fix(website): validate OAuth state on error callbacks by JustAGhosT · Pull Request #43 · phoenixvc/codeflow-engine

JustAGhosT · 2026-07-24T15:57:10Z

Summary

validate the saved OAuth transaction state before handling Identity error or incomplete callbacks
consume matched failed transactions while preserving unmatched transactions
replace provider-controlled error descriptions with bounded Codeflow messages
add regression coverage for matched cancellation and forged state

Verification

pm test -- app/auth/tests/AuthCallback.test.tsx

px eslint app/auth/AuthCallback.tsx app/auth/oidc.ts app/auth/tests/AuthCallback.test.tsx

pm run build

Live finding

A forged callback with �rror=access_denied and a mismatched state currently renders the supplied �rror_description. This change makes that path fail closed with the state-mismatch message.

Summary by CodeRabbit

Bug Fixes
- Improved sign-in callback handling for cancelled, incomplete, or invalid authentication attempts.
- Added clearer messages when authorization codes are missing or sign-in state validation fails.
- Prevented provider-supplied error descriptions from being displayed in the sign-in interface.
- Ensured completed or invalid authentication requests are cleared appropriately while preserving requests that may be retried.
Tests
- Added coverage for cancelled sign-ins, mismatched state values, displayed messages, and request cleanup behavior.

coderabbitai · 2026-07-24T15:58:37Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: beded25a-73bb-4261-baaa-656f3df1cbda

📥 Commits

Reviewing files that changed from the base of the PR and between ff86491 and 5897192.

📒 Files selected for processing (3)

website/app/auth/AuthCallback.tsx
website/app/auth/__tests__/AuthCallback.test.tsx
website/app/auth/oidc.ts

📝 Walkthrough

Walkthrough

The OIDC flow centralizes stored-request validation and adds request consumption. AuthCallback now handles authorization errors and missing codes through explicit error paths, while tests cover cancellation, state mismatches, message filtering, and storage cleanup.

Changes

OIDC callback flow

Layer / File(s)	Summary
Stored request validation and consumption `website/app/auth/oidc.ts`	Centralizes stored auth request retrieval, parsing, and state validation, and adds `consumeMystiraIdentityRequest` to remove validated requests from `sessionStorage`.
Callback error paths and coverage `website/app/auth/AuthCallback.tsx`, `website/app/auth/__tests__/AuthCallback.test.tsx`	Handles authorization errors and missing codes with explicit messages or exception text, updates browser history, uses the validated state for successful completion, and tests cancellation and state-mismatch behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

phoenixvc/codeflow-engine#42: Refactors the same Mystira Identity callback and OIDC request-validation flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: validating OAuth state during error callbacks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/oauth-callback-state-validation

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

website/app/auth/AuthCallback.tsx

Oops! Something went wrong! :(

ESLint: 8.57.1

YAMLException: Cannot read config file: /website/eslint.config.mjs
Error: end of the stream or a document separator is expected (9:16)

6 | const __filename = fileURLToPath(import.meta.url);
7 | const __dirname = dirname(__filename);
8 | const compat = new FlatCompat({
9 | baseDirectory: __dirname,
---------------------^
10 | });
11 |
at generateError (/vscode-extension/node_modules/js-yaml/lib/loader.js:183:10)
at throwError (/vscode-extension/node_modules/js-yaml/lib/loader.js:187:9)
at readDocument (/vscode-extension/node_modules/js-yaml/lib/loader.js:1645:5)
at loadDocuments (/vscode-extension/node_modules/js-yaml/lib/loader.js:1688:5)
at Object.load (/vscode-extension/node_modules/js-yaml/lib/loader.js:1714:19)
at loadLegacyConfigFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2565:21)
at loadConfigFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2680:20)
at ConfigArrayFactory._loadConfigData (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2984:42)
at ConfigArrayFactory.loadFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2850:40)
at createCLIConfigArray (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:3660:35)

website/app/auth/__tests__/AuthCallback.test.tsx

Oops! Something went wrong! :(

ESLint: 8.57.1

YAMLException: Cannot read config file: /website/eslint.config.mjs
Error: end of the stream or a document separator is expected (9:16)

6 | const __filename = fileURLToPath(import.meta.url);
7 | const __dirname = dirname(__filename);
8 | const compat = new FlatCompat({
9 | baseDirectory: __dirname,
---------------------^
10 | });
11 |
at generateError (/vscode-extension/node_modules/js-yaml/lib/loader.js:183:10)
at throwError (/vscode-extension/node_modules/js-yaml/lib/loader.js:187:9)
at readDocument (/vscode-extension/node_modules/js-yaml/lib/loader.js:1645:5)
at loadDocuments (/vscode-extension/node_modules/js-yaml/lib/loader.js:1688:5)
at Object.load (/vscode-extension/node_modules/js-yaml/lib/loader.js:1714:19)
at loadLegacyConfigFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2565:21)
at loadConfigFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2680:20)
at ConfigArrayFactory._loadConfigData (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2984:42)
at ConfigArrayFactory.loadFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2850:40)
at createCLIConfigArray (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:3660:35)

website/app/auth/oidc.ts

Oops! Something went wrong! :(

ESLint: 8.57.1

YAMLException: Cannot read config file: /website/eslint.config.mjs
Error: end of the stream or a document separator is expected (9:16)

6 | const __filename = fileURLToPath(import.meta.url);
7 | const __dirname = dirname(__filename);
8 | const compat = new FlatCompat({
9 | baseDirectory: __dirname,
---------------------^
10 | });
11 |
at generateError (/vscode-extension/node_modules/js-yaml/lib/loader.js:183:10)
at throwError (/vscode-extension/node_modules/js-yaml/lib/loader.js:187:9)
at readDocument (/vscode-extension/node_modules/js-yaml/lib/loader.js:1645:5)
at loadDocuments (/vscode-extension/node_modules/js-yaml/lib/loader.js:1688:5)
at Object.load (/vscode-extension/node_modules/js-yaml/lib/loader.js:1714:19)
at loadLegacyConfigFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2565:21)
at loadConfigFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2680:20)
at ConfigArrayFactory._loadConfigData (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2984:42)
at ConfigArrayFactory.loadFile (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:2850:40)
at createCLIConfigArray (/vscode-extension/node_modules/@eslint/eslintrc/dist/eslintrc.cjs:3660:35)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

fix(website): validate OAuth state on error callbacks

5897192

JustAGhosT merged commit 0442b4f into master Jul 24, 2026
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(website): validate OAuth state on error callbacks - #43

fix(website): validate OAuth state on error callbacks#43
JustAGhosT merged 1 commit into
masterfrom
fix/oauth-callback-state-validation

JustAGhosT commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

JustAGhosT commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

pm test -- app/auth/tests/AuthCallback.test.tsx

px eslint app/auth/AuthCallback.tsx app/auth/oidc.ts app/auth/tests/AuthCallback.test.tsx

Live finding

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

JustAGhosT commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading