wood-fired-tasks 2.0.4 → 2.0.5

package/CHANGELOG.md

@@ -13,6 +13,23 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.0.5] - 2026-06-08
+
+### Changed
+- **`tasks setup` → Remote now tells you the truth about what a server needs for
+  browser login.** When the server reports OIDC ready but you entered a
+  **plain-http, non-localhost URL**, browser/device login via Google SSO can
+  never complete — identity providers reject non-`https` OAuth redirect URIs
+  except for `localhost`. Previously setup would launch the device flow anyway
+  and the verification page dead-ended at the IdP callback ("unable to connect").
+  Setup now detects this up front and explains it: it tells you to either re-run
+  with an **https** URL (front the server with a TLS reverse proxy / real domain
+  so Google SSO completes) or **paste a personal access token**, and prints the
+  exact on-host command to mint one (`tasks db mint-token --user <email-or-id>`),
+  then drops straight into manual-PAT entry. `https` and `http://localhost`
+  servers are unaffected and complete browser login as before. New exported
+  helper `canUseBrowserSso()`.
+
 ## [v2.0.4] - 2026-06-08
 
 ### Fixed

package/dist/cli/commands/setup.d.ts

@@ -334,6 +334,23 @@ export declare function probeOidcState(baseUrl: string): Promise<OidcProbeResult
  *  - probe failure → manual-PAT (connectivity escape hatch).
  */
 export declare function selectRemoteOnboardingMethod(probe: OidcProbeResult): RemoteOnboardingMethod;
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so the interview can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export declare function canUseBrowserSso(baseUrl: string): boolean;
 /**
  * The minimal identity envelope `GET /api/v1/me` returns (task #809). Mirrors
  * the fields {@link writeCredentials} needs so a manually-pasted PAT lands in

package/dist/cli/commands/setup.js

@@ -604,6 +604,37 @@ export function selectRemoteOnboardingMethod(probe) {
         return 'manual-pat';
     return probe.oidc === 'ready' ? 'device-flow' : 'manual-pat';
 }
+/**
+ * Whether the browser/device login (Google SSO) can actually COMPLETE against
+ * `baseUrl` (#835).
+ *
+ * The whole OIDC dance — the verification page AND the IdP's OAuth callback —
+ * happens at the server's origin, and identity providers (Google especially)
+ * reject non-`https` OAuth redirect URIs *except* for `localhost`/`127.0.0.1`.
+ * So a server reached over plain `http` at a non-localhost address can report
+ * `oidc: 'ready'` yet still be unable to finish browser login: the user's
+ * browser gets bounced to an `http://…/auth/callback` the IdP won't honor. We
+ * detect that up front so the interview can tell the user the truth (need https,
+ * or use a PAT) instead of opening a URL that dead-ends.
+ *
+ * Returns true for any `https` URL and for `http://localhost` / `127.0.0.1` /
+ * `[::1]`; false for plain-http non-loopback hosts and unparseable input.
+ */
+export function canUseBrowserSso(baseUrl) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === 'https:')
+        return true;
+    if (url.protocol !== 'http:')
+        return false;
+    const host = url.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+}
 /**
  * Default manual-PAT persistence (task #809).
  *
@@ -811,6 +842,28 @@ export async function runRemoteOnboarding(options = {}) {
     // 3. Branch on the selected method.
     let method = selectRemoteOnboardingMethod(probeResult);
     const oidc = probeResult.ok ? probeResult.oidc : null;
+    // #835: even when the server reports OIDC ready, browser login can only
+    // COMPLETE over https (or localhost) — Google rejects non-https OAuth
+    // redirect URIs everywhere else. Catch a plain-http non-localhost URL here
+    // and tell the user plainly, then route to manual-PAT entry (with on-host
+    // mint instructions) rather than opening a verification URL that dead-ends at
+    // the IdP callback.
+    if (method === 'device-flow' && !canUseBrowserSso(baseUrl)) {
+        log('');
+        log(`"${baseUrl}" is plain http at a non-localhost address.`);
+        log('Browser login via Google SSO requires an https URL — identity providers');
+        log('reject non-https OAuth redirect URIs except for localhost — so the device');
+        log('flow cannot complete against this server. To finish setup, either:');
+        log('  • re-run with an https URL for this server (e.g. front it with a TLS');
+        log('    reverse proxy / real domain so Google SSO completes), or');
+        log('  • paste a personal access token now.');
+        log('');
+        log('To mint a PAT, run this ON THE SERVER HOST:');
+        log('  tasks db mint-token --user <your-email-or-user-id>');
+        log('(or create one from your account page once logged in via the browser).');
+        log('');
+        method = 'manual-pat';
+    }
     if (method === 'device-flow') {
         // Self-provision a PAT via the OIDC device flow (#806). runDeviceLogin owns
         // the entire RFC 8628 exchange AND persists the minted PAT via the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wood-fired-tasks",
-  "version": "2.0.4",
+  "version": "2.0.5",
   "description": "Network-wide task tracking system for Wood Fired Games",
   "keywords": [
     "task-tracker",