René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Self-hosted multi-user OAuth Problem in 1.35.1: client requests /api/auth/* but server mounts NextAuth at /v1/auth/*","articleBody":"## Summary\n  \n  After enabling Google OAuth multi-user mode on a self-hosted gateway, the dashboard fails to sign in because the client-side React code requests `/api/auth/providers` while the server-side NextAuth handler\n  is mounted at `/v1/auth/*`. Result: 404, redirect to `/api/auth/error` (also 404), no path to a working multi-user install. This blocks Projects, blocks the multi-account feature shipped in #187 (only\n  exposed via the org API), and effectively makes self-hosted multi-user mode unusable in 1.35.1.\n  \n  ## Environment\n  \n  - Gateway image: `ghcr.io/onecli/onecli:1.35.1` (digest `sha256:7339d4490…`)\n  - CLI: `onecli` 2.2.4 (macOS arm64)\n  - Host: macOS 14, Docker 29.3.1\n  - Mode: self-hosted, transitioning from single-user → multi-user\n  - Postgres: bundled `postgres:18-alpine`\n  \n  ## Reproduction \n  \n  1. Fresh self-hosted gateway running on `127.0.0.1:10254` with the default `docker-compose.yml`, no `.env`.\n  2. In Google Cloud Console: create OAuth 2.0 Client (Web application) with authorized redirect URIs:\n     - `http://localhost:10254/v1/auth/callback/google`\n     - `http://127.0.0.1:10254/v1/auth/callback/google`\n  3. Create `~/.onecli/.env`:\n     ``` \n     ONECLI_VERSION=1.35.1\n     NEXTAUTH_SECRET=\u003copenssl rand -base64 32\u003e\n     ``` \n  4. Create `~/.onecli/docker-compose.override.yml` to inject the Google vars (the bundled compose only maps `NEXTAUTH_SECRET` in its `environment:` block, not `GOOGLE_*`, so this override is also required —\n  see \"Secondary issue\" below):\n     ```yaml\n     services:\n       onecli:\n         environment:\n           GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}\n           GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}\n     ```\n  5. Add `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` to `~/.onecli/.env`.\n  6. `docker compose up -d`. Container becomes healthy.\n  7. Open `http://localhost:10254/auth/login` in a fresh Chrome incognito window. Click the Google sign-in button.\n  \n  ## Observed\n  \n  ```\n  GET http://localhost:10254/api/auth/providers\n  → 404 Not Found\n    {\"error\":{\"message\":\"Unrecognized request URL (GET: /v1/auth/providers). ...\",\"type\":\"invalid_request_error\"}}\n  \n  GET http://localhost:10254/api/auth/error\n  → 404 Not Found\n    (same gateway \"Unrecognized request URL\" body)\n  ```\n  \n  Browser address bar lands at `http://localhost:10254/api/auth/error` with no `?error=…` query string (because NextAuth never got far enough to attach one — the providers fetch failed first).\n  \n  Meanwhile, the same endpoints under `/v1/auth/*` work correctly server-side:\n  \n  ```\n  GET http://localhost:10254/v1/auth/providers  → 200\n  {\"google\":{\"id\":\"google\",\"name\":\"Google\",\"type\":\"oidc\",\"signinUrl\":\"http://localhost:10254/v1/auth/signin/google\",\"callbackUrl\":\"http://localhost:10254/v1/auth/callback/google\"}}\n  GET http://localhost:10254/v1/auth/csrf       → 200 {\"csrfToken\":\"...\"}\n  GET http://localhost:10254/v1/auth/session    → 200 (returns {} or session)\n  ```\n  \n  The Next.js routes-manifest inside the container confirms only `/v1/auth/[...nextauth]/route` and `/v1/auth/session/route` are registered — there are no `/api/auth/*` routes.\n  \n  ## What I tried that didn't help\n  \n  Setting these in the container env (via the override compose) made the SERVER side report the right URLs (the `signinUrl`/`callbackUrl` in `/v1/auth/providers` updated to the `/v1/auth/...` form), but the\n  CLIENT side still requested `/api/auth/providers`:\n  \n  - `NEXTAUTH_URL=http://localhost:10254/v1/auth`\n  - `AUTH_URL=http://localhost:10254/v1/auth`\n  - `AUTH_TRUST_HOST=true`\n  \n  Grepping the built client chunks under `/app/apps/web/.next/static/chunks`:\n  - No `SessionProvider` `basePath` prop assignment found\n  - No `NEXT_PUBLIC_*` env var for auth basePath defined or referenced\n  - Only `NEXT_PUBLIC_APP_URL` and three `NEXT_PUBLIC_COGNITO_*` vars exist on the public side\n  - The only hardcoded auth path in the built code is `/v1/auth/session` (one occurrence); everything else NextAuth-related is constructed at runtime by the library default\n\n## Impact\n  \n  - Self-hosted multi-user OAuth is fully blocked in 1.35.1\n  - Projects feature inaccessible (gated on multi-user)\n  - Multi-account connections (#180 / #187) are gated on the org API which itself is gated on multi-user\n  - The 1.35.1 release note \"restore default project fallback for self-hosted auth\" suggests this area is being actively maintained — this issue is likely a close cousin\n","author":{"url":"https://github.com/dj42spfmvb-eng","@type":"Person","name":"dj42spfmvb-eng"},"datePublished":"2026-06-10T05:00:53.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/362/onecli/issues/362"}