[APPS] Add OAuth auth for Apps by otorrillas · Pull Request #393 · DataDog/build-plugins

otorrillas · 2026-06-02T06:52:29Z

Summary

Depends on #421.

Adds OAuth support for Datadog Apps while keeping the optional dependency integrity support in its own PR:

adds the core OAuth PKCE token flow and optional keychain cache
adds oauth-request.ts, which owns OAuth token resolution and doOAuthRequest
extends doRequest to accept request-ready auth via API/app keys or an already resolved OAuth access token
adds Apps-scoped auth selection via apps.authOverrides.method and DD_APPS_AUTH_METHOD / DATADOG_APPS_AUTH_METHOD, defaulting to API-key auth
wires OAuth auth into Apps uploads and the Apps Vite dev-server execution path
keeps oauth4webapi as a regular dependency and @napi-rs/keyring as an optional dependency

Validation

yarn workspace @dd/tests test:unit packages/core/src/helpers/request.test.ts packages/core/src/helpers/oauth-request.test.ts packages/plugins/error-tracking/src/sourcemaps/sender.test.ts packages/plugins/apps/src/auth.test.ts packages/plugins/apps/src/upload.test.ts packages/plugins/apps/src/index.test.ts packages/plugins/apps/src/validate.test.ts packages/plugins/apps/src/vite/dev-server.test.ts packages/plugins/apps/src/vite/index.test.ts
yarn cli integrity
git diff --check

datadog-prod-us1-4 · 2026-06-02T06:53:36Z

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 4cfb545 | Docs | Datadog PR Page | Give us feedback!}

yoannmoinet

Doing a quick review first, to tackle my biggest comments 😃

sdkennedy2 · 2026-06-11T19:31:33Z

    "dependencies": {
        "@datadog/js-instrumentation-wasm": "1.0.8",
        "@jridgewell/remapping": "2.3.5",
+        "@napi-rs/keyring": "1.3.0",


If these are in the core package do we need these as dependencies within all the build specific plugins (esbuild-plugin, rollup-plugin, etc)

Yeah, I think we still need them here. The published packages bundle the internal @dd/* packages rather than depending on @dd/core at runtime, and the integrity dependency sync flattens external deps from internal workspaces into each published package. Since the OAuth helper in core dynamically loads oauth4webapi and @napi-rs/keyring, the published packages need to declare them so they’re installed for consumers.

This is pretty bad.
We need to find a way to make this optional only.

sdkennedy2 · 2026-06-11T20:07:43Z

@codex review
@cursor review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 703d88302a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

yoannmoinet · 2026-06-12T21:15:50Z

+const OAUTH_PACKAGE_NAME = 'oauth4webapi';
+const KEYRING_PACKAGE_NAME = '@napi-rs/keyring';
+
+type OAuthAuthorizationServer = import('oauth4webapi').AuthorizationServer;
+type OAuthClient = import('oauth4webapi').Client;
+type OAuthModule = typeof import('oauth4webapi');
+type OAuthTokenEndpointResponse = import('oauth4webapi').TokenEndpointResponse;
+type KeyringModule = typeof import('@napi-rs/keyring');
+
+// Load through a variable specifier so bundlers leave these as runtime requires
+// instead of inlining them — notably the native `@napi-rs/keyring` binary. Node
+// caches modules by specifier, so repeated calls reuse the same instance.
+const loadOauth = () => import(OAUTH_PACKAGE_NAME) as Promise<OAuthModule>;
+const loadKeyring = () => import(KEYRING_PACKAGE_NAME) as Promise<KeyringModule>;


Why do we do this if the dependency is required in all the package.json?

yoannmoinet · 2026-06-12T21:23:11Z

        return { errors, warnings };
    }

+    if (!requestAuth) {


Shouldn't this be reflected on the type instead?

yoannmoinet · 2026-06-12T21:30:39Z

+auth?: {
+    apiKey?: string;
+    appKey?: string;
+    site?: string;
+}
+


This will break the root README once included in it.
Because we copy this ## Configuration block into the global configuration block of the root.

yoannmoinet · 2026-06-12T21:31:55Z

+
+> default: `apiKey`
+
+Authentication method for uploading app bundles. Scoped to the `apps` plugin rather than the shared `auth` config, because not every Datadog endpoint supports OAuth.


Not sure this is a necessary detail...

Suggested change

Authentication method for uploading app bundles. Scoped to the `apps` plugin rather than the shared `auth` config, because not every Datadog endpoint supports OAuth.

Authentication method for uploading app bundles.

yoannmoinet · 2026-06-12T21:36:05Z

+    const { AsyncEntry } = await loadKeyring();
+    return new AsyncEntry(OAUTH_KEYCHAIN_SERVICE, getOAuthCredentialAccount(site, options));


What is keyring necessary for?
No alternative?

yoannmoinet · 2026-06-12T21:49:51Z

    "dependencies": {
        "@datadog/js-instrumentation-wasm": "1.0.8",
        "@jridgewell/remapping": "2.3.5",
+        "@napi-rs/keyring": "1.3.0",


This is pretty bad.
We need to find a way to make this optional only.

sdkennedy2 · 2026-06-16T16:52:34Z

    return { errors, dependencies };
 };

+type DependencyType = 'dependencies' | 'optionalDependencies';


Would it be worth separating out optionalDependencies integrity support into a separate PR?

sdkennedy2 · 2026-06-16T21:20:23Z

    viteBuild: typeof build,
    getBackendFunctions: () => BackendFunction[],
    auth: AuthOptionsWithDefaults,
+    authMethod: AuthMethod,


Couldn't we just thread through doAuthenticatedRequest like we do in other places?

sdkennedy2 · 2026-06-16T21:22:46Z

+                : getAuthenticatedRequest(options.authOverrides.method, auth, log)) ||
+            doMissingAuthenticationRequest;


I wonder if getAuthenticatedRequest should just throw if we are missing auth information. We probably need to differentiate between a 500 and 400 error in some cases, perhaps we should create error classes.

sdkennedy2 · 2026-06-16T21:36:18Z

    func: BackendFunction,
    args: unknown[],
-    auth: AuthConfig,
+    site: Site,


It looks like we missed some places. We were support to revert site: Site, changes back to auth: AuthConfig,

otorrillas requested review from a team and yoannmoinet as code owners June 2, 2026 06:52

otorrillas force-pushed the oriol.torrillas/apps-oauth-pkce-upload branch 4 times, most recently from 53ad0e4 to 490c3f3 Compare June 2, 2026 08:22

yoannmoinet reviewed Jun 2, 2026

View reviewed changes

Comment thread packages/core/src/helpers/oauth-request.ts

Comment thread packages/core/src/types.ts Outdated

Comment thread packages/core/src/types.ts Outdated

Comment thread packages/plugins/apps/src/vite/dev-server.ts Outdated

sdkennedy2 changed the title ~~Add OAuth PKCE auth for Apps uploads~~ [APPS] Add OAuth PKCE auth for Apps uploads Jun 11, 2026

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/core/src/helpers/request.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/vite/handle-upload.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/index.test.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/types.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/upload.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/validate.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/plugins/apps/README.md Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/core/src/helpers/oauth.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/core/src/helpers/request.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/core/src/helpers/oauth.ts Outdated

sdkennedy2 reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/upload.ts Outdated

chatgpt-codex-connector Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/core/src/helpers/oauth.ts Outdated

sdkennedy2 mentioned this pull request Jun 12, 2026

[APPS] Add OAuth auth for Apps dev server #413

Closed

yoannmoinet reviewed Jun 12, 2026

View reviewed changes

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/core/src/helpers/request.ts Outdated

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/core/src/helpers/request.ts

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/core/src/helpers/request.ts Outdated

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/core/src/types.ts Outdated

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/core/package.json

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/auth.ts

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/auth.ts Outdated

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Comment thread packages/plugins/apps/src/upload.ts Outdated

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

sdkennedy2 force-pushed the oriol.torrillas/apps-oauth-pkce-upload branch 2 times, most recently from b2ac87c to 2cc5df7 Compare June 16, 2026 18:22

sdkennedy2 changed the title ~~[APPS] Add OAuth PKCE auth for Apps uploads~~ [CORE] Add OAuth request helpers Jun 16, 2026

sdkennedy2 changed the base branch from master to codex/optional-deps-integrity June 16, 2026 18:22

sdkennedy2 mentioned this pull request Jun 16, 2026

[APPS] Add OAuth auth for Apps uploads #422

Closed

sdkennedy2 force-pushed the oriol.torrillas/apps-oauth-pkce-upload branch 2 times, most recently from bdeb952 to fb3a06d Compare June 16, 2026 21:05

sdkennedy2 changed the title ~~[CORE] Add OAuth request helpers~~ [APPS] Add OAuth auth for Apps Jun 16, 2026

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

sdkennedy2 force-pushed the oriol.torrillas/apps-oauth-pkce-upload branch 3 times, most recently from 2e23fc6 to e467ffc Compare June 16, 2026 21:33

sdkennedy2 reviewed Jun 16, 2026

View reviewed changes

Add OAuth auth for Apps

4cfb545

sdkennedy2 force-pushed the oriol.torrillas/apps-oauth-pkce-upload branch from e467ffc to 4cfb545 Compare June 16, 2026 21:38


		> default: `apiKey`

		Authentication method for uploading app bundles. Scoped to the `apps` plugin rather than the shared `auth` config, because not every Datadog endpoint supports OAuth.

		const { AsyncEntry } = await loadKeyring();
		return new AsyncEntry(OAUTH_KEYCHAIN_SERVICE, getOAuthCredentialAccount(site, options));

		: getAuthenticatedRequest(options.authOverrides.method, auth, log)) \|\|
		doMissingAuthenticationRequest;

Conversation

otorrillas commented Jun 2, 2026 • edited by sdkennedy2 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

datadog-prod-us1-4 Bot commented Jun 2, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yoannmoinet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sdkennedy2 commented Jun 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

otorrillas commented Jun 2, 2026 •

edited by sdkennedy2

Loading

datadog-prod-us1-4 Bot commented Jun 2, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading