CL-6389: mount createOAuthConnectRoutes in apps/hub - #136
Merged
Merged
Conversation
Covers createTenantConnectCredential mounted through the real createOAuthConnectRoutes factory: a full authorize -> callback -> credential-stored round trip, a tampered-state callback that must never persist anything, and provider-health clearing on connect.
createOAuthConnectRoutes (packages/connections' oauth-pkce/oauth-code factory) was exported but only reachable through packages/onboarding's first-login mount, and even there its oauthEnv never carried GITHUB_APP_CLIENT_ID/SECRET — so the GitHub App one-click connect path added in #132 always reported not_configured. Threads those two through onboarding's own mount, and adds a second, tenant-scoped mount directly in apps/hub at .../connections/oauth, beside the existing createConnectionRoutes settings surface, so a caller that already knows its tenant (not just onboarding's first-login flow) can drive the same OAuth connect mechanics. createTenantConnectCredential (packages/connections) is the connectCredential wiring that new mount needs: it reads the tenant/ principal the platform's own tenant middleware already resolved (c.get("tenant")/c.get("principal")) and persists exactly the way createConnectionRoutes' own /complete handler does -- ensureProvider + ensureCredential, then seedCatalog for an inference connector. connectCredential's own args gained a c: Context field so a tenant-scoped caller can read it directly, matching the shape afterConnected already had; onboarding's existing implementation is unaffected since it never reads it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
createOAuthConnectRoutes(packages/connections' oauth-pkce/oauth-code factory) was exported but only reachable throughpackages/onboarding's first-login mount, and that mount never threadedGITHUB_APP_CLIENT_ID/SECRETinto itsoauthEnv-- so the GitHub App one-click connect path added in CL-6386: GitHub connect discoverable in Plugins, select on new-workbench #132 always reportednot_configuredeven when configured.githubAppClientId/githubAppClientSecretthrough onboarding's existing mount.apps/hubat.../connections/oauth, beside the existingcreateConnectionRoutessettings surface (mirrors MCP OAuth connect: fix missing state param (CL-6371) #115'smcp-servers/oauthpattern -- state-param CSRF, realstate(), exact-match callback validation, all inside the factory itself).createTenantConnectCredential(packages/connections) as theconnectCredentialwiring that new mount needs -- reads the tenant/principal the platform's tenant middleware already resolved and persists the same waycreateConnectionRoutes' own/completehandler does.Test plan
packages/connectionstypecheck + tests (full authorize->callback->credential-stored round trip, tampered-state rejection, provider-health clear)packages/onboardingtypecheck + testsapps/hubtypecheck + tests/api/onboarding/oauth/{openrouter,huggingface,github}/startall resolve 302 (unknown connector 404s); new.../connections/oauth/openrouter/startmount resolves (401 unauthenticated, matching every other tenant-scoped route's behavior -- not 404); confirmed no path overlap withmcp-servers/oauth