OpenRouter: Fix OAuth flow with enabled accounts

4ced7abaa3f001723df19269ccdef8df32732574

Cohee <18619528+Cohee1207@users.noreply.github.com>

public/scripts/secrets.js+6 -3 Viewed

+}
 function authorizeOpenRouter() {
-    const openRouterUrl = `https://openrouter.ai/auth?callback_url=${encodeURIComponent(location.origin)}`;
+    const redirectUrl = new URL('/callback/openrouter', window.location.origin);
+    const openRouterUrl = `https://openrouter.ai/auth?callback_url=${encodeURIComponent(redirectUrl.toString())}`;
     location.href = openRouterUrl;
+}
 async function checkOpenRouterAuth() {
     const params = new URLSearchParams(location.search);
-    if (params.has('code')) {
+    const source = params.get('source');
-        const code = params.get('code');
+    if (source === 'openrouter') {
+        const query = new URLSearchParams(params.get('query'));
+        const code = query.get('code');
         try {
             const response = await fetch('https://openrouter.ai/api/v1/auth/keys', {
                 method: 'POST',

server.js+12 -1 Viewed

 app.use(cookieSession({
     name: getCookieSessionName(),
-    sameSite: 'strict',
+    sameSite: 'lax',
     httpOnly: true,
     maxAge: getSessionCookieAge(),
     secret: getCookieSecret(globalThis.DATA_ROOT),

     return response.sendFile('index.html', { root: path.join(process.cwd(), 'public') });
 });
+// Callback endpoint for OAuth PKCE flows (e.g. OpenRouter)
+app.get('/callback/:source?', (request, response) => {
+    const source = request.params.source;
+    const query = request.url.split('?')[1];
+    const searchParams = new URLSearchParams();
+    source && searchParams.set('source', source);
+    query && searchParams.set('query', query);
+    const path = `/?${searchParams.toString()}`;
+    return response.redirect(307, path);
+});
 // Host login page
 app.get('/login', loginPageMiddleware);