Repository navigation
fix(oauth): let a brand-new user connect an MCP client by signing up in the UI - #719
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t org (fclairamb/solidping-business#35) A new account sent to /login by an MCP client landed on /no-org (it has no org) and the pending /api/v1/oauth/authorize request was lost: creating the org opened its dashboard, never the consent screen. resolveHandoffLanding (web/dash0/src/lib/auth-handoff.ts) and the login page's two /no-org branches dropped returnTo. They now carry it through orgCreationReturnTo, which keeps only the authorize request or device approval (unwrapping the login page a federated sign-in hands back), and CreateOrgCard resumes it once POST /api/v1/orgs has set the new org's session cookie. Tests: auth-handoff, login-destination and create-org-card unit tests; the handoff one fails without the fix. Closes fclairamb/solidping-business#35 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…oin trap Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…mcp-new-user-signup
…in the UI A person with no SolidPing account sent to /api/v1/oauth/authorize by an MCP client could not get back to the client by signing up: - the login page's "Create an account" link, the register page, the register API, the email confirmation and the confirm page all dropped the pending authorize request; - an org-less session hitting authorize was redirected to /d/orgs//oauth/consent (empty slug), and approving looked up the org "" and answered 500. Authorize now resolves the consent org from a live membership (super admins bypass), not the claim alone. A user with no org at all goes to /d/no-org?returnTo=<authorize>, which the org-creation form already resumes (orgCreationReturnTo); one whose session names an org they left but who has another goes back through the login bounce. ApproveAuthorize refuses such a session with 403 FORBIDDEN. POST /auth/register accepts an optional returnTo, kept in the pending registration only when it is the authorize endpoint or the device approval page as a same-origin relative path (pendingFlowReturnTo), and confirm-registration returns it: the confirmation opens in a new tab, so the value has to travel server-side. The dashboard forwards it from the login link to the register page (and its provider buttons), sends it with the sign-up, and resumes it after confirmation, through /no-org when the account has no org. Tests: oauth unit tests for the org-less and stale-org sessions on both authorize legs; auth tests for the returnTo allowlist and its round trip through register/confirm; an HTTP walk-through (register client, authorize, sign up, confirm, /no-org bounce, create org, consent, approve, token, MCP create_check) on the real router; Playwright specs for a brand-new password user (confirmation in a fresh browser context) and for a signed-in user without an org. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…and on /no-org Wired at password login, registration confirmation and provider logins. Skipped when an invitation, a registration email pattern or a pending membership request may still give the user an org. The test user seed keeps users org-less by default (decoy pending request) unless personalOrg is set. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ething to join Also adapts the e2e specs to the automatic personal org. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…no-org: create a personal org for them Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ion notes Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…no-org: create a personal org for them Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.