.buildNativeLoginSuccessResponse(result, body.next);
+    }
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -198,43 +225,52 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!result.ok) {
       return jsonResponse({ error: result.error }, result.status || 400);
     }
-    return jsonResponse({ ok: true, redirect: `${AUTH_LOGIN_PATH}?reset=success` });
+    return jsonResponse({ ok: true, redirect: `${loginPath()}?reset=success` });
   }
 
   // ── OAuth ────────────────────────────────────────────────────────────────
-  // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_* take the
-  // matching /api/oauth/{provider}/start button when set.
-  if (path === '/api/oauth/iam/callback' && method === 'GET') {
-    return iamPlatformOAuthCallback(request, env, adapter, identity);
+  // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_*/CLOUDFLARE_*
+  // take the matching /api/oauth/{provider}/start button when set.
+  // Desktop PKCE: GOOGLE_DESKTOP_CLIENT_ID → POST /api/oauth/google/desktop-exchange.
+  // Canonical platform id = inneranimalmedia (legacy /api/oauth/iam/* still accepted).
+  if (path === '/api/oauth/google/desktop-exchange') {
+    return handleGoogleDesktopExchangeRequest(request, env);
+  }
+  if (path === '/api/oauth/inneranimalmedia/callback' || path === '/api/oauth/iam/callback') {
+    if (method === 'GET') {
+      return iamPlatformOAuthCallback(request, env, adapter, identity);
+    }
   }
-  if (path === '/api/oauth/iam/start' && method === 'GET') {
-    const lane = resolveOAuthCredentialLane(env, 'iam');
-    if (!lane) return jsonResponse({ ok: false, error: 'iam_oauth_not_configured' }, 503);
-    return iamPlatformOAuthStart(request, env, adapter, identity);
+  if (path === '/api/oauth/inneranimalmedia/start' || path === '/api/oauth/iam/start') {
+    if (method === 'GET') {
+      const lane = resolveOAuthCredentialLane(env, 'inneranimalmedia');
+      if (!lane) return jsonResponse({ ok: false, error: 'inneranimalmedia_oauth_not_configured' }, 503);
+      return iamPlatformOAuthStart(request, env, adapter, identity);
+    }
   }
 
   if (path === '/api/oauth/google/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
     if (!lane) return jsonResponse({ ok: false, error: 'google_oauth_not_configured' }, 503);
     if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
-    return oauthStart(request, env, adapter, 'google', lane);
+    return oauthStart(request, env, identity, adapter, 'google', lane);
   }
   if (path === '/api/oauth/github/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'github');
     if (!lane) return jsonResponse({ ok: false, error: 'github_oauth_not_configured' }, 503);
     if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
-    return oauthStart(request, env, adapter, 'github', lane);
+    return oauthStart(request, env, identity, adapter, 'github', lane);
   }
   if (path === '/api/oauth/cloudflare/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'cloudflare');
     if (!lane) return jsonResponse({ ok: false, error: 'cloudflare_oauth_not_configured' }, 503);
-    return oauthStart(request, env, adapter, 'cloudflare', lane);
+    return oauthStart(request, env, identity, adapter, 'cloudflare', lane);
   }
 
   if (path === '/api/oauth/google/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     if (lane.lane === 'iam_platform') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -244,7 +280,7 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   if (path === '/api/oauth/github/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'github');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     if (lane.lane === 'iam_platform') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -254,37 +290,28 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   if (path === '/api/oauth/cloudflare/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'cloudflare');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     return oauthCallback(request, env, identity, adapter, 'cloudflare', lane);
   }
 
-  // Auth HTML shells — use extensionless paths; assets serves foo.html at /foo.
-  const authPageMap = {
-    '/auth/login': '/auth/login',
-    '/auth/signup': '/auth/signup',
-    '/auth/reset': '/auth/reset',
-  };
+  // Auth HTML shells — identity pages only (Worker ASSETS binding, not R2).
+  const authPages = new Set([
+    loginPath(),
+    signupPath(),
+    resetPath(),
+  ]);
 
-  if (method === 'GET' && authPageMap[path]) {
+  if (method === 'GET' && authPages.has(path)) {
     if (env.ASSETS?.fetch) {
-      const assetUrl = new URL(authPageMap[path], url.origin);
+      const assetUrl = new URL(path, url.origin);
       return env.ASSETS.fetch(new Request(assetUrl, request));
     }
     return jsonResponse({ error: 'assets_binding_required', path }, 500);
   }
 
-  if (method === 'GET' && (path === '/dashboard' || path.startsWith('/dashboard/'))) {
-    const ctx = await identity.sessionFromRequest(request);
-    if (!ctx) {
-      const next = encodeURIComponent(path + url.search);
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?next=${next}`, 302);
-    }
-    if (env.ASSETS?.fetch) {
-      const assetUrl = new URL('/dashboard/index.html', url.origin);
-      return env.ASSETS.fetch(new Request(assetUrl, request));
-    }
-  }
+  // Product SPA mounts (/agentsam, /admin, /cad, …) are owned by the host app
+  // registry — identity does not invent or gate those routes here.
 
   if (env.ASSETS?.fetch) {
     return env.ASSETS.fetch(request);
@@ -293,133 +320,168 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   return jsonResponse({ error: 'not_found', path }, 404);
 }
 
-async function oauthStart(request, env, adapter, provider, creds) {
+async function oauthStart(request, env, identity, adapter, provider, creds) {
   const url = new URL(request.url);
   if (!creds.clientId) {
     return jsonResponse({ ok: false, error: `${provider}_oauth_not_configured` }, 503);
   }
-  const state = randomOAuthState();
-  const codeVerifier = pkceVerifier();
-  const codeChallenge = await pkceChallenge(codeVerifier);
-  const redirectTo = identity.resolvePostLoginPath(
-    url.searchParams.get('next') || url.searchParams.get('return_to'),
-  );
-  await adapter.saveOAuthState({ state, provider, codeVerifier, redirectTo });
-
-  const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
-  let authUrl;
-  if (provider === 'google') {
-    authUrl = getGoogleAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
-    });
-  } else if (provider === 'cloudflare') {
-    authUrl = getCloudflareAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
-    });
-  } else {
-    authUrl = getGithubAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
+  try {
+    const state = randomOAuthState();
+    const codeVerifier = pkceVerifier();
+    const codeChallenge = await pkceChallenge(codeVerifier);
+    const redirectTo = identity.resolvePostLoginPath(
+      url.searchParams.get('next') || url.searchParams.get('return_to'),
+    );
+    await adapter.saveOAuthState({
       state,
-      codeChallenge,
+      provider,
+      codeVerifier,
+      redirectTo,
+      appId: identity.app?.id || null,
     });
+
+    const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
+    let authUrl;
+    if (provider === 'google') {
+      authUrl = getGoogleAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    } else if (provider === 'cloudflare') {
+      authUrl = getCloudflareAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    } else {
+      authUrl = getGithubAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    }
+    return Response.redirect(authUrl, 302);
+  } catch (error) {
+    const message = String(error?.message || error || 'oauth_start_failed');
+    console.error('oauth_start_failed', provider, message);
+    // Prefer redirect to login with error over bare Worker 1101 for browsers.
+    const lp = identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN);
+    const login = new URL(lp, url.origin);
+    login.searchParams.set('error', 'oauth_start_failed');
+    login.searchParams.set('provider', provider);
+    login.searchParams.set('detail', message.slice(0, 120));
+    const next = url.searchParams.get('next') || url.searchParams.get('return_to');
+    if (next) login.searchParams.set('next', next);
+    return Response.redirect(login.toString(), 302);
   }
-  return Response.redirect(authUrl, 302);
 }
 
 async function oauthCallback(request, env, identity, adapter, provider, creds) {
   const url = new URL(request.url);
-  const code = url.searchParams.get('code');
-  const state = url.searchParams.get('state');
-  const err = url.searchParams.get('error');
-  if (err || !code || !state) {
-    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_failed`, 302);
-  }
-  const saved = await adapter.consumeOAuthState(state);
-  if (!saved || saved.provider !== provider) {
-    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=state_mismatch`, 302);
-  }
-  const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
-  let token;
-  let profile;
-  if (provider === 'google') {
-    token = await exchangeGoogleCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+  const login = resolveLoginPath(identity);
+  try {
+    const code = url.searchParams.get('code');
+    const state = url.searchParams.get('state');
+    const err = url.searchParams.get('error');
+    if (err || !code || !state) {
+      await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
+      return Response.redirect(`${url.origin}${login}?error=oauth_failed`, 302);
     }
-    profile = await fetchGoogleProfile(token.access_token);
-  } else if (provider === 'cloudflare') {
-    token = await exchangeCloudflareCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+    const saved = await adapter.consumeOAuthState(state);
+    if (!saved || saved.provider !== provider) {
+      await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
+      return Response.redirect(`${url.origin}${login}?error=state_mismatch`, 302);
     }
-    profile = await fetchCloudflareProfile(token.access_token);
-  } else {
-    token = await exchangeGithubCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+    const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
+    let token;
+    let profile;
+    if (provider === 'google') {
+      token = await exchangeGoogleCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchGoogleProfile(token.access_token);
+    } else if (provider === 'cloudflare') {
+      token = await exchangeCloudflareCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchCloudflareProfile(token.access_token);
+    } else {
+      token = await exchangeGithubCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchGithubProfile(token.access_token);
+    }
+    if (!profile) {
+      return Response.redirect(`${url.origin}${login}?error=userinfo_failed`, 302);
     }
-    profile = await fetchGithubProfile(token.access_token);
-  }
-  if (!profile) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=userinfo_failed`, 302);
-  }
 
-  let normalized;
-  if (provider === 'google') {
-    normalized = { subject: profile.sub, email: profile.email, name: profile.name };
-  } else if (provider === 'cloudflare') {
-    normalized = { subject: String(profile.sub), email: profile.email, name: profile.name || profile.email };
-  } else {
-    normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
-  }
+    let normalized;
+    if (provider === 'google') {
+      normalized = { subject: profile.sub, email: profile.email, name: profile.name };
+    } else if (provider === 'cloudflare') {
+      const subject = profile.sub || profile.email;
+      if (!subject) {
+        return Response.redirect(`${url.origin}${login}?error=userinfo_incomplete`, 302);
+      }
+      normalized = { subject: String(subject), email: profile.email, name: profile.name || profile.email };
+    } else {
+      normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
+    }
 
-  const result = await identity.provisionOAuthUser({
-    provider,
-    providerSubject: normalized.subject,
-    email: normalized.email,
-    displayName: normalized.name,
-  });
-  await adapter.logAuthEvent({
-    userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
-  });
+    const result = await identity.provisionOAuthUser({
+      provider,
+      providerSubject: normalized.subject,
+      email: normalized.email,
+      displayName: normalized.name,
+    });
+    await adapter.logAuthEvent({
+      userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
+    });
 
-  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
-  const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: globeUrl,
-      'Set-Cookie': res.headers.get('Set-Cookie') || '',
-    },
-  });
+    const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
+    const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
+    const globeUrl = `${url.origin}${login}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: globeUrl,
+        'Set-Cookie': res.headers.get('Set-Cookie') || '',
+      },
+    });
+  } catch (error) {
+    const message = String(error?.message || error || 'oauth_callback_failed');
+    console.error('oauth_callback_failed', provider, message);
+    const loginUrl = new URL(login, url.origin);
+    loginUrl.searchParams.set('error', 'oauth_callback_failed');
+    loginUrl.searchParams.set('provider', provider);
+    loginUrl.searchParams.set('detail', message.slice(0, 120));
+    return Response.redirect(loginUrl.toString(), 302);
+  }
 }
 
 export { createIdentityService, createCloudflareD1Adapter };

package/packages/identity/tests/auth-config.test.mjs

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import {
   AGENTSAM_AUTH_CONTRACT,
+  PLATFORM_ACCOUNT_ISSUER,
   buildApiAuthorizationHeaders,
   resolveApiKey,
   resolveBridgeKey,
@@ -23,8 +24,8 @@ describe('auth configuration contract', () => {
     assert.equal(resolveIamOrigin({ IAM_ORIGIN: 'https://legacy.example.test/' }), 'https://legacy.example.test');
   });
 
-  it('defaults issuer when neither IAM_OAUTH_ISSUER nor IAM_ORIGIN exists', () => {
-    assert.equal(resolveIamOrigin({}), 'https://inneranimalmedia.com');
+  it('falls back to the canonical platform account issuer when env is unset', () => {
+    assert.equal(resolveIamOrigin({}), PLATFORM_ACCOUNT_ISSUER);
   });
 
   it('resolves only AGENTSAM_API_KEY for delegated account API auth', () => {

package/packages/identity/tests/finalize-inbound-oauth.test.mjs

@@ -99,16 +99,16 @@ test('createFinalizeInboundOAuth fails closed when identity plane fails for new
   assert.deepEqual(result, { ok: false, error: 'provision_failed' });
 });
 
-test('createOAuthRedirectHelpers blocks integrations return path', () => {
-  const { safeDashboardLoginRedirectPath } = createOAuthRedirectHelpers({
+test('createOAuthRedirectHelpers rejects disallowed return paths', () => {
+  const { safeLoginRedirectPath } = createOAuthRedirectHelpers({
+    loginPath: '/auth/login',
     isAllowedLoginResumePath: (p) => p.startsWith('/mcp-oauth'),
   });
-  assert.equal(
-    safeDashboardLoginRedirectPath('https://inneranimalmedia.com', '/dashboard/settings/integrations'),
-    '/dashboard/agent',
+  assert.throws(
+    () => safeLoginRedirectPath('https://inneranimalmedia.com', '/dashboard/settings/integrations'),
   );
   assert.equal(
-    safeDashboardLoginRedirectPath('https://inneranimalmedia.com', '/mcp-oauth/resume'),
+    safeLoginRedirectPath('https://inneranimalmedia.com', '/mcp-oauth/resume'),
     '/mcp-oauth/resume',
   );
 });

package/packages/identity/tests/iam-provider.test.mjs

@@ -16,7 +16,7 @@ describe('iam identity provider', () => {
       getIamAuthUrl({
         issuer: 'https://inneranimalmedia.com',
         clientId: 'iam_identity_test',
-        redirectUri: 'https://legendary.example/api/oauth/iam/callback',
+        redirectUri: 'https://legendary.example/api/oauth/inneranimalmedia/callback',
         state: 'st_test',
         codeChallenge: 'challenge',
         scope: IAM_DEFAULT_OIDC_SCOPE,

package/packages/identity/tests/identity-init-scaffold.test.mjs

@@ -16,7 +16,10 @@ describe('identity init scaffold', () => {
     assert.ok(files['app/frontend/auth/signup.html'].includes('/api/auth/signup'));
     assert.ok(files['backend/src/index.js'].includes('handleIdentityWorkerRequest'));
     assert.ok(files['migrations/0001_identity_core.sql'].includes('CREATE TABLE IF NOT EXISTS company'));
+    assert.ok(files['migrations/0001_identity_core.sql'].includes('CREATE TABLE IF NOT EXISTS accounts'));
     assert.ok(files['migrations/0001_identity_core.sql'].includes('INSERT OR IGNORE INTO company'));
+    assert.ok(files['.env.example'].includes('GOOGLE_DESKTOP_CLIENT_ID'));
+    assert.ok(files['.env.example'].includes('CLOUDFLARE_OAUTH_CLIENT_ID'));
     assert.ok(files['app/frontend/shared/company-branding.js'].includes('/api/company'));
 
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'identity-init-'));