@stjoseph/prumo 0.5.0 → 0.6.0

package/dist/pnpm-extended.js

@@ -0,0 +1,159 @@
+// pnpm applies a compatibility database, @yarnpkg/extensions, to every manifest it reads: the registry's packages and
+// the project's own package.json alike. An entry matches by name and version range, and the template version 0.0.1
+// falls inside ranges like `ws@<7.2.1`. A project carrying one of these names therefore gains the dependencies the
+// entry adds, installed into its root, and a package among them with a build script stops `pnpm install` with
+// ERR_PNPM_IGNORED_BUILDS. Each name maps to the packages it would add.
+//
+// Derived from @yarnpkg/extensions, pinned in devDependencies, by test/names.spec.ts, which fails when this list and
+// the database part ways. Only names a project can take are kept, and only entries that add a package: one that sets
+// nothing but peerDependenciesMeta changes no install.
+export const EXTENDED_BY_PNPM = {
+    'apollo-upload-client': ['graphql'],
+    'auto-relay': ['reflect-metadata'],
+    'babel-plugin-graphql-tag': ['graphql'],
+    'babel-plugin-remove-graphql-queries': ['@babel/runtime', '@babel/types', 'gatsby-core-utils'],
+    'babel-plugin-transform-typescript-metadata': ['@babel/core', '@babel/traverse'],
+    'babel-preset-gatsby-package': ['@babel/runtime'],
+    'bin-links': ['mkdirp-infer-owner'],
+    'cacheable-lookup': ['@types/keyv'],
+    'clipanion-v3-codemod': ['jscodeshift'],
+    'connect-mongo': ['express-session'],
+    consolidate: [
+        'arc-templates',
+        'atpl',
+        'babel-core',
+        'bracket-template',
+        'coffee-script',
+        'dot',
+        'dust',
+        'dustjs-helpers',
+        'dustjs-linkedin',
+        'eco',
+        'ect',
+        'ejs',
+        'haml-coffee',
+        'hamlet',
+        'hamljs',
+        'handlebars',
+        'hogan.js',
+        'htmling',
+        'jade',
+        'jazz',
+        'jqtpl',
+        'just',
+        'liquid-node',
+        'liquor',
+        'lodash',
+        'marko',
+        'mote',
+        'mustache',
+        'nunjucks',
+        'plates',
+        'pug',
+        'qejs',
+        'ractive',
+        'razor-tmpl',
+        'react',
+        'react-dom',
+        'slm',
+        'squirrelly',
+        'swig',
+        'swig-templates',
+        'teacup',
+        'templayed',
+        'then-jade',
+        'then-pug',
+        'tinyliquid',
+        'toffee',
+        'twig',
+        'twing',
+        'underscore',
+        'vash',
+        'velocityjs',
+        'walrus',
+        'whiskers',
+    ],
+    'cordova-ios': ['underscore'],
+    'cordova-lib': ['underscore'],
+    'create-gatsby': ['@babel/runtime'],
+    'elm-webpack-loader': ['temp'],
+    'eslint-import-resolver-vite': ['debug', 'resolve'],
+    fdir: ['picomatch'],
+    'fork-ts-checker-webpack-plugin': ['eslint', 'typescript', 'vue-template-compiler', 'webpack'],
+    'gatsby-admin': ['@babel/runtime'],
+    'gatsby-cli': ['@babel/runtime'],
+    'gatsby-core-utils': ['@babel/runtime', 'got'],
+    'gatsby-design-tokens': ['@babel/runtime'],
+    'gatsby-legacy-polyfills': ['@babel/runtime'],
+    'gatsby-plugin-benchmark-reporting': ['@babel/runtime'],
+    'gatsby-plugin-favicon': ['webpack'],
+    'gatsby-plugin-gatsby-cloud': ['gatsby-core-utils', 'webpack'],
+    'gatsby-plugin-graphql-config': ['@babel/runtime'],
+    'gatsby-plugin-i18n': ['ramda'],
+    'gatsby-plugin-image': ['@babel/runtime'],
+    'gatsby-plugin-mdx': ['@babel/runtime', 'mkdirp'],
+    'gatsby-plugin-netlify-cms': ['@babel/runtime'],
+    'gatsby-plugin-no-sourcemaps': ['@babel/runtime'],
+    'gatsby-plugin-page-creator': ['@babel/runtime', 'fs-extra'],
+    'gatsby-plugin-preact': ['@babel/runtime'],
+    'gatsby-plugin-preload-fonts': ['@babel/runtime'],
+    'gatsby-plugin-schema-snapshot': ['@babel/runtime'],
+    'gatsby-plugin-sharp': ['debug'],
+    'gatsby-plugin-styletron': ['@babel/runtime'],
+    'gatsby-plugin-subfont': ['@babel/runtime'],
+    'gatsby-plugin-utils': ['@babel/runtime', 'fastq', 'graphql'],
+    'gatsby-react-router-scroll': ['prop-types'],
+    'gatsby-recipes': ['@babel/runtime'],
+    'gatsby-remark-prismjs': ['lodash'],
+    'gatsby-source-apiserver': ['babel-polyfill'],
+    'gatsby-source-shopify': ['@babel/runtime'],
+    'gatsby-source-wikipedia': ['@babel/runtime'],
+    'gatsby-transformer-screenshot': ['@babel/runtime'],
+    'gatsby-worker': ['@babel/runtime'],
+    'git-node-fs': ['js-git'],
+    got: ['@types/keyv', '@types/responselike'],
+    'http-link-dataloader': ['graphql'],
+    'ink-select-input': ['react'],
+    'jest-vue-preprocessor': ['@babel/core', '@babel/template', 'pug'],
+    'jss-plugin-rule-value-function': ['tiny-warning'],
+    mqtt: ['duplexify'],
+    'query-ast': ['lodash'],
+    'rc-animate': ['react', 'react-dom'],
+    'react-bootstrap-table2-paginator': ['classnames'],
+    'react-color': ['react'],
+    'react-dev-utils': ['typescript', 'webpack'],
+    'react-draggable': ['react', 'react-dom'],
+    'react-github-btn': ['react'],
+    'react-instantsearch-core': ['algoliasearch'],
+    'react-instantsearch-dom': ['react-fast-compare'],
+    'react-live': ['react', 'react-dom'],
+    'react-portal': ['react-dom'],
+    'react-rnd': ['react', 'react-dom'],
+    'react-scripts': ['eslint', 'react'],
+    reactcss: ['react'],
+    rebass: ['react'],
+    'redux-persist': ['react'],
+    'redux-thunk': ['redux'],
+    'rollup-plugin-polyfill-node': ['rollup'],
+    'scss-parser': ['lodash'],
+    skypack: ['tar'],
+    snowpack: ['magic-string'],
+    terser: ['acorn'],
+    testcafe: ['@babel/plugin-transform-for-of', '@babel/runtime'],
+    'testcafe-legacy-api': ['read-file-relative', 'testcafe-hammerhead'],
+    'typescript-language-server': ['vscode-jsonrpc', 'vscode-languageserver-protocol'],
+    unified: ['@types/unist'],
+    'unplugin-vue2-script-setup': ['@vue/composition-api', '@vue/runtime-dom'],
+    'vite-plugin-vuetify': ['vue'],
+    'volar-service-typescript': ['typescript'],
+    'volar-service-typescript-twoslash-queries': ['typescript'],
+    'vue-cli-plugin-vuetify': ['null-loader', 'semver'],
+    'vue-i18n': ['vue'],
+    'vue-loader': ['@vue/compiler-sfc', 'webpack'],
+    'vue-router': ['vue'],
+    'vue-template-babel-compiler': ['vue-template-compiler'],
+    'webpack-plugin-vuetify': ['vue'],
+    'winston-transport': ['logform'],
+    ws: ['bufferutil', 'utf-8-validate'],
+    xo: ['webpack'],
+};

package/dist/questions.js

@@ -1,7 +1,7 @@
+import { defaultApps, parseApp, TYPES, typesOf, validateApps } from "./apps.js";
 import { SOCIAL_PROVIDERS } from "./features.js";
 import { projectAt, targetProblem, validateProjectName } from "./names.js";
 import { CliError } from "./output.js";
-const TYPES = ['api', 'web', 'mobile', 'site'];
 const TENANT_AWARE = ['api', 'web', 'mobile'];
 function missing(flag) {
     throw new CliError('needs_input', `Missing ${flag}. Outside an interactive terminal every answer must come from a flag.`);
@@ -59,18 +59,27 @@ export async function resolveAnswers(flags, asker, cwd = process.cwd()) {
     if (occupied !== undefined) {
         throw new CliError('target_not_empty', occupied);
     }
+    const named = (flags.apps ?? []).map(parseApp);
     let types;
     if (flags.types !== undefined) {
         types = parseTypes(flags.types);
     }
+    else if (named.length > 0) {
+        types = [];
+    }
     else if (asker !== undefined) {
         types = await asker.types();
     }
     else {
         missing('--types');
     }
+    // The types answered take their own names; an app named on purpose comes after them.
+    let apps = [...defaultApps(types), ...named];
     let architecture;
-    if (types.length > 1) {
+    if (named.length > 0 && flags.alone) {
+        throw new CliError('invalid_input', '--app names an app inside a workspace; drop --alone.');
+    }
+    if (apps.length > 1 || named.length > 0) {
         if (flags.alone) {
             throw new CliError('invalid_input', '--alone holds a single type; several types make a workspace.');
         }
@@ -85,6 +94,16 @@ export async function resolveAnswers(flags, asker, cwd = process.cwd()) {
     else {
         missing('--alone or --monorepo');
     }
+    // Renaming an app, or adding another web or site, is for those who ask: offered once, after the types were asked
+    // rather than passed, and answered no by default. With flags, --app says it.
+    if (architecture === 'monorepo' &&
+        flags.types === undefined &&
+        named.length === 0 &&
+        asker !== undefined) {
+        apps = await asker.apps(apps, name);
+    }
+    validateApps(apps, name);
+    types = typesOf(apps);
     let multiTenant = false;
     if (!types.some((type) => TENANT_AWARE.includes(type))) {
         if (flags.multiTenant) {
@@ -162,5 +181,5 @@ export async function resolveAnswers(flags, asker, cwd = process.cwd()) {
         warnings.push('Without --email no password account is ever confirmed, so the first sign-in with a provider for an existing ' +
             "account's email removes its password: the owner keeps the account through the provider. --email avoids it.");
     }
-    return { name, types, architecture, multiTenant, mcp, email, social, target, warnings };
+    return { name, types, apps, architecture, multiTenant, mcp, email, social, target, warnings };
 }

package/dist/workspace-yaml.js

@@ -0,0 +1,91 @@
+// pnpm-workspace.yaml as Prumo writes it: `catalog:`, `catalogs:` with a block per named catalog, and `allowBuilds:`,
+// each a top-level key with its entries indented below it. An app that joins only adds to them: an entry already
+// there is the workspace's, and its version wins, since a team that moved it did so on purpose.
+const entryName = (line) => /^\s*'?([^'#\s][^':]*)'?\s*:/.exec(line)?.[1];
+const indentOf = (line) => line.length - line.trimStart().length;
+// The lines of a block's entries, from the line after its key to the first line indented no deeper than it.
+function block(lines, key, indent, from = 0, to = lines.length) {
+    const start = lines.findIndex((line, index) => index >= from && index < to && line === `${' '.repeat(indent)}${key}:`);
+    if (start === -1) {
+        return undefined;
+    }
+    let end = start + 1;
+    while (end < to && (lines[end]?.trim() === '' || indentOf(lines[end] ?? '') > indent)) {
+        end += 1;
+    }
+    // Blank lines before the next key belong to the gap, not to the block.
+    while (end > start + 1 && lines[end - 1]?.trim() === '') {
+        end -= 1;
+    }
+    return { start, end };
+}
+function addEntries(lines, where, entries, indent) {
+    const present = new Set(lines
+        .slice(where.start + 1, where.end)
+        .map(entryName)
+        .filter((name) => name !== undefined));
+    const missing = Object.keys(entries)
+        .filter((name) => !present.has(name))
+        .sort()
+        .map((name) => `${' '.repeat(indent)}'${name}': ${entries[name]}`);
+    lines.splice(where.end, 0, ...missing);
+}
+export function addToCatalogs(text, catalogs) {
+    const lines = text.replace(/\n$/, '').split('\n');
+    const catalog = block(lines, 'catalog', 0);
+    if (catalog === undefined) {
+        lines.push('', 'catalog:');
+        addEntries(lines, { start: lines.length - 1, end: lines.length }, catalogs.default, 2);
+    }
+    else {
+        addEntries(lines, catalog, catalogs.default, 2);
+    }
+    for (const [name, entries] of Object.entries(catalogs.named)) {
+        let named = block(lines, 'catalogs', 0);
+        if (named === undefined) {
+            lines.push('', 'catalogs:');
+            named = { start: lines.length - 1, end: lines.length };
+        }
+        const own = block(lines, name, 2, named.start + 1, named.end);
+        if (own === undefined) {
+            lines.splice(named.end, 0, `  ${name}:`);
+            addEntries(lines, { start: named.end, end: named.end + 1 }, entries, 4);
+        }
+        else {
+            addEntries(lines, own, entries, 4);
+        }
+    }
+    return `${lines.join('\n')}\n`;
+}
+// Each approval arrives with the comment above it that says why, as the template wrote them.
+export function addApprovals(text, approvals) {
+    const lines = text.replace(/\n$/, '').split('\n');
+    let builds = block(lines, 'allowBuilds', 0);
+    if (builds === undefined) {
+        if (approvals.length === 0) {
+            return text;
+        }
+        lines.push('', 'allowBuilds:');
+        builds = { start: lines.length - 1, end: lines.length };
+    }
+    const present = new Set(lines
+        .slice(builds.start + 1, builds.end)
+        .map(entryName)
+        .filter((name) => name !== undefined));
+    const added = [];
+    let comments = [];
+    for (const line of approvals) {
+        if (line.trimStart().startsWith('#')) {
+            comments.push(line);
+            continue;
+        }
+        const name = entryName(line);
+        if (name !== undefined && !present.has(name)) {
+            added.push(...comments, line);
+            present.add(name);
+        }
+        comments = [];
+    }
+    lines.splice(builds.end, 0, ...added);
+    return `${lines.join('\n')}\n`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stjoseph/prumo",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Scaffolds a TypeScript project and ships it the conventions it follows, in a .prumo/ folder any AI assistant reads.",
   "keywords": [
     "scaffolding",
@@ -48,6 +48,9 @@
   "devDependencies": {
     "@biomejs/biome": "2.5.13",
     "@types/node": "24.13.4",
+    "@types/semver": "7.8.0",
+    "@yarnpkg/extensions": "2.0.7",
+    "semver": "7.8.5",
     "typescript": "6.0.3",
     "vitest": "4.1.11"
   },

package/templates/api/.env.example

@@ -10,6 +10,7 @@ POSTGRES_PORT=5432
 # Signs the access tokens. `prumo new` writes a random one into .env; never reuse it between environments.
 JWT_SECRET=replace-this-with-at-least-32-characters
 API_URL=http://localhost:3000
+# Every web app the API answers, comma-separated. The first is where MCP consent opens.
 WEB_ORIGIN=http://localhost:5173
 # prumo:social
 # The mobile app's scheme, as in app.json: where it is sent back after signing in with a provider.

package/templates/api/README.md

@@ -51,7 +51,8 @@ one comes from.
 <!-- prumo:mcp -->
 
 The MCP server answers at `/api/mcp`. This API is also the OAuth authorization server that issues its tokens: an MCP
-client finds it through `/.well-known/oauth-protected-resource`, and the user signs in and consents on the web app.
+client finds it through `/.well-known/oauth-protected-resource`, and the user signs in and consents on the first web
+app in `WEB_ORIGIN`.
 <!-- prumo:end-mcp -->
 
 ## Everyday commands

package/templates/api/scripts/ports.mjs

@@ -14,22 +14,23 @@ import { basename, dirname, join, resolve } from 'node:path'
 import { createInterface } from 'node:readline/promises'
 import { parseArgs } from 'node:util'
 
-// Where each app keeps its port, what it falls back to, and how its dev command is told about it.
-const APPS = {
+// Where an app of each type keeps its port, what it falls back to, and how its dev command is told about it.
+const TYPES = {
   api: { key: 'PORT', fallback: 3000, flag: [] },
   web: { key: 'WEB_PORT', fallback: 5173, flag: ['--port', '--strictPort'] },
   site: { key: 'SITE_PORT', fallback: 3200, flag: ['--port'] },
   mobile: { key: 'METRO_PORT', fallback: 8081, flag: ['--port'] },
 }
 
-// A port that moves takes these with it: the key to write, in which app, from which app's port.
+// A port that moves takes these with it: the key to write, in every app of which type. A list holds one URL per app,
+// so only the moving app's entry changes.
 const FOLLOWERS = {
   api: [
-    { app: 'api', key: 'API_URL' },
-    { app: 'web', key: 'VITE_API_URL' },
-    { app: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
+    { type: 'api', key: 'API_URL' },
+    { type: 'web', key: 'VITE_API_URL' },
+    { type: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
   ],
-  web: [{ app: 'api', key: 'WEB_ORIGIN' }],
+  web: [{ type: 'api', key: 'WEB_ORIGIN', list: true }],
   site: [],
   mobile: [],
 }
@@ -117,36 +118,43 @@ function projectRoot() {
 const root = projectRoot()
 const workspace = existsSync(join(root, 'apps'))
 
-function directoryOf(type) {
-  return workspace ? join(root, 'apps', type) : root
+function readConfig() {
+  const path = join(root, '.prumo', 'config.json')
+
+  return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {}
 }
 
-function typeOf(directory) {
-  const name = basename(directory)
+// Every app of the project, as { name, type, directory }. A workspace lists its apps in .prumo/config.json; one written
+// before apps had names holds one per type, named after it. An alone project is its one app, named after its type.
+function projectApps() {
+  const config = readConfig()
+
+  if (!workspace) {
+    // A project is named by its author, so only .prumo/config.json says what it is.
+    const type = TYPES[basename(root)] !== undefined ? basename(root) : config.types?.[0]
 
-  if (APPS[name] !== undefined) {
-    return name
+    return type === undefined ? [] : [{ name: type, type, directory: root }]
   }
 
-  // An alone project is named by its author, so only .prumo/config.json says what it is.
-  const config = join(root, '.prumo', 'config.json')
-  const types = existsSync(config) ? JSON.parse(readFileSync(config, 'utf8')).types : []
+  const listed = config.apps ?? (config.types ?? []).map((type) => ({ name: type, type }))
 
-  return types[0]
+  return listed
+    .map((app) => ({ ...app, directory: join(root, 'apps', app.name) }))
+    .filter(
+      (app) => TYPES[app.type] !== undefined && existsSync(join(app.directory, 'package.json')),
+    )
 }
 
-function typesToCheck() {
-  if (!values.all) {
-    return [typeOf(here)]
-  }
+const apps = projectApps()
 
-  return Object.keys(APPS).filter((type) => existsSync(join(directoryOf(type), 'package.json')))
+function appsToCheck() {
+  return values.all ? apps : apps.filter((app) => app.directory === here)
 }
 
-function portOf(type) {
-  const app = APPS[type]
+function portOf(app) {
+  const { key, fallback } = TYPES[app.type]
 
-  return Number(envValue(readEnv(directoryOf(type)), app.key) ?? app.fallback)
+  return Number(envValue(readEnv(app.directory), key) ?? fallback)
 }
 
 function listening(host, port) {
@@ -269,22 +277,31 @@ async function nextFree(from) {
   throw new Failure('port_busy', `No free port between ${from + 1} and ${from + PORTS_TRIED - 1}.`)
 }
 
-function movePort(type, port) {
-  const app = APPS[type]
+function movePort(app, from, port) {
+  const before = `http://localhost:${from}`
+  const after = `http://localhost:${port}`
 
-  writeEnvValue(directoryOf(type), app.key, port)
+  writeEnvValue(app.directory, TYPES[app.type].key, port)
 
-  for (const follower of FOLLOWERS[type]) {
-    const directory = directoryOf(follower.app)
+  for (const follower of FOLLOWERS[app.type]) {
+    for (const other of apps.filter((each) => each.type === follower.type)) {
+      const current = envValue(readEnv(other.directory), follower.key)
+      const entries = (current ?? '').split(',').map((entry) => entry.trim())
+      const value =
+        follower.list && current !== undefined
+          ? (entries.includes(before)
+              ? entries.map((entry) => (entry === before ? after : entry))
+              : [...entries, after]
+            ).join(',')
+          : after
 
-    if (existsSync(join(directory, 'package.json'))) {
-      writeEnvValue(directory, follower.key, `http://localhost:${port}`)
+      writeEnvValue(other.directory, follower.key, value)
     }
   }
 }
 
-async function settle(type) {
-  const port = portOf(type)
+async function settle(app) {
+  const port = portOf(app)
 
   if (!(await taken(port))) {
     return port
@@ -292,12 +309,12 @@ async function settle(type) {
 
   const found = holders(port)
 
-  say(`${type} wants port ${port}, held by ${describe(found)}.`)
+  say(`${app.name} wants port ${port}, held by ${describe(found)}.`)
 
   const moved = async () => {
     const free = await nextFree(port)
-    movePort(type, free)
-    say(`${type} moved to port ${free}, written to .env.`)
+    movePort(app, port, free)
+    say(`${app.name} moved to port ${free}, written to .env.`)
     return free
   }
 
@@ -311,7 +328,7 @@ async function settle(type) {
   if (!interactive) {
     throw new Failure(
       'port_busy',
-      `Port ${port} is in use by ${describe(found)}. Pass --kill to stop it, or --change to move ${type} to the next free port.`,
+      `Port ${port} is in use by ${describe(found)}. Pass --kill to stop it, or --change to move ${app.name} to the next free port.`,
     )
   }
 
@@ -669,10 +686,8 @@ async function main() {
   const starting = command === undefined ? undefined : startJob()
 
   try {
-    for (const type of typesToCheck()) {
-      if (type !== undefined) {
-        ports[type] = await settle(type)
-      }
+    for (const app of appsToCheck()) {
+      ports[app.name] = await settle(app)
     }
   } catch (error) {
     ;(await starting)?.close()
@@ -685,10 +700,10 @@ async function main() {
 
   // Only an app tells its command which port to use. A workspace root wraps `pnpm`, which would pass a stray
   // `--port` on to every app it runs.
-  const [type] = values.all ? [] : Object.keys(ports)
-  const flag = APPS[type ?? '']?.flag ?? []
+  const [app] = values.all ? [] : appsToCheck()
+  const flag = app === undefined ? [] : TYPES[app.type].flag
   const withPort = flag.flatMap((entry) =>
-    entry === '--port' ? ['--port', String(ports[type])] : [entry],
+    entry === '--port' ? ['--port', String(ports[app.name])] : [entry],
   )
   // Before the command starts, so that it and everything it starts are members from their first instant.
   const job = await starting

package/templates/api/src/infra/config/env.ts

@@ -1,6 +1,9 @@
 import { existsSync } from 'node:fs'
 import { z } from 'zod'
 
+// Written as a browser sends it in an Origin header: scheme, host and port, with no path or trailing slash.
+const origin = z.url().transform((url) => new URL(url).origin)
+
 const envSchema = z.object({
   NODE_ENV: z.enum(['development', 'test', 'production']),
   PORT: z.coerce.number().int().min(1).max(65535),
@@ -8,7 +11,11 @@ const envSchema = z.object({
   JWT_SECRET: z.string().min(32),
   // Where this API is reached from outside: the issuer of its tokens, and what decides whether cookies are Secure.
   API_URL: z.url(),
-  WEB_ORIGIN: z.string().min(1),
+  // Every web app this API answers, comma-separated. The first is the one MCP consent opens on.
+  WEB_ORIGIN: z
+    .string()
+    .transform((value) => value.split(',').map((origin) => origin.trim()))
+    .pipe(z.tuple([origin], origin)),
   // prumo:social
   // Where a mobile app is sent back after signing in with a provider: its own scheme, as in app.json.
   MOBILE_APP_SCHEME: z

package/templates/api/src/infra/http/controllers/oauth.controller.ts

@@ -129,8 +129,8 @@ export async function oauthController(fastify: FastifyInstance): Promise<void> {
           scopesSupported,
         )
 
-        // Signing in, if needed, and the consent itself happen on the web app.
-        return reply.redirect(`${env.WEB_ORIGIN}/consent?request=${authorization.id}`)
+        // Signing in, if needed, and the consent itself happen on the first web app.
+        return reply.redirect(`${env.WEB_ORIGIN[0]}/consent?request=${authorization.id}`)
       } catch (error) {
         if (error instanceof AuthorizationRequestError) {
           return reply.redirect(

package/templates/api/src/infra/http/controllers/social.controller.ts

@@ -51,10 +51,14 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
     path: '/api/auth/social',
   } as const
 
-  const back = (client: SocialClient, query: Record<string, string>) =>
+  // A web app is sent back to itself, so only an origin this API trusts is ever a destination.
+  const trusted = (origin: string | undefined) =>
+    origin !== undefined && env.WEB_ORIGIN.includes(origin) ? origin : env.WEB_ORIGIN[0]
+
+  const back = (client: SocialClient, origin: string, query: Record<string, string>) =>
     client === 'mobile'
       ? `${env.MOBILE_APP_SCHEME}://social?${new URLSearchParams(query)}`
-      : `${env.WEB_ORIGIN}/sign-in?${new URLSearchParams(query)}`
+      : `${origin}/sign-in?${new URLSearchParams(query)}`
 
   // Apple's answer is a form.
   app.addContentTypeParser(
@@ -73,11 +77,19 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
         querystring: z.object({
           client: z.enum(['web', 'mobile']).default('web'),
           returnTo: z.string().max(512).optional(),
+          // The web app that started, when there are several; one the API does not trust is refused.
+          origin: z.string().max(512).optional(),
         }),
       },
     },
     async (request, reply) => {
-      const { client, returnTo } = request.query
+      const { client, returnTo, origin: requested } = request.query
+
+      if (requested !== undefined && !env.WEB_ORIGIN.includes(requested)) {
+        throw new HttpError(422, 'origin is not one of the web apps this API trusts')
+      }
+
+      const origin = client === 'web' ? trusted(requested) : ''
 
       if (client === 'mobile' && env.MOBILE_APP_SCHEME === undefined) {
         throw new HttpError(
@@ -92,8 +104,9 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
         returnTo: safePath(returnTo),
       })
 
-      // The client rides beside the token, so an error found before the flow is read still goes to the right place.
-      reply.setCookie(BROWSER_COOKIE, `${client}~${started.browserToken}`, {
+      // The client and its origin ride beside the token, so an error found before the flow is read still goes to the
+      // right place.
+      reply.setCookie(BROWSER_COOKIE, `${client}~${origin}~${started.browserToken}`, {
         ...cookie,
         maxAge: BROWSER_COOKIE_MAX_AGE_S,
       })
@@ -132,16 +145,17 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
       },
     },
     async (request, reply) => {
-      const [client, browserToken] = (request.cookies[BROWSER_COOKIE] ?? 'web~').split('~') as [
-        SocialClient,
-        string,
-      ]
+      const [client, written, browserToken] = (request.cookies[BROWSER_COOKIE] ?? 'web~~').split(
+        '~',
+      ) as [SocialClient, string | undefined, string | undefined]
+      // Read back through the list, so a cookie edited by hand cannot name a destination of its own.
+      const origin = trusted(written)
       const { state, code, error } = request.query
 
       reply.clearCookie(BROWSER_COOKIE, cookie)
 
       if (error !== undefined || state === undefined || code === undefined) {
-        return reply.redirect(back(client, { error: 'social_sign_in_failed' }))
+        return reply.redirect(back(client, origin, { error: 'social_sign_in_failed' }))
       }
 
       try {
@@ -154,15 +168,17 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
         })
 
         if (outcome.client === 'mobile') {
-          return reply.redirect(back('mobile', { code: outcome.code }))
+          return reply.redirect(back('mobile', origin, { code: outcome.code }))
         }
 
         setCookies(reply, outcome.tokens)
 
-        return reply.redirect(`${env.WEB_ORIGIN}${outcome.returnTo}`)
+        return reply.redirect(`${origin}${outcome.returnTo}`)
       } catch (caught) {
         if (caught instanceof DomainError) {
-          return reply.redirect(back(client, { error: caught.code ?? 'social_sign_in_failed' }))
+          return reply.redirect(
+            back(client, origin, { error: caught.code ?? 'social_sign_in_failed' }),
+          )
         }
 
         throw caught