Fix UTexas EMU login redirect_uri mismatch and project creation failure

[Copilot]

Two bugs in the UTexas EMU auth flow: the OAuth redirect_uri was hardcoded to PUBLIC_REDIRECT_URL (the canonical deployment URL), causing GitHub to reject it on preview deployments. After login, EMU tokens cannot access AVAnnotate/project-template because EMU accounts are isolated to their enterprise — making project creation fail with _repo_create_failed_.

Changes

redirect_uri mismatch (GitHub "Be careful!" warning)

• SignInGitHub.tsx — Replace import.meta.env.PUBLIC_REDIRECT_URL with window.location.origin when building the UTexas OAuth authorize URL. Safe because the component is client:only="react".
• git-enterprise/index.ts — Replace PUBLIC_REDIRECT_URL with new URL(request.url).origin for the post-auth redirect to /en/projects.

EMU project creation failure

EMU tokens cannot call POST /repos/AVAnnotate/project-template/generate — the template is outside their enterprise. The fix lets an enterprise-internal copy of the template be used instead.

• git-enterprise/index.ts — Set a second auth-provider=utexas cookie on successful EMU login so downstream server routes can identify the session.
• GitHub/index.ts — Add optional templateOwner parameter to createRepositoryFromTemplate; defaults to GIT_REPO_ORG for no behavior change on non-EMU paths.
• api/projects/[projectName]/index.ts — When auth-provider=utexas and UTEXAS_GIT_REPO_ORG is set, use that org's copy of the template:

const isUtexasSession = cookies.get('auth-provider')?.value === 'utexas';
const templateOwner = isUtexasSession && utexasTemplateOrg ? utexasTemplateOrg : undefined;

• .env.example / README.md — Document UTEXAS_GIT_REPO_ORG and UTEXAS_GIT_REPO_PROJECT_TEMPLATE with step-by-step instructions to fork AVAnnotate/project-template into the UTexas enterprise and mark it as a template repository.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add UTexas Github Enterprise Managed User login</issue_title>
<issue_description>We need to add another button to the login screen of AVAnnotate to give users the option of logging in using their UTexas EID, which will authenticate not to the main github auth, but to the Github Enterprise Managed User SSO authentication.

The URL for Github with Utexas Enterprise Managed Users is https://github.com/enterprises/utexas-internal.

Please use and document placeholders for any settings unique to this environment.</issue_description>

<agent_instructions>Keep it simple and easy for us to read & understand -- the challenge with authentication is configuring and testing!</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Add UTexas Github Enterprise Managed User login #437

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[netlify]

✅ Deploy Preview for avannotate-staging ready!

Name	Link
🔨 Latest commit	d8bdddb
🔍 Latest deploy log	https://app.netlify.com/projects/avannotate-staging/deploys/6a569b165c941000088e1de4
😎 Deploy Preview	https://deploy-preview-438--avannotate-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[saracarl]

@copilot Ok. We've got the button for logging in to UT showing up, but after we login we see that the redirect takes us to:

https://github.com/login/oauth/authorize?client_id=Ov23liAisKSxjrLdFLFC&redirect_uri=https://avannotate-staging.netlify.app/git-enterprise&scope=repo%20workflow

and the github auth UI shows:

We're deployed to a staging URL that is different -- https://deploy-preview-438--avannotate-staging.netlify.app/
We've added that staging URL to the github OAuth app configuration as the callback: https://deploy-preview-438--avannotate-staging.netlify.app/git-enterprise

[Copilot]

@copilot Ok. We've got the button for logging in to UT showing up, but after we login we see that the redirect takes us to:

https://github.com/login/oauth/authorize?client_id=Ov23liAisKSxjrLdFLFC&r...

The "Be careful!" error was caused by the redirect_uri being hard-coded to PUBLIC_REDIRECT_URL (the canonical staging URL) at build time, so any preview deployment sent the wrong URL to GitHub.

Two changes in commit fix: use window.location.origin…:

1. SignInGitHub.tsx — replaced import.meta.env.PUBLIC_REDIRECT_URL with window.location.origin when building the UTexas OAuth URL. Because the component is client:only="react", window is always available and always reflects the actual deployment origin (preview URL, production, etc.).

2. git-enterprise/index.ts — replaced PUBLIC_REDIRECT_URL with new URL(request.url).origin for the post-auth redirect to /en/projects, so the user lands back on the same deployment URL after sign-in.

With these changes, as long as the current preview URL is registered in the OAuth App's callback list (which you've already done), the full flow should work without any changes to environment variables.