GameCult/Heimdall
Watch
9
0
Fork
You've already forked Heimdall
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

OAuth start: connect keeps admitting identity providers, as Bifrost uses it

Browse source 
The first gate refused connect for a provider outside managedConnectionProviders,
which broke Bifrost's existing Discord connect. sign_in and link still take
identityProviders only, so a managed-only provider (Joystick) can never sign
anyone in or link; connect takes either list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-10-19 12:38:13 +02:00
commit c1fbc1261a
3 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

7
tests/app.test.ts
View file

@ -2023,7 +2023,7 @@ describe("OAuth start admits a provider by the profile's role for the mode", ()
const allProviders = ["discord", "patreon", "github", "twitch", "youtube", "spotify", "joystick"] as const;
const modes = ["sign_in", "link", "connect"] as const;
it("sign_in and link take identityProviders only; connect takes managedConnectionProviders only, for every profile", async () => {
it("sign_in and link take identityProviders only; connect takes managedConnectionProviders or identityProviders, for every profile", async () => {
const app = await buildApp({ config: createTestConfig() });
try {
for (const profile of Object.values(builtInAppProfiles)) {
@ -2034,7 +2034,10 @@ describe("OAuth start admits a provider by the profile's role for the mode", ()
url: `/v1/oauth/${provider}/start`,
payload: { appSlug: profile.slug, mode, returnTo: `${profile.allowedReturnOrigins[0]}/x` },
});
const roleList = mode === "connect" ? profile.managedConnectionProviders : profile.identityProviders;
const roleList =
mode === "connect"
? [...profile.managedConnectionProviders, ...profile.identityProviders]
: profile.identityProviders;
const refused = start.json().error === "provider_not_supported_for_app";
expect([profile.slug, provider, mode, refused]).toEqual([profile.slug, provider, mode, !roleList.includes(provider)]);
}