Repository navigation
Conversation
Replace the client-secret OAuth web flow for user-supplied ("custom") OAuth
apps with the OAuth device flow, which authorizes using only a public client ID.
- Add a custom OAuth app sign-in that collects a hostname and client ID and
reuses the shared device-flow authorization and scope UI; no client secret.
- Retire the web flow end to end: the /login/github/oauth-app route, the
authorization-code + secret exchange, the oauthWebApp adapter bundle, and the
gitify:// custom-protocol callback across the Electron main process, preload,
and the shared IPC event.
- Rename auth-method labels: GitHub App -> Gitify OAuth App, OAuth App ->
Custom OAuth App; persist the custom app's client ID for its settings link.
- Migrate persisted accounts on load without forcing re-login.
- Surface actionable guidance for device_flow_disabled and unknown client IDs.
This was referenced Oct 17, 2026
Follow-up naming pass on the device-flow migration: - Rename describeDeviceFlowError -> describeDeviceFlowStartError; it only covers start-time failures (device_flow_disabled / unknown client ID), not poll errors. - Group the custom OAuth app helpers (authMethod, validateClientId, getNewOAuthAppUrl) into a customOAuthApp adapter bundle, so validateClientId and getNewOAuthAppUrl live together instead of split across the top-level adapter and the deviceFlow bundle. - Have useLogins derive the recorded auth method from the adapter's customOAuthApp bundle rather than hardcoding 'Custom OAuth App'. - Extract GitHubDeviceFlowAuthorize as the shared authorization UI and keep GitHubLoginWithDeviceFlowRoute as the thin built-in route element, so the custom route composes a mechanism-named component rather than a login route. - Rename effectiveHostname -> resolvedHostname and migrateAuthMethod -> migrateLegacyAuthMethod.
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the client-secret OAuth web flow for user-supplied ("custom") OAuth apps with the OAuth device flow, which authorizes using only a public client ID — no secret, and no
gitify://custom-protocol redirect.A desktop app is an OAuth public client and cannot keep a client secret confidential, and the
gitify://custom-scheme callback can be registered by any local app. The device flow removes both. Gitify's built-in GitHub sign-in already used the device flow, so this makes it the single OAuth mechanism for both sign-in paths.What changed
/login/github/oauth-appweb-flow route, the authorization-code + secret exchange, theoauthWebAppadapter bundle, and thegitify://custom-protocol callback (Electron mainopen-url/handleProtocolURL, preloadonAuthCallback, and theAUTH_CALLBACKIPC event).GitHub App→Gitify OAuth AppandOAuth App→Custom OAuth App; the custom app's client ID is persisted so its developer-settings link targets the user's own app.device_flow_disabledand unrecognized client IDs surface actionable guidance (enable device flow in the app's settings / the client ID is invalid for the host).Compatibility
Existing custom-app and built-in accounts keep working without re-authentication. On a host where Gitify's app is disallowed (e.g. enterprise OAuth-app restrictions), the user registers their own OAuth app, enables its device flow, and signs in with that client ID.
BREAKING: the
gitify://custom-protocol callback is removed.Testing
pnpm check(lint + format + types): cleanpnpm test: 1911 passingpnpm test:visual: 60 passing — baselines updated (newlogin-github-custom-oauth-approute, retiredlogin-github-oauth-appremoved)