mosaicstack/stack
1
0
Fork 0
Code Issues 42 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

fix(federation): enrollment URL derives from BETTER_AUTH_URL instead of the gateway base URL #684

New Issue
Open
opened 2026-06-25 02:55:21 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-06-25 02:55:21 +00:00
Owner
Copy Link

Summary

POST /api/admin/federation/grants/:id/tokens constructs the federation enrollment URL from BETTER_AUTH_URL, but that env var is the Better Auth origin (typically the web app), not the gateway's own listening address. In any deployment where the web origin differs from the gateway base URL (the normal case), the returned enrollmentUrl points at the wrong host/port, so a peer cannot redeem the token without manual URL surgery.

Location

apps/gateway/src/federation/federation.controller.ts:145

const baseUrl = process.env['BETTER_AUTH_URL'] ?? 'http://localhost:14242';
const enrollmentUrl = `${baseUrl}/api/federation/enrollment/${result.token}`;

Why it is wrong

BETTER_AUTH_URL is the Better Auth issuer/origin (web app URL). The enrollment endpoint lives on the gateway (/api/federation/enrollment/:token). Reusing the auth origin conflates two unrelated hosts. The fallback http://localhost:14242 is also a web-tier port, not the gateway.

Impact

  • Operators receive an enrollmentUrl pointing at the web origin instead of the gateway, breaking the out-of-band enrollment hand-off in real deployments.
  • The federation test harness (tools/federation-harness/) already has to work around this: the compose file sets BETTER_AUTH_URL: http://gateway-b:3000 to coax an in-cluster-reachable URL, and seed.ts then rewrites the host portion of the returned URL to the host-accessible base before redeeming. See tools/federation-harness/README.md -> "Known Limitations -> BETTER_AUTH_URL enrollment URL bug" for the documented workaround.

Suggested fix

Derive the enrollment base URL from the gateway's own listening address rather than BETTER_AUTH_URL — e.g. a dedicated FEDERATION_ENROLLMENT_BASE_URL (preferred, explicit) or a GATEWAY_BASE_URL env var, falling back to the gateway's configured host/port. Once fixed, the harness workaround (compose BETTER_AUTH_URL override + seed URL rewrite) can be removed.

Notes

  • Surfaced during the M3 federation harness-readiness audit (origin/next @ 86e106fc).
  • Originally noted as a follow-up to PR #505; not yet tracked as a standalone issue.
  • Do not bundle the fix with harness changes.
## Summary `POST /api/admin/federation/grants/:id/tokens` constructs the federation **enrollment URL** from `BETTER_AUTH_URL`, but that env var is the Better Auth origin (typically the **web app**), not the gateway's own listening address. In any deployment where the web origin differs from the gateway base URL (the normal case), the returned `enrollmentUrl` points at the wrong host/port, so a peer cannot redeem the token without manual URL surgery. ## Location `apps/gateway/src/federation/federation.controller.ts:145` ```ts const baseUrl = process.env['BETTER_AUTH_URL'] ?? 'http://localhost:14242'; const enrollmentUrl = `${baseUrl}/api/federation/enrollment/${result.token}`; ``` ## Why it is wrong `BETTER_AUTH_URL` is the Better Auth issuer/origin (web app URL). The enrollment endpoint lives on the **gateway** (`/api/federation/enrollment/:token`). Reusing the auth origin conflates two unrelated hosts. The fallback `http://localhost:14242` is also a web-tier port, not the gateway. ## Impact - Operators receive an `enrollmentUrl` pointing at the web origin instead of the gateway, breaking the out-of-band enrollment hand-off in real deployments. - The federation test harness (`tools/federation-harness/`) already has to **work around** this: the compose file sets `BETTER_AUTH_URL: http://gateway-b:3000` to coax an in-cluster-reachable URL, and `seed.ts` then **rewrites the host portion** of the returned URL to the host-accessible base before redeeming. See `tools/federation-harness/README.md` -> "Known Limitations -> BETTER_AUTH_URL enrollment URL bug" for the documented workaround. ## Suggested fix Derive the enrollment base URL from the gateway's own listening address rather than `BETTER_AUTH_URL` — e.g. a dedicated `FEDERATION_ENROLLMENT_BASE_URL` (preferred, explicit) or a `GATEWAY_BASE_URL` env var, falling back to the gateway's configured host/port. Once fixed, the harness workaround (compose `BETTER_AUTH_URL` override + seed URL rewrite) can be removed. ## Notes - Surfaced during the M3 federation harness-readiness audit (origin/next @ 86e106fc). - Originally noted as a follow-up to PR #505; not yet tracked as a standalone issue. - Do **not** bundle the fix with harness changes.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#684
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?