From aaed2dd082e5b15e6ebd61748fbbcecbc3394734 Mon Sep 17 00:00:00 2001
From: Lak-G <aaaaaamado@gmail.com>
Date: Fri, 14 Aug 2026 20:21:14 -0700
Subject: [PATCH] Fix: pasar el signin por endpoint propio para completar PKCE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

El flow OAuth de Supabase (@supabase/ssr) es PKCE por default: requiere
guardar un code_verifier en cookies del cliente ANTES de mandar al user
a Google. El login.astro anterior linkeaba directo a
supabase.buglabs.dev/auth/v1/authorize saltándose ese paso, así que el
exchangeCodeForSession del callback fallaba sin cookies válidas.

Ahora el botón "Continuar con Google" apunta a /api/auth/signin, que
usa supabase.auth.signInWithOAuth() — este método sí setea el
code_verifier en las cookies del dominio de la app, y después el
callback lo recupera para completar el intercambio.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 src/env.d.ts                 |  2 ++
 src/pages/api/auth/signin.ts | 15 +++++++++++++++
 src/pages/login.astro        |  5 +----
 3 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 src/pages/api/auth/signin.ts

diff --git a/src/env.d.ts b/src/env.d.ts
index eca1d69..63e3eaf 100644
--- a/src/env.d.ts
+++ b/src/env.d.ts
@@ -30,3 +30,5 @@ interface ImportMetaEnv {
 interface ImportMeta {
   readonly env: ImportMetaEnv;
 }
+
+declare const process: { env: Record<string, string | undefined> };
diff --git a/src/pages/api/auth/signin.ts b/src/pages/api/auth/signin.ts
new file mode 100644
index 0000000..e661dc4
--- /dev/null
+++ b/src/pages/api/auth/signin.ts
@@ -0,0 +1,15 @@
+import type { APIRoute } from 'astro';
+import { serverClient } from '@/lib/supabase';
+
+export const GET: APIRoute = async ({ cookies, url, redirect }) => {
+  const appUrl = process.env.PUBLIC_APP_URL ?? import.meta.env.PUBLIC_APP_URL ?? url.origin;
+  const supabase = serverClient(cookies);
+
+  const { data, error } = await supabase.auth.signInWithOAuth({
+    provider: 'google',
+    options: { redirectTo: `${appUrl}/api/auth/callback` },
+  });
+
+  if (error || !data?.url) return redirect('/login?error=oauth');
+  return redirect(data.url);
+};
diff --git a/src/pages/login.astro b/src/pages/login.astro
index b3c364a..31a5b52 100644
--- a/src/pages/login.astro
+++ b/src/pages/login.astro
@@ -9,10 +9,7 @@ const errorMsg = errorParam === 'dominio'
     ? 'No se pudo completar la autenticación con Google. Inténtalo de nuevo.'
     : null;
 
-const appUrl = process.env.PUBLIC_APP_URL ?? import.meta.env.PUBLIC_APP_URL ?? url.origin;
-const supabaseUrl = process.env.PUBLIC_SUPABASE_URL ?? import.meta.env.PUBLIC_SUPABASE_URL;
-const redirectTo = `${appUrl}/api/auth/callback`;
-const googleAuthUrl = `${supabaseUrl}/auth/v1/authorize?provider=google&redirect_to=${encodeURIComponent(redirectTo)}`;
+const googleAuthUrl = '/api/auth/signin';
 ---
 <Layout title="Iniciar sesión — LabPréstamos UABC">
   <main id="main" class="min-h-screen grid place-items-center p-4">