Desktop OIDC: redirect webview to local server, Go opens browser

The webview navigates to http://127.0.0.1:18901/oidc/open?apiUrl=...
The Go server opens the system browser to Authentik, waits for callback,
exchanges code for token, saves to keychain, then redirects the webview
back with ?desktop=1&token=TOKEN. main.ts extracts the token from URL.

cmd/desktop/main.go

@@ -142,7 +142,7 @@ func startOIDCServer() *http.Server {
 		})
 	}
 
-	h("/oidc/login", func(w http.ResponseWriter, r *http.Request) {
+	h("/oidc/open", func(w http.ResponseWriter, r *http.Request) {
 		apiUrl := strings.TrimRight(r.URL.Query().Get("apiUrl"), "/")
 		if apiUrl == "" {
 			http.Error(w, "apiUrl required", http.StatusBadRequest)
@@ -151,7 +151,7 @@ func startOIDCServer() *http.Server {
 
 		oidcCfg, err := fetchOIDCConfig(apiUrl)
 		if err != nil {
-			http.Error(w, fmt.Sprintf("OIDC config: %v", err), http.StatusServiceUnavailable)
+			http.Error(w, err.Error(), http.StatusServiceUnavailable)
 			return
 		}
 
@@ -185,13 +185,12 @@ func startOIDCServer() *http.Server {
 			if token != "" {
 				c := &ConfigService{}
 				c.SaveConfig(apiUrl, token)
+				http.Redirect(w, r, "/?desktop=1&token="+url.QueryEscape(token), http.StatusFound)
+			} else {
+				http.Redirect(w, r, "/?desktop=1&error=login_failed", http.StatusFound)
 			}
-			w.Header().Set("Content-Type", "application/json")
-			json.NewEncoder(w).Encode(map[string]string{"token": token})
 		case <-time.After(5 * time.Minute):
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusRequestTimeout)
-			json.NewEncoder(w).Encode(map[string]string{"error": "login timed out"})
+			http.Redirect(w, r, "/?desktop=1&error=timeout", http.StatusFound)
 		}
 	})