Studio Web: sign in through studio.tigersystem.io itself (authDomain = the proxying host) — Google's picker names tigersystem.io, first-party sign-in for Safari / iOS / installed apps

Author: BenGlut

WORKLOG.md

@@ -4,6 +4,7 @@
 - Tiger Studio Web hotfixes — ship web-only fixes without a desktop build: `npm run web:hotfix` tags the commit `web-vX.Y.Z.N` (X.Y.Z = the latest release, checked against package.json); `web-sync.yml` also runs on those tags (refuses a non-latest base, deploys the Hub, waits for `{version, webBuild}`); the build stamps the web build number (`--web-build`, shown as "X.Y.Z · web N", part of the reload check); the Hub builds the highest hotfix of the latest release — `scripts/web-hotfix.mjs`, `scripts/build-web.mjs`, `renderer/web-bridge.js`, `.github/workflows/web-sync.yml`, `package.json`, `docs/WEB_HOTFIX.md`
 
 ## Changed
+- Studio Web signs in through its own domain: on `studio.tigersystem.io` Firebase Auth's `authDomain` is the page's host (the Hub proxies `/__/auth/*`; Google OAuth client gained the origin + `/__/auth/handler` redirect), so Google's account picker names tigersystem.io instead of `tigertag-connect.firebaseapp.com`, and sign-in stays first-party for Safari / iOS / installed apps; desktop and other hosts unchanged (shipped to the web as web-v2.40.0.2) — `renderer/firebase.js`
 - Studio Web served at the root of `studio.tigersystem.io` (no redirect); `tigersystem.io/studio` redirects there; separate sign-in from the Hub — `docs/WEB_DEPLOYMENT.md`, `docs/STUDIO-WEB-PLAN.md`, `README.md`, `FEATURES.md`, `llms.txt`, `scripts/build-web.mjs` (comments)
 
 ## Fixed

renderer/firebase.js

@@ -2,9 +2,19 @@
 // Must be loaded AFTER firebase-app-compat.js, firebase-auth-compat.js,
 // and firebase-firestore-compat.js (see inventory.html script tags).
 
+// Hosts that proxy Firebase Auth's /__/auth/* handler (TigerTag_Hub →
+// next.config.mjs). Studio Web signs in through its OWN domain there: Google's
+// account picker names it instead of tigertag-connect.firebaseapp.com, and the
+// sign-in stays first-party, which Safari / iOS / installed apps require. The
+// desktop app and any other host keep the default handler domain.
+const AUTH_PROXY_HOSTS = ["studio.tigersystem.io"];
+const AUTH_DOMAIN = window.electronAPI?.isWeb && AUTH_PROXY_HOSTS.includes(location.hostname)
+  ? location.hostname
+  : "tigertag-connect.firebaseapp.com";
+
 const FIREBASE_CONFIG = {
   apiKey:            "AIzaSyCkxPTs_Cv0KVLqsZj-UKWWqIY0OtfVpnw",
-  authDomain:        "tigertag-connect.firebaseapp.com",
+  authDomain:        AUTH_DOMAIN,
   projectId:         "tigertag-connect",
   storageBucket:     "tigertag-connect.firebasestorage.app",
   messagingSenderId: "298062874545",