From d3fd824a6aa1f6e76f9164231d96014e611ddd1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vi=CC=81ctor=20Falco=CC=81n?= <victoor89@gmail.com>
Date: Sat, 18 Jul 2026 19:30:36 +0200
Subject: [PATCH] fix(pwa): keep mobile OAuth consent from being swallowed by
 the installed app

The web app manifest declares scope "/", so the installed PWA claims the whole
origin including /oauth/authorize. On Android an OAuth link (e.g. ChatGPT
connecting over MCP) is captured into the app, and the default launch behavior
focuses the already-open window (the dashboard) and drops the incoming URL, so
the consent screen never loads.

Set launch_handler.client_mode to "focus-existing" and add a launchQueue
consumer that navigates to the captured target URL when it is an /oauth/ path.
Non-OAuth launches keep their place. Scope can't simply exclude /oauth because
the app's routes are flat and share no prefix.
---
 public/favicon/site.webmanifest |  3 +++
 resources/js/app.tsx            | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/public/favicon/site.webmanifest b/public/favicon/site.webmanifest
index ae6b41c0..1bb66769 100644
--- a/public/favicon/site.webmanifest
+++ b/public/favicon/site.webmanifest
@@ -6,6 +6,9 @@
   "scope": "/",
   "id": "/",
   "display": "standalone",
+  "launch_handler": {
+    "client_mode": "focus-existing"
+  },
   "orientation": "portrait-primary",
   "theme_color": "#1b1b18",
   "background_color": "#ffffff",
diff --git a/resources/js/app.tsx b/resources/js/app.tsx
index adb1fe31..add6ca0b 100644
--- a/resources/js/app.tsx
+++ b/resources/js/app.tsx
@@ -34,6 +34,38 @@ import { __, setTranslations } from './utils/i18n';
 
 installChunkLoadRecovery();
 
+// The installed PWA claims the whole origin (manifest scope "/"), so on mobile an
+// OAuth link (e.g. from ChatGPT connecting over MCP) gets captured into the app.
+// Paired with launch_handler "focus-existing", the launcher hands us the target
+// URL instead of dropping it and showing the dashboard — navigate there so the
+// OAuth consent screen actually loads. Non-OAuth launches keep their place.
+type LaunchParams = { targetURL?: string };
+
+const launchQueue = (
+    window as Window & {
+        launchQueue?: {
+            setConsumer(consumer: (params: LaunchParams) => void): void;
+        };
+    }
+).launchQueue;
+
+if (launchQueue) {
+    launchQueue.setConsumer(({ targetURL }) => {
+        if (!targetURL) {
+            return;
+        }
+
+        const target = new URL(targetURL);
+
+        if (
+            target.pathname.startsWith('/oauth/') &&
+            target.href !== window.location.href
+        ) {
+            window.location.href = targetURL;
+        }
+    });
+}
+
 Sentry.init({
     dsn: import.meta.env.SENTRY_LARAVEL_DSN,
     environment: import.meta.env.MODE,