unoverse 0.1.145 → 0.1.146

package/operator/infra/aws/main.tf

@@ -112,6 +112,19 @@ locals {
   # Where a person actually goes. Shared by the invitation email and the canvas_url output
   # so the address in the email can never drift from the address in the deploy summary.
   canvas_entry = var.domain != "" ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001"
+  # STUDIO IS A CALLBACK THIS GROUND OWNS, exactly like canvas_entry above.
+  #
+  # Studio signs in with `redirect_uri: window.location.origin` (packages/studio
+  # src/UniverseSession.tsx) and serves on a pinned 4108 (vite.config.ts, strictPort). On a
+  # BYO-OIDC ground the operator adds that to their own tenant; here the app client IS a
+  # resource of this module, so leaving it out means every developer who connects Studio to
+  # an AWS universe meets `redirect_mismatch` and has to discover a port number to put in a
+  # variable. The ground knows the address, so the ground allows it.
+  #
+  # Loopback only. It grants nothing on its own: the client is public, the flow is code with
+  # PKCE, and a code returned to 127.0.0.1 is redeemable only by the process that asked for
+  # it. The same reasoning already ships localhost:5173 in terraform.tfvars.example.
+  studio_entry = "http://localhost:4108"
   api_host   = "api.${var.domain}"
   dns_auto   = local.has_domain && var.route53_zone_id != ""
 }
@@ -592,8 +605,8 @@ resource "aws_cognito_user_pool_client" "spa" {
   # canvas_entry is the same expression the invitation email and the canvas_url output use,
   # so the address a person is sent to is by construction an address they may return to.
   # Anything else in the variable (localhost for dev, a second front end) is kept.
-  callback_urls                        = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
-  logout_urls                          = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
+  callback_urls                        = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
+  logout_urls                          = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
   supported_identity_providers         = ["COGNITO"]
 }
 

package/operator/infra/aws/terraform.tfvars.example

@@ -30,9 +30,12 @@ docr_token           = "dop_v1_..."   # registry token (pulls platform images)
 openai_api_key       = "sk-..."       # memory server + OpenAI nodes
 # hyperbrowser_api_key = ""           # optional — page intelligence
 
+# EXTRA sign-in callbacks only. Your Canvas (canvas.<domain>, or the ALB address when
+# there is no domain) and Studio (http://localhost:4108) are allowed automatically — the
+# ground provisions the app client, so it knows those two addresses and adds them itself.
+# List anything else here: a second front end, another dev port.
 oauth_callback_urls = [
-  "https://yourdomain.com",
-  "http://localhost:5173", # local Studio/Canvas dev against this universe
+  "http://localhost:5173", # Canvas dev server
 ]
 
 # RBAC roles (noun:verb — the grammar node manifests' requires.role matches).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.145",
+  "version": "0.1.146",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",