fix(auth): normalize proxy proto and align oauth backend env config

[LucasSantana-Dev]

Summary

• normalize proxy protocol handling for OAuth/session flows behind reverse proxies
• add/align backend OAuth-related envs in compose and docs (WEBAPP_BACKEND_URL, CLIENT_SECRET)
• update .env.example and setup docs to use canonical API callback domain guidance

Why

These changes reduce login/session inconsistencies in proxied production setups and make required env wiring explicit across local and deployed compose environments.

Validation

• npm run test --workspace=packages/backend -- tests/integration/routes/auth.test.ts --runInBand
• npm run type:check --workspace=packages/backend

Notes

• branch was rebased onto current main before final commit
• no feature behavior changes outside auth/proxy/config wiring

Summary by CodeRabbit

Release Notes

• New Features

  • Added support for canonicalizing OAuth callbacks to API domain.
  • Introduced new environment variables for improved configuration flexibility.

• Bug Fixes

  • Enhanced secure session cookie handling in production environments.
  • Improved HTTPS header processing for secure proxy deployments.
  • Added callback alias route for OAuth compatibility.

• Documentation

  • Updated setup guides and examples to reflect new OAuth callback requirements and environment variable configuration.

• Tests

  • Added security-focused tests for cookie attributes and OAuth callback flows.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lucky	Ready	Preview, Comment	Mar 10, 2026 4:30am

[netlify]

✅ Deploy Preview for regal-bunny-0c8efe ready!

Name	Link
🔨 Latest commit	a2cefe7
🔍 Latest deploy log	https://app.netlify.com/projects/regal-bunny-0c8efe/deploys/69af9e0bc2365e0008f7827c
😎 Deploy Preview	https://deploy-preview-133--regal-bunny-0c8efe.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates OAuth callback routing to use a backend API domain instead of the frontend domain, introduces separate frontend/backend URL configuration variables, and enhances production proxy handling with proper trust settings and header normalization.

Changes

Cohort / File(s)	Summary
Environment Configuration .env.example, docker-compose.dev.yml, docker-compose.yml	Added WEBAPP_FRONTEND_URL, WEBAPP_BACKEND_URL, and CLIENT_SECRET environment variables to support dual frontend/backend URL model with explicit OAuth callback configuration.
Documentation README.md, CHANGELOG.md, docs/CLOUDFLARE_TUNNEL_SETUP.md, docs/WEBAPP_SETUP.md	Updated setup guides and changelog to reflect OAuth callback routing to backend API domain, canonicalization patterns, and trust proxy settings for production deployments.
Proxy and Session Handling nginx/nginx.conf, packages/backend/src/server.ts	Configured nginx to normalize X-Forwarded-Proto header with https default; enabled trust proxy in backend production environment for secure session cookies behind reverse proxies.
Test Infrastructure and Integration Tests packages/backend/tests/setup.ts, packages/backend/tests/integration/routes/auth.test.ts	Enhanced mock session factory with cookie handling logic, HTTPS detection helpers, and secure cookie attribute management; added integration tests validating secure session cookies, canonical callback URLs, and callback alias routing.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(auth): stop vercel oauth infinite loop #125: Implements OAuth routing to separate backend API origin with frontend-to-API base URL canonicalization and callback domain changes.
• fix(deploy): switch to lucky-api domain and stabilize smoke check #127: Modifies OAuth callback and backend domain configuration with WEBAPP_REDIRECT_URI canonicalization to API-domain URLs.

Suggested labels

backend, size/m

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and concisely summarizes the main changes: normalizing proxy protocol handling and aligning OAuth backend environment configuration across the codebase.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/oauth-secure-cookie-proxy-proto

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud