From 65d0e13008d0167bbc9b81e17822e22d1f50b95c Mon Sep 17 00:00:00 2001 From: sososttil Date: Mon, 27 Jul 2026 19:41:49 -0400 Subject: [PATCH] fix(auth): stop redirecting sign-in to the dead Vercel origin signal-ui/src/main.jsx hardcoded WEBAPP_URL to https://signal-ui-xi.vercel.app and passed it to signInUrl/signUpUrl/afterSignInUrl/afterSignUpUrl. The production Clerk instance (clerk.sttilsolutions.com) rejects that origin with 400 origin_invalid on every write path, so sign-in was handed back to an origin that cannot authenticate. Verified live: POST /v1/client/sign_ins returns 400 from the Vercel origin and 200/422 from signal.sttilsolutions.com. Redirect target now derives from window.location.origin, overridable via VITE_APP_URL, so it cannot drift from the deployed domain again. Also replaced afterSignInUrl/afterSignUpUrl with signInFallbackRedirectUrl/ signUpFallbackRedirectUrl, deprecated in Clerk Core 2. Build verified: pnpm build succeeds, dead Vercel URL absent from dist output. NOT verified: a real sign-in completing end to end. Needs deploy first. Also updates the pilot readiness table: hosted-URL row now names signal.sttilsolutions.com (confirmed canonical by Kisa 2026-07-27), login row moved from PASS to OPEN. Honest count 11/13 clean, 1 open, 1 disputed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Aqzsyo1PudjabuV9XQzxwp --- CLAUDE.md | 27 +++++++++++++++------------ signal-ui/src/main.jsx | 17 ++++++++++++----- 2 files changed, 27 insertions(+), 17 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index a77dc27..7c81df9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -88,22 +88,25 @@ BAA; see the NEVER-CLAIM list in `docs/build-plans/03-game-center-token-layer.md Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Projects/2026-05-18-pilot-readiness-whitepaper.md` -### Checklist Status (as of 2026-06-16) — 100% pilot-ready (13/13) +### Checklist Status (updated 2026-07-27) — 11/13 clean, 1 open, 1 disputed -> **STALE ROW WARNING, flagged 2026-07-26.** This table is dated 2026-06-16 and has -> not been re-verified since. The row "Demo login / controlled access working: PASS" -> is **contradicted** by the CLERK LOGIN open thread in `context/current-state.md` -> dated 2026-07-07, which records that Kisa cannot sign in to signal-ui-xi.vercel.app -> and that this gates the P6 click-through. Both cannot be true. Until the Clerk bug -> is resolved or the row is re-tested, **do not quote 13/13 or "100% pilot-ready" -> to anyone external.** The file's own instruction below says to re-count before -> quoting a percentage; re-counting is not enough if a row is stale, so re-test the -> login row specifically. +> **Do not quote "100% pilot-ready" or 13/13.** Superseded 2026-07-27. The hosted-URL +> row is now correct (Kisa confirmed `signal.sttilsolutions.com` as canonical, so the +> Clerk `origin_invalid` fault no longer applies to the URL under test). The login row +> is **not** clean: Clerk's `after_sign_in_url` still points at `https://sttilsolutions.com`, +> so a successful sign-in lands on the marketing site rather than the app. That fix +> needs a **production** Clerk secret (`sk_live_`) via the Backend API; the +> `CLERK_SECRET_KEY` currently in `~/.claude/.secrets.env` is `sk_test_` and belongs to +> an unrelated **development** instance (`holy-gar-49.clerk.accounts.dev`, created +> 2026-06-29) — it authenticates with HTTP 200 against the wrong instance, which is why +> its presence is not the same as the blocker being cleared. +> The honest external number is **11 of 13 clean**. Re-test the login row after Fault B +> is fixed; re-counting alone is not enough when a row is stale. | Checklist Item | Status | |---|---| -| App hosted behind stable URL | PASS — (deployed 2026-05-29) | -| Demo login / controlled access working | PASS | +| App hosted behind stable URL | PASS — (confirmed canonical by Kisa 2026-07-27; the Vercel URL `signal-ui-xi.vercel.app` is NOT canonical and cannot authenticate) | +| Demo login / controlled access working | **OPEN (2026-07-27)** — origin fault resolved by the canonical URL, but Clerk `after_sign_in_url` still redirects to the marketing site. Blocked on a production Clerk secret. Not a PASS. | | Synthetic sample data loads end to end | PASS — verified as Gaboro DME org 2026-06-10 | | 25 CSV variants pass ingestion tests | PASS — 50 new files generated (PA + NJ sets), 100% normalizer pass rate 2026-06-07 | | Import flow: mapping, validation, warnings | PASS — mapping review step built 2026-06-10; confidence display, override dropdown, unmapped column notice, required-missing notice all implemented in CSVImport.jsx | diff --git a/signal-ui/src/main.jsx b/signal-ui/src/main.jsx index 1db3e08..0518e18 100644 --- a/signal-ui/src/main.jsx +++ b/signal-ui/src/main.jsx @@ -10,16 +10,23 @@ if (!PUBLISHABLE_KEY) { throw new Error("Missing VITE_CLERK_PUBLISHABLE_KEY — add it to signal-ui/.env"); } -const WEBAPP_URL = "https://signal-ui-xi.vercel.app"; +// Where Clerk sends the user after sign-in, and where it points its own redirects. +// Defaults to the host the app is actually being served from, so this can never +// again drift out of sync with the deployed domain. Override with VITE_APP_URL +// only if a deploy must redirect somewhere other than its own origin. +// Previously hardcoded to https://signal-ui-xi.vercel.app, which the production +// Clerk instance rejects (origin_invalid), so every sign-in redirected into an +// origin that could not authenticate. +const APP_URL = import.meta.env.VITE_APP_URL ?? window.location.origin; createRoot(document.getElementById("root")).render(