fix(auth): Improve OAuth credential detection and startup warning#747
fix(auth): Improve OAuth credential detection and startup warning#747
Conversation
- Enhanced getClaudeAuthIndicators() to return detailed check information including file paths checked and specific error details for debugging - Added debug logging to server startup credential detection for easier troubleshooting in Docker environments - Show paths that were checked in the warning message to help users debug mount issues - Added support for CLAUDE_CODE_OAUTH_TOKEN environment variable - Return authType in verify-claude-auth response to distinguish between OAuth and CLI authentication methods - Updated UI to show specific success messages for Claude Code subscription vs generic CLI auth - Added Docker troubleshooting tips to sandbox risk dialog - Added comprehensive unit tests for OAuth credential detection scenarios Closes #721 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Shironex
added
Bug
📝 WalkthroughWalkthroughStartup and verification now detect Claude authentication method (API key, OAuth token, or CLI) across server, platform, and UI; filesystem checks are structured and reported; UI shows auth-specific messages and a sandbox dialog now includes Docker troubleshooting tips. Changes
Sequence Diagram(s)sequenceDiagram
participant UI
participant Server
participant Platform
participant FS as Filesystem
UI->>Server: GET /verify-claude-auth
Server->>Platform: getClaudeAuthIndicators()
Platform->>FS: read settings.json, stats-cache, projects dir, credential files
FS-->>Platform: per-path FileCheckResult / DirectoryCheckResult
Platform-->>Server: ClaudeAuthIndicators (checks + cli indicators)
Server->>Server: determine authType (api_key | oauth | cli)
Server-->>UI: { success, authenticated, authType }
UI->>UI: update cliAuthType state & render conditional message
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @Shironex, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly refines the authentication mechanism for Claude, focusing on improving the clarity, debuggability, and user experience around credential detection. It introduces more detailed logging and error reporting for authentication checks, provides better feedback to users through specific UI messages and warning details, and expands support for OAuth tokens via environment variables. Additionally, it includes new troubleshooting guidance for Docker users and a robust set of unit tests to validate the enhanced detection logic. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request significantly improves the OAuth credential detection and startup warnings. The changes to getClaudeAuthIndicators to return detailed check information and handle errors gracefully are excellent for debugging. The addition of comprehensive unit tests for credential detection scenarios is a major step forward in ensuring the robustness of this critical feature. The UI improvements, such as showing specific auth success messages and adding Docker troubleshooting tips, will greatly enhance the user experience. I've identified one high-severity logic bug in how multiple credential files are prioritized, which could lead to incorrect auth detection. With that addressed, this will be a very strong set of improvements.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@libs/platform/src/system-paths.ts`:
- Around line 1069-1076: The code sets settingsFileCheck.readable to true based
solely on systemPathAccess(settingsPath) which currently checks F_OK (existence)
and can be misleading; change the check to explicitly verify read permission
(use R_OK via systemPathAccess or an fs.access call with fs.constants.R_OK) when
determining settingsFileCheck.readable, keep result.hasSettingsFile true only if
existence check passes, and ensure the catch still assigns
settingsFileCheck.error; update references in this block (systemPathAccess,
settingsPath, settingsFileCheck.readable, result.hasSettingsFile) accordingly.
🧹 Nitpick comments (1)
libs/platform/tests/oauth-credential-detection.test.ts (1)
68-69: Use@automaker/platformentrypoint instead of relative module paths.The
getClaudeAuthIndicatorsfunction and related exports are available directly from the@automaker/platformpublic entrypoint. Relative imports from../src/system-pathsbypass the shared package interface. Switch to the platform barrel export to align with package architecture:const { getClaudeAuthIndicators } = await import('@automaker/platform');This applies to all similar dynamic imports in this test file.
- Updated getClaudeAuthIndicators() to ensure that empty or token-less credential files do not prevent the detection of valid credentials in subsequent paths. - Improved error handling for settings file readability checks, providing clearer feedback on file access issues. - Added unit tests to validate the new behavior, ensuring that the system continues to check all credential paths even when some files are empty or invalid. This change improves the robustness of the credential detection process and enhances user experience by allowing for more flexible credential management.
1 participant
Closes #721
Summary by CodeRabbit
New Features
Improvements
Tests