feat(auth-sidecar): inject AUTH_OIDC_ALLOWED_RETURN_HOSTS #25

2026-07-01T13:49:13Z

jorgen.stensrud commented

2026-07-01 13:49:13 +00:00

What

inject-sidecar-oidc now maps the policies.forteapps.io/auth-oidc-allowed-return-hosts pod annotation into the sidecar's AUTH_OIDC_ALLOWED_RETURN_HOSTS env var (mirrors the existing AUTH_OIDC_COOKIE_DOMAIN wiring).

Why

Enables origin-preserving post-login redirects so a login that round-trips through a shared apex callback returns the user to the originating subdomain — fixing cold-login on <slug>.drop.forteapps.net landing on the apex admin page.

Safety

Absent annotation → '' → unchanged path-only redirect. Every other app injected by this ClusterPolicy is unaffected.

Activation chain (all required)

Forte/auth-sidecar#24 — sidecar support (≥ v1.5.0)
Forte/forte-helm fix/oidc-allowed-return-hosts — chart emits the annotation
this PR — injector reads annotation → env
Forte/helm-prod-values feat/forte-drop-allowed-return-hosts — sets the value

🤖 Generated with Claude Code

## What `inject-sidecar-oidc` now maps the `policies.forteapps.io/auth-oidc-allowed-return-hosts` pod annotation into the sidecar's `AUTH_OIDC_ALLOWED_RETURN_HOSTS` env var (mirrors the existing `AUTH_OIDC_COOKIE_DOMAIN` wiring). ## Why Enables origin-preserving post-login redirects so a login that round-trips through a shared apex callback returns the user to the originating subdomain — fixing cold-login on `<slug>.drop.forteapps.net` landing on the apex admin page. ## Safety Absent annotation → `''` → unchanged path-only redirect. Every other app injected by this ClusterPolicy is unaffected. ## Activation chain (all required) 1. `Forte/auth-sidecar#24` — sidecar support (≥ v1.5.0) 2. `Forte/forte-helm` `fix/oidc-allowed-return-hosts` — chart emits the annotation 3. **this PR** — injector reads annotation → env 4. `Forte/helm-prod-values` `feat/forte-drop-allowed-return-hosts` — sets the value 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jorgen.stensrud added 1 commit 2026-07-01 13:49:14 +00:00

feat(auth-sidecar): inject AUTH_OIDC_ALLOWED_RETURN_HOSTS

/ test (pull_request) Successful in 8s

Details

eeabe8f49b

Reads the new `policies.forteapps.io/auth-oidc-allowed-return-hosts` pod
annotation into the OIDC sidecar's AUTH_OIDC_ALLOWED_RETURN_HOSTS env var
(mirrors the existing cookie-domain wiring). Enables origin-preserving
post-login redirects so a login that round-trips through a shared apex
callback returns the user to the originating subdomain.

Absent annotation => empty => unchanged path-only redirect, so all other
apps injected by this policy are unaffected. Requires auth-sidecar >= v1.5.0
(Forte/auth-sidecar#24) and the matching forteapp chart annotation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

jorgen.stensrud requested review from danijel.simeunovic 2026-07-01 13:49:14 +00:00

jorgen.stensrud requested review from edvard.unsvag 2026-07-01 13:49:14 +00:00

danijel.simeunovic approved these changes 2026-07-02 10:29:29 +00:00

jorgen.stensrud merged commit 52c752caba into main

2026-07-02 13:17:57 +00:00

jorgen.stensrud deleted branch fix/oidc-allowed-return-hosts

2026-07-02 13:17:58 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Forte/launchpad#25