[WRONG BRANCH] fix(oauth): require dashboard consent for Meta Muse Keychain import - #474
[WRONG BRANCH] fix(oauth): require dashboard consent for Meta Muse Keychain import#474luvs01 wants to merge 1 commit into
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
✅ Deterministic PR hygiene checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58c5412fd0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // access, not that a person acknowledged that credential move and its ToS | ||
| // risk. The dashboard warning therefore needs this matching server-side gate; | ||
| // headers are not evidence because an admin-token holder can forge them. | ||
| if (provider === "meta-muse" && principal !== "gui-session") { |
There was a problem hiding this comment.
When an operator runs ocx login meta-muse or ocx account login meta-muse, src/cli/account-auth.ts posts to this endpoint using the admin token, so this condition now always returns 403 before the existing CLI consent warning, Keychain import, or manual-key prompt can run. This also contradicts src/oauth/meta-muse.ts, which explicitly directs users without another paste surface to run that command, and makes headless Meta Muse setup impossible. Either add a consent mechanism that the CLI can satisfy or remove/update the CLI fallback and its user-facing documentation and regression coverage.
AGENTS.md reference: AGENTS.md:L367-L372
Useful? React with 👍 / 👎.
github-actions
Bot
changed the title
⏳ DRAFT
What to do
Its title has been prefixed with |
1 participant
Motivation
POST /api/oauth/loginendpoint could import a Muse CLI API key from the macOS Keychain without a GUI consent acknowledgement.Description
handleOauthAccountRoutesthat rejectsmeta-muselogin attempts unless the request principal is the dashboardgui-session, returning403withcode: "oauth_consent_required"when not satisfied. 【F:src/server/management/oauth-account-routes.ts†L150-L164】principalinto the management OAuth handler so the route can distinguish consent-bearing GUI sessions from admin-token or other non-consent principals. 【F:src/server/management/oauth-account-routes.ts†L129-L131】admin-tokenandgui-pair-capability) are rejected and that agui-sessionprincipal continues into the existing flow. 【F:tests/oauth/oauth-public-surface.test.ts†L87-L114】Testing
bun run test -- tests/oauth/oauth-public-surface.test.ts, and the suite passed including the new assertion. 【F:tests/oauth/oauth-public-surface.test.ts†L87-L114】bun run typecheck, which completed successfully.bun run privacy:scan, which passed.bun run test; the environment/contention run produced many unrelated failures in the full suite, but the focused OAuth regression passed independently.Codex Task