@m8t-stack/cli 0.2.25 → 0.2.26

package/dist/cli.js

@@ -1247,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.25";
+var CLI_VERSION = "0.2.26";
 
 // src/lib/render-error.ts
 init_errors();
@@ -20660,6 +20660,19 @@ async function ensureAppReg(opts) {
   await ensureExposeAnApi(created.appId, created.id);
   return { tenantId: opts.tenantId, clientId: created.appId, appObjectId: created.id };
 }
+async function ensureGatewayRedirectUri(gatewayClientId, fqdn) {
+  const appObjectId = await azJson(
+    ["ad", "app", "show", "--id", gatewayClientId, "--query", "id", "--output", "json"]
+  );
+  if (!appObjectId) {
+    throw new LocalCliError({
+      code: "APP_REG_OBJECT_ID_MISSING",
+      message: `Could not resolve the object ID for app registration ${gatewayClientId}.`,
+      hint: "You need directory read access to the app registration the gateway signs in against."
+    });
+  }
+  await patchRedirectUris(appObjectId, fqdn);
+}
 async function patchRedirectUris(appObjectId, fqdn) {
   const targetUri = `https://${fqdn}`;
   const existing = await azJson(
@@ -26473,6 +26486,20 @@ var BootstrapFinishCommand = class extends M8tCommand {
 
 `
       );
+      try {
+        await ensureGatewayRedirectUri(d.gatewayClientId, new URL(d.gatewayUrl).host);
+      } catch (e) {
+        const err = e;
+        this.context.stderr.write(
+          `  ${colors.error("\u26A0 could not authorize sign-in for your webapp:")} ${err.message}
+  ${colors.hint(`Until this is fixed, opening ${d.gatewayUrl} will fail with AADSTS50011 (redirect URI mismatch).`)}
+  ${colors.hint("Ask a directory admin to run:")}
+  ${colors.hint(`    m8t bootstrap finish --repo-root ${repoRoot}   # (as an admin), or by hand:`)}
+  ${colors.hint(`    az ad app update --id ${d.gatewayClientId} --set spa.redirectUris="['${d.gatewayUrl}']"  # (merge, do not overwrite)`)}
+
+`
+        );
+      }
     } catch (e) {
       const err = e;
       this.context.stdout.write(`${colors.success("\u2705 The platform is live.")}