mirror of
https://github.com/stack-auth/stack.git
synced 2026-06-13 21:01:21 +08:00
5bfe1a79ce
Other minor redirect URL changes:
- app.urls.* is now deprecated
- redirectToSignOut now sets and preserves after_auth_return_to
- OAuth sign-in after_auth_return_to now carries callback-return context
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **High Risk**
> High risk because it changes OAuth authorization/token issuance,
redirect URL validation, and introduces a new cross-domain handoff
endpoint plus a DB migration linking authorization codes to refresh
tokens, which can affect login/session security and reliability.
>
> **Overview**
> Adds **hosted URL targets** for SDK `urls` resolution (new `{ type:
"hosted" }`/`{ type: "handler-component" }`/`{ type: "custom" }`
options), including env-driven hosted handler domain/template support
and fallback routing for unknown `/handler/*` paths.
>
> Implements a **cross-domain OAuth PKCE handoff**: a new
`/auth/oauth/cross-domain/authorize` endpoint issues one-time
authorization-code redirects bound to the caller’s session refresh
token; authorization codes now persist `grantedRefreshTokenId` and token
issuance reuses/validates ownership of that refresh token. Redirect
planning for `redirectTo*` (and OAuth callback handling) is refactored
into `redirect-page-urls.ts` to preserve `after_auth_return_to` and
cross-domain handoff params.
>
> Tightens redirect safety (e.g., `after_callback_redirect_url` is
validated/whitelisted), centralizes SDK env var reads via `envVars` with
lint enforcement, hardens `EventTracker` startup for partial DOM test
environments, and adds unit/E2E coverage plus a demo page for manual
cross-domain verification.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9197d4f32b. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Cross-domain OAuth PKCE handoff flow (client + server) for hosted
sign-in.
* Hosted handler URL templating with local development domain suffix
support.
* Demo UI page to exercise hosted cross-domain sign-in/out and OAuth
flows.
* Authorization codes now preserve an associated refresh-token id to
support cross-domain exchanges.
* **Bug Fixes**
* Stricter redirect-URL validation and stronger refresh-token ownership
checks.
* More robust event-tracker startup guards in partial DOM environments.
* **Tests**
* New E2E and unit tests covering cross-domain authorize, callback
validation, and handoff flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
126 lines
6.5 KiB
Plaintext
126 lines
6.5 KiB
Plaintext
NEXT_PUBLIC_STACK_API_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}02
|
|
NEXT_PUBLIC_STACK_DASHBOARD_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}01
|
|
NEXT_PUBLIC_STACK_HOSTED_HANDLER_DOMAIN_SUFFIX=.localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}09
|
|
NEXT_PUBLIC_STACK_IS_LOCAL_EMULATOR=false
|
|
STACK_SERVER_SECRET=23-wuNpik0gIW4mruTz25rbIvhuuvZFrLOLtL7J4tyo
|
|
|
|
STACK_CHANGELOG_URL=https://raw.githubusercontent.com/stack-auth/stack-auth/refs/heads/dev/CHANGELOG.md
|
|
|
|
STACK_SEED_ENABLE_DUMMY_PROJECT=true
|
|
STACK_SEED_INTERNAL_PROJECT_SIGN_UP_ENABLED=true
|
|
STACK_SEED_INTERNAL_PROJECT_OTP_ENABLED=true
|
|
STACK_SEED_INTERNAL_PROJECT_ALLOW_LOCALHOST=true
|
|
STACK_SEED_INTERNAL_PROJECT_OAUTH_PROVIDERS=github,spotify,google,microsoft
|
|
STACK_SEED_INTERNAL_PROJECT_USER_GITHUB_ID=admin@example.com
|
|
STACK_SEED_INTERNAL_PROJECT_USER_INTERNAL_ACCESS=true
|
|
STACK_SEED_INTERNAL_PROJECT_PUBLISHABLE_CLIENT_KEY=this-publishable-client-key-is-for-local-development-only
|
|
STACK_SEED_INTERNAL_PROJECT_SECRET_SERVER_KEY=this-secret-server-key-is-for-local-development-only
|
|
STACK_SEED_INTERNAL_PROJECT_SUPER_SECRET_ADMIN_KEY=this-super-secret-admin-key-is-for-local-development-only
|
|
|
|
STACK_OAUTH_MOCK_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}14
|
|
STACK_TURNSTILE_SITEVERIFY_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}14/turnstile/siteverify
|
|
|
|
# Cloudflare Turnstile test keys — always-pass widgets, no real challenges
|
|
# See https://developers.cloudflare.com/turnstile/troubleshooting/testing/
|
|
NEXT_PUBLIC_STACK_BOT_CHALLENGE_SITE_KEY=1x00000000000000000000AA
|
|
NEXT_PUBLIC_STACK_BOT_CHALLENGE_INVISIBLE_SITE_KEY=1x00000000000000000000BB
|
|
STACK_TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
|
|
# Set to true to disable Turnstile entirely in local development.
|
|
# This skips invisible/visible bot challenge flow and removes the Turnstile risk penalty.
|
|
STACK_DISABLE_BOT_CHALLENGE=false
|
|
# Default behavior is to block sign-up if the visible challenge cannot be completed.
|
|
# Flip this only when you intentionally want local sign-up to continue during Turnstile outages.
|
|
STACK_ALLOW_SIGN_UP_ON_VISIBLE_BOT_CHALLENGE_FAILURE=false
|
|
|
|
STACK_GITHUB_CLIENT_ID=MOCK
|
|
STACK_GITHUB_CLIENT_SECRET=MOCK
|
|
STACK_GOOGLE_CLIENT_ID=MOCK
|
|
STACK_GOOGLE_CLIENT_SECRET=MOCK
|
|
STACK_MICROSOFT_CLIENT_ID=MOCK
|
|
STACK_MICROSOFT_CLIENT_SECRET=MOCK
|
|
STACK_SPOTIFY_CLIENT_ID=MOCK
|
|
STACK_SPOTIFY_CLIENT_SECRET=MOCK
|
|
|
|
STACK_ALLOW_SHARED_OAUTH_ACCESS_TOKENS=true
|
|
|
|
STACK_DATABASE_CONNECTION_STRING=postgres://postgres:PASSWORD-PLACEHOLDER--uqfEC1hmmv@localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}28/stackframe
|
|
STACK_DATABASE_REPLICA_CONNECTION_STRING=postgres://postgres:PASSWORD-PLACEHOLDER--uqfEC1hmmv@localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}34/stackframe
|
|
STACK_DATABASE_REPLICATION_WAIT_STRATEGY=pg-stat-replication
|
|
|
|
STACK_EMAIL_HOST=127.0.0.1
|
|
STACK_EMAIL_PORT=${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}29
|
|
STACK_EMAIL_SECURE=false
|
|
STACK_EMAIL_USERNAME="does not matter, ignored by Inbucket"
|
|
STACK_EMAIL_PASSWORD="does not matter, ignored by Inbucket"
|
|
STACK_EMAIL_SENDER=noreply@example.com
|
|
|
|
STACK_ACCESS_TOKEN_EXPIRATION_TIME=60s
|
|
|
|
STACK_DEFAULT_EMAIL_CAPACITY_PER_HOUR=10000
|
|
|
|
STACK_SVIX_SERVER_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}13
|
|
STACK_SVIX_API_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE2NTUxNDA2MzksImV4cCI6MTk3MDUwMDYzOSwibmJmIjoxNjU1MTQwNjM5LCJpc3MiOiJzdml4LXNlcnZlciIsInN1YiI6Im9yZ18yM3JiOFlkR3FNVDBxSXpwZ0d3ZFhmSGlyTXUifQ.En8w77ZJWbd0qrMlHHupHUB-4cx17RfzFykseg95SUk
|
|
|
|
# Trusted reverse proxy for reading real client IP addresses.
|
|
# Set to "vercel", "cloudflare", or leave empty/unset for no proxy trust.
|
|
STACK_TRUSTED_PROXY=
|
|
|
|
STACK_ARTIFICIAL_DEVELOPMENT_DELAY_MS=500
|
|
|
|
STACK_ENABLE_HARDCODED_PASSKEY_CHALLENGE_FOR_TESTING=yes
|
|
|
|
STACK_INTEGRATION_CLIENTS_CONFIG='[{"client_id": "neon-local", "client_secret": "neon-local-secret", "id_token_signed_response_alg": "ES256", "redirect_uris": ["http://localhost:30000/api/v2/identity/authorize", "http://localhost:30000/api/v2/auth/authorize"]}, {"client_id": "custom-local", "client_secret": "custom-local-secret", "id_token_signed_response_alg": "ES256", "redirect_uris": ["http://localhost:30000/api/v2/identity/authorize", "http://localhost:30000/api/v2/auth/authorize"]}]'
|
|
CRON_SECRET=mock_cron_secret
|
|
STACK_FREESTYLE_API_KEY=mock_stack_freestyle_key
|
|
STACK_VERCEL_SANDBOX_TOKEN=vercel_sandbox_disabled_for_local_development
|
|
STACK_OPENAI_API_KEY=mock_openai_api_key
|
|
STACK_STRIPE_SECRET_KEY=sk_test_mockstripekey
|
|
STACK_STRIPE_WEBHOOK_SECRET=mock_stripe_webhook_secret
|
|
STACK_OPENROUTER_API_KEY=FORWARD_TO_PRODUCTION
|
|
# Email monitor configuration for tests
|
|
STACK_EMAIL_MONITOR_VERIFICATION_CALLBACK_URL=http://localhost:8101/handler/email-verification
|
|
STACK_EMAIL_MONITOR_PROJECT_ID=internal
|
|
STACK_EMAIL_MONITOR_PUBLISHABLE_CLIENT_KEY=this-publishable-client-key-is-for-local-development-only
|
|
STACK_EMAIL_MONITOR_RESEND_EMAIL_DOMAIN=stack-generated.example.com
|
|
STACK_EMAIL_MONITOR_RESEND_EMAIL_API_KEY=this-is-a-fake-key
|
|
STACK_EMAIL_MONITOR_INBUCKET_API_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}05
|
|
STACK_EMAIL_MONITOR_USE_INBUCKET=true
|
|
STACK_EMAIL_MONITOR_SECRET_TOKEN=this-secret-token-is-for-local-development-only
|
|
|
|
STACK_EMAILABLE_API_KEY=
|
|
|
|
STACK_INTERNAL_FEEDBACK_RECIPIENTS=team@stack-auth.com
|
|
|
|
# S3 Configuration for local development using s3mock
|
|
STACK_S3_ENDPOINT=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}21
|
|
STACK_S3_REGION=us-east-1
|
|
STACK_S3_ACCESS_KEY_ID=s3mockroot
|
|
STACK_S3_SECRET_ACCESS_KEY=s3mockroot
|
|
STACK_S3_BUCKET=stack-storage
|
|
STACK_S3_PRIVATE_BUCKET=stack-storage-private
|
|
|
|
# AWS region defaults to LocalStack
|
|
STACK_AWS_REGION=us-east-1
|
|
STACK_AWS_KMS_ENDPOINT=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}24
|
|
STACK_AWS_ACCESS_KEY_ID=test
|
|
STACK_AWS_SECRET_ACCESS_KEY=test
|
|
|
|
# Upstash defaults to one of the pre-build test users of the local emulator
|
|
STACK_QSTASH_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}25
|
|
STACK_QSTASH_TOKEN=eyJVc2VySUQiOiJkZWZhdWx0VXNlciIsIlBhc3N3b3JkIjoiZGVmYXVsdFBhc3N3b3JkIn0=
|
|
STACK_QSTASH_CURRENT_SIGNING_KEY=sig_7kYjw48mhY7kAjqNGcy6cr29RJ6r
|
|
STACK_QSTASH_NEXT_SIGNING_KEY=sig_5ZB6DVzB1wjE8S6rZ7eenA8Pdnhs
|
|
|
|
# Clickhouse
|
|
STACK_CLICKHOUSE_URL=http://localhost:${NEXT_PUBLIC_STACK_PORT_PREFIX:-81}36
|
|
STACK_CLICKHOUSE_ADMIN_USER=stackframe
|
|
STACK_CLICKHOUSE_ADMIN_PASSWORD=PASSWORD-PLACEHOLDER--9gKyMxJeMx
|
|
STACK_CLICKHOUSE_EXTERNAL_PASSWORD=PASSWORD-PLACEHOLDER--EZeHscBMzE
|
|
|
|
# Managed emails
|
|
STACK_RESEND_API_KEY=mock_resend_api_key
|
|
STACK_RESEND_WEBHOOK_SECRET=mock_resend_webhook_secret
|
|
STACK_DNSIMPLE_API_TOKEN=mock_dnsimple_api_token
|
|
STACK_DNSIMPLE_ACCOUNT_ID=mock_dnsimple_account_id
|
|
STACK_DNSIMPLE_API_BASE_URL=https://api.dnsimple.com/v2
|