Unified · Split
| @@ -92,13 +92,20 @@ export const CLOUD_MOUNT_PREFIX = "/api" as const; · 91 unmodified lines | ||
| 92 | 92 | // (id + secret). Each provider-side registration must list |
| 93 | 93 | // `${VITE_PUBLIC_SITE_URL}/api/oauth/callback` as its callback; the org slug |
| 94 | 94 | // travels inside OAuth `state`, so the single static callback serves every org. |
| 95 | +// | |
| 96 | +// The endpoint URLs default to the real provider; the `_AUTHORIZE_URL` / | |
| 97 | +// `_TOKEN_URL` overrides exist so tests and dev instances can point the app at | |
| 98 | +// an emulated provider (`@executor-js/emulate`) and run the complete flow. | |
| 99 | +// Production leaves them unset. | |
| 95 | 100 | const cloudFirstPartyOAuthClients = (): readonly FirstPartyOAuthClientConfig[] => [ |
| 96 | 101 | ...(env.FIRST_PARTY_GITHUB_CLIENT_ID && env.FIRST_PARTY_GITHUB_CLIENT_SECRET |
| 97 | 102 | ? [ |
| 98 | 103 | { |
| 99 | 104 | name: "github", |
| 100 | − authorizationUrl: "https://github.com/login/oauth/authorize", | |
| 101 | − tokenUrl: "https://github.com/login/oauth/access_token", | |
| 105 | + authorizationUrl: | |
| 106 | + env.FIRST_PARTY_GITHUB_AUTHORIZE_URL ?? "https://github.com/login/oauth/authorize", | |
| 107 | + tokenUrl: | |
| 108 | + env.FIRST_PARTY_GITHUB_TOKEN_URL ?? "https://github.com/login/oauth/access_token", | |
| 102 | 109 | clientId: env.FIRST_PARTY_GITHUB_CLIENT_ID, |
| 103 | 110 | clientSecret: env.FIRST_PARTY_GITHUB_CLIENT_SECRET, |
| 104 | 111 | }, |
| @@ -60,6 +60,11 @@ declare global { · 59 unmodified lines | ||
| 60 | 60 | // `${VITE_PUBLIC_SITE_URL}/api/oauth/callback`. |
| 61 | 61 | FIRST_PARTY_GITHUB_CLIENT_ID?: string; |
| 62 | 62 | FIRST_PARTY_GITHUB_CLIENT_SECRET?: string; |
| 63 | + // Endpoint overrides for the GitHub first-party app, so tests/dev can | |
| 64 | + // point it at an emulated provider and complete the whole flow. Unset in | |
| 65 | + // production (the real github.com endpoints are the defaults). | |
| 66 | + FIRST_PARTY_GITHUB_AUTHORIZE_URL?: string; | |
| 67 | + FIRST_PARTY_GITHUB_TOKEN_URL?: string; | |
| 63 | 68 | FIRST_PARTY_GOOGLE_CLIENT_ID?: string; |
| 64 | 69 | FIRST_PARTY_GOOGLE_CLIENT_SECRET?: string; |
| 65 | 70 | |
| @@ -99,6 +99,11 @@ export const bootCloud = async (options: CloudBootOptions): Promise<CloudBooted> · 98 unmodified lines | ||
| 99 | 99 | // authorize REDIRECT only (client id + callback), never visits github.com. |
| 100 | 100 | FIRST_PARTY_GITHUB_CLIENT_ID: "e2e-first-party-github", |
| 101 | 101 | FIRST_PARTY_GITHUB_CLIENT_SECRET: "e2e-first-party-github-secret", |
| 102 | + // Optional endpoint overrides pass through so a dev instance (`cli up | |
| 103 | + // cloud`) can point the first-party app at an emulated GitHub and run the | |
| 104 | + // complete authorize → token dance instead of stopping at github.com. | |
| 105 | + FIRST_PARTY_GITHUB_AUTHORIZE_URL: process.env.FIRST_PARTY_GITHUB_AUTHORIZE_URL, | |
| 106 | + FIRST_PARTY_GITHUB_TOKEN_URL: process.env.FIRST_PARTY_GITHUB_TOKEN_URL, | |
| 102 | 107 | // Shrink the per-org hourly execution cap (prod default 1000) to a number |
| 103 | 108 | // the rate-limit-backstop scenario can actually exhaust with real |
| 104 | 109 | // executions — but see execution-limits.ts: it must stay above every other |