fix: respect GitHub Codespaces port forwarding for OAuth callback URL

[Copilot]

OAuth PKCE flow hardcoded http://localhost:{port}/callback as the redirect URI, which is unreachable from the browser in GitHub Codespaces — ports must be accessed via the forwarded HTTPS URL.

Changes

• packages/adt-auth/src/utils/codespaces.ts — new getCallbackBaseUrl(port) helper that checks CODESPACE_NAME + GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN env vars (auto-injected by Codespaces) and returns the appropriate base URL:

  // Codespaces → https://my-codespace-3000.app.github.dev
  // elsewhere  → http://localhost:3000

• packages/adt-auth/src/plugins/service-key.ts — replace hardcoded http://localhost:${port} with getCallbackBaseUrl(port) when constructing the redirect URI passed to XSUAA and the token exchange.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/cf7cb116-0216-4de5-8a1a-73c9e0bc24ac
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx build adt-auth (http block)
• https://storage.googleapis.com/prod-north-america/69ab0980542defed8d2aa8f4/cf7cb116-0216-4de5-8a1a-73c9e0bc24ac-logs
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/adt-cli/adt-cli/node_modules/.bin/nx build adt-auth (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

are you sure oauth is working? I have redirect to http://localhost:3000/callback?code=ex8SSkZDH2cIBIeNmBmsrR8Jh9qPkVoV&state=0f116b62cd97873e78b5129dd5b0cad2 but we are running in codespaces! we need to respect this https://docs.github.com/en/codespaces/developing-in-a-codespace/forwarding-ports-in-your-codespace

The user has attached the following file paths as relevant context:

• AGENTS.md

Created from VS Code.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[sonarqubecloud]

Quality Gate failed

Failed conditions
12 Security Hotspots
27.1% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 05de004

---

☁️ Nx Cloud last updated this comment at 2026-03-12 13:32:41 UTC