From 0e6346d937703b0571b53d8320337a4db48e3498 Mon Sep 17 00:00:00 2001
From: Jakob Karlstrand <jakob@berget.ai>
Date: Thu, 10 Sep 2026 17:19:01 +0200
Subject: [PATCH 1/2] feat(stage): getKeycloakUrl -> auth.stage.berget.ai
 (issuer migration)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stage flip of the plugin's authorize + token-exchange host. Must ship
together with the api stage-overlay flip (KEYCLOAK_URL=auth.stage): dynamic
hostname pairs mint-host with refresh-host, so client and api must agree —
otherwise refreshes 401 in a loop.

Prod flip (keycloak.berget.ai -> auth.berget.ai) ships separately with
user communication (one /connect per user on update).
---
 package.json     | 4 ++--
 src/constants.ts | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 8b4a122..6469560 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bergetai/opencode-auth",
-  "version": "1.0.26",
+  "version": "1.0.27",
   "description": "Berget AI auth plugin for OpenCode - authenticate with your Berget account",
   "author": "Berget AI",
   "repository": "https://github.com/berget-ai/opencode-berget-auth",
@@ -68,4 +68,4 @@
     "oauth",
     "keycloak"
   ]
-}
+}
\ No newline at end of file
diff --git a/src/constants.ts b/src/constants.ts
index c5f68d2..578244d 100644
--- a/src/constants.ts
+++ b/src/constants.ts
@@ -31,10 +31,10 @@ export const KEYCLOAK_CLIENT_ID = 'berget-code';
 export const getKeycloakUrl = (): string => {
   const apiUrl = getApiUrl();
   if (apiUrl.includes('localhost') || apiUrl.includes('127.0.0.1')) {
-    return 'https://keycloak.stage.berget.ai'; // Local dev uses stage Keycloak
+    return 'https://auth.stage.berget.ai'; // Local dev uses stage Keycloak
   }
   if (apiUrl.includes('stage')) {
-    return 'https://keycloak.stage.berget.ai';
+    return 'https://auth.stage.berget.ai';
   }
   return 'https://keycloak.berget.ai';
 };

From b2abcb669b8c7c6a4c5093867af78e6c1f4572ca Mon Sep 17 00:00:00 2001
From: Jakob Karlstrand <jakob@berget.ai>
Date: Fri, 11 Sep 2026 14:00:10 +0200
Subject: [PATCH 2/2] fix(prod): getKeycloakUrl -> auth.berget.ai (issuer
 migration)

Same follow-up to incident 2026-09-10-0 as the stage flip in the
preceding commit: the Keycloak cutover moved token issuance to
auth.berget.ai, so PKCE login must discover the new issuer (openid-client
strict-iss validation) . Token refresh already goes through
api /v1/auth/refresh which has issuer-routing (api #453).
---
 src/constants.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/constants.ts b/src/constants.ts
index 578244d..430f830 100644
--- a/src/constants.ts
+++ b/src/constants.ts
@@ -36,7 +36,7 @@ export const getKeycloakUrl = (): string => {
   if (apiUrl.includes('stage')) {
     return 'https://auth.stage.berget.ai';
   }
-  return 'https://keycloak.berget.ai';
+  return 'https://auth.berget.ai';
 };
 
 export const getKeycloakRealm = (): string => 'berget';