@nado-language/mcp 0.1.3 → 0.1.4

package/README.md

@@ -54,6 +54,8 @@ NADO_MCP_REFRESH_TOKEN='supabase-user-refresh-token'
 
 By default this uses the existing Azure Static Web Apps production site as a static OAuth relay. It does not require a new Azure Function, App Service, database, or paid runtime. The local helper still receives the final callback on `127.0.0.1`; Azure only serves the static relay page.
 
+The installed CLI opens the Nado relay page first. The relay stores the local callback in browser session storage, then sends Supabase a fixed redirect URL. This avoids Supabase rejecting a dynamic `redirect_to` URL with `local_callback` query parameters and falling back to the normal Nado web site.
+
 The MCP server refreshes expired access tokens with `NADO_MCP_REFRESH_TOKEN` and updates the auth file when Supabase rotates the refresh token.
 
 Supported local browser providers are `google`, `kakao`, and `apple`. Naver login is not available in the local MCP flow yet because the current Naver Edge Function uses fixed web/native redirect URLs.
@@ -64,6 +66,8 @@ Supabase Auth must allow the Azure relay redirect URL:
 https://language.nado.ai.kr/auth/mcp-callback
 ```
 
+Register the exact URL above. Do not include `local_callback`, `provider`, or other query parameters in the Supabase allow list.
+
 For direct local callback mode, run with `--redirect-mode local` and allow:
 
 ```text

package/dist/nado-mcp-auth.mjs

@@ -183,19 +183,18 @@ async function login(options) {
 
   const localCallbackUrl = new URL(`http://127.0.0.1:${address.port}/callback`);
   localCallbackUrl.searchParams.set('state', state);
-  const redirectTo = buildRedirectTo(options, localCallbackUrl.toString());
-  const authUrl = buildAuthorizeUrl({
-    supabaseUrl: options.supabaseUrl,
+  const browserUrl = buildBrowserLoginUrl({
+    options,
     provider,
-    redirectTo,
+    localCallbackUrl: localCallbackUrl.toString(),
     codeChallenge,
   });
 
   console.log(`Opening browser for Nado MCP login (${provider}).`);
   console.log(`Local callback: ${localCallbackUrl.toString()}`);
   if (options.redirectMode === 'azure') console.log(`Azure relay: ${options.relayUrl}`);
-  if (!options.noOpen) openBrowser(authUrl);
-  console.log(`If the browser did not open, visit:\n${authUrl}`);
+  if (!options.noOpen) openBrowser(browserUrl);
+  console.log(`If the browser did not open, visit:\n${browserUrl}`);
 
   let timeoutId;
   const timeout = new Promise((_, reject) => {
@@ -217,18 +216,39 @@ function loginTimeoutError(options) {
     'Timed out waiting for browser login.',
     `Rerun \`nado-mcp login --provider ${options.provider} --timeout-ms 900000\` and keep the terminal open until the browser says login completed.`,
     'If the browser did not open, copy the printed URL into the same desktop browser where you can sign in.',
-    'If you already signed in but it still timed out, check that the browser can reach the printed 127.0.0.1 local callback URL and that Supabase Auth allows the relay URL.',
+    'If Google login succeeds but the browser lands on the normal Nado site, upgrade @nado-language/mcp and confirm Supabase Auth allows the exact relay URL without query parameters.',
+    'If it still times out after the relay page says it is returning to the local helper, check that the browser can reach the printed 127.0.0.1 local callback URL.',
   ].join(' '));
 }
 
-function buildRedirectTo(options, localCallbackUrl) {
-  if (options.redirectMode === 'local') return localCallbackUrl;
+function buildBrowserLoginUrl({ options, provider, localCallbackUrl, codeChallenge }) {
+  if (options.redirectMode === 'local') {
+    return buildAuthorizeUrl({
+      supabaseUrl: options.supabaseUrl,
+      provider,
+      redirectTo: localCallbackUrl,
+      codeChallenge,
+    });
+  }
+
+  return buildRelayStartUrl({
+    relayUrl: options.relayUrl,
+    localCallbackUrl,
+    provider,
+    supabaseUrl: options.supabaseUrl,
+    codeChallenge,
+  });
+}
 
-  const relayUrl = new URL(options.relayUrl);
+function buildRelayStartUrl({ relayUrl: value, localCallbackUrl, provider, supabaseUrl, codeChallenge }) {
+  const relayUrl = new URL(value);
   if (relayUrl.protocol !== 'https:') {
     throw new Error('--relay-url must be an HTTPS URL when --redirect-mode azure is used.');
   }
   relayUrl.searchParams.set('local_callback', localCallbackUrl);
+  relayUrl.searchParams.set('provider', provider);
+  relayUrl.searchParams.set('supabase_url', supabaseUrl);
+  relayUrl.searchParams.set('code_challenge', codeChallenge);
   return relayUrl.toString();
 }
 
@@ -498,6 +518,10 @@ Default mode uses the existing Azure Static Web Apps site as a zero-new-resource
 OAuth relay. Supabase Auth must allow this redirect URL:
   ${DEFAULT_RELAY_URL}
 
+The relay starts login with local state in browser sessionStorage, then sends
+Supabase the fixed redirect URL above. Do not add local_callback query strings
+to the Supabase allow list.
+
 The optional local mode requires Supabase Auth to allow:
   http://127.0.0.1:*/callback
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nado-language/mcp",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Nado Language MCP server for saving AI-generated English flashcards and practicing saved materials.",
   "type": "module",
   "private": false,