Repository navigation
fix(gateway): land a refused key on manual entry with the gateway's reason - #354
Merged
Merged
Conversation
…eason When the CoDev gateway declines to issue a key for an account (an email domain outside its allowlist, e.g. a sub-domain of a listed one), the backend now answers 403 with code "key_refused". Both configure flows treated that like a flaky network: withRetries spent three attempts on it, then the TUI quit with a generic "setup failed" and the desktop toast showed a nested 502/400 status chain. fetchApiKey now throws a BackendError carrying the backend's reason and code; isKeyRefusal is what callers branch on. withRetries (TUI and desktop) rethrows a refusal on the first attempt. The TUI's SSO flow and the desktop controller's fetchSetup route a refusal to the manual API-key step with the gateway's own sentence and a note that retrying won't change it — the desktop carries it as GatewaySetupResult.keyRefused, which the renderer's API-key step renders via a new gateway.configure.apikey.refused string. Hub parity: codev-hub's install step got the same handling. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DFzDyvc2uV1Vp1WoHBkiPB
quickbeard
force-pushed
the
key-refusal
branch
from
September 10, 2026 08:30
ae1e5dd to
f4d3a90
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A user whose email sits on a sub-domain of an allowlisted one was refused by the gateway's key-minting endpoint. In CoDev Code the SSO configure flow handled that like a flaky network:
withRetriesspent three attempts on it, then the TUI quit with a generic "setup failed" and the desktop toast showed the raw nested 502/400 status chain. The refusal is a policy answer, and the manual API-key step already exists for exactly this situation.The companion backend change (quickbeard/codev-backend#25) reports the refusal as
403withcode: "key_refused"; the hub side is quickbeard/codev-hub#266. This PR is the CoDev Code twin.What
@codev/gateway:fetchApiKeythrows aBackendErrorcarrying the backend'sstatus,reasonandcode;isKeyRefusalis the check callers branch on. Both exported.dialog-configure.tsx,dialog-custom-provider.tsx):withRetriesrethrows a refusal on the first attempt. The SSO flow routes it to the existing manual-key prompt with a warning toast carrying the gateway's own sentence plus "Retrying won't change this — enter an API key issued to you by hand", instead offailAndQuit.gateway-sso/controller.ts): samewithRetriesrule;fetchSetupreturns{ hasApiKey: false, keyRefused: <reason> }instead of throwing.GatewaySetupResultgains the optionalkeyRefusedfield (structured-clone safe, passes through the existing IPC unchanged).gateway/dialog-configure.tsx): the API-key step shows the reason via a newgateway.configure.apikey.refusedstring (en + es) when present, otherwise the existing "no key" copy.gateway.configure.*family.Tests
@codev/gateway:fetchApiKeyhappy path, a 403key_refused→BackendErrorwith code/reason/message, and a plain 502 that is aBackendErrorbut not a refusal (78 pass).keyRefusedwith the controller left inready(23 pass).codev-gateway,tui,desktop,app. Prettier clean on all changed files.Rollout
Only takes effect against a backend that sends
key_refused; against an older backend the previous behaviour stands. The reporting user is unblocked only by the gateway allowlist change or a key issued by hand.🤖 Generated with Claude Code
https://claude.ai/code/session_01DFzDyvc2uV1Vp1WoHBkiPB