v3.0.5

Signed-off-by: Dinger <[email protected]>

Author: quantdinger-lab

backend_api_python/app/services/oauth_service.py

@@ -156,15 +156,29 @@ def _load_config(self):
         self.github_redirect_uri = os.getenv('GITHUB_REDIRECT_URI', '')
         self.github_enabled = bool(self.github_client_id and self.github_client_secret)
 
-        # Frontend URL for redirect after OAuth
-        self.frontend_url = os.getenv('FRONTEND_URL', 'http://localhost:8080')
+        # Frontend URL for redirect after OAuth.
+        #
+        # FRONTEND_URL accepts a comma-separated list of origins (the same
+        # convention used by CORS in `app/__init__.py`). This lets one backend
+        # serve e.g. ai.quantdinger.com + m.quantdinger.com without forcing the
+        # operator to also fill OAUTH_ALLOWED_REDIRECTS.
+        #
+        # The FIRST entry is the default post-login redirect target. Every
+        # entry is added to the allow-list. If we ever stored the raw
+        # comma-joined string as a single URL we'd build a redirect like
+        # "https://a.example.com,https://b.example.com?oauth_token=..." and
+        # the browser would land on a malformed page (see bug report
+        # 2026-05-14: stray comma + missing colon in the second origin).
+        raw_frontend = os.getenv('FRONTEND_URL', 'http://localhost:8080')
+        frontend_list = [x.strip() for x in raw_frontend.split(',') if x.strip()]
+        self.frontend_url = frontend_list[0] if frontend_list else 'http://localhost:8080'
 
         # Allow-listed origins that may be used as post-login redirect targets
-        # (comma-separated). FRONTEND_URL is always allowed.
+        # (comma-separated). FRONTEND_URL entries are always allowed.
         raw_allowed = os.getenv('OAUTH_ALLOWED_REDIRECTS', '')
         extra = [x.strip() for x in raw_allowed.split(',') if x.strip()]
         self.allowed_redirect_origins = set()
-        for item in [self.frontend_url] + extra:
+        for item in frontend_list + extra:
             origin = self._normalize_origin(item)
             if origin:
                 self.allowed_redirect_origins.add(origin)

backend_api_python/env.example

@@ -56,6 +56,15 @@ ADMIN_EMAIL=
 # Core app
 # =========================
 DATABASE_URL=postgresql://quantdinger:quantdinger123@postgres:5432/quantdinger
+# FRONTEND_URL: the canonical user-facing URL of the web app.
+# - Used for: CORS allow-list, default post-login OAuth redirect target.
+# - Comma-separated multi-origin IS supported (the first entry is the
+#   default OAuth redirect; every entry is added to the CORS / OAuth
+#   allow-list). Prefer the simpler `OAUTH_ALLOWED_REDIRECTS` below for
+#   the second / third front-end origin so that this stays a single URL.
+# Examples:
+#   FRONTEND_URL=https://ai.quantdinger.com
+#   FRONTEND_URL=https://ai.quantdinger.com,https://m.quantdinger.com
 FRONTEND_URL=http://localhost:8888
 # Extra front-end origins allowed as OAuth post-login redirect targets.
 # Comma-separated, scheme + host (+ optional port). Used when multiple clients