Skip to content

fix(oauth): send a same-origin path as the OAuth return #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
emooreatx merged 1 commit into from
Oct 30, 2026
Merged

fix(oauth): send a same-origin path as the OAuth return #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions apps/agui/app/account/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@
id: 'google',
name: 'Google',
icon: (
<svg className="w-5 h-5" viewBox="0 0 24 24">

Check warning on line 63 in apps/agui/app/account/page.tsx

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This <svg> lacks an accessible name; add a "title" child, "aria-label", or "aria-labelledby", or mark it as decorative (e.g. aria-hidden or role="presentation"). 


See more on https://sonarcloud.io/project/issues?id=CIRISAI_ScoutGUI&issues=AaGPJAYpE-Km-bl-u_QQ&open=AaGPJAYpE-Km-bl-u_QQ&pullRequest=1
<path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/>
<path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/>
<path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/>
Expand All @@ -73,7 +73,7 @@
id: 'discord',
name: 'Discord',
icon: (
<svg className="w-5 h-5" viewBox="0 0 24 24" fill="#5865F2">

Check warning on line 76 in apps/agui/app/account/page.tsx

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This <svg> lacks an accessible name; add a "title" child, "aria-label", or "aria-labelledby", or mark it as decorative (e.g. aria-hidden or role="presentation"). 


See more on https://sonarcloud.io/project/issues?id=CIRISAI_ScoutGUI&issues=AaGPJAYpE-Km-bl-u_QR&open=AaGPJAYpE-Km-bl-u_QR&pullRequest=1
<path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515a.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0a12.64 12.64 0 0 0-.617-1.25a.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057a19.9 19.9 0 0 0 5.993 3.03a.078.078 0 0 0 .084-.028a14.09 14.09 0 0 0 1.226-1.994a.076.076 0 0 0-.041-.106a13.107 13.107 0 0 1-1.872-.892a.077.077 0 0 1-.008-.128a10.2 10.2 0 0 0 .372-.292a.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127a12.299 12.299 0 0 1-1.873.892a.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028a19.839 19.839 0 0 0 6.002-3.03a.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419c0-1.333.956-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42c0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419c0-1.333.955-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42c0 1.333-.946 2.418-2.157 2.418z"/>
</svg>
),
Expand All @@ -87,7 +87,7 @@
};

// Handle OAuth linking flow
const handleOAuthLink = async (provider: string) => {

Check warning on line 90 in apps/agui/app/account/page.tsx

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Async arrow function 'handleOAuthLink' has no 'await' expression. 


See more on https://sonarcloud.io/project/issues?id=CIRISAI_ScoutGUI&issues=AaGPJAYpE-Km-bl-u_QS&open=AaGPJAYpE-Km-bl-u_QS&pullRequest=1
try {
// Store intention to link (not login) and provider info
localStorage.setItem('oauthIntention', 'link');
Expand All @@ -100,8 +100,9 @@
const agentIdMatch = apiBaseUrl.match(/\/api\/([^\/]+)/);
const agentId = agentIdMatch ? agentIdMatch[1] : (currentAgent?.agent_id || 'scout');

// Use agent-specific callback URL for linking
const redirectUri = encodeURIComponent(`${window.location.origin}/oauth/${agentId}/${provider}/callback`);
// Same-origin path only (see login/page.tsx): the API host's nginx
// forwards /oauth/* back to this origin.
const redirectUri = encodeURIComponent(`/oauth/${agentId}/${provider}/callback`);

// apiBaseUrl does NOT include /v1, so we need to add it
const oauthUrl = `${apiBaseUrl}/v1/auth/oauth/${provider}/login`;
Expand Down Expand Up @@ -428,7 +429,7 @@
<div className="bg-blue-50 border border-blue-200 rounded-lg p-4">
<div className="flex">
<div className="flex-shrink-0">
<svg className="h-5 w-5 text-blue-400" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor">

Check warning on line 432 in apps/agui/app/account/page.tsx

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This <svg> lacks an accessible name; add a "title" child, "aria-label", or "aria-labelledby", or mark it as decorative (e.g. aria-hidden or role="presentation"). 


See more on https://sonarcloud.io/project/issues?id=CIRISAI_ScoutGUI&issues=AaGPJAYpE-Km-bl-u_QT&open=AaGPJAYpE-Km-bl-u_QT&pullRequest=1
<path fillRule="evenodd" d="M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7-4a1 1 0 11-2 0 1 1 0 012 0zM9 9a1 1 0 000 2v3a1 1 0 001 1h1a1 1 0 100-2v-3a1 1 0 00-1-1H9z" clipRule="evenodd" />
</svg>
</div>
Expand Down
7 changes: 5 additions & 2 deletions apps/agui/app/login/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@
}
};

const handleOAuthLogin = async (provider: string) => {

Check warning on line 85 in apps/agui/app/login/page.tsx

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Async arrow function 'handleOAuthLogin' has no 'await' expression. 


See more on https://sonarcloud.io/project/issues?id=CIRISAI_ScoutGUI&issues=AaGPJAcTE-Km-bl-u_QU&open=AaGPJAcTE-Km-bl-u_QU&pullRequest=1
try {
// Clear any leftover OAuth linking state
localStorage.removeItem('oauthIntention');
Expand All @@ -91,8 +91,11 @@

const apiBaseUrl = process.env.NEXT_PUBLIC_SCOUT_API_URL || process.env.NEXT_PUBLIC_API_BASE_URL || window.location.origin;

// Use static HTML callback page
const callbackUrl = `${window.location.origin}/oauth-complete.html?marketing_opt_in=${marketingOptIn}`;
// The agent accepts only a same-origin PATH as its OAuth return (an
// absolute URL on another origin is refused as an open redirect). The
// browser therefore lands on the API host, whose nginx forwards
// /oauth-complete.html back to this origin with the one-time code.
const callbackUrl = `/oauth-complete.html?marketing_opt_in=${marketingOptIn}`;
const redirectUri = encodeURIComponent(callbackUrl);
// apiBaseUrl does NOT include /v1, so we need to add it
const oauthUrl = `${apiBaseUrl}/v1/auth/oauth/${provider}/login`;
Expand All @@ -108,7 +111,7 @@
switch (provider.toLowerCase()) {
case "google":
return (
<svg className="w-5 h-5" viewBox="0 0 24 24">

Check warning on line 114 in apps/agui/app/login/page.tsx

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This <svg> lacks an accessible name; add a "title" child, "aria-label", or "aria-labelledby", or mark it as decorative (e.g. aria-hidden or role="presentation"). 


See more on https://sonarcloud.io/project/issues?id=CIRISAI_ScoutGUI&issues=AaGPJAcTE-Km-bl-u_QV&open=AaGPJAcTE-Km-bl-u_QV&pullRequest=1
<path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/>
<path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/>
<path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/>
Expand All @@ -117,7 +120,7 @@
);
case "discord":
return (
<svg className="w-5 h-5" viewBox="0 0 24 24" fill="#5865F2">

Check warning on line 123 in apps/agui/app/login/page.tsx

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This <svg> lacks an accessible name; add a "title" child, "aria-label", or "aria-labelledby", or mark it as decorative (e.g. aria-hidden or role="presentation"). 


See more on https://sonarcloud.io/project/issues?id=CIRISAI_ScoutGUI&issues=AaGPJAcTE-Km-bl-u_QW&open=AaGPJAcTE-Km-bl-u_QW&pullRequest=1
<path d="M20.317 4.37a19.791 19.791 0 0 0-4.885-1.515a.074.074 0 0 0-.079.037c-.21.375-.444.864-.608 1.25a18.27 18.27 0 0 0-5.487 0a12.64 12.64 0 0 0-.617-1.25a.077.077 0 0 0-.079-.037A19.736 19.736 0 0 0 3.677 4.37a.07.07 0 0 0-.032.027C.533 9.046-.32 13.58.099 18.057a.082.082 0 0 0 .031.057a19.9 19.9 0 0 0 5.993 3.03a.078.078 0 0 0 .084-.028a14.09 14.09 0 0 0 1.226-1.994a.076.076 0 0 0-.041-.106a13.107 13.107 0 0 1-1.872-.892a.077.077 0 0 1-.008-.128a10.2 10.2 0 0 0 .372-.292a.074.074 0 0 1 .077-.01c3.928 1.793 8.18 1.793 12.062 0a.074.074 0 0 1 .078.01c.12.098.246.198.373.292a.077.077 0 0 1-.006.127a12.299 12.299 0 0 1-1.873.892a.077.077 0 0 0-.041.107c.36.698.772 1.362 1.225 1.993a.076.076 0 0 0 .084.028a19.839 19.839 0 0 0 6.002-3.03a.077.077 0 0 0 .032-.054c.5-5.177-.838-9.674-3.549-13.66a.061.061 0 0 0-.031-.03zM8.02 15.33c-1.183 0-2.157-1.085-2.157-2.419c0-1.333.956-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42c0 1.333-.956 2.418-2.157 2.418zm7.975 0c-1.183 0-2.157-1.085-2.157-2.419c0-1.333.955-2.419 2.157-2.419c1.21 0 2.176 1.096 2.157 2.42c0 1.333-.946 2.418-2.157 2.418z"/>
</svg>
);
Expand Down
Loading