feat: add token-gated manual CIBA approve/deny UI - #245
Merged
Conversation
Hosted OIDF certification has no equivalent of the local dev-mode automated_ciba_approval_url mechanism, so a CIBA module that needs a real completed flow always expires and fails once nothing calls POST /backchannel-approve. Adds -ciba-approval-ui-token, which serves a token-gated HTML form at GET/POST /ciba-approve for driving a pending auth_req_id by hand during a live hosted run. Off by default; reuses the existing approve/deny logic (extracted into backchannelHandler.decide) rather than duplicating it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
decide's own doc comment already guarantees it only ever returns a *decideError or nil; handleApprove and the new UI's submit handler were still defensively falling back to a generic 500 for a shape that guarantee rules out. Trust it directly instead, and add coverage for the one real gap that surfaced alongside it: an invalid action value through the manual approve/deny UI.
… into conformance-as/ciba-approval-ui
|
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
automated_ciba_approval_urlmechanism — locally, the suite calls this binary's own/backchannel-approveautomatically; the hosted certification UI has no such field. Without it, any CIBA module needing a real completed flow (happy-flow, refresh-token, a two-attempt module) always expires and fails once itsauth_req_id's lifetime runs out, since nothing ever calls that endpoint.-ciba-approval-ui-token=<token>, off by default, which serves a token-gated HTML form atGET/POST /ciba-approvefor driving a pendingauth_req_idby hand while watching a live hosted run — paste the ID, click Approve/Deny.POST /backchannel-approveitself stays unauthenticated by design (meant to be called automatically by the local suite); the new UI needs its own access gate to be usable as a link over the public internet, hence the token (compared withsubtle.ConstantTimeCompare; wrong/missing token → 404, not 403, so a bad guess doesn't even confirm the route exists).backchannelHandler.handleApprove's core logic (pending-set lookup, building theInteractionResult, callingCompleteBackchannelAuthentication) is extracted into a newdecidemethod so the existing JSON endpoint and the new HTML UI share one implementation instead of duplicating it.Test plan
TestValidCIBAApprovalUIToken— token comparison (match/mismatch/empty)TestCIBAApproveUIRouteNotRegisteredWhenTokenEmpty— confirms the route truly doesn't exist when the flag is unsetTestCIBAApproveFormRequiresToken— no/wrong/right token onGETTestCIBAApproveUIApprovesRealRequest/TestCIBAApproveUIDeniesRealRequest— full round trip through a realclient.BeginBackchannelAuthenticationsession, approved/denied via the new UI, confirmed viaclient.PollBackchannelAuthentication(a real issued token, or a real denial)TestCIBAApproveUIUnknownAuthReqID— error rendering, not a panicTestCIBAApproveUISubmitRequiresToken— a wrong-token POST is a true no-op (the same request is still approvable afterward with the right token)go build ./...,go vet ./cmd/conformance-as/...,gofmt -l cmd/conformance-asall cleango test ./cmd/conformance-as/...and fullgo test ./...both pass🤖 Generated with Claude Code
https://claude.ai/code/session_01KWEP7ddZm9T8pVotywwFfF