pal-e-docs

Review: Bug: OmniAuth redirect_uri hardcoded to Tailscale hostname

review-1478-2026-06-17 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — references #224
  • [x] Repo — ldraney/landscaping-assistant
  • [x] What Broke — detailed description with redirect_uri mismatch
  • [x] Repro Steps — 5 concrete steps
  • [x] Expected Behavior — dynamic redirect_uri matching Host header
  • [x] Environment — prod namespace, public domain, Keycloak realm/client specified
  • [x] Root Cause — extra section identifying OmniAuth initializer hardcoding (accurate)
  • [x] Acceptance Criteria — 4 criteria, all testable
  • [x] Related — 4 references to upstream/sibling tickets

Traceability

  • [x] story:custom-domain label — "Access app via landscaping-assistant.app instead of Tailscale hostname"
  • [x] story note verified — found in project-landscaping-assistant user-stories section (custom-domain row)
  • [x] arch:rails-app label — Rails application component
  • [ ] arch note MISSING — no arch-rails-app note exists in pal-e-docs. However, this is a platform-wide architecture note covering dozens of tickets across all Rails work. Not blocking for this bug review.
  • [x] Forgejo issue — ldraney/landscaping-assistant#246, open

File Targets

  • [x] config/initializers/omniauth.rb (line 28) — verified: redirect_uri uses ENV.fetch('APP_URL', 'https://landscaping-assistant.tail5b443a.ts.net') with hardcoded Tailscale fallback. Root cause confirmed.
  • [x] config/environments/production.rb (lines 97-99) — verified: config.hosts whitelists multiple hostnames but doesn't affect OmniAuth redirect_uri
  • [x] app/controllers/sessions_controller.rb (line 50) — verified: logout redirect uses dynamic root_url, but OmniAuth callback URL is static

Repo Placement

Correct. Issue filed on ldraney/landscaping-assistant, fix is in the same repo (OmniAuth initializer). Keycloak client redirect URIs may also need updating but that was covered by #224.

Dependencies

  • #224 (config.hosts + Keycloak redirect URIs) — in validation column. This bug is a follow-up discovery from #224's incomplete scope (redirect_uri not addressed).
  • #434 (Caddy reverse proxy for landscaping-assistant.app) — in validation column. Must be working for this fix to be testable.
  • #231 (HostAuthorization fix) — done. Prerequisite resolved.
No blockers. Dependencies are either done or in validation.

Acceptance Criteria

All 4 criteria are concrete and agent-verifiable:
  • AC1: redirect_uri check via browser or curl — testable
  • AC2: Tailscale hostname regression check — testable
  • AC3: Keycloak valid_redirect_uris — verifiable via Keycloak admin API or config
  • AC4: Full login flow on public domain — testable via browser automation
Note: AC3 (Keycloak redirect URIs) may already be covered by #224. If so, it's a no-op verification rather than new work. This doesn't change the scope estimate.

Blast Radius

Low. The fix is isolated to the OmniAuth initializer. The same pattern (ENV.fetch with Tailscale fallback) should be checked for any other URL-generating code, but the agent search found only the OmniAuth initializer and sessions controller (which already uses dynamic URLs). No sibling services affected.

Decomposition Assessment

1 primary file target, 1 repo, 4 acceptance criteria. Estimated agent work: under 5 minutes. No decomposition needed.

Recommendation

No action needed. Ticket is well-scoped and ready for implementation.
Note: The missing arch-rails-app note is a platform-wide gap affecting many tickets, not specific to this bug. It should be tracked separately if desired.