OAuth follow-ups: DCR off by default on 2.38, unnoticed nightly scope failures, CLI inheriting CODER_SESSION_TOKEN
維護者通常 2 天內回覆
評估
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 新手友好度
- 68/100
- Issue 類型
- 缺陷
- 描述清晰度
- 描述清楚
- 活躍度
- 活躍
- 技術堆疊
- node.js, typescript
研究方向
Three independent follow-ups; pick one and scope it explicitly. For item 3, start at runCliCommand in src/api/workspace.ts and the spawn sites in src/core/cliExec.ts, and find where the CLI is handed process.env; done means CODER_SESSION_TOKEN (and other CODER_* auth vars) never reach the child process and the live suite still passes. For item 2, read .github/workflows/oauth-scopes.yaml and make a failed scheduled run open or comment on a tracking issue; for item 1, trace the OAuth registration failure path in the extension's sign-in flow so the 403 names dynamic_client_registration_enabled and falls back to session-token sign-in.
由索引模型根據 Issue 內容生成。
描述
Follow-ups found while fixing OAuth scopes (#1138) and adding the live scope suite (#1128).
1. OAuth sign-in fails on 2.38+ unless an admin enables dynamic client registration
On release/2.38 and main, dynamic client registration (DCR) is a runtime setting that is off by default. Admins turn it on with PUT /api/v2/oauth2-provider/settings and {"dynamic_client_registration_enabled": true}.
Discovery (/.well-known/oauth-authorization-server) still lists registration_endpoint, so the extension offers OAuth. Then POST /oauth2/register fails with 403 invalid_request: Dynamic client registration is disabled on this deployment, and sign-in fails with no hint at the cause.
Proposed: when registration is refused, show an error naming the setting, and fall back to session-token sign-in.
2. Nightly scope-suite failures notify almost no one
.github/workflows/oauth-scopes.yaml runs nightly against ghcr.io/coder/coder-preview:latest to catch server-side changes before they ship, such as new OAuth or DCR requirements, or a changed scope or permission. GitHub emails a failed scheduled run only to the user who last edited the cron line, so a failure can go unnoticed.
Proposed: when a scheduled run fails, open or update a tracking issue (for example with gh issue create, or by commenting on an existing issue).
3. CLI calls inherit the extension host's environment, including CODER_SESSION_TOKEN
Every CLI call spawns the binary with the full process.env:
runCliCommandinsrc/api/workspace.ts(coder start,coder update)src/core/cliExec.ts(speedtest,support bundle,ping)
The CLI prefers CODER_SESSION_TOKEN over the session the extension stores, whether in the --global-config directory or the keyring. If the extension host's environment has that variable, as it does inside some Coder workspaces, these commands run with that token instead of the user's session. They then fail with 401 You are signed out, or act as a different user. The live suite hit this when run from a Coder workspace and now unsets the variable.
The SSH ProxyCommand that Remote-SSH spawns may be affected the same way (not verified).
Proposed: pass the CLI an environment without CODER_SESSION_TOKEN, and probably without other CODER_* auth variables, since the extension already passes --url and the stored session explicitly.
- 主要語言
- TypeScript
- 星號
- 132
- 分支
- 48
- 平均合併
- 1 天 17 小時
- 30 天內合併 PR
- 24
環境準備
在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
coder/vscode-coder 的其他 Issue
-
難度 3/5 1-2 天 新手友好度 55/100
coder/vscode-coder#1159 · 2 則留言 ·
維護者通常 2 天內回覆
-
ReconnectingWebSocket drops messages the server sends right after the handshake可能已有人在做 @EhabY 於 15 天前認領。 未關閉bug vs-code
難度 3/5 1-2 天 新手友好度 72/100
coder/vscode-coder#1141 · 1 則留言 · 已指派 1 人 ·
維護者通常 2 天內回覆
-
Split commands.ts by topic可能已有人在做 @EhabY 於 15 天前認領。 未關閉Improvement tech-debt vs-code
難度 4/5 3-5 天 新手友好度 48/100
coder/vscode-coder#1135 · 1 則留言 · 已指派 1 人 ·
維護者通常 2 天內回覆
-
Design the VS Code Workspaces panel可能重新可做 @chrifro 於 42 天前認領，目前沒有進行中的 PR。 未關閉
coder/vscode-coder#1113 · 3 則留言 · 已指派 1 人 ·
維護者通常 2 天內回覆
-
bug upstream
難度 4/5 3-5 天 新手友好度 42/100
coder/vscode-coder#1087 · 1 則留言 ·
維護者通常 2 天內回覆
查看 coder/vscode-coder 的全部 Issue
相似的 Issue
-
category::task code priority::normal
難度 2/5 1-3 小時 新手友好度 78/100
e0ipso/strikethroo#145 ·
維護者通常 1 天內回覆
-
難度 1/5 1-3 小時 新手友好度 85/100
cocos/cocos-docs#3333 ·
-
bug
難度 2/5 1-3 小時 新手友好度 75/100
RevenueCat/react-native-purchases#2079 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 78/100
RevenueCat/purchases-hybrid-common#2039 ·
維護者通常 1 天內回覆
-
agent-reported area/react bug
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆