fix(cli): default logicsrc login to logicsrc.com - #104
Merged
Conversation
The default API origin was the generated Railway hostname (logicsrc-credentials-production.up.railway.app), which leaked deployment infrastructure into every login prompt and stored identity. Point it at the production domain instead. NOTE: logicsrc.com does not currently serve the credentials app's CLI routes — /cli/device/code, /cli/device/token, /cli/authorize, /cli/token, and /api/me live in apps/pwa (src/routes/cli.mjs), while the apex serves apps/logicsrc-web. At time of writing all of those return 404 on logicsrc.com and 200 on the Railway origin, so login will fail until the apex (or a subdomain) is pointed at the pwa service. $LOGICSRC_API overrides the default in the meantime. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
ralyodio
marked this pull request as ready for review
July 30, 2026 14:23
This was referenced Jul 30, 2026
ralyodio
added a commit
that referenced
this pull request
Jul 30, 2026
`logicsrc login` defaults to https://logicsrc.com (#104), but every path it needs returns 404 there: the apex runs the marketing app, while /cli/* lives in apps/pwa on its own service. Proxy those paths from the app that owns the apex, the same way CommandBoard is already proxied. No DNS record, no Railway custom domain, and no subdomain -- and it makes the CLI's existing default origin correct rather than requiring another change to chase it. Pointing the apex at the pwa instead was the obvious alternative and is wrong: the pwa serves `/` too, so it would take the marketing site down with it. Proxied: /cli/:path* the device-code and loopback login flows /api/me identity /api/credshare/:path* the credential-sharing API used after login /auth/:path* /cli/authorize and /cli/device are behind requireAuth, so an unauthenticated visitor is redirected here; without it the browser half of the flow dead-ends on a 404 Order matters and is asserted: CommandBoard owns a catch-all /api/:path*, so /api/me and /api/credshare/* have to match first or CLI auth silently goes to the wrong service. Rewrite construction is factored into pure functions so the ordering is testable without booting Next, and degrades cleanly: with CREDENTIALS_APP_URL unset the output is byte-identical to what shipped before. Requires CREDENTIALS_APP_URL on the logicsrc-web service, pointing at the credentials app's origin. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
logicsrc logindefaulted to the generated Railway hostnamehttps://logicsrc-credentials-production.up.railway.app, which leaked deploymentinfrastructure into every login prompt and every stored identity. This points it at
https://logicsrc.com.logicsrc.comdoes not currently serve the CLI routes. Measured just now:logicsrc.com…up.railway.app/cli/device/code/cli/authorize/healthzThe apex serves
apps/logicsrc-web(the marketing site). The login routes live inapps/pwa/src/routes/cli.mjs—/cli/device/code,/cli/device/token,/cli/authorize,/cli/token,/api/me.So merging this as-is breaks
logicsrc loginfor everyone until the pwa service isreachable at
logicsrc.com. Either:logicsrc.com(or a subdomain, and change this constant to match) to the pwaRailway service, or
/cli/*routes into the app serving the apex.$LOGICSRC_APIstill overrides the default, so it remains a workaround either way.Opened as a draft deliberately for that reason.
History
The Railway URL was not arbitrary — it came from cf475f0 (Jul 28), which fixed the
default from
http://localhost:4010. This change supersedes that once the domain isin place.
🤖 Generated with Claude Code