From 9c7ccdead7c3c2cfc0fe38736d341ecede232498 Mon Sep 17 00:00:00 2001
From: EveCogs <evedash@evecogs.dev>
Date: Fri, 8 May 2026 03:00:03 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20OAuth=20callback=20redirect=20was=20brok?=
 =?UTF-8?q?en=20=E2=80=94=20rsplit('/api/',=201)=20instead=20of=20rsplit('?=
 =?UTF-8?q?/',=202)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The callback was redirecting to http://ip:port/api/#/callback?token=... instead of
http://ip:port/#/callback?token=... — the SPA lives at root, not /api/.
---
 dashboard/server.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dashboard/server.py b/dashboard/server.py
index 87719ea..8f03641 100644
--- a/dashboard/server.py
+++ b/dashboard/server.py
@@ -314,7 +314,7 @@ class DashboardServer:
         token = _make_token(user_id, secret)
 
         # Redirect to frontend with token
-        base_url = redirect_uri.rsplit("/", 2)[0]  # Remove /api/auth/callback
+        base_url = redirect_uri.rsplit("/api/", 1)[0]  # Remove /api/auth/callback
         resp = web.HTTPFound(f"{base_url}/#/callback?token={token}")
         resp.set_cookie(
             "eve_token", token,