fix(oauth): use registered redirect_uri for Codex on remote access

When accessing OmniRoute remotely (e.g. llms.omniroute.online), the
Codex OAuth redirect_uri was incorrectly set to http://localhost:443/callback.
OpenAI only accepts the registered http://localhost:1455/auth/callback.

This caused 'unknown_error' on auth.openai.com for remote users.
Other providers (Google-based: Antigravity, Gemini) are unaffected as
Google OAuth accepts any localhost port.
This commit is contained in:
diegosouzapw
2026-02-18 01:42:01 -03:00
parent 599668bba2
commit 62f3c7416e

View File

@@ -211,8 +211,15 @@ export default function OAuthModal({
// Authorization code flow
// Always use localhost redirect_uri — this is what providers have registered.
// On remote, the browser redirects to localhost (error page), user copies URL and pastes back.
const port = window.location.port || (window.location.protocol === "https:" ? "443" : "80");
const redirectUri = `http://localhost:${port}/callback`;
// Codex (OpenAI) requires exactly http://localhost:1455/auth/callback — the registered URI.
// Other providers (Antigravity/Gemini via Google OAuth) accept any localhost port.
let redirectUri: string;
if (provider === "codex" || provider === "openai") {
redirectUri = "http://localhost:1455/auth/callback";
} else {
const port = window.location.port || (window.location.protocol === "https:" ? "443" : "80");
redirectUri = `http://localhost:${port}/callback`;
}
const res = await fetch(
`/api/oauth/${provider}/authorize?redirect_uri=${encodeURIComponent(redirectUri)}`