local emulator allow localhost callback, add ssh debugging, fix file …

…perms
stack-auth · BilalG1 · Mar 13, 2026 · Mar 18, 2026 · Mar 18, 2026 · Mar 18, 2026
commit bc1f95124bef9f28b0720fa88a36a9712f275dfe
diff --git a/apps/backend/src/lib/redirect-urls.tsx b/apps/backend/src/lib/redirect-urls.tsx
@@ -1,5 +1,6 @@
 import { StackAssertionError, captureError } from "@stackframe/stack-shared/dist/utils/errors";
 import { createUrlIfValid, isLocalhost, matchHostnamePattern } from "@stackframe/stack-shared/dist/utils/urls";
+import { isLocalEmulatorEnabled } from "./local-emulator";
 import { Tenancy } from "./tenancies";
 
 /**
@@ -85,8 +86,8 @@ export function validateRedirectUrl(
   const url = createUrlIfValid(urlOrString);
   if (!url) return false;
 
-  // Check localhost permission
-  if (tenancy.config.domains.allowLocalhost && isLocalhost(url)) {
+  // Check localhost permission — always allow in local emulator mode
+  if ((tenancy.config.domains.allowLocalhost || isLocalEmulatorEnabled()) && isLocalhost(url)) {
     return true;
   }
 

diff --git a/docker/local-emulator/qemu/cloud-init/emulator/user-data b/docker/local-emulator/qemu/cloud-init/emulator/user-data
@@ -15,7 +15,7 @@ chpasswd:
     stack:stack-emulator
   expire: false
 
-ssh_pwauth: false
+ssh_pwauth: true
 
 package_update: true
 package_upgrade: false
@@ -163,8 +163,8 @@ write_files:
       WantedBy=multi-user.target
 
 runcmd:
-  - systemctl disable --now ssh || true
-  - systemctl mask ssh || true
+  - systemctl unmask ssh || true
+  - systemctl enable --now ssh || true
   - bash /usr/local/bin/install-emulator-containers
   - systemctl daemon-reload
   - systemctl enable stack.service

diff --git a/docker/local-emulator/qemu/run-emulator.sh b/docker/local-emulator/qemu/run-emulator.sh
@@ -204,6 +204,8 @@ build_qemu_cmd() {
   netdev+=",hostfwd=tcp::${PORT_PREFIX}25-:8080"
   netdev+=",hostfwd=tcp::${PORT_PREFIX}36-:8123"
   netdev+=",hostfwd=tcp::${PORT_PREFIX}37-:9009"
+  # SSH
+  netdev+=",hostfwd=tcp::${PORT_PREFIX}22-:22"
   # App services
   netdev+=",hostfwd=tcp::${PORT_PREFIX}01-:${PORT_PREFIX}01"
   netdev+=",hostfwd=tcp::${PORT_PREFIX}02-:${PORT_PREFIX}02"
@@ -362,6 +364,7 @@ cmd_status() {
   print_service_status "MinIO" "${PORT_PREFIX}21" http /minio/health/live
   print_service_status "QStash" "${PORT_PREFIX}25" http / 401
   print_service_status "ClickHouse" "${PORT_PREFIX}36" http /ping
+  print_service_status "SSH" "${PORT_PREFIX}22" tcp
   exit "$STATUS_FAILED"
 }
 

diff --git a/docker/server/entrypoint.sh b/docker/server/entrypoint.sh
@@ -114,12 +114,27 @@ done
 
 # ============= START BACKEND AND DASHBOARD =============
 
+# When running inside the QEMU emulator with a 9p host mount, the guest kernel
+# checks file permissions using guest UIDs. Files on the host are owned by the
+# host user (e.g. UID 501) so the app processes must run as that UID to be able
+# to read/write config files on the host filesystem (including in sticky-bit
+# directories like /tmp).
+HOST_MOUNT_ROOT="${STACK_LOCAL_EMULATOR_HOST_MOUNT_ROOT:-}"
+RUN_AS=""
+if [ -n "$HOST_MOUNT_ROOT" ] && [ -d "$HOST_MOUNT_ROOT" ]; then
+  HOST_UID=$(stat -c %u "$HOST_MOUNT_ROOT/etc" 2>/dev/null || echo "")
+  if [ -n "$HOST_UID" ] && [ "$HOST_UID" != "0" ]; then
+    useradd -u "$HOST_UID" -M -s /bin/false -d "$WORK_DIR" hostuser 2>/dev/null || true
+    RUN_AS="gosu $HOST_UID"
+  fi
+fi
+
 echo "Starting backend on port $BACKEND_PORT..."
 cd "$WORK_DIR"
-PORT=$BACKEND_PORT HOSTNAME=0.0.0.0 node apps/backend/server.js &
+$RUN_AS env PORT=$BACKEND_PORT HOSTNAME=0.0.0.0 node apps/backend/server.js &
 
 echo "Starting dashboard on port $DASHBOARD_PORT..."
-PORT=$DASHBOARD_PORT HOSTNAME=0.0.0.0 node apps/dashboard/server.js &
+$RUN_AS env PORT=$DASHBOARD_PORT HOSTNAME=0.0.0.0 node apps/dashboard/server.js &
 
 # Wait for both to finish
 wait -n