Method setupAuthRoutes

server/src/http.ts:5957–8509

()

  }

  private setupAuthRoutes(): void {
    if (!workos) {
      logger.error('Cannot setup auth routes - WorkOS not initialized');
      return;
    }

    const orgDb = new OrganizationDatabase();

    // GET /auth/login - Redirect to WorkOS for authentication (or dev login page)
    // On AdCP domain, redirect to AAO first to keep auth on a single domain
    // Supports slack_user_id param for auto-linking after login (for existing users)
    this.app.get('/auth/login', (req, res) => {
      try {
        // Dev mode: show dev login page
        if (isDevModeEnabled()) {
          const returnTo = req.query.return_to as string || '/member-hub';
          return res.redirect(`/dev-login.html?return_to=${encodeURIComponent(returnTo)}`);
        }

        // If on AdCP domain, redirect to AAO for login (keeps cookies on single domain)
        // Preserve the AdCP URL as return_to so the session bridge sends them back to AdCP after login
        if (this.isAdcpDomain(req)) {
          const returnTo = req.query.return_to as string;
          const slackUserId = req.query.slack_user_id as string;
          // Keep the return_to as an AdCP URL so the callback bridges the session back
          let aaoReturnTo = returnTo;
          if (returnTo && returnTo.startsWith('/')) {
            aaoReturnTo = `https://${req.get('host')}${returnTo}`;
          }
          let redirectUrl = 'https://agenticadvertising.org/auth/login';
          const params = new URLSearchParams();
          if (aaoReturnTo) params.append('return_to', aaoReturnTo);
          if (slackUserId) params.append('slack_user_id', slackUserId);
          if (params.toString()) redirectUrl += `?${params.toString()}`;
          return res.redirect(redirectUrl);
        }

        const returnTo = req.query.return_to as string;
        const slackUserId = req.query.slack_user_id as string;
        const nativeMode = req.query.native === 'true';
        const nativeRedirectUri = req.query.redirect_uri as string;

        // Validate native redirect URI to prevent open redirect attacks
        const ALLOWED_NATIVE_SCHEMES = ['addie://'];
        const isValidNativeRedirectUri = (uri: string): boolean => {
          return ALLOWED_NATIVE_SCHEMES.some(scheme => uri.startsWith(scheme));
        };

        if (nativeMode && nativeRedirectUri && !isValidNativeRedirectUri(nativeRedirectUri)) {
          return res.status(400).json({ error: 'Invalid redirect_uri - must use addie:// scheme' });
        }

        // Build state object with return_to, slack_user_id for auto-linking, and native app params
        const stateObj: { return_to?: string; slack_user_id?: string; native?: boolean; native_redirect_uri?: string } = {};
        if (returnTo) stateObj.return_to = returnTo;
        if (slackUserId) stateObj.slack_user_id = slackUserId;
        if (nativeMode) {
          stateObj.native = true;