feat!: support oauth authorization code flow (#906) by frano-m · Pull Request #905 · DataBiosphere/findable-ui

frano-m · 2026-05-01T08:09:32Z

Summary

Add Google authorization code flow as an opt-in alternative to the existing implicit token flow on service.login
New optional authorize?: string field on OAuthProvider — when set, initCodeClient + requestCode() is used and the resulting code is POSTed to that URL to exchange for an access token; when unset, the existing initTokenClient + requestAccessToken() flow is preserved
Initial commit applies @hannes-ucsc's POC verbatim (URL hardcoded); follow-up commit factors out the access-token handling and makes the authorize URL configurable

Closes #906. Refs DataBiosphere/data-browser#4793. Companion PR in data-browser wires this up for the anvil-cmg/dev site.

Test plan

npm run check-format clean
npm run lint clean
npm run test-compile clean
npm test — 47 suites, 389 tests pass (includes new googleService.test.ts covering both branches)
Manually verified end-to-end against anvildev via tarball install in data-browser: login (POST /user/authorize returns tokens, profile loads), logout, inactivity timeout, Terra checks

based on poc patches in DataBiosphere/data-browser#4793. url hardcoded as in the original; subsequent commit makes it configurable. Co-authored-by: hannes-ucsc <hannes-ucsc@users.noreply.github.com> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

introduce optional `authorize` field on oauthprovider; service.login uses initcodeclient + requestcode when set and falls back to the existing inittokenclient + requestaccesstoken implicit flow when unset. add unit tests covering both branches. refs DataBiosphere/data-browser#4793 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds an opt-in Google OAuth authorization code flow to the existing Google sign-in service, allowing consumers of @databiosphere/findable-ui to exchange an auth code for tokens via a configurable backend endpoint while preserving the current implicit token flow as the default.

Changes:

Introduces OAuthProvider.authorize?: string to toggle between code flow (code exchange via POST) and implicit token flow.
Updates Google login service to use initCodeClient + requestCode() when authorize is set, and factors token handling into a shared path.
Adds unit tests to validate branching between code flow and implicit flow.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
`src/config/entities.ts`	Adds optional `authorize` endpoint to the OAuth provider config to enable code flow.
`src/google/types.ts`	Introduces a `CodeResponse` interface for the Google auth code callback payload shape.
`src/google/service.ts`	Implements the new code-flow branch with backend token exchange and shared access-token handling.
`tests/googleService.test.ts`	Adds tests asserting correct client initialization based on presence/absence of `provider.authorize`.

per copilot review on #905: - catch network errors, non-ok responses, and missing access_token in the authorize exchange; reset auth/token state on failure so login no longer hangs - extract resetSession helper now that the reset is reused by both the fetchprofile error path and the new authorize catch - add tests covering successful exchange (POST + updateToken dispatch), non-ok response, and missing access_token Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds opt-in support for OAuth 2.0 authorization code flow to the Google sign-in service in @databiosphere/findable-ui, enabling clients (e.g., Data Browser) to exchange Google auth codes server-side for access tokens while preserving the existing implicit token flow as the default.

Changes:

Added authorize?: string to OAuthProvider to configure a backend code-exchange endpoint.
Updated Google service.login to use initCodeClient + requestCode() and POST the CodeResponse to authorize when configured; otherwise keep initTokenClient + requestAccessToken().
Added Jest coverage for both flows and success/failure cases of the code-exchange request.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
tests/googleService.test.ts	Adds test coverage for code flow vs implicit flow selection and for code-exchange success/failure behaviors.
src/google/types.ts	Introduces `CodeResponse` type used by the auth code callback path.
src/google/service.ts	Implements the opt-in auth code flow and factors shared token/profile handling into helpers.
src/config/entities.ts	Extends `OAuthProvider` with optional `authorize` URL for backend token exchange.

google's oauth code-flow callback returns either a success payload (code, scope, state) or an error payload (error, error_description, error_uri, state) — required strings on every field misrepresent the contract. trim the test fixture down to the only field we actually populate. Closes #907 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ode flow (#906) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

select the oauth flow via an explicit `flow` field on the provider config instead of inferring it from `authorize` truthiness. oauthprovider is now a discriminated union of implicitflowprovider | authorizationcodeflowprovider, so misconfiguration (auth code flow without an authorize url) is a type error rather than a silent fallback to implicit. drops the `as string` cast on authorize. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

per copilot review on #905: deleting globalThis.fetch in afterEach permanently removes node 18+'s built-in fetch for any later tests in the same worker, risking order-dependent failures. snapshot the original in beforeEach and restore (or delete only if it wasn't there) in afterEach. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

+    fetchProfile(userinfo, getAuthenticationRequestOptions(token), {
+      onError: resetSession,
+      onSuccess: (r: GoogleProfile) =>
+        dispatch.authenticationDispatch?.(
+          updateAuthentication({


+    callback: (response: TokenSetParameters) =>
+      onAccessToken(response.access_token),


frano-m and others added 2 commits May 1, 2026 17:44

Copilot AI review requested due to automatic review settings May 1, 2026 08:09

frano-m assigned NoopDog May 1, 2026

Copilot started reviewing on behalf of frano-m May 1, 2026 08:10 View session

frano-m mentioned this pull request May 1, 2026

feat: implement authorization code flow with azul and data browser (#4793) DataBiosphere/data-browser#4796

Merged

6 tasks

frano-m assigned hannes-ucsc May 1, 2026

frano-m marked this pull request as ready for review May 1, 2026 08:11

frano-m marked this pull request as draft May 1, 2026 08:11

Copilot AI reviewed May 1, 2026

View reviewed changes

Comment thread src/google/service.ts Outdated

Comment thread src/google/service.ts Outdated

Comment thread src/google/types.ts Outdated

Comment thread tests/googleService.test.ts Outdated

frano-m changed the title ~~feat: support oauth authorization code flow~~ feat: support oauth authorization code flow (#906) May 1, 2026

frano-m mentioned this pull request May 1, 2026

Tighten CodeResponse types for OAuth error vs success cases #907

Closed

frano-m marked this pull request as ready for review May 1, 2026 10:30

Copilot AI review requested due to automatic review settings May 1, 2026 10:30

Copilot started reviewing on behalf of frano-m May 1, 2026 10:31 View session

Copilot AI reviewed May 1, 2026

View reviewed changes

frano-m mentioned this pull request May 1, 2026

refactor: make codeResponse fields optional (#907) #908

Merged

4 tasks

refactor: split google service into implicit flow and authorization c…

ace57fa

…ode flow (#906) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings May 5, 2026 03:27

Copilot started reviewing on behalf of frano-m May 5, 2026 03:28 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread src/google/services/authorizationCodeFlow.ts Outdated

Comment thread tests/googleService.test.ts

frano-m requested a review from Copilot May 5, 2026 04:12

Copilot started reviewing on behalf of frano-m May 5, 2026 04:12 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread src/google/services/authorizationCodeFlow.ts

Comment thread src/google/services/authorizationCodeFlow.ts

Comment thread src/google/services/implicitFlow.ts

Comment thread src/google/service.ts

Comment thread src/google/services/common.ts

frano-m changed the title ~~feat: support oauth authorization code flow (#906)~~ feat!: support oauth authorization code flow (#906) May 5, 2026

frano-m requested a review from Copilot May 5, 2026 04:29

NoopDog approved these changes May 5, 2026

View reviewed changes

NoopDog merged commit 86e57b5 into main May 5, 2026
4 checks passed

Copilot started reviewing on behalf of frano-m May 5, 2026 04:30 View session

github-actions Bot mentioned this pull request Apr 30, 2026

chore(main): release 52.0.0 #904

Merged

Copilot AI reviewed May 5, 2026

View reviewed changes

frano-m deleted the fran/4793-authorization-code-flow branch May 5, 2026 07:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat!: support oauth authorization code flow (#906)#905

feat!: support oauth authorization code flow (#906)#905
NoopDog merged 7 commits into
mainfrom
fran/4793-authorization-code-flow

frano-m commented May 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		callback: (response: TokenSetParameters) =>
		onAccessToken(response.access_token),

Conversation

frano-m commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

frano-m commented May 1, 2026 •

edited

Loading