Lotus CIandClaude Opus 5.5
70206d6033
CI / Build & Quality Checks (push) Skipped
CI / Secret scan (gitleaks) (push) Skipped
CI / Playwright smoke (e2e) (push) Skipped
CI / Build & Quality Checks (pull_request) Successful in 3m24s
CI / Trigger Desktop Build (pull_request) Skipped
CI / Docker image build & smoke test (pull_request) Skipped
CI / Secret scan (gitleaks) (pull_request) Successful in 10s
CI / Playwright smoke (e2e) (pull_request) Successful in 16m50s
Picks up three releases of MatrixRTC / delayed-event fixes and matrix-sdk-crypto-wasm 18.3.1 -> 18.9.0. SDK 43 moved OAuth (MSC3861) into the SDK and dropped oidc-client-ts, so the native-OAuth sign-in is ported: - login discovers the auth server via /auth_metadata, registers with OAuth2.registerClient, and keeps the PKCE verifier + device in its own sessionStorage entry keyed by `state` (single use; CSRF check); - refresh is done by the SDK (oauthClientId + onTokenRefresh); the #16 cross-tab protection is kept by a narrow guard on refresh-token grants (the SDK calls the global fetch for OAuth, not fetchFn), which serialises them with a Web Lock and adopts a sibling tab's tokens; - logout and forced logout revoke via mx.logout() (the SDK revokes at the auth server for OAuth sessions); - the callback page parsed its params on every render, re-running the single-use code exchange in a loop; parsed once now. Also: notification_type is deprecated in MSC4075 (ring in DMs, notify elsewhere when omitted), _onRTCSessionMemberUpdate -> ensureRecalculateSessionMembers, precache limit 6 -> 10 MB for the 7.8 MB crypto wasm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
38 lines
1.5 KiB
TypeScript
38 lines
1.5 KiB
TypeScript
import type { OAuthRegistrationRequest } from 'matrix-js-sdk';
|
|
import { OIDC_CALLBACK_PATH } from '../../paths';
|
|
import { getOriginBaseUrl, withOriginBaseUrl } from '../../pathUtils';
|
|
|
|
const LotusLogo = withOriginBaseUrl(getOriginBaseUrl(), '/public/res/lotus-logo.png');
|
|
|
|
/**
|
|
* Absolute URL the OIDC provider redirects back to after authorization.
|
|
*
|
|
* It MUST be a real (non-hash) path on our origin: OAuth redirect_uris cannot
|
|
* contain a fragment, and with hashRouter the app's routes live after `#`. We
|
|
* therefore always build it against the plain origin base — `getOriginBaseUrl()`
|
|
* with NO hashRouter arg returns `${origin}${BASE_URL}` (no `#`) — and App.tsx
|
|
* short-circuits this path before the router mounts.
|
|
*/
|
|
export const getOidcCallbackUrl = (): string =>
|
|
withOriginBaseUrl(getOriginBaseUrl(), OIDC_CALLBACK_PATH);
|
|
|
|
/**
|
|
* Client metadata sent during dynamic client registration.
|
|
*
|
|
* The SDK drops any URI that doesn't share `client_uri` as a common base, so
|
|
* every URI here lives under our origin base.
|
|
*/
|
|
export const getOidcClientMetadata = (): OAuthRegistrationRequest => {
|
|
// `${origin}${BASE_URL}` (with trailing slash) — the common base for all URIs.
|
|
const clientUri = getOriginBaseUrl();
|
|
return {
|
|
client_name: 'Lotus Chat',
|
|
client_uri: clientUri,
|
|
logo_uri: new URL(LotusLogo, window.location.origin).href,
|
|
application_type: 'web',
|
|
tos_uri: clientUri,
|
|
policy_uri: clientUri,
|
|
redirect_uris: [getOidcCallbackUrl()],
|
|
};
|
|
};
|