Fix hosted OIDC endpoints to use the /v1/client/oauth namespace
buildAuthorizationRequest, exchangeCode, and getUserInfo were hitting /oauth/authorize, /oauth/token, and /oauth/userinfo, which belong to smbCloud's Doorkeeper-based operator control plane. AuthApp end-user login lives under /v1/client/oauth/*, same as AuthCoreClient's Apple sign-in path. The old paths hit Devise's API-mode 401 instead of the hosted login form.
Seto Elkahfi committed
Aug 1, 2026 at 13:09 UTC
815d2b03d45645f1c4084b0f154bfa15dc9e6069
2 files changed
+7
-4
Sources/AuthCore/OIDC.swift
+5
-3
@@ -82,7 +82,7 @@ public enum OIDC {
82
83
guard
84
var components = URLComponents(
85
- url: environment.baseURL.appendingPathComponent("oauth/authorize"),
85
+ url: environment.baseURL.appendingPathComponent("v1/client/oauth/authorize"),
86
resolvingAgainstBaseURL: false
87
)
88
else {
@@ -131,7 +131,8 @@ public enum OIDC {
131
codeVerifier: String,
132
session: URLSession = .shared
133
) async throws -> TokenResponse {
134
- var request = URLRequest(url: environment.baseURL.appendingPathComponent("oauth/token"))
134
+ var request = URLRequest(
135
+ url: environment.baseURL.appendingPathComponent("v1/client/oauth/token"))
136
request.httpMethod = "POST"
137
request.setValue("application/json", forHTTPHeaderField: "Accept")
138
request.setValue("application/x-www-form-urlencoded", forHTTPHeaderField: "Content-Type")
@@ -152,7 +153,8 @@ public enum OIDC {
153
tenantId: String? = nil,
154
session: URLSession = .shared
155
) async throws -> UserInfo {
155
- var request = URLRequest(url: environment.baseURL.appendingPathComponent("oauth/userinfo"))
156
+ var request = URLRequest(
157
+ url: environment.baseURL.appendingPathComponent("v1/client/oauth/userinfo"))
158
request.httpMethod = "GET"
159
request.setValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
160
request.setValue("application/json", forHTTPHeaderField: "Accept")
Tests/AuthCoreTests/AuthCoreTests.swift
+2
-1
@@ -115,7 +115,8 @@ final class AuthCoreTests: XCTestCase {
115
let request = try OIDC.buildAuthorizationRequest(
116
environment: .production, oidcClientId: "oidc-1", redirectURI: "myapp://auth/callback")
117
let url = request.authorizeURL
118
- XCTAssertEqual(URLComponents(url: url, resolvingAgainstBaseURL: false)?.path, "/oauth/authorize")
118
+ XCTAssertEqual(
119
+ URLComponents(url: url, resolvingAgainstBaseURL: false)?.path, "/v1/client/oauth/authorize")
120
XCTAssertEqual(query(url, "response_type"), "code")
121
XCTAssertEqual(query(url, "code_challenge_method"), "S256")
122
XCTAssertEqual(query(url, "client_id"), "oidc-1")