Deploy: GitHub sign-in credentials, auth helper move, callback defaults

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

config/services.tsmodified+3-3

Changes to config/services.ts

		⋯53 linesShow the 53 lines above this hunk@@ -54,21 +54,21 @@ export default {
54	54	teamId: String(env.APPLE_TEAM_ID || ''),
55	55	keyId: String(env.APPLE_KEY_ID || ''),
56	56	privateKey: String(env.APPLE_PRIVATE_KEY || ''), // literal \n newlines allowed
57		- redirectUrl: String(env.APPLE_REDIRECT_URL || 'http://localhost:3000/auth/apple/callback'),
	57	+ redirectUrl: String(env.APPLE_REDIRECT_URL || `${oauthBase()}/api/auth/apple/callback`),
58	58	scopes: ['name', 'email'],
59	59	},
60	60
61	61	facebook: {
62	62	clientId: String(env.FACEBOOK_CLIENT_ID || ''),
63	63	clientSecret: String(env.FACEBOOK_CLIENT_SECRET || ''),
64		- redirectUrl: String(env.FACEBOOK_REDIRECT_URL || 'http://localhost:3000/auth/facebook/callback'),
	64	+ redirectUrl: String(env.FACEBOOK_REDIRECT_URL || `${oauthBase()}/api/auth/facebook/callback`),
65	65	scopes: ['email', 'public_profile'],
66	66	},
67	67
68	68	twitter: {
69	69	clientId: String(env.TWITTER_CLIENT_ID || ''),
70	70	clientSecret: String(env.TWITTER_CLIENT_SECRET || ''),
71		- redirectUrl: String(env.TWITTER_REDIRECT_URL || 'http://localhost:3000/auth/twitter/callback'),
	71	+ redirectUrl: String(env.TWITTER_REDIRECT_URL || `${oauthBase()}/api/auth/twitter/callback`),
72	72	scopes: ['tweet.read', 'users.read', 'offline.access'],
73	73	},
74	74