Migrate desktop auth from dedicated Cloud Run to Python backend#5360
Open
Migrate desktop auth from dedicated Cloud Run to Python backend#5360
Conversation
Replaces the hardcoded omi-desktop-auth Cloud Run URL with the OMI_API_URL environment variable, matching APIClient.baseURL resolution. Python backend already has identical /v1/auth/* endpoints. Closes #5359
Pass redirect_uri from the auth session to the callback HTML template instead of hardcoding omi://auth/callback. This enables desktop apps (which use omi-computer://auth/callback) to receive OAuth callbacks correctly when authenticating through the Python backend.
Both Google and Apple callback endpoints now pass the session's redirect_uri to the auth_callback.html template, enabling dynamic custom URL scheme redirects per client (mobile vs desktop).
Greptile SummaryThis PR successfully migrates desktop auth from a dedicated Cloud Run service to the unified Python backend by making the redirect URI dynamic. The Swift changes are clean and well-implemented, with proper environment variable resolution and helpful logging. However, the implementation introduces a critical XSS vulnerability in the auth callback template where the Key Changes:
Critical Issues:
Recommendation: Fix the XSS vulnerability by using Confidence Score: 2/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant Desktop as Desktop App<br/>(AuthService.swift)
participant Browser
participant Backend as Python Backend<br/>(auth.py)
participant OAuth as OAuth Provider<br/>(Google/Apple)
participant HTML as Callback Page<br/>(auth_callback.html)
Note over Desktop,Backend: BEFORE: Separate Cloud Run<br/>AFTER: Unified Python Backend
Desktop->>Backend: GET /v1/auth/authorize?provider=google<br/>&redirect_uri=omi-computer://auth/callback
Note over Backend: Store redirect_uri<br/>in Redis session
Backend->>Browser: Redirect to OAuth provider
Browser->>OAuth: User authenticates
OAuth->>Backend: Callback with auth code
Backend->>Backend: Exchange code for tokens
Backend->>HTML: Render auth_callback.html<br/>with redirect_uri={{ redirect_uri }}
HTML->>Desktop: window.location = omi-computer://auth/callback?code=...
Desktop->>Backend: POST /v1/auth/token (exchange code)
Backend->>Desktop: Return OAuth credentials
Last reviewed commit: 7d011c2 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
backend/templates/auth_callback.html
Outdated
Comment on lines
+112
to
+113
| const redirectUri = "{{ redirect_uri }}"; | ||
| let redirectUrl = redirectUri + '?code=' + encodeURIComponent(code); |
There was a problem hiding this comment.
XSS vulnerability: redirect_uri injected into JavaScript without proper escaping. An attacker could craft a malicious /v1/auth/authorize URL with redirect_uri containing quotes to break out of the string and inject arbitrary JavaScript (e.g., redirect_uri=omi://callback"+alert('xss')+").
Suggested change
| const redirectUri = "{{ redirect_uri }}"; | |
| let redirectUrl = redirectUri + '?code=' + encodeURIComponent(code); | |
| const redirectUri = {{ redirect_uri | tojson }}; |
Additional Comments (1)
|
Add server-side validation at /v1/auth/authorize to reject redirect_uri values that don't match allowed app schemes (omi://, omi-computer://, omi-computer-dev://). Also fix empty string fallback with 'or' operator.
Use |tojson filter for safe template variable serialization. Add defense-in-depth scheme validation in JavaScript before redirect. Block redirect and manual link for disallowed schemes.
…ering 15 tests covering: - Redirect_uri allowlist validation (rejects https, javascript, data, ftp, empty) - Allowed schemes pass (omi://, omi-computer://, omi-computer-dev://) - Google/Apple callback uses session redirect_uri in template - Fallback to default omi://auth/callback when missing - XSS safety: JSON-escaped redirect_uri prevents script injection
Collaborator
Author
CP9: Live Backend Validation — EvidenceSource Code Verification ✅
Python Backend Auth Endpoints ✅ (tested from Mac Mini)
Redirect URI Validation ✅ (15 unit tests passing)
Deployment NotePython backend changes must be deployed before the Swift client update ships, because the current prod callback HTML hardcodes Full evidenceby AI for @beastoin |
Collaborator
Author
PR Ready for MergeAll checkpoints passed (CP0-CP9):
Deploy note: Python backend changes (redirect_uri validation + dynamic callback template) should be deployed to Awaiting explicit merge approval. by AI for @beastoin |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Eliminates the dedicated
omi-desktop-authCloud Run service by pointing the desktop macOS app's auth flow at the Python backend (api.omi.me), which already has identical/v1/auth/*endpoints.Changes
Swift (
AuthService.swift)omi-desktop-authCloud Run URL withOMI_API_URLenv varAPIClient.baseURL:getenv()→ProcessInfo→ fatalPython (
auth.py+auth_callback.html)redirect_urifrom auth session to callback HTML template{{ redirect_uri }}with|tojsonsafe serializationomi-computer://auth/callback) to receive OAuth callbacks correctlyomi://auth/callbackfor mobile compatibilitySecurity hardening
redirect_urimust match allowed app URL schemes (omi://,omi-computer://,omi-computer-dev://)oroperator instead of.get()default|tojsonfilter to prevent XSS from malformed URIsTests (15 new)
test_auth_routes.py: redirect_uri validation, callback template rendering, XSS safetytest.shWhy
Risk
redirect_uriwith dual validation ensures both mobile (omi://) and desktop (omi-computer://) schemes work safelyTesting
Checkpoints
Closes #5359
Part of #5302
by AI for @beastoin