fix: proxy Firebase auth handler so Safari mobile redirect login completes (#4067)

apps/web/next.config.ts

@@ -38,6 +38,22 @@ const nextConfig: NextConfig = {
     // for type info + tsconfig paths instead. Requires Next >= 16.3.
     useTypeScriptCli: true,
   },
+  // Same-origin proxy for Firebase's auth handler so signInWithRedirect isn't
+  // blocked by Safari ITP. Must be a rewrite (transparent), not a 302.
+  // https://firebase.google.com/docs/auth/web/redirect-best-practices
+  async rewrites() {
+    const authHelper = 'https://bypass-links.firebaseapp.com';
+    return [
+      {
+        source: '/__/auth/:path*',
+        destination: `${authHelper}/__/auth/:path*`,
+      },
+      {
+        source: '/__/firebase/:path*',
+        destination: `${authHelper}/__/firebase/:path*`,
+      },
+    ];
+  },
 };
 
 export default nextConfig;

apps/web/src/app/helpers/firebase/index.ts

@@ -1,6 +1,9 @@
 import { getFirebasePublicConfig } from '@bypass/configs/firebase.config';
 import { initializeApp } from 'firebase/app';
 
+// The Safari redirect fix (same-origin authDomain + /__/auth proxy) is applied
+// to prod only. Local dev keeps the cross-domain authDomain — replicating it
+// needs https dev + a separate OAuth redirect URI, which isn't worth the setup.
 const firebaseApp = initializeApp(
   getFirebasePublicConfig(process.env.NODE_ENV === 'production')
 );

packages/configs/firebase.config.ts

@@ -2,7 +2,8 @@ export const getFirebasePublicConfig = (isProd: boolean) => {
   if (isProd) {
     return {
       apiKey: 'AIzaSyDiMRlBhW36sLjEADoQj9T5L1H-hIDUAso',
-      authDomain: 'bypass-links.firebaseapp.com',
+      // Same-origin as the app (vs Safari ITP); /__/auth/* proxied in next.config.
+      authDomain: 'bypass-links.vercel.app',
       databaseURL: 'https://bypass-links.firebaseio.com/',
       projectId: 'bypass-links',
       storageBucket: 'bypass-links.appspot.com',