refactor: use zod for oidc params#771
Merged
Merged
Conversation
dosubot
Bot
added
the
size:L
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughReplaces manual OIDC param assembly with Zod validation: Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Browser as Browser
participant Hook as useOIDCParams
participant Page as Page (Authorize/Login/TOTP)
participant API as Server API
Browser->>Hook: provide URLSearchParams
Hook->>Hook: validate via oidcParamsSchema (Zod)
Hook-->>Page: return oidcParams { values, isOidc, compiled, issues }
Page->>API: fetch client (/api/oidc/clients/:id) [if isOidc]
Page->>API: post authorize (/api/oidc/authorize) with oidcParams.values
API-->>Page: response (client info / authorize result)
Page->>Browser: navigate to /authorize?{compiled} or /continue[?redirect_uri]
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~18 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #771 +/- ##
=======================================
Coverage 19.82% 19.82%
=======================================
Files 50 50
Lines 3960 3960
=======================================
Hits 785 785
Misses 3104 3104
Partials 71 71 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@frontend/src/lib/hooks/oidc.ts`:
- Line 12: Remove the unsupported prompt field from the OIDC zod schema in
frontend/src/lib/hooks/oidc.ts: delete or comment out the line that adds prompt:
z.string().optional() so the frontend no longer preserves prompt values the
backend ignores; instead add a TODO/note referencing that prompt will be
re-added once AuthorizeRequest in oidc_service.go gains a prompt field and
prompt semantics are implemented.
- Around line 4-7: The OIDC param schema currently allows empty strings because
it uses z.string(); update each required field (scope, response_type, client_id,
redirect_uri) to enforce non-empty values by replacing z.string() with
z.string().nonempty() (or .min(1)) so the frontend validation rejects empty
parameters (also adjust any related type-guard or helper that sets isOidc to
rely on the tightened schema if present).
In `@frontend/src/pages/authorize-page.tsx`:
- Around line 80-82: The request URL interpolates a raw OIDC client_id into the
path (in the authorize-page component) which breaks routing for IDs containing
'/', ':', '?' etc.; fix by URL-encoding the client_id before building the path
(use encodeURIComponent on oidcParams.values.client_id where the fetch to
`/api/oidc/clients/${...}` is constructed) so the fetch uses
`/api/oidc/clients/${encodeURIComponent(oidcParams.values.client_id)}` and
safely looks up the client.
In `@frontend/src/pages/login-page.tsx`:
- Around line 109-110: The redirect to the TOTP page currently forwards only
redirect_uri, losing the rest of the OIDC query params; update the
window.location.replace call in frontend/src/pages/login-page.tsx (the call that
builds `/totp...`) to preserve and forward the full original query string (e.g.,
use window.location.search or construct the entire query from location) so
client_id, scope, state, nonce, etc. are included when landing on /totp and the
TOTP success path can detect OIDC and continue to /authorize.
- Around line 174-177: The guard currently treats undefined redirectUri as
non-empty because it checks redirectUri !== "", so logged-in users without a
redirect_uri get redirected incorrectly; update the condition in the login-page
component to require a truthy string for redirectUri (e.g., use if (isLoggedIn
&& redirectUri) or explicitly check typeof redirectUri === "string" &&
redirectUri !== "") so the Navigate block (and its use of
encodeURIComponent(redirectUri)) only runs when redirectUri is present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b4746966-fb13-448a-8d3e-c9e9c55e004c
📒 Files selected for processing (4)
frontend/src/lib/hooks/oidc.tsfrontend/src/pages/authorize-page.tsxfrontend/src/pages/login-page.tsxfrontend/src/pages/totp-page.tsx
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
frontend/src/lib/hooks/oidc.ts (1)
3-12: Use.min(1)instead of.nonempty()for string validation.Zod v3.20+ deprecated
.nonempty()on strings in favor of.min(1). The project uses Zod v4.3.6, so this deprecation applies. While.nonempty()still works, updating to.min(1)aligns with current Zod best practices.♻️ Suggested change
export const oidcParamsSchema = z.object({ - scope: z.string().nonempty(), - response_type: z.string().nonempty(), - client_id: z.string().nonempty(), - redirect_uri: z.string().nonempty(), + scope: z.string().min(1), + response_type: z.string().min(1), + client_id: z.string().min(1), + redirect_uri: z.string().min(1), state: z.string().optional(), nonce: z.string().optional(), code_challenge: z.string().optional(), code_challenge_method: z.string().optional(), });🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@frontend/src/lib/hooks/oidc.ts` around lines 3 - 12, Replace deprecated .nonempty() uses with .min(1) on required string fields in the oidcParamsSchema: update scope, response_type, client_id, and redirect_uri validators to use .min(1) instead of .nonempty() so the schema conforms to Zod v3.20+/v4 semantics while leaving optional fields (state, nonce, code_challenge, code_challenge_method) unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@frontend/src/lib/hooks/oidc.ts`:
- Around line 3-12: Replace deprecated .nonempty() uses with .min(1) on required
string fields in the oidcParamsSchema: update scope, response_type, client_id,
and redirect_uri validators to use .min(1) instead of .nonempty() so the schema
conforms to Zod v3.20+/v4 semantics while leaving optional fields (state, nonce,
code_challenge, code_challenge_method) unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b9f08d29-a767-41ae-90a2-6d402045383a
📒 Files selected for processing (3)
frontend/src/lib/hooks/oidc.tsfrontend/src/pages/authorize-page.tsxfrontend/src/pages/login-page.tsx
🚧 Files skipped from review as they are similar to previous changes (2)
- frontend/src/pages/login-page.tsx
- frontend/src/pages/authorize-page.tsx
Rycochet
approved these changes
Apr 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Bug Fixes
Refactor