Repository navigation
Conversation
Adapt private client construction, endpoint typestates, token-response bounds, and async HTTP calls for oauth2 5 while preserving redirect protection and the public OAuth API. Add loopback regressions for authorization and denial, CSRF, refresh-token rotation and omission, HTTP and persistence failures, redirects, expiry, blocking cached tokens, and endpoint selection. Update the Unreleased changelog. Validated on Ubuntu with OAuth default and all-feature tests, SDK and HTTP-client tests, minimum-production-feature checks, API documentation, workspace Clippy, and nightly formatting. Dedicated real OAuth authorization, rotating refresh, and Paper queries before and after refresh also passed.
Merge upstream main while preserving PKCE, revoke/clear, token storage semantics, and all SDK bindings. Adapt the revocation request and OAuth client helper endpoint states to oauth2 5 without relaxing redirect protection. Combine the changelog entries and update PKCE, storage deletion, and insecure-endpoint regression coverage. Validated in isolated Orb Ubuntu: OAuth default tests (44 unit and 2 doc), all-feature tests (45 unit and 3 doc), HTTP client tests (12 unit), and SDK tests (80 unit and 101 doc). OAuth strict Clippy, workspace Clippy, the minimal-feature check, and nightly formatting passed. Existing warnings in unchanged workspace sources remain. Successful HTTPS revocation and redirect network paths were not exercised. No credentials, CI, or runtime configuration were changed.
5 tasks done
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Update the private OAuth client construction, endpoint typestates, token-response
bound, and async HTTP calls for oauth2 5. Explicitly disable redirects to preserve
the previous transport's behavior.
Add regression tests through
OAuthBuilder,OAuth::access_token, andTokenStorage, using loopback HTTP servers and an exclusivelycfg(test)endpoint override. Cover authorization and denial, CSRF rejection, refresh
rotation and omission, HTTP and storage failures, reauthorization, redirect
refusal, default expiry, blocking cached-token loading, and isolated endpoint
selection.
Keep public APIs, token persistence, endpoint precedence, and error categories
unchanged. Add an Unreleased changelog entry; no binding APIs or CI changes.
Evidence
Before: The authorization-flow test passes with oauth2 4.4.2. Changing only
the dependency to 5 produces seven compiler errors.
After: The adapted implementation passes the following Ubuntu checks:
cargo test -p longbridge-oauth: 33 unit tests and 2 doctests.cargo test -p longbridge-oauth --all-features: 34 unit tests and 3 doctests.cargo test -p longbridge-httpcli --all-features: 12 unit tests.cargo test -p longbridge --all-features: 80 unit tests and 101 doctests.cargo clippy --all --all-featuresandcargo +nightly fmt --all.cargo clippy -p longbridge-oauth --all-features --all-targets -- -D warnings.cargo check -p longbridge-oauth --lib --no-default-features.cargo doc -p longbridge-oauth -p longbridge --all-features --no-deps.The ignored endpoint helper is invoked by the matrix test in three separate
processes. Offline regressions run with loopback-only networking. Full-workspace
Clippy reports warnings in unchanged SDK/binding sources; the OAuth all-targets
check is warning-free.
Before: Removing the no-redirect policy in an isolated validation copy makes
both redirect tests fail because the redirected token is accepted.
After: Both tests pass with the policy, and their redirect targets receive
no requests.
Linux dependency-graph comparison includes package identities, sources, edges,
and features. The old reqwest 0.11 / hyper 0.14 / rustls 0.21 dependency chain is
removed; OAuth now uses the existing reqwest 0.12 stack.
Real OAuth validation with a dedicated client and user-confirmed Paper,
read-only authorization succeeds: authorization-code exchange, a Paper
account_balancequery, a real refresh with refresh-token rotation, and asecond Paper query using the refreshed token. The refresh is triggered through
public
TokenStorageby expiring only the test's in-memory token copy; it isnot replaced by reauthorization. The Paper guard remains enabled throughout.
A separate legacy API-key Paper query also succeeds. No orders are submitted;
test tokens and account responses are not persisted locally.
Merge Danger
Door: Two-way.
No public API or stored-token schema migration is required.
Blast Radius: Authentication.
The internal OAuth transport is shared by the language bindings. Error categories
are preserved, but dependency-provided error text may differ. Non-Linux runtime
behavior remains for the existing platform CI to validate.