From 39aae51ca2f1129217f7f4fc09538de5befc5cb7 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Thu, 19 Feb 2026 22:28:27 -0300
Subject: [PATCH] =?UTF-8?q?fix:=20OAuth=20login=20behind=20nginx=20?=
 =?UTF-8?q?=E2=80=94=20use=20actual=20origin=20for=20redirect=20URI=20(Clo?=
 =?UTF-8?q?ses=20#82)=20(#86)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
---
 .env.example                         |  3 +++
 src/shared/components/OAuthModal.tsx | 15 ++++++++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.env.example b/.env.example
index a4cdb4ac49..7dfb70f02e 100644
--- a/.env.example
+++ b/.env.example
@@ -44,6 +44,9 @@ REQUIRE_API_KEY=false
 BASE_URL=http://localhost:20128
 CLOUD_URL=
 # Backward-compatible/public variables:
+# NEXT_PUBLIC_BASE_URL is also used as the OAuth redirect_uri origin when running behind a
+# reverse proxy (e.g., nginx). Set this to your public-facing URL so OAuth callbacks work.
+# Example: NEXT_PUBLIC_BASE_URL=https://omniroute.example.com
 NEXT_PUBLIC_BASE_URL=http://localhost:20128
 NEXT_PUBLIC_CLOUD_URL=
 
diff --git a/src/shared/components/OAuthModal.tsx b/src/shared/components/OAuthModal.tsx
index c75ec2bf30..8749b8a62f 100644
--- a/src/shared/components/OAuthModal.tsx
+++ b/src/shared/components/OAuthModal.tsx
@@ -209,13 +209,22 @@ export default function OAuthModal({
       }
 
       // Authorization code flow
-      // Always use localhost redirect_uri — this is what providers have registered.
-      // On remote, the browser redirects to localhost (error page), user copies URL and pastes back.
+      // On localhost: use localhost callback so popup/BroadcastChannel/localStorage can relay code.
+      // On remote (behind nginx/reverse proxy): use the actual origin so the callback page loads.
       // Codex (OpenAI) requires exactly http://localhost:1455/auth/callback — the registered URI.
-      // Other providers (Antigravity/Gemini via Google OAuth) accept any localhost port.
       let redirectUri: string;
       if (provider === "codex" || provider === "openai") {
         redirectUri = "http://localhost:1455/auth/callback";
+      } else if (!isLocalhost) {
+        // Behind reverse proxy: use actual origin (e.g., https://omniroute.example.com/callback)
+        // This ensures the OAuth provider redirects to the proxied URL where the callback page loads.
+        // Supports PUBLIC_URL env var override, or falls back to window.location.origin.
+        const publicUrl = process.env.NEXT_PUBLIC_BASE_URL;
+        const origin =
+          publicUrl && publicUrl !== "http://localhost:20128"
+            ? publicUrl.replace(/\/$/, "")
+            : window.location.origin;
+        redirectUri = `${origin}/callback`;
       } else {
         const port = window.location.port || (window.location.protocol === "https:" ? "443" : "80");
         redirectUri = `http://localhost:${port}/callback`;