Repository navigation
Improve OAuth connections for Claude, ChatGPT, and native apps - #9
Merged
Merged
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
Support Claude and ChatGPT published client identities (CIMD) alongside dynamic registration, show a consent screen bound to the browser before Are.na sign-in, and include iss in redirects back to the client. Validate registration metadata and redirect URIs, honor public and client_secret_post authentication, bind codes to their client, and require well-formed PKCE verifiers and resource values. Scopes are validated, and the token response reports the scope Are.na granted. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Use a consent cookie per flow so starting, completing, or cancelling one sign-in no longer invalidates another in the same browser. Co-authored-by: Cursor <cursoragent@cursor.com>
A failed cache write no longer rejects a freshly fetched, valid Claude or ChatGPT metadata document. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds support for Claude and ChatGPT’s published app identities alongside automatic client registration.
Are.na continues to issue access tokens and enforce their permissions.
Evidence
Previously, published app identities were unsupported. The updated flow supports them, with regression coverage for registration, consent, callbacks, concurrent sign-ins, and caching failures.
Typecheck, 128 application tests, 8 review-policy tests, formatting, and diff checks pass. Complete sign-in flows still need testing in the supported apps.
Merge Danger
Door: Two-way. No storage migration.
Blast Radius: Connections.
Existing access tokens continue to work. Sign-ins underway during deployment may need restarting, and some existing app connections may need to be removed and added again.