feature/app-launcher-login-sso

frontend/src/lib/server/workspace-auth.ts

@@ -239,6 +239,20 @@ export function redirectToKeycloakLogin(systemBaseUrl: string, redirectPath: str
 	throw redirect(303, buildKeycloakLoginUrl(systemBaseUrl, redirectPath));
 }
 
+/**
+ * URL del Hub FastAPI para llamadas server-to-server (ej. sso-exchange).
+ * No aplica isDevOnlyUrl: las URLs internas de Docker son válidas aquí.
+ * Lee HUB_BACKEND_URL (override explícito) → INTERNAL_HUB_URL (ya en docker-compose)
+ * → fallback a URL pública del workspace (vía proxy SvelteKit del Hub).
+ */
+export function getHubBackendUrl(): string {
+	const direct =
+		(env.HUB_BACKEND_URL || '').trim() ||
+		(env.INTERNAL_HUB_URL || '').trim();
+	if (direct) return stripTrailingSlashes(direct);
+	return getWorkspaceBaseUrl();
+}
+
 export function buildKeycloakLogoutUrl(systemBaseUrl: string, idTokenHint?: string): string {
 	const keycloakBaseUrl = getPublicKeycloakBaseUrl();
 	const postLogoutRedirectUri = `${systemBaseUrl}/auth/post-logout`;