Chris Coutinho and Claude Opus 4.5
1cc460b0d8
fix(astrolabe): Address reviewer feedback for hybrid mode
...
Addresses code review feedback:
Personal.php:
- Consolidate template variables to use camelCase consistently
- Remove duplicate snake_case variables (auth_mode, supports_app_passwords)
- Add oauthUrl to standard OAuth mode parameters (fixes fallback issue)
- Add requesttoken for CSRF protection
personal.php (template):
- Use null coalescing for safe variable access
- Reuse computed $isHybridMode variable instead of duplicate check
- Remove complex fallback URL logic (oauthUrl now always provided)
IdpTokenRefresher.php:
- Use Nextcloud's overwrite.cli.url config when available
- Fall back to http://localhost for container deployments
- Better supports non-containerized environments
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-16 10:44:52 +01:00
Chris Coutinho and Claude Opus 4.5
c95459234b
fix(astrolabe): fix OAuth flow and settings UI for hybrid mode
...
In hybrid mode (multi_user_basic + offline_access), users need BOTH:
- OAuth token for Astrolabe→MCP API calls
- App password for MCP→Nextcloud background sync
Changes:
- Personal.php: Pass correct oauthUrl pointing to Astrolabe's OAuth
controller instead of MCP server's browser OAuth. Check both OAuth
token AND app password status in hybrid mode.
- personal.php template: Show two-step workflow UI requiring both
credentials before showing "Active" status. Each step shows
completion badges.
- IdpTokenRefresher.php: Use http://localhost for internal token
refresh requests (consistent with OAuthController). External URLs
like localhost:8080 don't work from inside the container.
Fixes 401 errors when searching in Astrolabe with hybrid deployment.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-15 16:14:00 +01:00
Chris Coutinho and Claude Sonnet 4.5
daabd90359
fix(security): address critical security issues from PR #401 code review
...
Implemented 6 critical security fixes identified during PR #401 review:
1. Token Rotation Race Condition (Issue 1)
- Added in-progress marker pattern to prevent concurrent refresh
- Prevents token invalidation when multiple requests refresh simultaneously
- File: token_broker.py:324, 343-390
2. Hardcoded Localhost URL (Issue 2)
- Added getNextcloudBaseUrl() with fallback chain
- Supports overwrite.cli.url, trusted_domains, and localhost fallback
- File: IdpTokenRefresher.php:38-61, 116
3. Error Information Leakage (Issue 3)
- Replaced 13 instances of str(e) with sanitized errors
- Prevents exposure of stack traces, paths, and tokens
- File: management.py:368, 444, 492, 510, 546, 571, 625, 643, 695, 750, 919, 956, 1121
4. Input Validation Gaps (Issue 4)
- Added validation helpers: _parse_int_param, _parse_float_param, _validate_query_string
- Applied bounds checking to get_chunk_context and unified_search
- File: management.py:119-164, 807-835, 1197-1212
5. PHP Refresh Token Validation (Issue 5)
- Added explicit refresh_token presence check
- Prevents silent token rotation failures
- File: IdpTokenRefresher.php:122-132
6. Cookie Security Configuration (Issue 6)
- Added _should_use_secure_cookies() with auto-detection
- Supports explicit COOKIE_SECURE env var or auto-detect from NEXTCLOUD_HOST
- Files: browser_oauth_routes.py:27-44, 470; env.sample:54-57
Testing:
- Unit tests: 195 passed
- Integration tests: 102 passed, 4 skipped
- OAuth tests: 9 passed
- All linting and type checks passed
Follow-up work tracked in issues #408-#417
🤖 Generated with [Claude Code](https://claude.com/claude-code )
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com >
2025-12-19 13:57:33 +01:00
