farhoodlabs/intervalsicu-mcp-auth
8
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auth: server-side /login redirect to Google (no interactive JS page)
build / test (push) Successful in 10s
Details
build / build (push) Failing after 13s
Details

Browse Source 
Claude's OAuth window doesn't run page JS, so the button never fired. Initiate
Google sign-in server-side via auth.api.signInSocial and 302 straight to Google;
after Google, callbackURL returns to /oauth2/authorize and the flow resumes. Pure
redirect chain, no client JS.
This commit is contained in:
Chris Farhood
2026-07-05 22:59:32 -04:00
parent b6c0751687
commit cfac41d774
1 changed files with 31 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server.ts
+31 -41
View File
@@ -5,51 +5,42 @@
* JWKS, discovery) are served by its node handler. We add a tiny login page
* (the OIDC `loginPage` target) with Google/Apple buttons, and a health check.
*/
import { createServer } from "node:http";
import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
import { toNodeHandler } from "better-auth/node";
import { auth } from "./auth.js";
const PORT = Number(process.env.PORT ?? 8080);
const handler = toNodeHandler(auth);
function loginPage(rawSearch: string): string {
// Better Auth's oauth-provider redirects here with the original, signed
// authorize params in the query. After sign-in we must hand them back to the
// authorize endpoint verbatim so it resumes and issues the code. If there's no
// OAuth context (a stray visit), fall back to the portal.
const cb = rawSearch ? "/api/auth/oauth2/authorize" + rawSearch : "/portal";
const social = (provider: string, label: string) => `
<button data-provider="${provider}" class="btn">${label}</button>`;
return `<!doctype html>
<html lang="en"><head><meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Sign in — Intervals.icu MCP</title>
<style>
body{font-family:system-ui,sans-serif;max-width:22rem;margin:6rem auto;padding:0 1rem;color:#111}
h1{font-size:1.25rem} .btn{display:block;width:100%;padding:.75rem;margin:.5rem 0;font-size:1rem;
border:1px solid #ccc;border-radius:.5rem;background:#fff;cursor:pointer}
.btn:hover{background:#f5f5f5} .muted{color:#666;font-size:.85rem}
</style></head><body>
<h1>Sign in to Intervals.icu MCP</h1>
<p class="muted">Connect your Intervals.icu account to use it from Claude.</p>
${auth.options.socialProviders && "google" in auth.options.socialProviders ? social("google", "Continue with Google") : ""}
${auth.options.socialProviders && "apple" in auth.options.socialProviders ? social("apple", "Continue with Apple") : ""}
<script>
const cb = ${JSON.stringify(cb)};
for (const b of document.querySelectorAll(".btn")) {
b.addEventListener("click", async () => {
b.disabled = true;
const r = await fetch("api/auth/sign-in/social", {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({ provider: b.dataset.provider, callbackURL: cb }),
});
const data = await r.json().catch(() => ({}));
if (data.url) location.href = data.url; else { b.disabled = false; alert("Sign-in failed"); }
});
}
</script>
</body></html>`;
// Better Auth's oauth-provider redirects here (its loginPage) with the original
// signed authorize params in the query. Rather than serve an interactive HTML
// page (Claude's OAuth window doesn't run our JS), initiate Google sign-in
// server-side and 302 straight to Google. After Google, Better Auth returns to
// the authorize endpoint (via callbackURL) and resumes — a pure redirect chain
// that any OAuth-following client handles. Google is the only provider for now.
async function startLogin(req: IncomingMessage, res: ServerResponse, rawSearch: string) {
const callbackURL = rawSearch ? "/api/auth/oauth2/authorize" + rawSearch : "/portal";
try {
const { headers, response } = await auth.api.signInSocial({
body: { provider: "google", callbackURL },
returnHeaders: true,
});
const setCookie = headers.getSetCookie();
if (setCookie.length) res.setHeader("set-cookie", setCookie);
const target = (response as { url?: string } | null)?.url;
if (!target) {
res.writeHead(500, { "content-type": "text/plain" });
res.end("Could not start sign-in.");
return;
}
res.writeHead(302, { location: target });
res.end();
} catch (err) {
// eslint-disable-next-line no-console
console.error("[login] signInSocial failed", err);
res.writeHead(500, { "content-type": "text/plain" });
res.end("Sign-in error.");
}
}
const server = createServer((req, res) => {
@@ -66,8 +57,7 @@ const server = createServer((req, res) => {
return;
}
if (url.pathname === "/login" && req.method === "GET") {
res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
res.end(loginPage(url.search));
void startLogin(req, res, url.search);
return;
}
// Everything else -> Better Auth (async handler).