fix: sanitize OAuth client store keys for URL-based client_ids#84
Conversation
Goose authenticates via a Client ID Metadata Document (CIMD), so its OAuth client_id is a URL (e.g. https://goose-docs.ai/oauth/client-metadata.json). FastMCP's OAuth proxy persists clients in the FileTreeStore keyed by client_id, and FileTreeStore defaults to PassthroughStrategy which does not sanitize keys. The slashes in the URL were treated as path separators, pointing at directories that were never created, causing a FileNotFoundError and a 500 on /authorize. Pass FileTreeV1KeySanitizationStrategy and FileTreeV1CollectionSanitizationStrategy to FileTreeStore so URL-shaped client_ids collapse to flat, filesystem-safe filenames. DCR clients (Claude, ChatGPT) were unaffected because their client_ids are opaque and slash-free.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughSummary by CodeRabbitRelease Notes
WalkthroughThis PR adds explicit file-tree sanitization strategies to OAuth token persistence in the server, preventing URL-based client IDs (containing slashes) from being misinterpreted as nested directory paths. The server imports and configures sanitization strategies in ChangesOAuth Token Storage Sanitization
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #84 +/- ##
=======================================
Coverage 97.59% 97.59%
=======================================
Files 22 22
Lines 3499 3499
=======================================
Hits 3415 3415
Misses 84 84
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
Goose authenticates via a Client ID Metadata Document (CIMD), so its OAuth client_id is a URL (e.g.
https://goose-docs.ai/oauth/client-metadata.json). FastMCP's OAuth proxy persists clients in the FileTreeStore keyed by client_id, and FileTreeStore defaults to PassthroughStrategy which does not sanitize keys. The slashes in the URL were treated as path separators, pointing at directories that were never created, causing a FileNotFoundError and a 500 on /authorize.
Pass FileTreeV1KeySanitizationStrategy and
FileTreeV1CollectionSanitizationStrategy to FileTreeStore so URL-shaped client_ids collapse to flat, filesystem-safe filenames. DCR clients (Claude, ChatGPT) were unaffected because their client_ids are opaque and slash-free.