Fix Google consent: clientId pinning, tokenless-reconnect probe, read-only scope pin - #9
Merged
Merged
Conversation
The stock DO OAuth provider only learns its clientId from dynamic registration — which Google never does — and its clientId getter throws when unset, killing the authorization leg inside saveCodeVerifier before any consent URL existed. GoogleOAuthProvider now pins the pre-registered clientId in its constructor. Two more holes closed: the consent probe now also runs when the desk is already connected but tokenless (a connection left over from an earlier visit skipped the probe entirely), and the authorize URL's scope is pinned to the read-only trio — the SDK was deriving scopes from Google's resource metadata, which advertises write scopes. Verified with the real provider class against the live endpoint: auth URL produced with the three read-only scopes, access_type=offline, prompt=consent, and persisted state + verifier records for the callback. Claude-Session: https://claude.ai/code/session_01MKLJUWk6biNAKXupHTTWn5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixes verified against the live Google endpoint with the real provider class: (1) pin the pre-registered clientId — the stock provider's getter throws when unset, killing the auth leg before a consent URL existed; (2) run the consent probe even when the desk connection already exists but has no tokens; (3) pin the authorize scope to the read-only trio instead of the SDK's resource-metadata-derived list, which included write scopes.
https://claude.ai/code/session_01MKLJUWk6biNAKXupHTTWn5