fix: enable Apple OAuth desktop redirect to app #103
Conversation
Apple OAuth now properly redirects back to desktop app after authentication. Previously, AppleAuthProvider would navigate within the browser instead of checking the redirect-to-native flag and redirecting to the desktop app. This fix adds the same Tauri redirect logic used by GitHub/Google OAuth: - Check localStorage for "redirect-to-native" flag - If set, clear flag and redirect to deep link with access/refresh tokens - Otherwise, use regular web navigation Fixes #94 🤖 Generated with [Claude Code](https://claude.ai/code) Co-authored-by: AnthonyRonning <AnthonyRonning@users.noreply.github.com>
WalkthroughThe code introduces a conditional authentication redirect flow in the AppleAuthProvider component. When running in a Tauri (native) environment, after successful Apple authentication, it constructs and triggers a deep link back to the native app, otherwise defaulting to the standard web flow. No exported or public entity declarations were altered. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant AppleAuthProvider
participant OpenSecretSDK
participant NativeApp
participant WebApp
User->>AppleAuthProvider: Initiate Apple Sign-In
AppleAuthProvider->>OpenSecretSDK: Handle Apple Auth Callback
OpenSecretSDK-->>AppleAuthProvider: Return Auth Success
alt "redirect-to-native" flag is true
AppleAuthProvider->>AppleAuthProvider: Clear "redirect-to-native" flag
AppleAuthProvider->>NativeApp: Redirect via deep link with tokens
else
AppleAuthProvider->>WebApp: Invoke onSuccess & redirectAfterLogin
end
Assessment against linked issues
Assessment against linked issues: Out-of-scope changesNo out-of-scope changes found. Poem
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
Enhanced Apple OAuth implementation in frontend/src/components/AppleAuthProvider.tsx to properly handle desktop app authentication flow, ensuring users are redirected back to the Tauri desktop app after successful authentication.
- Added Tauri desktop detection and redirect-to-native flag handling in
AppleAuthProvider.tsx - Implemented deep link redirection with access/refresh tokens similar to GitHub/Google OAuth flows
- Maintains existing web and iOS authentication flows while adding desktop support
1 file reviewed, 1 comment
Edit PR Review Bot Settings | Greptile
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
frontend/src/components/AppleAuthProvider.tsx (1)
240-242: Document or make the timeout delay configurable.The 1-second delay appears arbitrary. Consider documenting why this delay is necessary or making it configurable.
+ // Add delay to ensure token storage is complete before redirect setTimeout(() => { window.location.href = deepLinkUrl; }, 1000);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
frontend/src/components/AppleAuthProvider.tsx(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (4)
- GitHub Check: build-ios
- GitHub Check: browseruse-tests
- GitHub Check: build-macos (universal-apple-darwin)
- GitHub Check: build-linux
🔇 Additional comments (1)
frontend/src/components/AppleAuthProvider.tsx (1)
234-238:Details
✅ Verification successful
Consider security implications of passing tokens in URL parameters.
Passing sensitive tokens in URL parameters could expose them in browser history, logs, or referrer headers. Verify that this approach is consistent with the existing GitHub and Google OAuth implementations mentioned in the PR description.
🏁 Script executed:
#!/bin/bash # Description: Check how GitHub and Google OAuth implementations handle Tauri redirects # Expected: Similar deep link patterns with tokens in URL parameters echo "Searching for GitHub OAuth Tauri redirect implementation..." rg -A 10 -B 5 "redirect-to-native.*github" --type tsx --type ts echo "Searching for Google OAuth Tauri redirect implementation..." rg -A 10 -B 5 "redirect-to-native.*google" --type tsx --type ts echo "Searching for other OAuth deep link implementations..." rg -A 5 "cloud\.opensecret\.maple://" --type tsx --type tsLength of output: 653
🏁 Script executed:
#!/bin/bash # Improved search without relying on built-in file type mappings echo "Searching for GitHub OAuth Tauri redirect implementation..." rg -g '*.ts' -g '*.tsx' -A10 -B5 'redirect-to-native.*github' echo "Searching for Google OAuth Tauri redirect implementation..." rg -g '*.ts' -g '*.tsx' -A10 -B5 'redirect-to-native.*google' echo "Searching for any OAuth deep link patterns..." rg -g '*.ts' -g '*.tsx' -A5 'cloud\.opensecret\.maple://'Length of output: 2712
Deep link token handling is consistent across all providers
Verified that the GitHub and Google callbacks in
frontend/src/routes/auth.$provider.callback.tsxuse the exact same deep-link pattern:
let deepLinkUrl = \cloud.opensecret.maple://auth?access_token=${encodeURIComponent(accessToken)}`;`- Optional
&refresh_token=\${encodeURIComponent(refreshToken)}The Apple implementation in
frontend/src/components/AppleAuthProvider.tsx(lines 234–238) matches this pattern, so there’s no divergence in how tokens are passed.
Consider documenting the security trade-offs of URL-based token delivery (e.g., potential exposure in logs or referrers) if you haven’t already.
Fixes #94
Apple OAuth now properly redirects back to desktop app after authentication. Previously, AppleAuthProvider would navigate within the browser instead of checking the redirect-to-native flag and redirecting to the desktop app.
This fix adds the same Tauri redirect logic used by GitHub/Google OAuth:
Changes Made:
AppleAuthProvider.tsxto check for Tauri desktop auth flowTesting:
Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes