CLI custom sync http-base unexpectedly replaces the default OAuth endpoint base

Search first

• I searched open and closed issues for custom sync OAuth, http-base, and Cognito endpoint behavior.

What happened?

Setting a custom CLI sync http-base also changes the implicit OAuth endpoint base. Without explicit OAuth overrides, logseq login derives authorize and token routes under the custom sync origin, for example:

https://<custom-sync-origin>/oauth2/authorize
https://<custom-sync-origin>/oauth2/token

A standard self-hosted DB Sync worker exposes graph, asset, E2EE, and sync routes, but does not expose these OAuth routes. Login or token refresh therefore fails unless users manually add all Cognito endpoint overrides to cli.edn.

Required workaround:

{:http-base "https://<custom-sync-origin>"
 :ws-url "wss://<custom-sync-origin>/sync/%s"
 :oauth-authorize-endpoint "https://<identity-provider>/oauth2/authorize"
 :oauth-token-endpoint "https://<identity-provider>/oauth2/token"
 :oauth-logout-endpoint "https://<identity-provider>/logout"}

This is especially easy to miss because initial login and later refresh depend on different OAuth routes.

Reproduce

1. Configure only a custom :http-base and :ws-url for a self-hosted DB Sync worker.
2. Run logseq login or allow an existing token to require refresh.
3. Observe the derived authorize or token URL.

Expected behavior

Sync transport endpoints and identity-provider endpoints should have independent defaults. Setting http-base should not replace the built-in OAuth provider unless explicit OAuth endpoint configuration requests that behavior.

Platform

• Current CLI repository build
• Self-hosted DB Sync worker
• Cognito authentication

Start at the CLI configuration handling for :http-base and the OAuth endpoint defaults used by logseq login and token refresh. Reproduce the issue with the listed http-base and ws-url settings, then verify that sync routes still use the custom origin while authorize, token, and logout routes retain their identity-provider defaults.