wood-fired-tasks 2.0.3 → 2.0.5

package/CHANGELOG.md

@@ -13,6 +13,43 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.0.5] - 2026-06-08
+
+### Changed
+- **`tasks setup` → Remote now tells you the truth about what a server needs for
+  browser login.** When the server reports OIDC ready but you entered a
+  **plain-http, non-localhost URL**, browser/device login via Google SSO can
+  never complete — identity providers reject non-`https` OAuth redirect URIs
+  except for `localhost`. Previously setup would launch the device flow anyway
+  and the verification page dead-ended at the IdP callback ("unable to connect").
+  Setup now detects this up front and explains it: it tells you to either re-run
+  with an **https** URL (front the server with a TLS reverse proxy / real domain
+  so Google SSO completes) or **paste a personal access token**, and prints the
+  exact on-host command to mint one (`tasks db mint-token --user <email-or-id>`),
+  then drops straight into manual-PAT entry. `https` and `http://localhost`
+  servers are unaffected and complete browser login as before. New exported
+  helper `canUseBrowserSso()`.
+
+## [v2.0.4] - 2026-06-08
+
+### Fixed
+- **Device-flow `verification_uri` now points at the address the client actually
+  connected to, not `localhost`.** `POST /auth/device/code` built the URL the
+  user opens in a browser from a STATIC configured origin (`OIDC_REDIRECT_URI`'s
+  origin), which is typically `http://localhost:3000`. A CLI that reached the
+  server over the LAN (e.g. `http://192.168.x.x:3000`) was told to open a
+  `localhost` URL pointing at its OWN machine — a dead end. The origin is now
+  derived per-request from the `Host` header (honoring `X-Forwarded-Host` /
+  `X-Forwarded-Proto` from a trusted reverse proxy), falling back to the
+  configured origin only when no `Host` is present. This is not a
+  host-header-injection vector: the `verification_uri` is returned only to the
+  same client that made the request. (Note: a Google-backed server whose OAuth
+  callback is `http://localhost` still can't complete the *browser login* leg
+  for a remote client — Google forbids non-`localhost` `http` redirect URIs — so
+  remote clients should use `tasks setup --remote <url> --token <pat>` or an
+  HTTPS domain. This fix makes the verification URL correct for properly
+  routable servers.)
+
 ## [v2.0.3] - 2026-06-08
 
 ### Fixed

package/dist/api/routes/auth/device-code.d.ts

@@ -26,9 +26,15 @@
 import type { FastifyPluginAsync } from 'fastify';
 export interface DeviceCodeRouteOptions {
     /**
-     * Server origin used to build the verification URIs the CLI prints. Plan
-     * 30-08 sources this from `new URL(env.OIDC_REDIRECT_URI).origin`.
-     * Example: `https://woodfiredbugs.local`.
+     * FALLBACK origin for the verification URIs the CLI prints, used only when
+     * the request carries no usable Host header. Plan 30-08 sources this from
+     * `new URL(env.OIDC_REDIRECT_URI).origin`. Example: `https://woodfiredbugs.local`.
+     *
+     * #834: the verification origin is now derived PER-REQUEST from the address
+     * the client actually connected to (see {@link resolveVerificationOrigin}),
+     * because this configured value is typically `http://localhost:3000` and is
+     * unroutable for any client that reached the server over the LAN / a real
+     * hostname. `origin` remains as the no-Host-header fallback.
      */
     origin: string;
     /**
@@ -37,5 +43,25 @@ export interface DeviceCodeRouteOptions {
      */
     expectedClientId: string;
 }
+/**
+ * Resolve the origin (`scheme://host[:port]`) the CLIENT used to reach this
+ * server, for building the device-flow `verification_uri` the user opens in a
+ * browser (#834).
+ *
+ * Previously this was a STATIC configured origin (`OIDC_REDIRECT_URI`'s origin),
+ * which is `http://localhost:3000` on a typical server — so a CLI that connected
+ * over the LAN (e.g. `http://192.168.x.x:3000`) was told to open a localhost URL
+ * pointing at its OWN machine. We instead use the host the request arrived on,
+ * honoring `X-Forwarded-{Host,Proto}` from a trusted reverse proxy.
+ *
+ * Security: this is NOT a host-header-injection vector. The `verification_uri`
+ * is returned ONLY to the same client that sent the request, so a spoofed Host
+ * merely misdirects the spoofer. Falls back to `fallback` (the configured
+ * origin) when no Host header is present at all.
+ */
+export declare function resolveVerificationOrigin(request: {
+    headers: Record<string, string | string[] | undefined>;
+    protocol?: string;
+}, fallback: string): string;
 declare const deviceCodeRoute: FastifyPluginAsync<DeviceCodeRouteOptions>;
 export default deviceCodeRoute;

package/dist/api/routes/auth/device-code.js

@@ -1,5 +1,38 @@
 import { z } from 'zod';
 import { createSession } from '../../../services/device-flow-store.js';
+/** First value of a possibly comma-joined / array-valued HTTP header. */
+function firstHeaderValue(v) {
+    const raw = Array.isArray(v) ? v[0] : v;
+    if (typeof raw !== 'string')
+        return undefined;
+    const first = raw.split(',')[0]?.trim();
+    return first && first.length > 0 ? first : undefined;
+}
+/**
+ * Resolve the origin (`scheme://host[:port]`) the CLIENT used to reach this
+ * server, for building the device-flow `verification_uri` the user opens in a
+ * browser (#834).
+ *
+ * Previously this was a STATIC configured origin (`OIDC_REDIRECT_URI`'s origin),
+ * which is `http://localhost:3000` on a typical server — so a CLI that connected
+ * over the LAN (e.g. `http://192.168.x.x:3000`) was told to open a localhost URL
+ * pointing at its OWN machine. We instead use the host the request arrived on,
+ * honoring `X-Forwarded-{Host,Proto}` from a trusted reverse proxy.
+ *
+ * Security: this is NOT a host-header-injection vector. The `verification_uri`
+ * is returned ONLY to the same client that sent the request, so a spoofed Host
+ * merely misdirects the spoofer. Falls back to `fallback` (the configured
+ * origin) when no Host header is present at all.
+ */
+export function resolveVerificationOrigin(request, fallback) {
+    const host = firstHeaderValue(request.headers['x-forwarded-host']) ??
+        firstHeaderValue(request.headers['host']);
+    if (!host)
+        return fallback;
+    const scheme = firstHeaderValue(request.headers['x-forwarded-proto']) ??
+        (request.protocol && request.protocol.length > 0 ? request.protocol : 'http');
+    return `${scheme}://${host}`;
+}
 /**
  * Body schema for POST /auth/device/code (JSON only — RFC 8628 lets servers
  * pick; the CLI always sends JSON). `scope` is accepted-and-ignored in v1.6
@@ -37,11 +70,15 @@ const deviceCodeRoute = async (fastify, opts) => {
             clientId: client_id,
             hostname: hostname ?? null,
         }, 'device flow started');
+        // #834: build the verification URL from the address the CLIENT connected to
+        // (request Host / X-Forwarded-*), not the static configured origin, so a
+        // remote/LAN client gets a URL it can actually open instead of localhost.
+        const origin = resolveVerificationOrigin(request, opts.origin);
         return reply.code(200).send({
             device_code: session.deviceCode,
             user_code: session.userCode,
-            verification_uri: `${opts.origin}/auth/device`,
-            verification_uri_complete: `${opts.origin}/auth/device?user_code=${session.userCode}`,
+            verification_uri: `${origin}/auth/device`,
+            verification_uri_complete: `${origin}/auth/device?user_code=${session.userCode}`,
             expires_in: 600,
             interval: 5,
         });

package/dist/cli/commands/setup.d.ts

@@ -334,6 +334,23 @@ export declare function probeOidcState(baseUrl: string): Promise<OidcProbeResult
  *  - probe failure → manual-PAT (connectivity escape hatch).
  */
 export declare function selectRemoteOnboardingMethod(probe: OidcProbeResult): RemoteOnboardingMethod;
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so the interview can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export declare function canUseBrowserSso(baseUrl: string): boolean;
 /**
  * The minimal identity envelope `GET /api/v1/me` returns (task #809). Mirrors
  * the fields {@link writeCredentials} needs so a manually-pasted PAT lands in

package/dist/cli/commands/setup.js

@@ -604,6 +604,37 @@ export function selectRemoteOnboardingMethod(probe) {
         return 'manual-pat';
     return probe.oidc === 'ready' ? 'device-flow' : 'manual-pat';
 }
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so the interview can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export function canUseBrowserSso(baseUrl) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === 'https:')
+        return true;
+    if (url.protocol !== 'http:')
+        return false;
+    const host = url.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+}
 /**
  * Default manual-PAT persistence (task #809).
  *
@@ -811,6 +842,28 @@ export async function runRemoteOnboarding(options = {}) {
     // 3. Branch on the selected method.
     let method = selectRemoteOnboardingMethod(probeResult);
     const oidc = probeResult.ok ? probeResult.oidc : null;
+    // #835: even when the server reports OIDC ready, browser login can only
+    // COMPLETE over https (or localhost) — Google rejects non-https OAuth
+    // redirect URIs everywhere else. Catch a plain-http non-localhost URL here
+    // and tell the user plainly, then route to manual-PAT entry (with on-host
+    // mint instructions) rather than opening a verification URL that dead-ends at
+    // the IdP callback.
+    if (method === 'device-flow' && !canUseBrowserSso(baseUrl)) {
+        log('');
+        log(`"${baseUrl}" is plain http at a non-localhost address.`);
+        log('Browser login via Google SSO requires an https URL — identity providers');
+        log('reject non-https OAuth redirect URIs except for localhost — so the device');
+        log('flow cannot complete against this server. To finish setup, either:');
+        log('  • re-run with an https URL for this server (e.g. front it with a TLS');
+        log('    reverse proxy / real domain so Google SSO completes), or');
+        log('  • paste a personal access token now.');
+        log('');
+        log('To mint a PAT, run this ON THE SERVER HOST:');
+        log('  tasks db mint-token --user <your-email-or-user-id>');
+        log('(or create one from your account page once logged in via the browser).');
+        log('');
+        method = 'manual-pat';
+    }
     if (method === 'device-flow') {
         // Self-provision a PAT via the OIDC device flow (#806). runDeviceLogin owns
         // the entire RFC 8628 exchange AND persists the minted PAT via the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wood-fired-tasks",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "description": "Network-wide task tracking system for Wood Fired Games",
   "keywords": [
     "task-tracker",