sttil/Signal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): stop redirecting sign-in to the dead Vercel origin

Browse source 
signal-ui/src/main.jsx hardcoded WEBAPP_URL to https://signal-ui-xi.vercel.app
and passed it to signInUrl/signUpUrl/afterSignInUrl/afterSignUpUrl. The
production Clerk instance (clerk.sttilsolutions.com) rejects that origin with
400 origin_invalid on every write path, so sign-in was handed back to an origin
that cannot authenticate. Verified live: POST /v1/client/sign_ins returns 400
from the Vercel origin and 200/422 from signal.sttilsolutions.com.

Redirect target now derives from window.location.origin, overridable via
VITE_APP_URL, so it cannot drift from the deployed domain again. Also replaced
afterSignInUrl/afterSignUpUrl with signInFallbackRedirectUrl/
signUpFallbackRedirectUrl, deprecated in Clerk Core 2.

Build verified: pnpm build succeeds, dead Vercel URL absent from dist output.
NOT verified: a real sign-in completing end to end. Needs deploy first.

Also updates the pilot readiness table: hosted-URL row now names
signal.sttilsolutions.com (confirmed canonical by Kisa 2026-07-27), login row
moved from PASS to OPEN. Honest count 11/13 clean, 1 open, 1 disputed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Aqzsyo1PudjabuV9XQzxwp
This commit is contained in:
sososttil 2026-07-27 19:41:49 -04:00
parent e3fd78f21e
commit 65d0e13008
2 changed files with 27 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
CLAUDE.md
View file

@ -88,22 +88,25 @@ BAA; see the NEVER-CLAIM list in `docs/build-plans/03-game-center-token-layer.md
Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Projects/2026-05-18-pilot-readiness-whitepaper.md`
### Checklist Status (as of 2026-06-16) — 100% pilot-ready (13/13)
### Checklist Status (updated 2026-07-27) — 11/13 clean, 1 open, 1 disputed
> **STALE ROW WARNING, flagged 2026-07-26.** This table is dated 2026-06-16 and has
> not been re-verified since. The row "Demo login / controlled access working: PASS"
> is **contradicted** by the CLERK LOGIN open thread in `context/current-state.md`
> dated 2026-07-07, which records that Kisa cannot sign in to signal-ui-xi.vercel.app
> and that this gates the P6 click-through. Both cannot be true. Until the Clerk bug
> is resolved or the row is re-tested, **do not quote 13/13 or "100% pilot-ready"
> to anyone external.** The file's own instruction below says to re-count before
> quoting a percentage; re-counting is not enough if a row is stale, so re-test the
> login row specifically.
> **Do not quote "100% pilot-ready" or 13/13.** Superseded 2026-07-27. The hosted-URL
> row is now correct (Kisa confirmed `signal.sttilsolutions.com` as canonical, so the
> Clerk `origin_invalid` fault no longer applies to the URL under test). The login row
> is **not** clean: Clerk's `after_sign_in_url` still points at `https://sttilsolutions.com`,
> so a successful sign-in lands on the marketing site rather than the app. That fix
> needs a **production** Clerk secret (`sk_live_`) via the Backend API; the
> `CLERK_SECRET_KEY` currently in `~/.claude/.secrets.env` is `sk_test_` and belongs to
> an unrelated **development** instance (`holy-gar-49.clerk.accounts.dev`, created
> 2026-06-29) — it authenticates with HTTP 200 against the wrong instance, which is why
> its presence is not the same as the blocker being cleared.
> The honest external number is **11 of 13 clean**. Re-test the login row after Fault B
> is fixed; re-counting alone is not enough when a row is stale.
| Checklist Item | Status |
|---|---|
| App hosted behind stable URL | PASS — <https://signal-ui-xi.vercel.app> (deployed 2026-05-29) |
| Demo login / controlled access working | PASS |
| App hosted behind stable URL | PASS — <https://signal.sttilsolutions.com> (confirmed canonical by Kisa 2026-07-27; the Vercel URL `signal-ui-xi.vercel.app` is NOT canonical and cannot authenticate) |
| Demo login / controlled access working | **OPEN (2026-07-27)** — origin fault resolved by the canonical URL, but Clerk `after_sign_in_url` still redirects to the marketing site. Blocked on a production Clerk secret. Not a PASS. |
| Synthetic sample data loads end to end | PASS — verified as Gaboro DME org 2026-06-10 |
| 25 CSV variants pass ingestion tests | PASS — 50 new files generated (PA + NJ sets), 100% normalizer pass rate 2026-06-07 |
| Import flow: mapping, validation, warnings | PASS — mapping review step built 2026-06-10; confidence display, override dropdown, unmapped column notice, required-missing notice all implemented in CSVImport.jsx |

17
signal-ui/src/main.jsx
View file

@ -10,16 +10,23 @@ if (!PUBLISHABLE_KEY) {
throw new Error("Missing VITE_CLERK_PUBLISHABLE_KEY — add it to signal-ui/.env");
}
const WEBAPP_URL = "https://signal-ui-xi.vercel.app";
// Where Clerk sends the user after sign-in, and where it points its own redirects.
// Defaults to the host the app is actually being served from, so this can never
// again drift out of sync with the deployed domain. Override with VITE_APP_URL
// only if a deploy must redirect somewhere other than its own origin.
// Previously hardcoded to https://signal-ui-xi.vercel.app, which the production
// Clerk instance rejects (origin_invalid), so every sign-in redirected into an
// origin that could not authenticate.
const APP_URL = import.meta.env.VITE_APP_URL ?? window.location.origin;
createRoot(document.getElementById("root")).render(
<StrictMode>
<ClerkProvider
publishableKey={PUBLISHABLE_KEY}
signInUrl={WEBAPP_URL}
signUpUrl={WEBAPP_URL}
afterSignInUrl={WEBAPP_URL}
afterSignUpUrl={WEBAPP_URL}
signInUrl={APP_URL}
signUpUrl={APP_URL}
signInFallbackRedirectUrl={APP_URL}
signUpFallbackRedirectUrl={APP_URL}
>
<App />
</ClerkProvider>