[ci-test] PR-D OIDC hardening — fork CI sandbox#1
Closed
MichaelUray wants to merge 4 commits into
Closed
Conversation
MichaelUray
force-pushed
the
ci-test/wac-pr-d-oidc-hardening
branch
2 times, most recently
from
June 23, 2026 06:40
0265db9 to
7d8bd26
Compare
Signed-off-by: Denis Bykhov <bykhov.denis@gmail.com>
…500) Production-blocking: every OIDC callback (bogus or real code) returned 500 Internal Server Error, even with valid sessions. No log was emitted between `try auth via openid` and the 500 — passport strategy threw silently before `handleProviderAuth` could log. Per Codex plan-review amendments: - Switch to explicit-callback passport.authenticate variant so strategy errors surface as err/info/status args instead of being swallowed. - Privacy-safe diagnostic shape (no raw code/state/tokens/user). Fields: stage, errMessage/Name/Stack, hasUser, infoSummary, statusCode, hasSession + sessionKeys (names only), cookie + state + code PRESENCE (lengths only), host, forwardedProto. - Permanent invalid-callback guard: ALL failures → 302 to /login with ?error=oidc_callback_failed, never 500. Same wrap covers handleProviderAuth throws. Image-tag: hardcoreeng/account:integration-wac-2026-06-21-codex-r7. Next step (P0-T2): user attempts login, we capture the actual error from the diagnostic, then ship a surgical fix in r8. Signed-off-by: Michael Uray <michael.uray@gmail.com> Signed-off-by: Michael Uray <michaeluray@users.noreply.github.com>
Codex plan-review Critical: server/account/src/admin.ts:15-18 built the ADMIN_EMAILS set without normalizing, AND isAdminEmail() didn't normalize the input. Today value is clean so isAdmin works, but a future env-value like ADMIN_EMAILS=" Michael@Uray.io " would silently break admin detection (Set lookup would miss the lowercased input). Mongo backend already has this hardening (collections/mongo.ts:1141-1147). Postgres + this helper didn't. Now BOTH sides normalize: env split -> trim -> toLowerCase -> filter non-empty + warn on no-@ entries (Codex Optional: warn not reject -- too sharp for a latent fix). Lookup also trim().toLowerCase(). Standalone upstream-PR-able per Codex Q-I3. Tests cover whitespace, case-insensitive env, case-insensitive lookup, invalid-shape warn, empty/unset env, multi-entry. Signed-off-by: Michael Uray <michael.uray@gmail.com> Signed-off-by: Michael Uray <michaeluray@users.noreply.github.com>
MichaelUray
force-pushed
the
ci-test/wac-pr-d-oidc-hardening
branch
from
June 25, 2026 19:58
7d8bd26 to
e1280f7
Compare
…amendment) Codex E4 amendment (optional, low-priority): hasCookieHeader is sufficient to diagnose missing session-cookie issues; the cookieHeaderLen byte count adds no operational value and is one more PII-adjacent surface to keep an eye on. Drop it from both diagnostic paths in pods/authProviders/src/openid.ts. Signed-off-by: Michael Uray <michael.uray@gmail.com> Signed-off-by: Michael Uray <michaeluray@users.noreply.github.com>
MichaelUray
force-pushed
the
ci-test/wac-pr-d-oidc-hardening
branch
from
June 25, 2026 21:42
e1280f7 to
bc55078
Compare
Owner
Author
|
CI sandbox complete. Upstream PR opened: hcengineering/platform#10931 |
MichaelUray
pushed a commit
that referenced
this pull request
Jul 9, 2026
Chore: use fixed versions in update-deps
MichaelUray
pushed a commit
that referenced
this pull request
Jul 9, 2026
feat: adjust hulylake client for storage adapter
MichaelUray
pushed a commit
that referenced
this pull request
Jul 9, 2026
Refactoring: typing, comments-into-names changes.
MichaelUray
pushed a commit
that referenced
this pull request
Jul 9, 2026
Refactor http handlers, extract supporting logic, remove magic constants
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fork-internal PR for CI testing only. Not for merge. Tracks upstream candidate
feat/oidc-hardeningfor hcengineering/platform. 3 commits.