Skip to content

Run as signed-in email; return auth URL on 401 - #20

Merged
kamath merged 2 commits into
mainfrom
default-script-user-email
Jul 28, 2026
Merged

Run as signed-in email; return auth URL on 401#20
kamath merged 2 commits into
mainfrom
default-script-user-email

Conversation

@kamath

@kamath kamath commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Lock the run-as field to the signed-in email (read-only) and prefer email over OIDC sub as Arcade user_id.
  • Once OIDC is configured, unauthenticated script runs get a 401 with authorizationUrl (and MCP-friendly WWW-Authenticate), and the UI shows a Sign in button instead of disabling Run.

Test plan

  • Signed in: Run as shows email and is disabled; scripts run as that email
  • Signed out: Run still works; 401 shows Sign in linking to /login
  • After sign-in, retry run succeeds
  • MCP/tool error text includes the authorization URL

Made with Cursor

kamath and others added 2 commits July 28, 2026 11:03
Lock the run-as field to session email, require a session once OIDC is configured, and surface authorizationUrl (plus MCP WWW-Authenticate) so clients can open sign-in and retry.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@vercel

vercel Bot commented Jul 28, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
abilities-frontend Ready Ready Preview, Comment Jul 28, 2026 6:04pm

Request Review

@kamath
kamath merged commit b61f949 into main Jul 28, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant