lael-labs/executor

apps/host-selfhost/src/app.ts+8−2

 import { makeSelfHostMcpSeams } from "./mcp";
 import { selfHostPlugins } from "./plugins";
 import { ErrorCaptureLive } from "./observability";
+import { oauthCallbackSignInRedirectLocation } from "./auth/oauth-callback-login";
 // ===========================================================================
 // The self-hosted Executor app, as ONE `ExecutorApp.make` call.
     // (it can't prove each host's resolution); self-host narrows it here.
     AppLayer: appLayer as Layer.Layer<never>,
     toWebHandler,
+    betterAuth,
     closeDb: async () => {
       await mcp.close();
       await dbHandle.close();
 export const makeSelfHostApiHandler = async (
   options: MakeSelfHostAppOptions = {},
 ): Promise<SelfHostApiHandler> => {
-  const { toWebHandler, closeDb } = await makeSelfHostApp(options);
+  const { toWebHandler, betterAuth, closeDb } = await makeSelfHostApp(options);
   const web = toWebHandler();
   return {
-    handler: web.handler,
+    handler: async (request) => {
+      const location = await oauthCallbackSignInRedirectLocation(request, betterAuth.auth);
+      if (location) return new Response(null, { status: 302, headers: { location } });
+      return web.handler(request);
+    },
     dispose: async () => {
       await web.dispose();
       await closeDb();

apps/host-selfhost/src/auth/oauth-callback-login.test.ts+44−0

@@ -0,0 +1,44 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2
	3	import { oauthCallbackSignInRedirectLocation } from "./oauth-callback-login";
	4
	5	const auth = (session: unknown \| null) => ({
	6	api: {
	7	getSession: async () => session,
	8	},
	9	});
	10
	11	describe("oauthCallbackSignInRedirectLocation", () => {
	12	it("redirects a signed-out OAuth callback to login with returnTo", async () => {
	13	await expect(
	14	oauthCallbackSignInRedirectLocation(
	15	new Request("http://selfhost.test/api/oauth/callback?state=s1&code=c1"),
	16	auth(null),
	17	),
	18	).resolves.toBe("/login?returnTo=%2Fapi%2Foauth%2Fcallback%3Fstate%3Ds1%26code%3Dc1");
	19	});
	20
	21	it("does not redirect a signed-in OAuth callback", async () => {
	22	await expect(
	23	oauthCallbackSignInRedirectLocation(
	24	new Request("http://selfhost.test/api/oauth/callback?state=s1&code=c1"),
	25	auth({ user: { id: "user_1" } }),
	26	),
	27	).resolves.toBeNull();
	28	});
	29
	30	it("ignores other paths and non-browser methods", async () => {
	31	await expect(
	32	oauthCallbackSignInRedirectLocation(
	33	new Request("http://selfhost.test/api/oauth/callback?state=s1", { method: "POST" }),
	34	auth(null),
	35	),
	36	).resolves.toBeNull();
	37	await expect(
	38	oauthCallbackSignInRedirectLocation(
	39	new Request("http://selfhost.test/api/oauth/callback/extra?state=s1"),
	40	auth(null),
	41	),
	42	).resolves.toBeNull();
	43	});
	44	});

apps/host-selfhost/src/auth/oauth-callback-login.ts+23−0

@@ -0,0 +1,23 @@
	1	import { loginPath } from "./return-to";
	2
	3	export const OAUTH_CALLBACK_PATH = "/api/oauth/callback";
	4
	5	interface SessionAuth {
	6	readonly api: {
	7	readonly getSession: (input: { readonly headers: Headers }) => Promise<unknown \| null>;
	8	};
	9	}
	10
	11	export const oauthCallbackSignInRedirectLocation = async (
	12	request: Request,
	13	auth: SessionAuth,
	14	): Promise<string \| null> => {
	15	if (request.method !== "GET" && request.method !== "HEAD") return null;
	16	const url = new URL(request.url);
	17	if (url.pathname !== OAUTH_CALLBACK_PATH) return null;
	18
	19	const session = await auth.api.getSession({ headers: request.headers });
	20	if (session) return null;
	21
	22	return loginPath(`${url.pathname}${url.search}`);
	23	};

apps/host-selfhost/src/auth/return-to.test.ts+58−0

@@ -0,0 +1,58 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2
	3	import { isSafeReturnTo, loginPath, safeReturnTo } from "./return-to";
	4
	5	describe("isSafeReturnTo", () => {
	6	const safe = [
	7	"/",
	8	"/tools",
	9	"/integrations/sentry?addAccount=1",
	10	"/api-keys",
	11	"/api/oauth/callback?state=oauth-state&code=provider-code",
	12	];
	13	for (const path of safe) {
	14	it(`allows ${path}`, () => {
	15	expect(isSafeReturnTo(path)).toBe(true);
	16	});
	17	}
	18
	19	const unsafe = [
	20	"https://evil.example",
	21	"//evil.example",
	22	"/api/auth/logout",
	23	"/api/oauth/callback/extra?state=oauth-state",
	24	"/api",
	25	"javascript:alert(1)",
	26	"tools",
	27	"",
	28	];
	29	for (const path of unsafe) {
	30	it(`rejects ${JSON.stringify(path)}`, () => {
	31	expect(isSafeReturnTo(path)).toBe(false);
	32	});
	33	}
	34	});
	35
	36	describe("safeReturnTo", () => {
	37	it("passes a safe path through", () => {
	38	expect(safeReturnTo("/tools")).toBe("/tools");
	39	});
	40
	41	it("nulls unsafe and absent values", () => {
	42	expect(safeReturnTo("https://evil.example")).toBeNull();
	43	expect(safeReturnTo(null)).toBeNull();
	44	expect(safeReturnTo(undefined)).toBeNull();
	45	});
	46	});
	47
	48	describe("loginPath", () => {
	49	it("omits returnTo for the root", () => {
	50	expect(loginPath("/")).toBe("/login");
	51	});
	52
	53	it("carries OAuth callback resumes URI-encoded", () => {
	54	expect(loginPath("/api/oauth/callback?state=oauth-state&code=provider-code")).toBe(
	55	"/login?returnTo=%2Fapi%2Foauth%2Fcallback%3Fstate%3Doauth-state%26code%3Dprovider-code",
	56	);
	57	});
	58	});

apps/host-selfhost/src/auth/return-to.ts+14−0

@@ -0,0 +1,14 @@
	1	const pathPart = (path: string): string => path.split(/[?#]/, 1)[0] ?? "";
	2
	3	const isOAuthCallbackReturnTo = (path: string): boolean => pathPart(path) === "/api/oauth/callback";
	4
	5	export const isSafeReturnTo = (path: string): boolean =>
	6	path.startsWith("/") &&
	7	!path.startsWith("//") &&
	8	(!/^\/api(\/\|$)/.test(path) \|\| isOAuthCallbackReturnTo(path));
	9
	10	export const safeReturnTo = (path: string \| null \| undefined): string \| null =>
	11	path && isSafeReturnTo(path) ? path : null;
	12
	13	export const loginPath = (returnTo: string): string =>
	14	returnTo === "/" ? "/login" : `/login?returnTo=${encodeURIComponent(returnTo)}`;

apps/host-selfhost/src/serve.ts+35−16

   HttpMiddleware,
   HttpRouter,
   HttpServerRequest,
+  HttpServerResponse,
   HttpStaticServer,
 } from "effect/unstable/http";
 import { BunFileSystem, BunHttpServer, BunPath, BunRuntime } from "@effect/platform-bun";
 import { makeSelfHostApp } from "./app";
 import { loadConfig } from "./config";
+import type { BetterAuthHandle } from "./auth";
+import {
+  OAUTH_CALLBACK_PATH,
+  oauthCallbackSignInRedirectLocation,
+} from "./auth/oauth-callback-login";
 import { stripMcpOrgSegment } from "./mcp/org-path";
 const distDir = fileURLToPath(new URL("../dist/", import.meta.url));
 // Rewrite `/<org>/mcp` (and its OAuth discovery path) to the bare path before
 // routing, so the "Connect an agent" card's org-pinned URL reaches the real
 // `/mcp` route — see ./mcp/org-path. A no-op for every other request.
-const mcpOrgPathRewrite = HttpMiddleware.make((httpApp) =>
+const selfHostHttpMiddleware = (betterAuth: BetterAuthHandle) =>
-  Effect.gen(function* () {
+  HttpMiddleware.make((httpApp) =>
-    const request = yield* HttpServerRequest.HttpServerRequest;
+    Effect.gen(function* () {
-    const url = new URL(request.url, "http://host.internal");
+      const request = yield* HttpServerRequest.HttpServerRequest;
-    const rewritten = stripMcpOrgSegment(url.pathname);
+      const url = new URL(request.url, "http://host.internal");
-    if (rewritten === null) return yield* httpApp;
+      if (
-    return yield* httpApp.pipe(
+        url.pathname === OAUTH_CALLBACK_PATH &&
-      Effect.provideService(
+        (request.method === "GET" || request.method === "HEAD")
-        HttpServerRequest.HttpServerRequest,
+      ) {
-        request.modify({ url: `${rewritten}${url.search}` }),
+        const headers = new Headers(request.headers as Record<string, string>);
-      ),
+        const webRequest = new Request(url, { method: request.method, headers });
-    );
+        const location = yield* Effect.promise(() =>
-  }),
+          oauthCallbackSignInRedirectLocation(webRequest, betterAuth.auth),
-);
+        );
+        if (location) return HttpServerResponse.redirect(location, { status: 302 });
+      }
+      const rewritten = stripMcpOrgSegment(url.pathname);
+      if (rewritten === null) return yield* httpApp;
+      return yield* httpApp.pipe(
+        Effect.provideService(
+          HttpServerRequest.HttpServerRequest,
+          request.modify({ url: `${rewritten}${url.search}` }),
+        ),
+      );
+    }),
+  );
 export const startServer = async (): Promise<void> => {
   const config = loadConfig();
-  const { AppLayer } = await makeSelfHostApp();
+  const { AppLayer, betterAuth } = await makeSelfHostApp();
   // Serve the built SPA. Specific API/docs/auth/mcp routes take precedence;
   // `spa: true` falls back to index.html for any other path (client routing).
   );
   const ServerLive = HttpRouter.serve(Layer.mergeAll(AppLayer, StaticLive), {
-    middleware: mcpOrgPathRewrite,
+    middleware: selfHostHttpMiddleware(betterAuth),
   }).pipe(
     Layer.provide(
       BunHttpServer.layer({ hostname: config.host, port: config.port, idleTimeout: 0 }),

apps/host-selfhost/web/login.tsx+3−1

 import { Label } from "@executor-js/react/components/label";
 import { authClient } from "./auth-client";
+import { safeReturnTo } from "../src/auth/return-to";
 // Self-host login: email + password sign-in via Better Auth. On success we
 // reload so the shared AuthProvider re-reads /account/me and the AuthGate swaps
 // redeeming an invite — either the full /join/<code> link, or by entering the
 // code here ("Have an invite code?"), which forwards to the same join page.
 export const LoginPage = () => {
+  const returnTo = safeReturnTo(new URLSearchParams(window.location.search).get("returnTo")) ?? "/";
   const [mode, setMode] = useState<"signin" | "code">("signin");
   const [email, setEmail] = useState("");
   const [password, setPassword] = useState("");
       setError(result.error.message ?? "Sign in failed");
       return;
     }
-    window.location.href = "/";
+    window.location.href = returnTo;
   };
   const redeem = (event: FormEvent) => {

e2e/selfhost/oauth-callback-unauthenticated.test.ts+146−0

@@ -0,0 +1,146 @@
	1	import { randomBytes } from "node:crypto";
	2
	3	import { expect } from "@effect/vitest";
	4	import { Effect } from "effect";
	5	import { composePluginApi } from "@executor-js/api/server";
	6	import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
	7	import {
	8	AuthTemplateSlug,
	9	ConnectionName,
	10	IntegrationSlug,
	11	OAuthClientSlug,
	12	} from "@executor-js/sdk/shared";
	13	import { serveOAuthTestServer } from "@executor-js/sdk/testing";
	14
	15	import { scenario } from "../src/scenario";
	16	import { Api, Browser, Target } from "../src/services";
	17
	18	const api = composePluginApi([openApiHttpPlugin()] as const);
	19
	20	const unique = (prefix: string) => `${prefix}_${randomBytes(4).toString("hex")}`;
	21
	22	const oauthIntegrationSpec = (oauth: {
	23	readonly authorizationEndpoint: string;
	24	readonly tokenEndpoint: string;
	25	}) =>
	26	({
	27	spec: {
	28	kind: "blob" as const,
	29	value: JSON.stringify({
	30	openapi: "3.0.3",
	31	info: { title: "OAuth-protected API", version: "1.0.0" },
	32	paths: {
	33	"/me": {
	34	get: {
	35	operationId: "getMe",
	36	tags: ["default"],
	37	responses: { "200": { description: "the caller" } },
	38	},
	39	},
	40	},
	41	}),
	42	},
	43	baseUrl: "http://127.0.0.1:59999",
	44	authenticationTemplate: [
	45	{
	46	slug: "oauth",
	47	kind: "oauth2" as const,
	48	authorizationUrl: oauth.authorizationEndpoint,
	49	tokenUrl: oauth.tokenEndpoint,
	50	scopes: ["read"],
	51	},
	52	],
	53	}) as const;
	54
	55	scenario(
	56	"OAuth callback · a signed-out self-host callback uses login returnTo and resumes the connection",
	57	{},
	58	Effect.gen(function* () {
	59	const target = yield* Target;
	60	const { client: makeApiClient } = yield* Api;
	61	const browser = yield* Browser;
	62	const oauth = yield* serveOAuthTestServer();
	63	const identity = yield* target.newIdentity();
	64	const client = yield* makeApiClient(api, identity);
	65
	66	const integration = IntegrationSlug.make(unique("selfhostsignedoutcb"));
	67	yield* client.openapi.addSpec({
	68	payload: { ...oauthIntegrationSpec(oauth), slug: integration },
	69	});
	70
	71	const clientSlug = OAuthClientSlug.make(unique("selfhostsignedoutc"));
	72	yield* client.oauth.createClient({
	73	payload: {
	74	owner: "org",
	75	slug: clientSlug,
	76	authorizationUrl: oauth.authorizationEndpoint,
	77	tokenUrl: oauth.tokenEndpoint,
	78	grant: "authorization_code",
	79	clientId: "test-client",
	80	clientSecret: "test-secret",
	81	},
	82	});
	83
	84	const started = yield* client.oauth.start({
	85	payload: {
	86	client: clientSlug,
	87	clientOwner: "org",
	88	owner: "org",
	89	name: ConnectionName.make("main"),
	90	integration,
	91	template: AuthTemplateSlug.make("oauth"),
	92	},
	93	});
	94	expect(started.status, "oauth.start begins at the provider").toBe("redirect");
	95	const authorizationUrl = started.status === "redirect" ? started.authorizationUrl : "";
	96
	97	const authorize = yield* Effect.promise(() => fetch(authorizationUrl, { redirect: "manual" }));
	98	expect(authorize.status, "the provider asks the user to log in").toBe(302);
	99	const consent = yield* Effect.promise(() =>
	100	fetch(authorize.headers.get("location") ?? "", {
	101	method: "POST",
	102	redirect: "manual",
	103	headers: {
	104	authorization: `Basic ${Buffer.from("alice:password").toString("base64")}`,
	105	},
	106	}),
	107	);
	108	expect(consent.status, "provider consent redirects back to Executor").toBe(302);
	109	const callback = new URL(consent.headers.get("location") ?? "");
	110	const callbackPath = `${callback.pathname}${callback.search}`;
	111
	112	yield* browser.session({ label: "anonymous" }, async ({ page, step }) => {
	113	await step("Provider sends a signed-out browser to the OAuth callback", async () => {
	114	const response = await page.goto(callbackPath, { waitUntil: "networkidle" });
	115	expect(response?.status(), "the callback redirects into the login flow").toBe(200);
	116	await page.getByText("Sign in to your instance").waitFor();
	117	});
	118
	119	const loginUrl = new URL(page.url());
	120	expect(loginUrl.pathname, "the signed-out callback lands on the sign-in page").toBe("/login");
	121	expect(
	122	loginUrl.searchParams.get("returnTo"),
	123	"login preserves the callback so it can resume after sign-in",
	124	).toBe(callbackPath);
	125
	126	await step("Sign in resumes the original OAuth callback", async () => {
	127	await page.getByLabel("Email").fill(identity.credentials!.email);
	128	await page.getByLabel("Password").fill(identity.credentials!.password);
	129	await page.getByRole("button", { name: "Sign in" }).click();
	130	await page.waitForURL((url) => url.pathname === "/api/oauth/callback", {
	131	timeout: 30_000,
	132	});
	133	await page.waitForFunction(() => document.body.innerText.includes("Connected"), null, {
	134	timeout: 30_000,
	135	});
	136	});
	137
	138	const body = (await page.locator("body").textContent())?.trim() ?? "";
	139	expect(new URL(page.url()).pathname, "the login returnTo lands back on the callback").toBe(
	140	"/api/oauth/callback",
	141	);
	142	expect(body, "the callback completes after the sign-in recovery").toContain("Connected");
	143	expect(body, "the raw protected API response is not shown").not.toContain("Unauthorized");
	144	});
	145	}).pipe(Effect.scoped),
	146	);