);
diff --git a/apps/streams/src/routes/chunks.ts b/apps/streams/src/routes/chunks.ts
index 1e2f930c33c..927b1c2206d 100644
--- a/apps/streams/src/routes/chunks.ts
+++ b/apps/streams/src/routes/chunks.ts
@@ -1,5 +1,5 @@
import { type Context, Hono } from "hono";
-import { z } from "zod";
+import * as z from "zod";
import type { AIDBSessionProtocol } from "../protocol";
import type { StreamChunk } from "../types";
diff --git a/apps/web/src/app/auth/desktop/success/components/DesktopRedirect/DesktopRedirect.tsx b/apps/web/src/app/auth/desktop/success/components/DesktopRedirect/DesktopRedirect.tsx
index 678b3ae4849..263b9234b63 100644
--- a/apps/web/src/app/auth/desktop/success/components/DesktopRedirect/DesktopRedirect.tsx
+++ b/apps/web/src/app/auth/desktop/success/components/DesktopRedirect/DesktopRedirect.tsx
@@ -4,10 +4,23 @@ import Image from "next/image";
import Link from "next/link";
import { useEffect } from "react";
-export function DesktopRedirect({ url }: { url: string }) {
+export function DesktopRedirect({
+ url,
+ localCallbackUrl,
+}: {
+ url: string;
+ localCallbackUrl?: string;
+}) {
useEffect(() => {
- window.location.href = url;
- }, [url]);
+ if (localCallbackUrl) {
+ // Full-page redirect to localhost — not blocked by mixed content.
+ // Browsers only block mixed-content subresources (fetch, XHR), not navigations.
+ window.location.href = localCallbackUrl;
+ } else {
+ // Fallback to deep link (macOS, or when local server unavailable)
+ window.location.href = url;
+ }
+ }, [url, localCallbackUrl]);
return (
@@ -16,7 +29,7 @@ export function DesktopRedirect({ url }: { url: string }) {
Redirecting to desktop app...
Click here if not redirected
diff --git a/apps/web/src/app/auth/desktop/success/page.tsx b/apps/web/src/app/auth/desktop/success/page.tsx
index 773440c2893..23c353d76f1 100644
--- a/apps/web/src/app/auth/desktop/success/page.tsx
+++ b/apps/web/src/app/auth/desktop/success/page.tsx
@@ -8,10 +8,17 @@ import { DesktopRedirect } from "./components/DesktopRedirect";
export default async function DesktopSuccessPage({
searchParams,
}: {
- searchParams: Promise<{ desktop_state?: string; desktop_protocol?: string }>;
+ searchParams: Promise<{
+ desktop_state?: string;
+ desktop_protocol?: string;
+ desktop_local_callback?: string;
+ }>;
}) {
- const { desktop_state: state, desktop_protocol = "superset" } =
- await searchParams;
+ const {
+ desktop_state: state,
+ desktop_protocol = "superset",
+ desktop_local_callback: localCallbackBase,
+ } = await searchParams;
if (!state) {
return (
@@ -73,10 +80,13 @@ export default async function DesktopSuccessPage({
updatedAt: now,
});
const desktopUrl = `${desktop_protocol}://auth/callback?token=${encodeURIComponent(token)}&expiresAt=${encodeURIComponent(expiresAt.toISOString())}&state=${encodeURIComponent(state)}`;
+ const localCallbackUrl = localCallbackBase
+ ? `${localCallbackBase}?token=${encodeURIComponent(token)}&expiresAt=${encodeURIComponent(expiresAt.toISOString())}&state=${encodeURIComponent(state)}`
+ : undefined;
return (
-
+
);
}
diff --git a/packages/auth/src/server.ts b/packages/auth/src/server.ts
index 6522e21219b..bbc7ba8b035 100644
--- a/packages/auth/src/server.ts
+++ b/packages/auth/src/server.ts
@@ -45,6 +45,14 @@ import {
const qstash = new Client({ token: env.QSTASH_TOKEN });
const NOTIFY_SLACK_URL = `${env.NEXT_PUBLIC_API_URL}/api/integrations/stripe/jobs/notify-slack`;
+const desktopDevPort = process.env.DESKTOP_VITE_PORT || "5173";
+const desktopDevOrigins =
+ process.env.NODE_ENV === "development"
+ ? [
+ `http://localhost:${desktopDevPort}`,
+ `http://127.0.0.1:${desktopDevPort}`,
+ ]
+ : [];
export const auth = betterAuth({
baseURL: env.NEXT_PUBLIC_API_URL,
@@ -61,6 +69,7 @@ export const auth = betterAuth({
env.NEXT_PUBLIC_MARKETING_URL,
env.NEXT_PUBLIC_ADMIN_URL,
...(env.NEXT_PUBLIC_DESKTOP_URL ? [env.NEXT_PUBLIC_DESKTOP_URL] : []),
+ ...desktopDevOrigins,
"superset://app",
"superset://",
...(process.env.NODE_ENV === "development"