---
name: "Hp Prod Tracker"
client: HP / Oliver Agency
status: active
server: optical-dev
tech: [Next.js 16, React 19, TypeScript, PostgreSQL 17, Prisma 7, TanStack Query, Ollama, Docker]
local_path: /Users/ai_leed/Documents/Projects/Oliver/hp-prod-tracker
deploy: bash deploy.sh
url: https://optical-dev.oliver.solutions/hp-prod-tracker
tags:
  - project
created: 2026-04-15
port: 3001
db: PostgreSQL 17
---

## Overview

HP CG Production Tracker is a unified web application that replaces fragmented workflows (Workfront, Excel, OMG platform) for the HP CG department at Oliver Agency. Production managers track a 10-stage CG render pipeline with dependency gates and deliverable deadlines; CG artists view assigned tasks, update statuses, and submit revisions. The system provides multiple project views (table, Kanban board, Gantt timeline, calendar), enforces stage approval gates, integrates an AI chat assistant for natural-language queries, and generates weekly executive reports.

## Tech Stack

- **Frontend:** Next.js 16 (App Router), React 19, TypeScript, TanStack Query v5, Zustand (UI state)
- **Backend:** Next.js Route Handlers (`/app/api/`), Node.js 22
- **Database:** PostgreSQL 17 + Prisma 7 ORM + pgvector (embeddings)
- **Infrastructure:** Docker + Docker Compose, Apache 2 reverse proxy, Ubuntu (Debian-based)
- **AI/ML:** Ollama (local primary) + Claude API (fallback), semantic search via pgvector embeddings
- **Auth:** Microsoft Entra ID (MSAL.js SPA + Auth.js v5) PKCE SSO
- **Key libraries:** TanStack Table, @xyflow/react (timeline), Zod v4 (validation), Framer Motion, Lucide Icons

## Architecture

The system is organized in clean layers:

- **Presentation:** Next.js App Router with server-rendered pages and interactive client components. Routing: `/hp-prod-tracker/dashboard`, `/projects/[id]/`, `/my-work`, `/settings`, etc.
- **API:** ~60 REST Route Handlers in `/app/api/` enforcing authentication middleware (RBAC, org-scoped access).
- **Business Logic:** 30+ service modules in `src/lib/services/` handling entity CRUD, pipeline state machine, automation rules, and AI tools.
- **State & Cache:** TanStack Query v5 for server state caching; Zustand for UI state (filters, sidebar collapse).
- **Database:** PostgreSQL 17 with Prisma 7. Schema includes: organizations, projects, deliverables, stages, revisions, team members, automation rules, chat messages, embeddings.
- **AI Integration:** Ollama (primary) running on internal GPU server (`10.24.42.219:11434`) for chat + embeddings; Claude API fallback.
- **Media Storage:** Docker volume `/data/uploads` persists revision images and HLS video segments; served via `/api/uploads/[...path]` route handler.
- **Authentication:** Microsoft Entra ID with MSAL.js browser flow (PKCE, no client secret). Local dev mode supports `DEV_BYPASS_AUTH=true` for testing.

**Data Flow:**
```
Browser (MSAL.js) 
  → Next.js SSR pages (requireAuth middleware)
    → Route Handlers (/api/*) [RBAC checks]
      → Service Layer (entity logic + pipelines)
        → Prisma ORM
          → PostgreSQL (+ pgvector embeddings)
        → Docker volume (media files)
        → Ollama or Claude (AI chat)
```

**Pipeline State Machine:**
Each `DeliverableStage` progresses through states: `BLOCKED` → `NOT_STARTED` → `IN_PROGRESS` → `REVIEW` → `APPROVED` → `RELEASED`. Critical gates (Model Prep, Catalog Images) block downstream stages until approved. Orchestrated by `src/lib/pipeline/` and `src/lib/services/stage-service.ts`.

## Dev Commands

```bash
# Clone and install
git clone git@bitbucket.org:zlalani/hp-prod-tracker.git
cd hp-prod-tracker
nvm use 22
npm install

# Set up local PostgreSQL (macOS)
brew install postgresql@17
brew services start postgresql@17
createdb hp_prod_tracker

# Configure environment
cp .env.example .env
# Edit .env: set DATABASE_URL, DEV_BYPASS_AUTH=true, DEV_USER_ID, OLLAMA_HOST, etc.

# Initialize database
npx prisma migrate dev
npx prisma db seed

# Start development server
npm run dev
# → Open http://localhost:3000/hp-prod-tracker (auto-logged as dev admin)

# Build for production
npm run build

# Run production build locally
npm start

# Type check
npm run type-check

# Linting
npm run lint

# Format code
npm run format

# Database operations
npx prisma studio          # GUI database browser
npx prisma migrate reset   # Wipe and reseed
npm run db:seed-tracker    # Sample tracker data
npm run db:seed-team       # Sample team data
```

## Deployment

- **Server:** optical-dev.oliver.solutions (Ubuntu, Docker Compose)
- **Deploy:** `bash deploy.sh` (runs locally; connects to prod server via SSH)
- **URL:** https://optical-dev.oliver.solutions/hp-prod-tracker
- **Port:** 3001 (host) → 3000 (container); 5491 (host PostgreSQL) → 5432 (container)
- **Service:** Docker Compose (not systemd). Services: `app` (Node 22 Alpine + FFmpeg), `db` (pgvector/pgvector:pg17)
- **Local path:** /Users/ai_leed/Documents/Projects/Oliver/hp-prod-tracker

**Deploy script (`deploy.sh`) does:**
1. Install Docker, Docker Compose, Apache, git, ufw if missing
2. Pull latest code from Bitbucket
3. Validate `.env` file
4. `docker compose down --remove-orphans && docker compose up -d --build`
5. Wait for PostgreSQL healthcheck (30s timeout)
6. Wait for app healthcheck at `/api/health` (120s timeout)
7. Inject Apache config snippet into vhost (idempotent)
8. Configure UFW firewall rules (allow 22, 80; deny incoming by default)

**Apache reverse proxy:**
- Config: `/etc/apache2/sites-available/optical-dev.oliver.solutions.conf` includes `apache/hp-prod-tracker.conf`
- Routes `/hp-prod-tracker/*` to `http://127.0.0.1:3001`
- API `/hp-prod-tracker/api/chat` has 300s timeout (Ollama can take 60–180s)
- Supports WebSocket for real-time features
- `LimitRequestBody` set to 500 MB for video uploads
- Modules required: `proxy`, `proxy_http`, `proxy_wstunnel`, `headers`, `rewrite`

## Environment Variables

**Critical (both local and prod):**
- `DATABASE_URL` — PostgreSQL connection string (e.g., `postgresql://user@localhost:5432/hp_prod_tracker?schema=public`)
- `AUTH_SECRET` — Random string for Auth.js session encryption
- `AZURE_TENANT_ID` — Microsoft Entra ID tenant ID
- `AZURE_CLIENT_ID` — Azure AD app registration client ID
- `AZURE_REDIRECT_URI` — OAuth redirect (e.g., `https://optical-dev.oliver.solutions/hp-prod-tracker/api/auth/callback/azure`)

**AI & Search:**
- `OLLAMA_HOST` — Ollama server URL (e.g., `http://10.24.42.219:11434`)
- `OLLAMA_CHAT_HOST` — Same or different Ollama endpoint
- `OLLAMA_CHAT_MODEL` — Model name (e.g., `gemma4:latest`)
- `OLLAMA_EMBED_MODEL` — Embedding model (e.g., `nomic-embed-text`)
- `ANTHROPIC_API_KEY` — Claude API key (fallback if Ollama unavailable)

**Local Development Only:**
- `DEV_BYPASS_AUTH` — Set to `true` to skip authentication
- `DEV_USER_ID` — Dev user ID (e.g., `dev-user-001`)

**Optional:**
- `LOG_LEVEL` — Logging verbosity (default: `info`)
- `NEXT_PUBLIC_API_BASE` — API base URL (default: derived from `AUTH_URL`)

See `.env.example` for complete list.

## API / Endpoints

~60 Route Handlers in `/app/api/`. Key examples:

| Endpoint | Method | Purpose |
|----------|--------|---------|
| `/api/health` | GET | Health check (used by Docker healthcheck & Apache) |
| `/api/auth/callback/azure` | GET/POST | OAuth token exchange (Entra ID callback) |
| `/api/projects` | GET, POST | List/create projects |
| `/api/projects/[id]/deliverables` | GET, POST | List/create deliverables for project |
| `/api/deliverables/[id]/stages/[stageId]` | PATCH | Update stage state (transition, approve) |
| `/api/deliverables/[id]/revisions` | POST | Upload revision (image/video) |
| `/api/chat` | POST | AI chat (websocket-like; 300s timeout) |
| `/api/uploads/[...path]` | GET | Serve revision files from `/data/uploads` volume |
| `/api/automation/rules` | GET, POST | Automation rules CRUD |
| `/api/reports/weekly` | GET | Generate PDF weekly report |

All endpoints require authentication (via session cookie or `DEV_BYPASS_AUTH`). RBAC enforced: org-level access, team permissions, project-scoped roles.

## Known Issues

- **Ollama response time:** Chat can take 60–180 seconds; Apache timeout set to 300s to accommodate.
- **WebSocket

## Sessions
### 2026-04-16 – Configure SSO with Azure credentials and
**Asked:** Configure SSO with Azure credentials and handle token exchange in browser.
**Done:** Set up Azure SSO with tenant/client IDs, fixed redirect paths to account for basePath, and pushed changes to git.

### 2026-04-16 – Asked for SSO configuration with Azure
**Asked:** Asked for SSO configuration with Azure credentials for a browser-based SPA application.
**Done:** Configured Azure SSO with provided tenant ID, client ID, and redirect URI, added sign-out button to NavLinks component.

### 2026-04-16 – Configure SSO with Azure credentials for
**Asked:** Configure SSO with Azure credentials for SPA browser-based token exchange.
**Done:** Set up Azure SSO with tenant/client IDs and redirect URI, pushed to git, and verified authentication works but user account needs organization binding in database.

### 2026-04-16 – Configure SSO with Azure credentials for
**Asked:** Configure SSO with Azure credentials for browser-based token exchange.
**Done:** Set up Azure SSO with provided credentials, pushed to git, and verified successful authentication on server after env variable updates.

### 2026-04-16 – Configure SSO with Azure credentials for
**Asked:** Configure SSO with Azure credentials for browser-based token exchange.
**Done:** Implemented MSAL.js-based SPA authentication flow with updated login component and API endpoint.

### 2026-04-16 – Configure SSO with Azure credentials and
**Asked:** Configure SSO with Azure credentials and implement browser-based token exchange for SPA.
**Done:** Implemented MSAL.js-based SSO flow in browser with Azure tenant/client credentials and updated auth endpoints.

### 2026-04-16 – Configured SSO with Azure credentials for
**Asked:** Configured SSO with Azure credentials for browser-based token exchange in SPA.
**Done:** Set up Azure SSO authentication with tenant ID, client ID, and redirect URI; committed changes to git.

### 2026-04-16 – Configure SSO with Azure credentials for
**Asked:** Configure SSO with Azure credentials for a SPA application using browser-based token exchange.
**Done:** Azure SSO configured with tenant ID, client ID, and redirect URI; changes pushed to git with server deployment instructions provided.

### 2026-04-16 – Configure SSO with Azure Entra ID
**Asked:** Configure SSO with Azure Entra ID credentials for browser-based token exchange.
**Done:** Updated auth.ts to remove state validation, pushed changes (6701946), and provided server deployment instructions.

### 2026-04-16 – Configure SSO with Azure tenant credentials
**Asked:** Configure SSO with Azure tenant credentials for browser-based token exchange.
**Done:** Set up Azure OAuth with PKCE flow, removed state parameter validation from OAuthRelay and auth.ts checks.

### 2026-04-16 – Configure SSO with Azure credentials for
**Asked:** Configure SSO with Azure credentials for SPA-based authentication.
**Done:** Set up Azure SSO configuration, pushed to git, and provided server deployment instructions with environment variables and Docker rebuild steps.

### 2026-04-16 – Configure SSO with Azure tenant, client
**Asked:** Configure SSO with Azure tenant, client ID, and redirect URI for browser-based token exchange.
**Done:** Pushed SSO configuration to git (commit 17fc539 on main) and provided server deployment steps.

### 2026-04-16 – Configure SSO with Azure tenant, client
**Asked:** Configure SSO with Azure tenant, client ID, and redirect URI for browser-based token exchange.
**Done:** Updated Auth.js provider with Azure credentials, custom authorization params, and client-only token exchange flow.

### 2026-04-16 – Configure SSO with Azure tenant, client
**Asked:** Configure SSO with Azure tenant, client ID, and redirect URI for SPA token exchange in browser.
**Done:** Updated environment configuration and docker-compose to include Azure credentials and redirect URI.

### 2026-04-15 – Developer needs to diagnose SSO authentication
**Asked:** Developer needs to diagnose SSO authentication failure with Microsoft Entra ID redirect URI mismatch.
**Done:** Identified that Azure redirect URI configuration doesn't match Auth.js callback endpoint; IT must update Azure portal to register the exact redirect URI.

### 2026-04-15 – Developer needs to fix SSO redirect
**Asked:** Developer needs to fix SSO redirect URI mismatch with Microsoft Entra ID.
**Done:** Identified that Azure portal configuration is missing the redirect URI and confirmed the application is accessible while awaiting IT to update Azure settings.

### 2026-04-15 – Helped debug SSO redirect URI mismatch
**Asked:** Helped debug SSO redirect URI mismatch in Microsoft Entra ID configuration.
**Done:** Identified that the configured redirect URI in Azure portal doesn't match the application's expected callback URL.

### 2026-04-15 – (Haiku error: HTTP Error 500: Internal
**Asked:** (Haiku error: HTTP Error 500: Internal Server Error)
**Done:** —

### 2026-04-15 – (Haiku error: HTTP Error 500: Internal
**Asked:** (Haiku error: HTTP Error 500: Internal Server Error)
**Done:** —

### 2026-04-15 – Asked | Troubleshoot SSO authentication failure
**Asked:** Asked | Troubleshoot SSO authentication failure with Microsoft Entra ID redirect URI mismatch
**Done:** Done | Identified redirect URI mismatch in Azure configuration and enabled debug logging to diagnose Auth.js token endpoint communication

### 2026-04-15 – Developer requested help troubleshooting SSO authentication
**Asked:** Developer requested help troubleshooting SSO authentication failure with Microsoft Entra ID redirect URI mismatch.
**Done:** Identified two issues — expired client secret in Azure and missing basePath in Auth.js redirect URL construction.

### 2026-04-15 – Asked | Developer debugged SSO redirect
**Asked:** Asked | Developer debugged SSO redirect URI mismatch in Microsoft Entra ID configuration
**Done:** Done | Identified missing basePath parameter in redirect URI configuration for Azure portal

### 2026-04-15 – Asked | Investigated SSO sign-in error
**Asked:** Asked | Investigated SSO sign-in error with Microsoft Entra ID redirect URI mismatch
**Done:** Done | Identified missing basePath configuration in health check URL causing AADSTS50011 error

### 2026-04-15 – Diagnose SSO redirect URI mismatch error
**Asked:** Diagnose SSO redirect URI mismatch error with Microsoft Entra ID authentication.
**Done:** Identified AUTH_URL configuration mismatch and token exchange sending incorrect redirect URI to Azure portal.

### 2026-04-15 – Fix SSO redirect URI mismatch error
**Asked:** Fix SSO redirect URI mismatch error in Microsoft Entra ID configuration.
**Done:** Identified that the configured redirect URI in Azure does not match the application's registered redirect URIs.

### 2026-04-15 – Troubleshoot SSO redirect URI mismatch error
**Asked:** Troubleshoot SSO redirect URI mismatch error in Microsoft Entra ID authentication.
**Done:** Identified redirect URI configuration mismatch between application request and Azure portal settings.

### 2026-04-15 – Debug SSO redirect URI mismatch error
**Asked:** Debug SSO redirect URI mismatch error in Microsoft Entra ID authentication.
**Done:** Identified that the configured redirect URI in Azure doesn't match the application's callback endpoint.

### 2026-04-15 – Diagnose SSO redirect URI mismatch error
**Asked:** Diagnose SSO redirect URI mismatch error in Microsoft Entra ID authentication setup.
**Done:** Identified that configured redirect URI in Azure doesn't match the one being used by the application.

### 2026-04-15 – Developer asked for help diagnosing SSO
**Asked:** Developer asked for help diagnosing SSO login failure with Microsoft Entra ID redirect URI mismatch.
**Done:** Analyzed project configuration and identified that redirect URI in Azure portal doesn't match the configured callback URL in the application.

### 2026-04-15 – How to fix SSO authentication error
**Asked:** How to fix SSO authentication error with Microsoft Entra ID redirect URI mismatch?
**Done:** Identified redirect URI mismatch in Azure portal configuration for the application.

### 2026-04-15 – Troubleshoot SSO redirect URI mismatch error
**Asked:** Troubleshoot SSO redirect URI mismatch error in Microsoft Entra ID authentication.
**Done:** Identified that redirect URI in Azure portal doesn't match application configuration and needs to be updated.

### 2026-04-15 – Developer requested help diagnosing SSO authentication
**Asked:** Developer requested help diagnosing SSO authentication failures with Microsoft Entra ID.
**Done:** Identified redirect URI mismatch error (AADSTS50011) requiring Azure portal configuration update.

### 2026-04-15 – Fix SSO redirect URI mismatch error
**Asked:** Fix SSO redirect URI mismatch error in Microsoft Entra ID authentication.
**Done:** Identified redirect URI configuration mismatch and provided steps to update auth configuration and redeploy via Docker.

### 2026-04-15 – Debug SSO redirect URI mismatch error
**Asked:** Debug SSO redirect URI mismatch error in Microsoft Entra ID authentication.
**Done:** Identified missing AUTH_MICROSOFT_ENTRA_ID_ID configuration and resolved file sync issues via SCP and Docker rebuild.

### 2026-04-15 – Diagnose and fix Microsoft Entra ID
**Asked:** Diagnose and fix Microsoft Entra ID SSO redirect URI mismatch error.
**Done:** Identified redirect URI configuration issue and provided solution to rebuild application and update Azure app registration.

### 2026-04-15 – Fix SSO redirect URI mismatch error
**Asked:** Fix SSO redirect URI mismatch error with Microsoft Entra ID authentication.
**Done:** Identified that next-auth ignores redirectProxyUrl and only uses AUTH_URL origin; rebuilt Docker container to send correct callback URI to Azure, and verified fix requires adding new URI to Azure App Registration.

### 2026-04-15 – Developer needs to fix SSO redirect
**Asked:** Developer needs to fix SSO redirect URI mismatch with Microsoft Entra ID authentication.
**Done:** Identified that next-auth@5.0.0-beta.30 ignores `redirectProxyUrl` and only uses `origin` from `AUTH_URL`, causing Azure to reject the redirect URI.

### 2026-04-15 – Debug SSO redirect URI mismatch error
**Asked:** Debug SSO redirect URI mismatch error in Microsoft Entra ID authentication.
**Done:** Identified that container environment variables were stale and corrected AUTH_URL by removing `/api/auth` suffix from the endpoint.

### 2026-04-15 – Diagnose and fix SSO redirect URI
**Asked:** Diagnose and fix SSO redirect URI mismatch error in Microsoft Entra ID authentication.
**Done:** Identified duplicate `/api/auth` in redirect URL caused by both `.env` and auth code adding the path, then corrected `AUTH_URL` to remove the redundant suffix.

### 2026-04-15 – Developer asked to troubleshoot SSO redirect
**Asked:** Developer asked to troubleshoot SSO redirect URI mismatch error from Microsoft Entra ID.
**Done:** Identified that AUTH_URL in .env incorrectly includes `/api/auth` suffix, causing the redirect URI to be duplicated.

### 2026-04-15 – Diagnose why SSO redirect URI doesn't
**Asked:** Diagnose why SSO redirect URI doesn't match Azure configuration.
**Done:** Identified that AUTH_URL is missing the `/hp-prod-tracker` basePath, causing the redirect URI mismatch with Azure Entra ID settings.

### 2026-04-15 – Asked | Investigated SSO/Microsoft Entra ID
**Asked:** Asked | Investigated SSO/Microsoft Entra ID redirect URI mismatch error
**Done:** Done | Identified that redirect URI in request doesn't match Azure App Registration configuration


## Change Log
| Date | Requested | Changed | Files |
|------|-----------|---------|-------|
| 2026-04-16 | SSO setup | Azure credentials added, redirectTo paths fixed for basePath /hp-prod-tracker | .env, auth config, pending page component |
| 2026-04-16 | SSO setup | Azure credentials added, sign-out button added to NavLinks | .env, NavLinks.tsx |
| 2026-04-16 | SSO setup | Azure credentials added, env vars configured, SSO authentication verified | .env, auth config files |
| 2026-04-16 | SSO setup | Azure credentials configured, env variables renamed (AUTH_MICROSOFT_ENTRA_ID_ID→AZURE_CLIENT_ID, AUTH_MICROSOFT_ENTRA_ID_TENANT_ID→AZURE_TENANT_ID), AUTH_URL removed | .env, docker-compose configuration |
| 2026-04-16 | SSO setup | MSAL.js integration, env variable mapping (AUTH_MICROSOFT_ENTRA_ID_ID→AZURE_CLIENT_ID, AUTH_MICROSOFT_ENTRA_ID_TENANT_ID→AZURE_TENANT_ID), removed AUTH_URL | MsalLogin.tsx, auth/sso/route.ts, .env |
| 2026-04-16 | SSO setup | Azure credentials configured, MSAL.js flow implemented, OAuth relay removed | MsalLogin.tsx, src/app/api/auth/sso/route.ts, .env |
| 2026-04-16 | Azure SSO setup | Added AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_REDIRECT_URI environment variables, removed old auth references | .env, auth.tsx, config.ts |
| 2026-04-16 | Azure SSO setup | Added AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_REDIRECT_URI, configured browser token exchange | .env, auth config files |
| 2026-04-16 | SSO configuration | Azure tenant/client setup, state validation removal | auth.ts, .env |
| 2026-04-16 | SSO setup | Azure tenant/client IDs, redirect URI, PKCE checks configuration, removed state validation | auth.ts, OAuthRelay component |
| 2026-04-16 | SSO setup | Azure tenant/client IDs, redirect URI, removed client secret, Docker rebuild | .env, auth.ts, docker-compose.yml |
| 2026-04-16 | SSO Azure configuration | AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_REDIRECT_URI, AUTH_URL added; AUTH_MICROSOFT_ENTRA_ID_SECRET removed | .env, auth.ts |
| 2026-04-16 | SSO configuration | Azure credentials added, authorization.params.redirect_uri set, token.request customized for PKCE flow | .env.local, src/lib/auth.ts, src/app/(auth)/login/OAuthRelay.tsx |
| 2026-04-16 | Azure SSO setup | Added AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_REDIRECT_URI, configured browser-based token exchange | .env.example, docker-compose.yml |
| 2026-04-15 | SSO configuration issue | Add redirect URI to Azure app registration | Azure portal configuration, .env file |
| 2026-04-15 | SSO redirect URI mismatch | Add https://optical-dev.oliver.solutions/api/auth/callback/microsoft-entra-id to Azure portal, verify AUTH_MICROSOFT_ENTRA_ID_ID and AUTH_MICROSOFT_ENTRA_ID_SECRET in .env | .env, Azure App Registration |
| 2026-04-15 | SSO redirect URI mismatch | Update redirect URI in Azure portal to match https://optical-dev.oliver.solutions/api/auth/callback/microsoft-entra-id | Azure portal configuration, .env |
| 2026-04-15 | SSO configuration | Enable AUTH_DEBUG, verify redirect URI in Azure portal matches https://optical-dev.oliver.solutions/api/auth/callback/microsoft-entra-id | .env |
| 2026-04-15 | SSO redirect URI fix | Verify Azure client secret expiration, update Auth.js basePath configuration | .env, auth.config.ts |
| 2026-04-15 | Log | SSO redirect URI mismatch | AUTH_MICROSOFT_ENTRA_ID_ID config, basePath in deploy.sh | .env, deploy.sh |
| 2026-04-15 | Log | SSO redirect URI fix | basePath configuration, health check URL | deploy.sh, .env |
| 2026-04-15 | SSO redirect URI fix | AUTH_URL path mismatch, token exchange redirect_uri mismatch | .env, authorization flow |
| 2026-04-15 | SSO redirect URI mismatch | Add redirect URI to Azure app registration or update AUTH_MICROSOFT_ENTRA_ID settings | .env, apache/hp-prod-tracker.conf |
| 2026-04-15 | SSO redirect URI fix | Update redirect URI in Azure portal to match https://optical-dev.oliver.solutions/api/auth/callback/microsoft-entra-id | .env, Azure App Registration |
| 2026-04-15 | SSO redirect URI mismatch | Add correct redirect URI to Azure portal configuration, verify AUTH_MICROSOFT_ENTRA_ID_ID and AUTH_MICROSOFT_ENTRA_ID_SECRET in .env | .env, Azure portal app settings |
| 2026-04-15 | SSO redirect URI mismatch | Add/update redirect URI in Azure portal to match https://optical-dev.oliver.solutions/api/auth/callback/microsoft-entra-id, verify AUTH_MICROSOFT_ENTRA_ID_ID in .env | .env, Azure portal app configuration |
| 2026-04-15 | SSO redirect URI mismatch | Verify Azure portal redirect URI matches https://optical-dev.oliver.solutions/api/auth/callback/microsoft-entra-id | .env, Azure portal configuration |
| 2026-04-15 | SSO redirect URI fix | Update AUTH_MICROSOFT_ENTRA_ID_ID and configure redirect URI in Azure portal | .env, Azure portal app settings |
| 2026-04-15 | SSO redirect URI fix | Auth callback URL mismatch with Azure portal config | .env, Azure portal app registration |
| 2026-04-15 | SSO redirect URI mismatch | AUTH_MICROSOFT_ENTRA_ID_ID config, Azure app redirect URI settings | .env, Azure Portal |
| 2026-04-15 | SSO redirect URI fix | Update auth.ts with correct redirect URI, rebuild Docker image | src/lib/auth.ts, docker-compose.yml |
| 2026-04-15 | SSO configuration fix | Added missing AUTH_MICROSOFT_ENTRA_ID_ID, synced auth.ts via SCP, rebuilt Docker | .env, src/lib/auth.ts |
| 2026-04-15 | SSO redirect URI fix | Update .env AUTH_MICROSOFT_ENTRA_ID_ID, rebuild Docker containers, add redirect URI to Azure App Registration | .env, docker-compose.yml |
| 2026-04-15 | SSO redirect URI fix | Auth.js configuration, Docker rebuild, Azure App Registration update | .env, docker-compose.yml, Azure portal configuration |
| 2026-04-15 | SSO redirect URI mismatch | next-auth version behavior, AUTH_URL configuration | .env, auth configuration |
| 2026-04-15 | SSO redirect URI fix | AUTH_URL corrected, removed /api/auth suffix | .env |
| 2026-04-15 | SSO redirect URI fix | Removed duplicate `/api/auth` from AUTH_URL value | .env |
| 2026-04-15 | SSO redirect URI fix | Remove `/api/auth` from AUTH_URL in .env, update AUTH_URL to base path only | .env, src/lib/auth.ts |
| 2026-04-15 | SSO redirect URI mismatch | AUTH_URL basePath missing, redirectProxyUrl construction | .env, src/lib/auth.ts |
| 2026-04-15 | SSO redirect URI mismatch | Review .env configuration and git history | .env, auth config files |

## Related