Enable redirect-based OAuth flow#127
Open
thepatrickchin wants to merge 10 commits into
Open
Conversation
thepatrickchin
force-pushed
the
feat/redirect-auth
branch
from
e87d657 to
baf12c7
Compare
thepatrickchin
force-pushed
the
feat/redirect-auth
branch
from
0f48d00 to
db82f96
Compare
dagardner-nv
added
non-breaking
|
This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 14 days. |
github-actions
Bot
added
the
Stale
thepatrickchin
force-pushed
the
feat/redirect-auth
branch
2 times, most recently
from
a4e5644 to
f853e4b
Compare
github-actions
Bot
removed
the
Stale
thepatrickchin
force-pushed
the
feat/redirect-auth
branch
2 times, most recently
from
76d54dc to
161b487
Compare
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
thepatrickchin
force-pushed
the
feat/redirect-auth
branch
2 times, most recently
from
d986ad4 to
46c06d4
Compare
The resume effect deleted 2 messages (user + assumed assistant placeholder) before resubmitting. No assistant placeholder is appended at send time; the assistant bubble is only created when a response/intermediate message arrives. For preflight auth the consent arrives before any agent execution, so deleting 2 removed the user message AND the previous turn's assistant reply. Delete the assistant bubble only when one actually exists, mirroring the cancellation branch's logic. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
window.open returns null when noopener/noreferrer is set, so the popup handle was always null and the popup.close() on auth completion never ran. Drop those flags so the handle is usable and the popup can be closed programmatically. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
The popup message listener acted on AUTH_CANCELLED from any window. The backend posts that message from the NAT server's /auth/redirect callback with targetOrigin '*', and oauthUrl points at the IdP authorize endpoint, so neither an origin check nor the oauthUrl origin identifies the legitimate sender. Gate on event.source === popup instead: the source window identity is the correct trust boundary and is stable across the popup's cross-origin hops. Relies on the popup handle being non-null (noopener/noreferrer removed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
…n error
When pre-flight authentication is cancelled or fails, the backend sends a bare
Error payload ({code, message, details}) with no type/conversation_id. The
strict message validator rejected it and surfaced a raw "Invalid WebSocket
message structure" toast, while the loading spinner stayed stuck.
Detect the user_auth_error payload before validation, clear the in-flight
loading/streaming state, and show the backend's auth message in a toast.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
With use_redirect_auth + preflight_auth, cancelling the OAuth login caused an infinite loop: cancel → reload → WS reconnects → preflight → redirect → cancel. The fix uses a sessionStorage flag (oauth_redirect_cancelled) to suppress auto-reconnect after a cancelled redirect, breaking the loop. Four coordinated changes: 1. oauth_redirect_initiated is stamped before window.location.href so the flag survives the page reload even when preflight fires before any user message exists (no pending message is saved in that case, so the resume effect returns early and cannot set the guard itself). 2. A new early effect reads oauth_redirect_initiated on reload and sets oauth_redirect_cancelled if oauth_auth_completed is absent from the URL. It runs before the WS toggle effect so the guard is in place before connectWebSocket is called. 3. The WS toggle effect checks oauth_redirect_cancelled before connecting, preventing a new preflight from starting. 4. openOAuthConsentUrl also checks the flag as defense-in-depth. 5. handleSend clears the flag so the user can retry by sending a new message. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
thepatrickchin
force-pushed
the
feat/redirect-auth
branch
from
46c06d4 to
0240338
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This is a complementary PR for NVIDIA/NeMo-Agent-Toolkit#1835
Closes NVIDIA/NeMo-Agent-Toolkit#1834
By Submitting this PR I confirm: