Repository navigation
fix(gateway): keep the sign-in URL, abort cancelled logins, proxy the token exchange - #351
Merged
Merged
Conversation
… token exchange The desktop controller's state merge never carried authUrl forward, and the real login() logs as it opens the browser, so the URL vanished on the very next event and the renderer hid its open/copy/paste-back fallback for the whole wait. Merge it like email and clear it on the transitions that end the wait. login() now takes an AbortSignal: aborting closes the loopback server and rejects with a cancellation at whichever step the flow is on, so a callback landing after Back, Log out, or the TUI's new escape from the SSO step can no longer write a session to disk. login() and silentSso() also take the caller's fetchImpl so the desktop's token exchange and silent refresh ride Electron's net.fetch like the gateway calls already do. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UtPnKQ9ATvc9kd1v74zC4Y
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UtPnKQ9ATvc9kd1v74zC4Y
3 of 4 tasks
3 of 4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-ups from an investigation of the TUI and desktop SSO login.
setStatein the SSO controller never mergedauthUrl, and the reallogin()logs synchronously insideopenBrowser(), so the URL was wiped one event afteronReady. The renderer only shows Open link, Copy and the paste-back field whileauthUrlis set, so those controls flashed and vanished; with no browser the only exits were Back or the five-minute timeout. Reproduced against the reallogin(); the existing test missed it because its fake browser opener never logged.authUrlis now carried forward and cleared explicitly on ready/error/idle.login()accepts anAbortSignal: abort closes the loopback server and rejects with a cancellation (isLoginCancelled) at whichever step the flow is on, including mid-exchange and just before the disk write. The desktop controller aborts oncancelLoginandlogout, so a late browser callback can no longer re-sign a user who just logged out.onCloseaborts the attempt. With nothing configured the gate invariant reopens the entry chooser; otherwise the dialog simply closes. Previously the only ways out were quitting or the timeout, which also quit the app.login()andsilentSso()takefetchImpl; the controller passes Electron'snet.fetchso the token exchange, userinfo and silent refresh (including the one insideensureKey) honour proxies, PAC files and enterprise roots like the gateway calls already did.All touched files are fork-only, so no
DIVERGENCES.mdrow; CHANGELOG has the user-facing entries.Test plan
packages/codev-gateway:bun test(68 pass) — newloginsuite covers abort closing the real loopback server, an already-aborted signal, and the injected fetch reaching the refresh and userinfo callspackages/desktop:bun test src/main/gateway-sso(22 pass) — the submitCode test now has the browser opener log like the real one, plus abort-on-cancel/logout and fetchImpl plumbing testspackages/tui: configure-gate and custom-provider view tests passbun typecheckin codev-gateway, desktop, tui🤖 Generated with Claude Code
https://claude.ai/code/session_01UtPnKQ9ATvc9kd1v74zC4Y