fix(api): 🛂 Fix incorrect redirect URI passed to external OIDC providers, normalize issuer URL

packages/config-manager/config.type.ts

@@ -99,7 +99,11 @@ export const configValidator = z.object({
                 z.object({
                     name: z.string().min(1),
                     id: z.string().min(1),
-                    url: z.string().min(1),
+                    url: z
+                        .string()
+                        .min(1)
+                        // Remove trailing slashes
+                        .transform((arg) => arg.replace(/\/$/, "")),
                     client_id: z.string().min(1),
                     client_secret: z.string().min(1),
                     icon: z.string().min(1).optional(),

packages/database-interface/oauth.ts

@@ -1,4 +1,3 @@
-import { oauthRedirectUri } from "@/constants";
 import { response } from "@/response";
 import type { InferInsertModel } from "drizzle-orm";
 import {
@@ -201,6 +200,7 @@ export class OAuthManager {
     async automaticOidcFlow(
         flowId: string,
         currentUrl: URL,
+        redirectUrl: URL,
         errorFn: (
             error: string,
             message: string,
@@ -234,7 +234,7 @@ export class OAuthManager {
         const oidcResponse = await this.getOIDCResponse(
             authServer,
             this.issuer,
-            `${oauthRedirectUri(this.issuer.id)}?flow=${flow.id}`,
+            redirectUrl.toString(),
             flow.codeVerifier,
             parameters,
         );

server/api/oauth/sso/:issuer/callback/index.ts

@@ -80,11 +80,15 @@ export default (app: Hono) =>
             const userInfo = await manager.automaticOidcFlow(
                 flowId,
                 currentUrl,
+                currentUrl,
                 (error, message, app) =>
                     returnError(
                         {
+                            redirect_uri: flow.application?.redirectUri,
+                            client_id: flow.application?.clientId,
+                            response_type: "code",
+                            scope: flow.application?.scopes,
                             ...manager.processOAuth2Error(app),
-                            link: link ? "true" : undefined,
                         },
                         error,
                         message,