unoverse 0.1.144 → 0.1.146

package/operator/ansible/playbooks/test-connectivity.yml

@@ -212,7 +212,11 @@
         echo "HTTP $RESULT"
         [ "$RESULT" -ge 200 ] && [ "$RESULT" -lt 500 ]
       loop:
-        - { name: "Canvas", sub: "", path: "/" }
+        # canvas.<domain>, NEVER the bare apex. Neither ground creates an apex record
+        # (aws/main.tf and digitalocean/main.tf publish api.<domain> and canvas.<domain>
+        # only), so `sub: ""` asked for a hostname that has no DNS at all and reported
+        # HTTP 000 FAILED on every healthy deploy.
+        - { name: "Canvas", sub: "canvas.", path: "/" }
         - { name: "API Server", sub: "api.", path: "/health" }
       register: domain_checks
       ignore_errors: yes

package/operator/infra/aws/main.tf

@@ -112,6 +112,19 @@ locals {
   # Where a person actually goes. Shared by the invitation email and the canvas_url output
   # so the address in the email can never drift from the address in the deploy summary.
   canvas_entry = var.domain != "" ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001"
+  # STUDIO IS A CALLBACK THIS GROUND OWNS, exactly like canvas_entry above.
+  #
+  # Studio signs in with `redirect_uri: window.location.origin` (packages/studio
+  # src/UniverseSession.tsx) and serves on a pinned 4108 (vite.config.ts, strictPort). On a
+  # BYO-OIDC ground the operator adds that to their own tenant; here the app client IS a
+  # resource of this module, so leaving it out means every developer who connects Studio to
+  # an AWS universe meets `redirect_mismatch` and has to discover a port number to put in a
+  # variable. The ground knows the address, so the ground allows it.
+  #
+  # Loopback only. It grants nothing on its own: the client is public, the flow is code with
+  # PKCE, and a code returned to 127.0.0.1 is redeemable only by the process that asked for
+  # it. The same reasoning already ships localhost:5173 in terraform.tfvars.example.
+  studio_entry = "http://localhost:4108"
   api_host   = "api.${var.domain}"
   dns_auto   = local.has_domain && var.route53_zone_id != ""
 }
@@ -592,8 +605,8 @@ resource "aws_cognito_user_pool_client" "spa" {
   # canvas_entry is the same expression the invitation email and the canvas_url output use,
   # so the address a person is sent to is by construction an address they may return to.
   # Anything else in the variable (localhost for dev, a second front end) is kept.
-  callback_urls                        = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
-  logout_urls                          = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
+  callback_urls                        = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
+  logout_urls                          = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
   supported_identity_providers         = ["COGNITO"]
 }
 

package/operator/infra/aws/terraform.tfvars.example

@@ -30,9 +30,12 @@ docr_token           = "dop_v1_..."   # registry token (pulls platform images)
 openai_api_key       = "sk-..."       # memory server + OpenAI nodes
 # hyperbrowser_api_key = ""           # optional — page intelligence
 
+# EXTRA sign-in callbacks only. Your Canvas (canvas.<domain>, or the ALB address when
+# there is no domain) and Studio (http://localhost:4108) are allowed automatically — the
+# ground provisions the app client, so it knows those two addresses and adds them itself.
+# List anything else here: a second front end, another dev port.
 oauth_callback_urls = [
-  "https://yourdomain.com",
-  "http://localhost:5173", # local Studio/Canvas dev against this universe
+  "http://localhost:5173", # Canvas dev server
 ]
 
 # RBAC roles (noun:verb — the grammar node manifests' requires.role matches).

package/operator/lib/deploy.sh

@@ -963,7 +963,11 @@ EOF
       # Embed doorway is served AND compressed (identity-encoded JS was a live outage).
       _smoke "embed.js gzipped" sh -c "curl -sf -m 10 -H 'accept-encoding: gzip' -D - '$smoke_api/embed.js' -o /dev/null | grep -qi '^content-encoding: gzip'"
       # MCP lane accepts an initialize (every external connector dies here first).
-      _smoke "MCP initialize" sh -c "curl -sf -m 10 -X POST '$smoke_api/mcp' -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"smoke\",\"version\":\"0\"}}}' -o /dev/null"
+      # 200 (auth off) or 401 (auth on) prove the lane is ALIVE, the same judgement the
+      # database canary below makes. This used `curl -sf`, which fails on any error status,
+      # so a universe that boots "JWT enforced on /mcp" — every Cognito/AWS deployment —
+      # reported FAIL on a correctly protected endpoint and turned a healthy deploy red.
+      _smoke "MCP initialize" sh -c "code=\$(curl -s -m 10 -o /dev/null -w '%{http_code}' -X POST '$smoke_api/mcp' -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"smoke\",\"version\":\"0\"}}}'); [ \"\$code\" = 200 ] || [ \"\$code\" = 401 ]"
       # Engine → Postgres canary: 200 (auth off) or 401 (auth on) prove the chain; a 500
       # is the DB-unreachable incident that hides behind an otherwise healthy stack.
       _smoke "engine reaches database" sh -c "code=\$(curl -s -m 10 -o /dev/null -w '%{http_code}' '$smoke_api/marketplace'); [ \"\$code\" = 200 ] || [ \"\$code\" = 401 ]"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.144",
+  "version": "0.1.146",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",