Reuse login redirect_uri in token request

[melvincarvalho]

Fixes #14.

login() registers the client and starts authorization with origin + pathname + search, but handleRedirectFromLogin() sent origin + pathname to the token endpoint. When the app URL has a query string (e.g. ?tracker=…), the two don't match and the IdP returns 400 invalid_grant (RFC 6749 §4.1.3).

Changes:

• login() saves the exact redirect URI to sessionStorage as solid_oidc_redirect_uri
• the token request reuses it, falling back to origin + pathname + search (after code/iss/state are stripped)
• the key is cleared alongside the other solid_oidc_* keys

[Copilot]

Copilot review overview

🟢 Approval recommended

The fix is minimal, matches the issue's proposed solution exactly, and the stored redirect URI is correctly set, reused with a consistent fallback, and cleared.

Review effort: Balanced
Findings: None

What changed in this PR

This PR fixes a login failure (400 invalid_grant) that occurred whenever an app signed in from a URL containing a query string. Per RFC 6749 §4.1.3, the redirect_uri in the token request must exactly match the one used in the authorization request. Previously login() authorized with origin + pathname + search while handleRedirectFromLogin() exchanged the code using only origin + pathname, causing a mismatch. The fix persists the exact redirect URI during login() and reuses it during the token exchange.

Changes:

• login() now saves the exact sanitizedRedirect to sessionStorage as solid_oidc_redirect_uri.
• The token request reuses the stored URI, falling back to origin + pathname + search (after code/iss/state are stripped).
• The new session key is cleared alongside the other solid_oidc_* keys after token exchange.

File	Description
solid-oidc.js	Stores the authorization redirect_uri in sessionStorage and reuses it in the token request so both requests match, with a cleanup removal added.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.