fix(desktop): compose the connect completion URL through the URL API

Concatenating `getBaseUrl()` with the completion path leaves the result
dependent on how the deployment spelled `NEXT_PUBLIC_APP_URL`: the helper only
adds a missing protocol, so a trailing slash produced `//desktop/connect/complete`,
a pathname that matches no route. The completion page is what bounces the OAuth
result to the desktop app's loopback, so that typo would have stranded the flow
just past the callback it was meant to fix.

Both callback URLs in the page — the launcher's and the workspace-scoped
authorize redirect's — now go through one helper that resolves the path against
the base with `new URL`, matching how the same function already builds the
authorize URL, with coverage for a trailing-slash base.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/desktop/connect/page.test.tsx

@@ -3,11 +3,13 @@
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockGetSession, mockRedirect } = vi.hoisted(() => ({
+const { mockGetSession, mockRedirect, baseUrl } = vi.hoisted(() => ({
   mockGetSession: vi.fn(),
   mockRedirect: vi.fn((url: string) => {
     throw new Error(`NEXT_REDIRECT:${url}`)
   }),
+  /** Mutable so a test can give the deployment a trailing-slash base URL. */
+  baseUrl: { value: 'https://sim.test' },
 }))
 
 vi.mock('@/lib/auth', () => ({
@@ -21,7 +23,7 @@ vi.mock('@/lib/auth/auth-client', () => ({
 }))
 
 vi.mock('@/lib/core/utils/urls', () => ({
-  getBaseUrl: () => 'https://sim.test',
+  getBaseUrl: () => baseUrl.value,
 }))
 
 /** Keeps the landing-page barrel the real shell pulls in out of this graph. */
@@ -57,6 +59,7 @@ async function renderPage(params: Record<string, string>) {
 describe('DesktopConnectPage', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    baseUrl.value = 'https://sim.test'
     mockGetSession.mockResolvedValue({ user: { id: 'user-1', email: 'user@example.com' } })
   })
 
@@ -93,6 +96,32 @@ describe('DesktopConnectPage', () => {
     expect(() => new URL(result.props.completeUrl as string)).not.toThrow()
   })
 
+  it('keeps the completion route intact when the deployment base URL has a trailing slash', async () => {
+    // `//desktop/connect/complete` matches no route, so the provider result
+    // would never reach the loopback and the connect would hang.
+    baseUrl.value = 'https://sim.test/'
+
+    const launcher = await renderPage({
+      provider: 'google-email',
+      state: VALID_STATE,
+      port: PORT,
+    })
+    expect(new URL(launcher.props.completeUrl as string).pathname).toBe('/desktop/connect/complete')
+
+    await expect(
+      DesktopConnectPage(
+        pageProps({
+          provider: 'google-email',
+          state: VALID_STATE,
+          port: PORT,
+          workspaceId: 'workspace-1',
+        })
+      )
+    ).rejects.toThrow('NEXT_REDIRECT:')
+    const callbackUrl = new URL(mockRedirect.mock.calls[0][0]).searchParams.get('callbackURL')
+    expect(new URL(callbackUrl as string).pathname).toBe('/desktop/connect/complete')
+  })
+
   it('sends a workspace-scoped connect to the authorize route with an absolute callback', async () => {
     await expect(
       DesktopConnectPage(

apps/sim/app/desktop/connect/page.tsx

@@ -34,6 +34,17 @@ function InvalidRequest() {
   )
 }
 
+/**
+ * Absolute URL better-auth returns the browser to once the OAuth callback is
+ * done. Composed through the URL API rather than concatenated, so a trailing
+ * slash on `NEXT_PUBLIC_APP_URL` cannot yield a `//desktop/...` pathname that
+ * matches no route — this page is what bounces the result to the app's
+ * loopback, so a base-URL typo would otherwise strand the whole flow.
+ */
+function buildConnectCompleteUrl(state: string, port: number, draftId?: string): string {
+  return new URL(buildConnectCompletePath(state, port, draftId), getBaseUrl()).toString()
+}
+
 /**
  * Desktop OAuth-connect landing. The desktop app opens this page in the
  * system browser with the provider to connect, a one-time state, and the port
@@ -112,10 +123,7 @@ export default async function DesktopConnectPage({ searchParams }: DesktopConnec
     const authorize = new URL('/api/auth/oauth2/authorize', getBaseUrl())
     authorize.searchParams.set('providerId', providerId)
     authorize.searchParams.set('workspaceId', workspaceId)
-    authorize.searchParams.set(
-      'callbackURL',
-      `${getBaseUrl()}${buildConnectCompletePath(state, port)}`
-    )
+    authorize.searchParams.set('callbackURL', buildConnectCompleteUrl(state, port))
     if (credentialId) {
       authorize.searchParams.set('credentialId', credentialId)
     }
@@ -125,7 +133,7 @@ export default async function DesktopConnectPage({ searchParams }: DesktopConnec
   return (
     <ConnectLauncher
       providerId={providerId}
-      completeUrl={`${getBaseUrl()}${buildConnectCompletePath(state, port, draftId)}`}
+      completeUrl={buildConnectCompleteUrl(state, port, draftId)}
     />
   )
 }