fix(shopify): OAuth redirected to localhost in prod; default SELF_URL + MESH_URL override - #528
Merged
Merged
Conversation
SELF_URL defaulted to http://localhost:8000, so with the env var unset in production authorizationUrl built http://localhost:8000/oauth/custom and sent merchants to their own machine. The MCP is deployed at a fixed domain, so default SELF_URL to https://sites-shopify.deco.site (override via env for local dev) — mirrors the SERVER_PUBLIC_URL convention in the microsoft-teams MCP. Also drop the MESH_URL dependency: validate the OAuth callback against a decocms.com host-suffix allowlist (+ loopback for dev), the same model as the GitHub MCP, so the mesh origin no longer needs to be configured. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Optional operator-set override on top of the decocms.com/loopback allowlist, so a local deco studio on a custom origin can complete the OAuth callback. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #526. Two prod-breaking bugs found after deploy, both in how OAuth URLs/origins were resolved.
Bug 1 — Authorize sent merchants to localhost
SELF_URLdefaulted tohttp://localhost:8000, so with the env unset in prodauthorizationUrlbuilthttp://localhost:8000/oauth/custom.Fix: default
SELF_URLto the deployed originhttps://sites-shopify.deco.site(override via env for local dev). Mirrors theSERVER_PUBLIC_URLconvention in the microsoft-teams MCP.Bug 2 — "Invalid or missing callback URL"
The runtime mounts its
/oauth/callbackon this MCP's own origin, so thecallback_urlhanded toauthorizationUrlis onsites-shopify.deco.site, notdecocms.com. The decocms-only allowlist rejected it.Fix: accept the
SELF_URLorigin as the primary allowed callback origin.Callback allowlist (anti-open-redirect)
Allowed callback origins now: the MCP's own origin (
SELF_URL),decocms.com(+ subdomains), loopback over http (dev), and an optional operator-setMESH_URLoverride for a self-hosted / local deco studio on a custom origin.Tests
bun test— 54 pass, incl.:SELF_URLunset → prod domain (not localhost); callback on the MCP's own origin accepted; off-origin rejected;MESH_URLwhitelists a custom origin.tscclean.🤖 Generated with Claude Code