Repository navigation
Feat/git integration - #1097
Draft
ddecrulle wants to merge 16 commits into
Draft
Feat/git integration#1097ddecrulle wants to merge 16 commits into
ddecrulle wants to merge 16 commits into
Conversation
- GitProvider port with GitLab, Forgejo and GitHub adapters (ui: oauth or PAT; service: PAT, scoped-access-token or oauth), GitHub API URL derived from the provider URL - GIT_PROVIDERS env (JSON5), unsupported combinations and duplicate ids refused at startup; empty: integration disabled - OAuthAuthorization port (PKCE in a popup, callback on /git/oauth/callback intercepted in main.tsx before oidc-spa) and GitSessionStore (refresh tokens in localStorage keyed by Keycloak sub, cross tab lock) - gitProvidersManagement usecase: load, OAuth refresh with retry on 401, sign in/out, PATs and favorite in gitConfigStr, one-time migration of the former GitHub PAT - gitAccountUiController usecase for the Account > Git tab (UI not built yet) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A config with initScriptUrl or oauthClientId now says the format changed and points to the .env documentation, instead of dumping the zod issues. Also adds a "web" dev server to .claude/launch.json. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- One card per configured provider: sign in with a popup (OAuth) or a personal access token checked before being saved, sign out (with a link to the authorized applications when the provider can't revoke), favorite provider, documentation; translated in the 9 languages - When GIT_PROVIDERS is set, the former name / email / GitHub token fields are hidden: each card shows its Git identity, the favorite's is used at launch, the Onyxia (Keycloak) account fills what it doesn't give - Launcher: git context from gitProvidersManagement.getGitContext(), git.token is the favorite's PAT; scoped tokens and service OAuth fall back to the former field until phase 3 - A denied OAuth sign-in shows the provider's error_description - GitProviderCard stories; web-mock launch config Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- gitAccountUiController now has a state per card: action in progress, last error, revocation hint, token replacement mode. Its thunks never reject. - Errors are mapped in the core, including Forgejo's "a grant exists with different scope", which now gets an explicit message and a link to revoke the previous authorization on the provider. - The view computes the status, message, git identity, favorite, link to the authorized applications and which buttons are shown or disabled. - GitProviderCard only displays the view; the token being typed stays in a small form component (a secret never goes through the state). - A denied OAuth sign-in keeps the provider's error_description. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
True once at least one Git provider is connected, always true without GIT_PROVIDERS (former behavior), false when personal infos aren't injected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…forge Each connected Git provider gets its commit identity and the credentials the service can use (personal access token, or OAuth config for git-credential-oauth). The single forge fields at the root (name, email, token, credentials_cache_duration) are kept, deprecated, filled from the favorite provider. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
ddecrulle
marked this pull request as draft
October 21, 2026 13:51
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 15e151bb3e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- getGitContext puts markers in git.token and git.providers for what only exists once "Launch" is clicked: the token of a scoped-access-token provider (and its git username), the access and refresh tokens of the favorite's service OAuth authorization. The fallback to the former GitHub PAT is gone. - getServiceGitCredentials, dispatched synchronously from the click: creates the tokens (onyxia-<service name>, lifetimeDays of the config, refreshed and retried once when rejected) and authorizes the service in a popup opened before anything is awaited. No marker left: nothing created, no popup. - The launcher replaces the markers only in the values sent to the API, the form state, saved configurations and shared links never hold a secret. - Nothing is launched when the credentials can't be obtained: a dialog says why (popup blocked, authorization cancelled or denied, session expired, provider error), translated in the 9 languages. - lifetimeDays on the scoped-access-token service of the GitProvider port. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Account > Git: "Add a Git provider" (GitLab, GitHub, Forgejo), always with a
personal access token, saved only once the provider accepts it. A url
already configured is refused, the errors (token rejected, provider
unreachable e.g. Forgejo without CORS, invalid url) are shown in the dialog.
- The providers added by the user are in gitConfigStr (userProviders, absent
from what the previous versions saved), listed after the admin's, with a
"Remove" button that also removes their token.
- GIT_PROVIDERS: disallowUserToAddProviders (false by default, as for AI).
An empty GIT_PROVIDERS no longer disables the integration, the former
fields are only shown with { providers: [], disallowUserToAddProviders: true }.
Ids starting with "user:" are reserved.
- The former GitHub token is migrated to a github.com of the user when the
admin doesn't configure github.com.
- The Context gets createGitProvider instead of a fixed list of adapters, the
list is the gitProviders selector of gitProvidersManagement.
- Translated in the 9 languages, stories for the dialog and the card.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- bitbucket type, Bitbucket Cloud (https://bitbucket.org) only, accepted with personal-access-token / personal-access-token, in GIT_PROVIDERS and in the providers added by the user: Bitbucket's OAuth token endpoint requires the client secret, even for the refresh token, and doesn't enforce PKCE. - Adapter: API token as a Bearer, identity from /2.0/user and the primary confirmed email from /2.0/user/emails (same read:user:bitbucket scope), repositories from /2.0/repositories?role=member with a BBQL search, the username Bitbucket puts in the clone url removed. - GitProvider port: an optional gitUsername paired with the PAT, the git username of git.providers credentials (x-bitbucket-api-token-auth). - Add dialog: Bitbucket Cloud option, the scopes to tick on id.atlassian.com, translated in the 9 languages; .env documentation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A failed OAuth revocation is reported: signOut resolves isGrantRevoked, the card links to the authorized applications whenever the grant wasn't revoked (unsupported or failed), not only when the provider can't revoke. - The OAuth refresh request sends the redirect URI again, as GitLab's PKCE refresh flow documents. - A popup "closed" within 5s of navigating is assumed severed by a Cross-Origin-Opener-Policy header (gitlab.com's Cloudflare challenge): the callback and the timeout are then the only way out, instead of a cancellation. - getLocalStorage reads window.localStorage inside its try: a SecurityError (denied storage) falls back to memory instead of aborting the bootstrap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The port no longer mirrors GitProvidersConfig: id, url, displayName and lifetimeDays are read from the configuration. userConnection (how the user connects), getGitUsername (paired with any of the user's tokens) and serviceCredentials (user-token, scoped-token, oauth) replace ui and service. The username of a scoped token is known when the context is built, the username marker is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Constants (UI_SCOPES, GIT_SCOPES), schemas, the asserts on the configuration, the URLs under the same names (apiUrl is always the base of the API), then userConnection and serviceCredentials, returned in the order of the port. The tests follow the same order. No change in behaviour. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Forgejo OAuth is kept: its tokens have every right of the user, as a PAT created with every scope would. The TODO becomes a note, and the .env documentation says it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… branch
- JSON schema: render "gitRepository" on an object { providerId, url,
branch }. In an array, one field per repository, added and removed as any
array item (maxItems). Other properties of the object are kept on update.
- FormField.GitRepository ("git repository"), computed in
computeRootFormFieldGroup and written by mutateHelmValues_update.
- gitProvidersManagement: connectedProviders selector (the favorite first)
and getConnectedProviderIdOfRepositoryUrl for a pasted url.
- Provisional field (until the designed UX): a connected provider, a
repository searched with listRepositories or pasted as a url, its branch
(the default one prefilled), warnings for a provider not connected and no
provider at all; translated in the 9 languages, with stories.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A {{...}} reference to an object of the context (git.providers) dropped
nothing undefined: applyDiffPatch then crawled into undefined and the
launcher crashed. The object is normalized as it would be serialized.
- Bitbucket: GET /2.0/repositories (every workspace) answers 404, the
repositories are listed per workspace (/2.0/user/workspaces, then
/2.0/repositories/{workspace}), most recently updated first. Needs the
read:workspace:bitbucket scope, added to the token hint (9 languages).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- GitProvider port: listBranches (at most 100, filtered on the search): GitLab with its search, GitHub and Forgejo filtered in Onyxia, Bitbucket with a BBQL search, most recent commit first. - gitProvidersManagement.listBranches, from the clone url: the repository's path under the provider's url (getRepositoryFullPath), also for a pasted url or a saved configuration. - The branch of the gitRepository field is an autocomplete of these branches, any other name can still be typed. - Forgejo: no default branch for an empty repository, the one it announces doesn't exist and the clone would fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.