From d01aa22477922aaa14f3870fd09bc99cdcad2840 Mon Sep 17 00:00:00 2001
From: Jesse Wierzbinski <contact@cpluspatch.com>
Date: Thu, 11 Dec 2025 04:10:45 +0100
Subject: [PATCH] fix: :bug: Fix broken auth consent flow

---
 .../{callback.vue => callback/[domain].vue}      |  6 ++++--
 app/pages/oauth/consent.vue                      | 16 ++++++----------
 app/stores/auth.ts                               |  2 +-
 3 files changed, 11 insertions(+), 13 deletions(-)
 rename app/pages/{callback.vue => callback/[domain].vue} (90%)

diff --git a/app/pages/callback.vue b/app/pages/callback/[domain].vue
similarity index 90%
rename from app/pages/callback.vue
rename to app/pages/callback/[domain].vue
index b2bc86c..8cbba05 100644
--- a/app/pages/callback.vue
+++ b/app/pages/callback/[domain].vue
@@ -29,13 +29,15 @@ definePageMeta({
 });
 
 const code = useRequestURL().searchParams.get("code");
-const domain = useRequestURL().searchParams.get("domain");
+const domain = useRoute().params.domain as string;
 const authStore = useAuthStore();
 
 if (code && domain) {
     const newOrigin = new URL(`https://${domain}`);
 
     await authStore.finishSignIn(code, newOrigin);
-    await navigateTo("/");
+    await navigateTo("/", {
+        external: true,
+    });
 }
 </script>
diff --git a/app/pages/oauth/consent.vue b/app/pages/oauth/consent.vue
index 56552a8..e356cfb 100644
--- a/app/pages/oauth/consent.vue
+++ b/app/pages/oauth/consent.vue
@@ -5,21 +5,17 @@
         backgroundImage: 'url(/images/banner.webp)',
     }"
     >
-        <form
-            method="POST"
-            :action="url.pathname.replace('/oauth/consent', '/oauth/authorize')"
-            class="w-full max-w-md"
-        >
+        <form method="GET" :action="redirectUri" class="w-full max-w-md">
             <Card class="*:w-full p-6">
+                <input type="hidden" name="code" :value="params.code">
                 <input
                     type="hidden"
-                    v-for="[key, value] in url.searchParams"
-                    :key="key"
-                    :name="key"
-                    :value="value"
+                    v-if="params.state"
+                    name="state"
+                    :value="params.state"
                 >
                 <CardHeader>
-                    <CardTitle as="h1" class="text-2xl break-words">
+                    <CardTitle as="h1" class="text-2xl wrap-break-word">
                         {{
                         m.fresh_broad_cockroach_radiate({
                             application: application ?? "",
diff --git a/app/stores/auth.ts b/app/stores/auth.ts
index b2d860a..df23ee3 100644
--- a/app/stores/auth.ts
+++ b/app/stores/auth.ts
@@ -112,7 +112,7 @@ export const useAuthStore = defineStore("auth", {
             origin: URL,
         ): Promise<z.infer<typeof CredentialApplication>> {
             const redirectUri = new URL(
-                `/callback?${new URLSearchParams({ domain: origin.host }).toString()}`,
+                `/callback/${origin.host}`,
                 useRequestURL().origin,
             );