Method HandleLogin

internal/auth/auth.go:267–299

HandleLogin redirects the user to Google OAuth. CLI login params (cli_callback, cli_state) are encoded into the OAuth state parameter so they survive the redirect through Google without relying on cookies. return_to (optional) is a same-origin server path the user resumes on after callback success —

(w http.ResponseWriter, r *http.Request)

// callback success — only paths under /oauth2/ are permitted, used to bounce
// MCP OAuth clients back into /oauth2/authorize after a session is created.
func (ua *UserAuth) HandleLogin(w http.ResponseWriter, r *http.Request) {
	cliCallback := r.URL.Query().Get("cli_callback")
	cliState := r.URL.Query().Get("cli_state")
	if (cliCallback == "") != (cliState == "") {
		http.Error(w, "cli_callback and cli_state must be provided together", http.StatusBadRequest)
		return
	}

	nonce := generateNonce()
	state := &OAuthState{Nonce: nonce}

	if cliCallback != "" {
		callbackURL, err := validateCLICallbackURL(cliCallback)
		if err != nil {
			http.Error(w, err.Error(), http.StatusBadRequest)
			return
		}
		state.CLICallback = callbackURL.String()
		state.CLIState = cliState
	}

	if returnTo := r.URL.Query().Get("return_to"); returnTo != "" {
		if err := validateReturnToPath(returnTo); err != nil {
			http.Error(w, err.Error(), http.StatusBadRequest)
			return
		}
		state.ReturnTo = returnTo
	}

	ua.setCookie(w, StateCookieName, nonce, 600)

	http.Redirect(w, r, ua.oauthConfig.AuthCodeURL(EncodeOAuthState(state)), http.StatusFound)
}

// validateReturnToPath enforces the same-origin / known-prefix allow-list
// for return_to values. Accepting an arbitrary URL would turn /api/auth/login