@luckystack/server 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.3] - 2026-07-20
+
+### Fixed
+
+- **Stale-port bug class after a dev auto-increment hop.** When the dev server
+  auto-incremented off a busy port (`:80` → `:81`), the bind-address registry
+  still held the INTENDED port, so `checkOrigin`'s same-origin CORS entry pointed
+  at a port nothing listened on. `listenLuckyStackServer` now re-registers the
+  ACTUALLY-bound port inside the listen callback, so every `getBindAddress()`
+  reader (CORS foremost) sees reality.
+- **OAuth now targets the actually-bound port after a hop.** The `/auth/api/<provider>`
+  authorize route rewrites a `localhost` OAuth `redirect_uri` to the port the
+  server bound (via core's `resolveDevCallbackUrl`), matching the token-exchange
+  side in `@luckystack/login` — so the OAuth round-trip reaches the live dev
+  server even after an auto-increment hop, instead of a frozen dead port.
+- **Loud OAuth port-drift warning on a hop.** The framework auto-targets the bound
+  port for OAuth, but a provider console still exact-matches its registered
+  redirect URI — so the server now warns (naming both ports) to add the bound port
+  to the provider's authorized redirect URIs, or pin the port with
+  `SERVER_PORT_AUTO_INCREMENT=0`.
+
 ## [0.7.1] - 2026-07-18
 
 ### Fixed

package/dist/index.js

@@ -7,7 +7,7 @@ import {
 
 // src/createServer.ts
 import http from "http";
-import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig15, tryCatch as tryCatch10, isProduction as isProduction2, resolveEnvKey as resolveEnvKey5, dispatchHook as dispatchHook8 } from "@luckystack/core";
+import { registerBindAddress, writeBootUuid, getLogger as getLogger13, getProjectConfig as getProjectConfig15, tryCatch as tryCatch10, tryCatchSync as tryCatchSync2, isProduction as isProduction2, resolveEnvKey as resolveEnvKey5, dispatchHook as dispatchHook8 } from "@luckystack/core";
 
 // src/httpHandler.ts
 import { randomUUID } from "crypto";
@@ -457,7 +457,8 @@ import {
   dispatchHook as dispatchHook2,
   getLogger,
   getProjectConfig as getProjectConfig5,
-  resolveClientIp
+  resolveClientIp,
+  resolveDevCallbackUrl
 } from "@luckystack/core";
 
 // src/httpRoutes/sessionCookie.ts
@@ -561,7 +562,11 @@ var handleAuthApiRoute = async ({
     );
     const authParams = new URLSearchParams({
       client_id: provider.clientID,
-      redirect_uri: provider.callbackURL,
+      //? In dev, target the port the server ACTUALLY bound (auto-increment may
+      //? have moved it off the frozen `oauthCallbackBase` port). The token
+      //? exchange applies the SAME rewrite, so the two redirect_uri values stay
+      //? byte-identical as OAuth requires. Prod / non-localhost: unchanged.
+      redirect_uri: resolveDevCallbackUrl(provider.callbackURL),
       scope: provider.scope.join(" "),
       response_type: "code",
       prompt: "select_account"
@@ -2365,10 +2370,20 @@ var listenLuckyStackServer = (httpServer, ip, port, callback) => new Promise((re
     httpServer.once("error", onError);
     httpServer.listen(attemptPort, ip, () => {
       httpServer.off("error", onError);
+      registerBindAddress({ ip, port: attemptPort });
       if (!isProduction2 && process.env.NODE_ENV !== "test") {
         writeDevServerInfo(ip, attemptPort);
         process.once("exit", clearDevServerInfo);
       }
+      if (attemptPort !== startPort && !isProduction2) {
+        const configuredCallbackBase = tryCatchSync2(() => getProjectConfig15().oauthCallbackBase)[1] ?? "";
+        const callbackPort = /:(\d+)(?:\/|$)/.exec(configuredCallbackBase)?.[1];
+        if (callbackPort && callbackPort !== String(attemptPort)) {
+          getLogger13().warn(
+            `OAuth port drift: the server bound :${String(attemptPort)} but your OAuth callback base is configured for :${callbackPort} (${configuredCallbackBase}). The framework now auto-targets :${String(attemptPort)} for OAuth so the callback reaches THIS server \u2014 but your provider (Google/GitHub/\u2026) still exact-matches its registered redirect URI, so add :${String(attemptPort)} to the authorized redirect URIs, OR set SERVER_PORT_AUTO_INCREMENT=0 to pin :${callbackPort} (stop whatever holds it) instead of hopping.`
+          );
+        }
+      }
       const config = getProjectConfig15();
       if (config.logging.socketStartup || config.logging.devLogs) {
         getLogger13().info(`Server is running on http://${ip}:${String(attemptPort)}/`);