Onboarding: Guard deployedURL

Before, it was possible to provide `https://foo.com/` as input and generate a redirect_uri like `https://foo.com//api/keystatic/github/oauth/callback` which triggers the "The `redirect_uri` is not associated with this application." error by Github. Now the path is merged with the URL correctly for any valid URL input.
Thinkmill · Dec 6, 2024 · 88bcf5d · 88bcf5d
1 parent e65e7f3
commit 88bcf5d
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/.changeset/nice-parrots-sort.md b/.changeset/nice-parrots-sort.md
@@ -0,0 +1,5 @@
+---
+'@keystatic/core': patch
+---
+
+During onboarding, make sure the Deployed App URL does not have double slashes.
diff --git a/packages/keystatic/src/app/onboarding/setup.tsx b/packages/keystatic/src/app/onboarding/setup.tsx
@@ -77,15 +77,20 @@ export function KeystaticSetup(props: { config: GitHubConfig }) {
               parseRepoConfig(props.config.storage.repo).owner
             } Keystatic`,
             url: deployedURL
-              ? `${deployedURL}/keystatic`
+              ? new URL('/keystatic', deployedURL).toString()
               : `${window.location.origin}/keystatic`,
             public: true,
             redirect_url: `${window.location.origin}/api/keystatic/github/created-app`,
             callback_urls: [
               `${window.location.origin}/api/keystatic/github/oauth/callback`,
               `http://127.0.0.1/api/keystatic/github/oauth/callback`,
               ...(deployedURL
-                ? [`${deployedURL}/api/keystatic/github/oauth/callback`]
+                ? [
+                    new URL(
+                      '/api/keystatic/github/oauth/callback',
+                      deployedURL
+                    ).toString(),
+                  ]
                 : []),
             ],
             request_oauth_on_install: true,