fix: proxy Firebase auth handler so Safari mobile redirect login completes (#4067)

[amitsingh-007]

Context

Follow-up to #4070. That change made mobile use signInWithRedirect, but on iOS Safari the redirect returned no user — getRedirectResult() resolved null and the button stayed on "Login".

Root cause: authDomain (bypass-links.firebaseapp.com) is a different origin than the app (bypass-links.vercel.app). Firebase completes the redirect by reading state from a cross-origin iframe on firebaseapp.com, which Safari's ITP blocks. (The /__/firebase/init.json 404 in the Network tab was a symptom.)

Fix

Make the auth handler same-origin with the app, per Firebase's redirect best practices:

• apps/web/next.config.ts — rewrites() transparently proxy /__/auth/* and /__/firebase/* to bypass-links.firebaseapp.com.
• packages/configs/firebase.config.ts — prod authDomain → bypass-links.vercel.app (dev unchanged).

Prerequisite (done): https://bypass-links.vercel.app/__/auth/handler added as an Authorized redirect URI on the web OAuth client.

Rollback: revert the one authDomain line + redeploy; the old firebaseapp.com redirect URI is still registered.

Check if the Pull Request fulfils these requirements

• Does the extension require a version change?

🤖 Generated with Claude Code

Greptile Summary

This PR fixes Safari ITP blocking signInWithRedirect on iOS by making the Firebase auth handler same-origin with the app. The approach follows Firebase's official redirect best-practices guide.

• next.config.ts adds transparent Next.js rewrites that proxy /__/auth/* and /__/firebase/* to bypass-links.firebaseapp.com, making the auth handler reachable on the app's own domain.
• firebase.config.ts changes the prod authDomain from bypass-links.firebaseapp.com to bypass-links.vercel.app so Firebase SDK directs redirect traffic through the same-origin proxy.

Confidence Score: 5/5

Safe to merge for production; the fix is the standard Firebase-recommended approach and scoped correctly to prod config.

The change is a well-understood pattern (same-origin proxy for Firebase auth) with no functional issues on the production deployment. The one concern worth watching is that Vercel preview deployments inherit NODE_ENV=production, so auth redirects on preview URLs will land on the production domain — a workflow inconvenience rather than a production regression.

The authDomain / NODE_ENV coupling in packages/configs/firebase.config.ts and apps/web/src/app/helpers/firebase/index.ts is worth revisiting if preview deployments need to exercise the auth flow.

_{Reviews (4): Last reviewed commit: "revert: drop dev-mode redirect handling" | Re-trigger Greptile}

[sourcery-ai]

Hey - I've left some high level feedback:

• The authHelper domain in next.config.ts is hard-coded; consider reading this from environment or a shared config so staging/preview deployments and future domain changes don’t require code edits.
• Since rewrites() applies in all environments, double-check whether you want the Firebase proxy behavior in local/dev as well; if not, gate the rewrites on process.env.NODE_ENV or a dedicated flag.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `authHelper` domain in `next.config.ts` is hard-coded; consider reading this from environment or a shared config so staging/preview deployments and future domain changes don’t require code edits.
- Since `rewrites()` applies in all environments, double-check whether you want the Firebase proxy behavior in local/dev as well; if not, gate the rewrites on `process.env.NODE_ENV` or a dedicated flag.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Production Firebase configuration now sets authDomain to bypass-links.vercel.app and documents the Safari redirect behavior. The Next.js configuration adds asynchronous rewrite rules that proxy /__/auth/* and /__/firebase/* requests to https://bypass-links.firebaseapp.com, preserving the request paths.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: proxying Firebase auth handlers to fix Safari redirect login.
Description check	✅ Passed	The description follows the template and addresses the version-change question with a clear answer.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 24 rules

✅ Skills: e2e-test-generation

1. Auth domain host mismatch 🐞 Bug ≡ Correctness

Description

getFirebasePublicConfig(true) now hard-codes authDomain to bypass-links.vercel.app even though
the web app’s deployed origin is driven by NEXT_PUBLIC_HOST_NAME. If the app is served from a
different origin while using the prod config, Firebase redirect login will run on
bypass-links.vercel.app/__/auth/handler (not the current origin), so the current app origin may
not receive/observe the redirect result/session state.

Code

packages/configs/firebase.config.ts[R5-8]

+      // Same-origin as the app so signInWithRedirect works on Safari (ITP);
+      // /__/auth/* is reverse-proxied to firebaseapp.com via next.config rewrites.
+      authDomain: 'bypass-links.vercel.app',
      databaseURL: 'https://bypass-links.firebaseio.com/',

Relevance

⭐⭐ Medium

No prior reviews on Firebase authDomain vs NEXT_PUBLIC_HOST_NAME; env-driven host standardization
exists but not for authDomain.

PR-#3766
PR-#4070

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The web app initializes Firebase with the prod/non-prod split based on NODE_ENV, and uses
redirect-based auth flows. Separately, the app’s canonical/base URL is configured via
NEXT_PUBLIC_HOST_NAME, so a fixed authDomain can diverge from the actual origin the app is
served from in prod-mode deployments, leading redirect handling to occur on a different origin.

packages/configs/firebase.config.ts[1-23]
apps/web/src/app/helpers/firebase/index.ts[1-6]
apps/web/src/app/helpers/firebase/auth.ts[18-28]
apps/web/src/app/constants/env/client.ts[4-10]
apps/web/src/app/page.tsx[15-22]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Production Firebase config hard-codes `authDomain: 'bypass-links.vercel.app'`, but the app’s actual origin is configurable via `NEXT_PUBLIC_HOST_NAME`. In any prod-mode deployment where the origin differs (preview/staging/local prod), redirect auth can complete on the wrong origin.

## Issue Context
- Web Firebase initialization uses `getFirebasePublicConfig(process.env.NODE_ENV === 'production')`.
- Redirect login is used on mobile (`signInWithRedirect`) and completion depends on the configured auth handler origin.

## Fix Focus Areas
- packages/configs/firebase.config.ts[1-23]
- apps/web/src/app/helpers/firebase/index.ts[1-6]

## Suggested fix approach
- Stop hard-coding the prod `authDomain`.
- Option A: Change `getFirebasePublicConfig` to accept an optional `authDomainOverride` (or `host`) and in `apps/web` pass `new URL(process.env.NEXT_PUBLIC_HOST_NAME!).host` (or derive from `clientEnv`).
- Option B: Introduce `NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN` and use that for prod instead of a constant.
- Ensure whatever host is used is also present in Firebase Auth “Authorized domains” and has the `/__/auth/*` and `/__/firebase/*` rewrite/proxy in place.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---