Desktop OIDC: redirect webview to local server, Go opens browser

The webview navigates to http://127.0.0.1:18901/oidc/open?apiUrl=...
The Go server opens the system browser to Authentik, waits for callback,
exchanges code for token, saves to keychain, then redirects the webview
back with ?desktop=1&token=TOKEN. main.ts extracts the token from URL.

web/src/lib/oidc.ts

@@ -101,14 +101,13 @@ export async function startLogin(): Promise<void> {
     scope: 'openid profile email'
   })
 
-  const authURL = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
-
   if (isDesktop) {
-    window.open(authURL, '_blank', 'width=800,height=700')
-    throw new Error('Login opened in your browser. After authenticating, copy the token and paste it into the Token tab.')
+    const apiUrl = getConfig().apiUrl || location.protocol + '//' + location.host
+    location.href = `http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`
+    throw new Error('Redirecting to login...')
   }
 
-  location.href = authURL
+  location.href = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`
 }
 
 export async function handleCallback(code: string, returnedState: string): Promise<boolean> {

web/src/main.ts

@@ -1,25 +1,28 @@
 import { mount } from 'svelte'
 import App from './App.svelte'
 import './app.css'
-import { initConfig, setConfig } from '$lib/config'
+import { initConfig, setConfig, getConfig } from '$lib/config'
 
-async function loadDesktopConfig() {
-  const wails = (window as any).wails
-  if (!wails?.Call?.ByName) return
-
-  try {
-    const cfg = await wails.Call.ByName('GetStoredConfig')
-    if (cfg?.apiUrl && cfg?.token) {
-      setConfig({ apiUrl: cfg.apiUrl, token: cfg.token, isDesktop: true })
-    }
-  } catch {
-    // no stored config — Config page will handle it
+function handleDesktopToken() {
+  const params = new URLSearchParams(location.search)
+  const token = params.get('token')
+  if (token) {
+    const apiUrl = getConfig().apiUrl || params.get('apiUrl') || ''
+    setConfig({ apiUrl, token, isDesktop: true })
+    initConfig({ apiUrl, token, isDesktop: true })
+    // clean the URL
+    params.delete('token')
+    params.delete('apiUrl')
+    let q = params.toString()
+    history.replaceState(null, '', location.pathname + (q ? '?' + q : ''))
+    return true
   }
+  return false
 }
 
-async function start() {
+function start() {
   initConfig()
-  await loadDesktopConfig()
+  handleDesktopToken()
 
   requestAnimationFrame(() => import('./lib/renderers'))