refactor(auth-next): remove unused code and enforce valid redirect URIs

- Remove DEFAULT_PRODUCTION_CLIENT_ID (unused in auth-next)
- Throw when window undefined in deriveDefaultRedirectUri and getSandboxLogoutConfig
  (OAuth requires absolute URLs; path-only is invalid)
- Inline resolvedConfig in createAuthConfig: config ?? { ... }

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rodrigo-fournier-immutable

packages/auth-next-client/src/constants.ts

@@ -9,10 +9,8 @@ export const DEFAULT_AUDIENCE = 'platform_api';
 export const DEFAULT_SCOPE = 'openid profile email offline_access transact';
 export const IMMUTABLE_PROVIDER_ID = 'immutable';
 export const DEFAULT_NEXTAUTH_BASE_PATH = '/api/auth';
-export const DEFAULT_PRODUCTION_CLIENT_ID = 'PtQRK4iRJ8GkXjiz6xfImMAYhPhW0cYk';
 export const DEFAULT_SANDBOX_CLIENT_ID = 'mjtCL8mt06BtbxSkp2vbrYStKWnXVZfo';
 export const DEFAULT_REDIRECT_URI_PATH = '/callback';
-export const DEFAULT_POPUP_REDIRECT_URI_PATH = '/callback';
 export const DEFAULT_LOGOUT_REDIRECT_URI_PATH = '/';
 export const DEFAULT_TOKEN_EXPIRY_MS = 900_000;
 export const TOKEN_EXPIRY_BUFFER_MS = 60_000;

packages/auth-next-client/src/defaultConfig.ts

@@ -1,7 +1,7 @@
 /**
  * Sandbox default redirect URI for zero-config mode.
  * Defined locally to avoid importing from auth-next-server (which uses next/server).
- * Server: path only. Client: full URL (origin + path).
+ * OAuth requires an absolute URL; this runs in the browser when login is invoked.
  *
  * @internal
  */
@@ -10,7 +10,10 @@ import { DEFAULT_REDIRECT_URI_PATH } from './constants';
 
 export function deriveDefaultRedirectUri(): string {
   if (typeof window === 'undefined') {
-    return DEFAULT_REDIRECT_URI_PATH;
+    throw new Error(
+      '[auth-next-client] deriveDefaultRedirectUri requires window. '
+      + 'Login hooks run in the browser when the user triggers login.',
+    );
   }
   return `${window.location.origin}${DEFAULT_REDIRECT_URI_PATH}`;
 }

packages/auth-next-client/src/hooks.tsx

@@ -68,9 +68,13 @@ function getSandboxLoginConfig(): LoginConfig {
 }
 
 function getSandboxLogoutConfig(): LogoutConfig {
-  const logoutRedirectUri = typeof window === 'undefined'
-    ? DEFAULT_LOGOUT_REDIRECT_URI_PATH
-    : window.location.origin + DEFAULT_LOGOUT_REDIRECT_URI_PATH;
+  if (typeof window === 'undefined') {
+    throw new Error(
+      '[auth-next-client] getSandboxLogoutConfig requires window. '
+      + 'Logout runs in the browser when the user triggers it.',
+    );
+  }
+  const logoutRedirectUri = window.location.origin + DEFAULT_LOGOUT_REDIRECT_URI_PATH;
   return {
     clientId: DEFAULT_SANDBOX_CLIENT_ID,
     logoutRedirectUri,

packages/auth-next-client/src/index.ts

@@ -66,10 +66,8 @@ export {
   DEFAULT_AUDIENCE,
   DEFAULT_SCOPE,
   IMMUTABLE_PROVIDER_ID,
-  DEFAULT_PRODUCTION_CLIENT_ID,
   DEFAULT_SANDBOX_CLIENT_ID,
   DEFAULT_REDIRECT_URI_PATH,
-  DEFAULT_POPUP_REDIRECT_URI_PATH,
   DEFAULT_LOGOUT_REDIRECT_URI_PATH,
 } from './constants';
 export { deriveDefaultRedirectUri } from './defaultConfig';

packages/auth-next-server/src/config.ts

@@ -87,23 +87,9 @@ async function validateTokens(
  * ```
  */
 export function createAuthConfig(config?: ImmutableAuthConfig): NextAuthConfig {
-  let clientId: string;
-  let redirectUri: string;
-
-  if (config) {
-    clientId = config.clientId;
-    redirectUri = config.redirectUri;
-  } else {
-    clientId = DEFAULT_SANDBOX_CLIENT_ID;
-    redirectUri = deriveDefaultRedirectUri();
-  }
-
-  const resolvedConfig: ImmutableAuthConfig = {
-    clientId,
-    redirectUri,
-    audience: config?.audience,
-    scope: config?.scope,
-    authenticationDomain: config?.authenticationDomain,
+  const resolvedConfig: ImmutableAuthConfig = config ?? {
+    clientId: DEFAULT_SANDBOX_CLIENT_ID,
+    redirectUri: deriveDefaultRedirectUri(),
   };
   const authDomain = resolvedConfig.authenticationDomain || DEFAULT_AUTH_DOMAIN;
 

packages/auth-next-server/src/constants.ts

@@ -57,22 +57,15 @@ export const TOKEN_EXPIRY_BUFFER_MS = TOKEN_EXPIRY_BUFFER_SECONDS * 1000;
 export const DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
 
 /**
- * Public client IDs for Immutable's default applications.
- * auth-next zero-config uses DEFAULT_SANDBOX_CLIENT_ID only.
+ * Sandbox client ID for auth-next zero-config.
  */
-export const DEFAULT_PRODUCTION_CLIENT_ID = 'PtQRK4iRJ8GkXjiz6xfImMAYhPhW0cYk';
 export const DEFAULT_SANDBOX_CLIENT_ID = 'mjtCL8mt06BtbxSkp2vbrYStKWnXVZfo';
 
 /**
  * Default redirect URI path for sandbox zero-config.
  */
 export const DEFAULT_REDIRECT_URI_PATH = '/callback';
 
-/**
- * Default popup redirect URI path. Same as redirectUri to align with @imtbl/auth and @imtbl/wallet.
- */
-export const DEFAULT_POPUP_REDIRECT_URI_PATH = '/callback';
-
 /**
  * Default logout redirect URI path
  */

packages/auth-next-server/src/index.ts

@@ -51,10 +51,8 @@ export {
   DEFAULT_SCOPE,
   IMMUTABLE_PROVIDER_ID,
   DEFAULT_NEXTAUTH_BASE_PATH,
-  DEFAULT_PRODUCTION_CLIENT_ID,
   DEFAULT_SANDBOX_CLIENT_ID,
   DEFAULT_REDIRECT_URI_PATH,
-  DEFAULT_POPUP_REDIRECT_URI_PATH,
   DEFAULT_LOGOUT_REDIRECT_URI_PATH,
   DEFAULT_TOKEN_EXPIRY_MS,
   TOKEN_EXPIRY_BUFFER_MS,