Rewrite sign-in, the callback and the API wrapper #124

Merged

jcoffey-dev merged 1 commits from phase3/auth into main

2026-10-19 02:10:50 +00:00

jcoffey-dev commented

2026-10-19 02:08:29 +00:00

Owner

Phase 3 of the console rewrite, part 1.

Rewritten from what they do, with new tests written first:

OAuth: discovery, PKCE, starting sign-in, the code trade and the sign-out URL
the callback, whose checks now live in services/auth/callback.ts so they can be tested
the login page and the client id lookup
the API wrapper: retries while the server is unreachable, token refresh, and one retry after a 401

Storage keys, exports and behavior are unchanged. The PKCE tests include the example from RFC 7636. The suite goes from 692 to 701 tests.

	Not upstream's	Upstream lines left	Dual headers
main	78.8%	15,730 in 69 files	57
this PR	79.7%	15,098 in 62 files	50

Sign-in check: on a local preview, a deep link survives sign-in, the sign-in uses S256, a token refresh keeps you on the page, sign-out goes back to the login page, a forged callback is refused, and there are no page errors.

Visual check: I screenshotted all 167 pages in light and dark on a local preview, plus the open menus, command palette, a dialog, a select, a combobox and toasts, and diffed them pixel by pixel against phase 2. This covers both phase 3 PRs. Nothing in the UI changed: the only differences were live data (dashboard charts and the audit log).

Typecheck, lint, i18n:check, tests, build and notice check pass locally. No new strings.

Phase 3 of the console rewrite, part 1. Rewritten from what they do, with new tests written first: - OAuth: discovery, PKCE, starting sign-in, the code trade and the sign-out URL - the callback, whose checks now live in `services/auth/callback.ts` so they can be tested - the login page and the client id lookup - the API wrapper: retries while the server is unreachable, token refresh, and one retry after a 401 Storage keys, exports and behavior are unchanged. The PKCE tests include the example from RFC 7636. The suite goes from 692 to 701 tests. | | Not upstream's | Upstream lines left | Dual headers | |---|---|---|---| | main | 78.8% | 15,730 in 69 files | 57 | | this PR | 79.7% | 15,098 in 62 files | 50 | **Sign-in check:** on a local preview, a deep link survives sign-in, the sign-in uses S256, a token refresh keeps you on the page, sign-out goes back to the login page, a forged callback is refused, and there are no page errors. **Visual check:** I screenshotted all 167 pages in light and dark on a local preview, plus the open menus, command palette, a dialog, a select, a combobox and toasts, and diffed them pixel by pixel against phase 2. This covers both phase 3 PRs. Nothing in the UI changed: the only differences were live data (dashboard charts and the audit log). Typecheck, lint, i18n:check, tests, build and notice check pass locally. No new strings.

jcoffey-dev added 1 commit 2026-10-19 02:08:29 +00:00

Rewrite sign-in, the callback and the API wrapper

ci / build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / notices (pull_request) Successful in 1m39s

Details

ci / github (pull_request) Successful in 1m50s

Details

8f01e828ac

OAuth (discovery, PKCE with S256, the redirect, the code trade, the
end-session URL), the client id, the login page, the callback and the API
wrapper are rewritten from what they do, with new tests: RFC 7636's worked
example for the challenge, the state check, refusal versus no answer on
refresh, a shared refresh, the retry after a 401.

The callback's checks move out of the page into services/auth/callback.ts,
where they are tested directly. Storage keys, the sign-in parameters,
strings and behavior are unchanged. Checked on a local server: a deep link
through sign-in, a refresh, sign-out and a forged callback.

jcoffey-dev referenced this pull request

2026-10-19 02:08:35 +00:00

Rewrite the JMAP client, the stores and the JMAP types #125

jcoffey-dev merged commit ca98175eaf into main

2026-10-19 02:10:50 +00:00

jcoffey-dev deleted branch phase3/auth

2026-10-19 02:10:50 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-admin#124