Repository navigation
fix(oauth): the consent page names the box's own page, and its lookup refusals can be read there - #25
Merged
Merged
Conversation
… refusals can be read there An owner with no FTW app approves and removes an assistant on the box's own page, under Settings, then Access. The consent page said removal happens "in the FTW app" only, and named an Access page without saying where. The box page asks the code lookup from the owner's browser. Only a found code carried Access-Control-Allow-Origin, so the browser hid a wrong code and a rate limit behind the same network error. Every answer of the lookup now carries it; a refusal says nothing a code does not. Paired with srcfl/ftw's Access tab. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Fredrik, 17 October: an owner must be able to connect an assistant over MCP with no app involved. Such an owner approves on the box's own page, in the new Settings → Access tab (srcfl/ftw#1682). Two things here did not fit that.
What changes
GET /oauth/requests?code=from the owner's browser, on whatever address the box has. Only a found code carriedAccess-Control-Allow-Origin: *, so the browser hid a 404 and a 429 behind the same network error, and the page could not tell a mistyped code from no network. Every answer of the lookup now carries the header. A refusal says nothing a code does not, and the lookup stays rate limited and works once.Paired with srcfl/ftw#1682. Either can merge first: the box page already words a hidden refusal as "No answer from FTW Cloud. Check the code against the assistant's page, and that this device is online".
Tests
TestTheBoxPageFindsARequestByItsCodechecks the header on an unknown code and on a rate-limited lookup.TestTheConsentPagechecks both new lines.go vet ./...,go test -race ./...,go test -tags ftwclouddev ./internal/oauthandscripts/check-imports.shpass. Under the load of a parallelmake verify,TestTheSnapshotArrivesFastininternal/appsession(untouched here) missed its 100 ms p95 once; it passed three times in a row after.Nothing is deployed from here.
🤖 Generated with Claude Code