supabase / supabase / 26942694063

74%

push

github

fix: Don't use the custom domain when resolving OpenID config (#46637)

When setting up an OAuth Server app, the Studio fetches OpenID config
from the URL. If the project uses custom domain, it'll cause a CORS
because the custom domain is not whitelisted. This PR changes to use the
`<ref>.supabase.co` URL to resolve the config.

How to test:

1. Have a project with custom domain
2. Open `/project/_/auth/oauth-server`
3. Enable the Supabase OAuth Server
4. The OAuth endpoints in the bottom should appear

BEFORE:
<img width="1172" height="412" alt="Screenshot 2026-06-04 at 10 43 35"
src="https://github.com/user-attachments/assets/d6157281-dc80-4a55-9356-10efb7953b7c"
/>

AFTER:
<img width="1182" height="406" alt="Screenshot 2026-06-04 at 10 42 20"
src="https://github.com/user-attachments/assets/6222124e-5f9e-4898-9fae-41d295211403"
/>

Fixes
https://linear.app/supabase/issue/FE-2987/oauth-endpoint-fields-are-empty-with-custom-domains

989 of 1386 branches covered (71.36%)

Branch coverage included in aggregate %.

1525 of 2083 relevant lines covered (73.21%)

247.13 hits per line