Omar SobhandClaude Fable 5
91327e3618
- migration 0005 oauth_states: one-time states (10-min TTL), consumed by a CAS DELETE on callback — replays and forgeries both 404 - POST /api/apps/oauth/start: OIDC discovery on the configured issuer (or the custom MCP issuer for authType=mcp_oauth), state row, authorize URL - GET /api/apps/oauth/callback: code exchanged at the REAL token endpoint (client id+secret form POST); the access token goes straight to the broker (test proves it never appears unencrypted in Postgres); connection row + audit; redirects to the claw's Add Apps panel - [oauth] config (issuer/client/redirect_base) wired through AppState - Tests against a real local IdP server (discovery + validating token endpoint): full round trip, broker-held token, replay/forged state refused, bad code fails exchange, mcp_oauth uses the custom issuer while plain oauth refuses without a configured IdP - AddAppsApp: live connection badges + inline API-key connect per app (E2E: connect Notion by key from the directory) 136 Rust + 63 frontend tests + 21 Playwright journeys. Co-Authored-By: Claude Fable 5 <[email protected]>
53 lines
1.0 KiB
JSON
53 lines
1.0 KiB
JSON
{
|
|
"db_name": "PostgreSQL",
|
|
"query": "DELETE FROM oauth_states\n WHERE state = $1 AND expires_at > now()\n RETURNING workspace_id, user_id, agent_id, provider, auth_type, issuer_url",
|
|
"describe": {
|
|
"columns": [
|
|
{
|
|
"ordinal": 0,
|
|
"name": "workspace_id",
|
|
"type_info": "Uuid"
|
|
},
|
|
{
|
|
"ordinal": 1,
|
|
"name": "user_id",
|
|
"type_info": "Uuid"
|
|
},
|
|
{
|
|
"ordinal": 2,
|
|
"name": "agent_id",
|
|
"type_info": "Uuid"
|
|
},
|
|
{
|
|
"ordinal": 3,
|
|
"name": "provider",
|
|
"type_info": "Text"
|
|
},
|
|
{
|
|
"ordinal": 4,
|
|
"name": "auth_type",
|
|
"type_info": "Text"
|
|
},
|
|
{
|
|
"ordinal": 5,
|
|
"name": "issuer_url",
|
|
"type_info": "Text"
|
|
}
|
|
],
|
|
"parameters": {
|
|
"Left": [
|
|
"Text"
|
|
]
|
|
},
|
|
"nullable": [
|
|
false,
|
|
false,
|
|
false,
|
|
false,
|
|
false,
|
|
false
|
|
]
|
|
},
|
|
"hash": "c7c420c92d07cd95489549c2fc00f71092d2709b5ebf7f5f62d3df8a87691912"
|
|
}
|