Nexus Login & Tower URL Management

Overview

Tower's own email/password login is replaced by an OAuth 2.0 code flow against Nexus. The Tower's public URL is centralized via the activation token, and operators get a dedicated recovery screen when the registered URL has drifted.

How it works

1. The login page redirects to Nexus, passing company_id (from the activation token) so Nexus can display the company logo.
2. Nexus authenticates the user and the gateway redirects back to /auth/callback, where the nexus-auth module exchanges the code.
3. InitializationService reads towerUrl from the activation token at startup and injects it into ConfigurationService.getTowerUrl() — the single source of truth for the Tower's public URL (deprecating self.url in YAML).
4. If the gateway detects a URL mismatch, it redirects to /activate?reason=url_mismatch, where the operator can navigate to the registered URL or re-activate (POST /reactivate-url) with the current one.
5. /login/password remains as a discrete legacy fallback.

Key files

• src/core/auth/nexus/nexus-auth.controller.ts — OAuth callback + GET /auth/config
• src/core/bcyip-sync/bcyip-sync.service.ts — URL heartbeat with BCYIP (ex magic-auth)
• src/core/configuration/configuration.service.ts — setTowerUrl() / getTowerUrl()
• src/core/initialization/initialization.service.ts — reads towerUrl from activation token
• src/protocol/bcyip/api.ts — getNexusWebUrl() derives URL from BCYIP_TARGET_ENV
• ui/src/pages/login/login.tsx, NexusCallback.tsx, activate.tsx, LoginPassword.tsx

Technical decisions

• Tower URL lives in the activation token, not in editable settings — PUT /config/settings was removed and the Settings URL field is read-only.
• Nexus web URL is derived from BCYIP_TARGET_ENV (PROD/PREPROD/DEV), so no NEXUS_WEB_URL env var is needed on deployed envs (it remains an override).
• BrandingLogo uses a localStorage cache + opacity fade to prevent logo flash on load.

Next steps

• Remove the legacy /login/password route once all towers are migrated