7ddc045ed4 redirects to the app root when the OIDC round-trip fails, but the
middleware is mounted ahead of every route, so the redirect also caught traffic
it was never meant to:
- An /api/* XHR reaching a failed lazy init received a 302 to HTML where it
expected JSON. Throwing (the previous behaviour) was right for those callers.
- The redirect target is itself covered by the middleware, so a failure on "/"
redirected "/" to "/". A transient failure self-heals because the init promise
is reset, but a persistent one -- a malformed oauthBaseUrl that auth() rejects
on every build -- looped the browser until it gave up, replacing a JSON error
that named the bad config with an opaque ERR_TOO_MANY_REDIRECTS.
Restrict the redirect to the routes the user actually navigates to
(/authenticate, /callback, /logout) and hand everything else to the error chain.
The route table is hoisted out of generateOAuthConfig so the guard is derived
from the same literals the library is configured with rather than repeating
them; postLogoutRedirect is excluded, being where the library sends the browser
afterwards rather than a route it handles.
The guard compares req.path, so the callback still redirects when it arrives
with ?code=&state=; a test pins that, since the spec's fake request previously
carried no path at all and would have masked it.
Also fix spec/sync/sync-protocol.spec.ts, which has been failing since
7ddc045ed4: it asserted 500 for /authenticate, the behaviour that commit
replaced. Its purpose is proving the middleware is engaged rather than falling
through to the 404 handler, which a 302 to "/" demonstrates equally.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
0a3d310607