Feat/sign in gate pilot - #18
Merged
Merged
Conversation
Sign-in on this host reached 2plot.ai, succeeded, and left the user there. No error on either side, client or server — which is why it survived a deploy. CLERK_SATELLITE_SIGN_IN_REDIRECT was unset, so dash-clerk-auth's buildSatelliteRedirect() returned null and both click handlers (lib/auth.py's #clerk-login-button delegation and assets/auth_gate.js's #auth-gate-*) fell through to Clerk.redirectToSignIn(). That hops to CLERK_SIGN_IN_URL — accounts.2plot.ai, Clerk's HOSTED Account Portal. The hub's Dash app is never in the loop, so none of its returnTo machinery runs: not the whitelist check against allowed_redirect_origins(), not the force-redirect, not the /onboarding auto-open. Whether the user comes back is then decided entirely by the Clerk dashboard's own allowed-redirect list, and when that does not name this host ClerkJS drops signInForceRedirectUrl silently and uses the portal's default. Successful sign-in, wrong destination, nothing logged. Set to https://2plot.ai/onboarding, the button navigates to a page on the hub's own app, which validates ?returnTo= against a list that already contains https://leaflet.2plot.dev and sends the user home. auth_gate.js appends &mode=signup, which that page reads to open the sign-UP modal, so one value serves both buttons. The variable is read by dash-clerk-auth from the environment directly, so lib/auth.py does not pass it through — declaring it in render.yaml is the whole fix. This file's own note is why it was missing: it said to set it "only once 2plot.ai has a page that honours ?returnTo=". That page shipped; nobody came back. So register() now WARNS at boot whenever satellite mode is on and this is unset, because a misconfiguration with no error anywhere needs something to say it out loud. DEPLOYMENT.md gains the two-path table, and a blueprint-vs-dashboard drift section: Render applies envVars on a blueprint SYNC, not on autoDeploy, so the live service is also missing PAGE_VISIBILITY_FILE (control-board toggles reset every deploy), AD_SERVER_URL (no ads), ANALYTICS_GEO_LOOKUP, and carries two Gen-1 variables nothing reads. PYTHONUNBUFFERED is correctly absent — it is a Dockerfile ENV here, as in the boilerplate. 182 passed, flake8 clean, render.yaml parses. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
CLERK_SATELLITE_SIGN_IN_REDIRECT reads like a boolean and is not — it is a destination. buildSatelliteRedirect() builds `<value>?returnTo=<here>` by plain concatenation, so a truthy non-URL resolves against THIS host: CLERK_SATELLITE_SIGN_IN_REDIRECT=true sends the Sign In button to https://leaflet.2plot.dev/true?returnTo=..., which 404s. That is worse than leaving it unset, where at least the Clerk Account Portal fallback signs the user in before stranding them. dash-clerk-auth notices and does not act on it: one logger.warning, then it uses the value anyway. That warning lands several screens up in the boot output, nowhere near the other [auth] lines a deploy check reads. So the guard added in c046719 now covers both mistakes — unset, and set to something that is not an absolute http(s) URL — and says which one happened. Verified against '', 'true', a bare host, and the correct URL. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.