pepepper/fluxer
1
0 Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-18 13:35:42 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(oauth): stop granting scopes the user turned off (#2968)

Browse Source
This commit is contained in:
Hampus authored and GitHub committed 2026-09-26 13:48:23 +02:00
1 parent 841fb7af41
commit 858a2d9e2b
37 files changed
+356 -211
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

fluxer_app/src/features/auth/components/pages/oauth_authorize_page/OAuthAuthorizeFlowPanel.tsx
+1
View File
@@ -141,6 +141,7 @@ export const OAuthAuthorizeFlowPanel: React.FC<OAuthAuthorizeFlowPanelProps> = o
<OAuthScopesStep
authParams={authParams}
botInviteWithoutRedirect={flow.botInviteWithoutRedirect}
cannotSubmit={flow.cannotSubmit}
clientLabel={flow.clientLabel}
hasNextStep={flow.hasNextStep}
hasPreviousStep={flow.hasPreviousStep}
fluxer_app/src/features/auth/components/pages/oauth_authorize_page/OAuthScopesStep.tsx
+12 -3
View File
@@ -29,6 +29,7 @@ const REQUIRED_DESCRIPTOR = msg({
interface OAuthScopesStepProps {
authParams: AuthorizeParams;
botInviteWithoutRedirect: boolean;
cannotSubmit: boolean;
clientLabel: string;
hasNextStep: boolean;
hasPreviousStep: boolean;
@@ -51,6 +52,7 @@ interface OAuthScopesStepProps {
export const OAuthScopesStep: React.FC<OAuthScopesStepProps> = ({
authParams,
botInviteWithoutRedirect,
cannotSubmit,
clientLabel,
hasNextStep,
hasPreviousStep,
@@ -151,10 +153,16 @@ export const OAuthScopesStep: React.FC<OAuthScopesStepProps> = ({
})
)}
</div>
{scopesAdjusted && (
<div className={styles.caution} data-flx="auth.o-auth-authorize-page.caution--2">
<Trans>Turning off scopes may prevent the app from working correctly.</Trans>
{scopes.length > 0 && selectedScopes.size === 0 ? (
<div className={styles.caution} data-flx="auth.o-auth-authorize-page.caution--no-scopes">
<Trans>Turn on at least one scope to authorize this app.</Trans>
</div>
) : (
scopesAdjusted && (
<div className={styles.caution} data-flx="auth.o-auth-authorize-page.caution--2">
<Trans>Turning off scopes may prevent the app from working correctly.</Trans>
</div>
)
)}
</div>
</div>
@@ -165,6 +173,7 @@ export const OAuthScopesStep: React.FC<OAuthScopesStepProps> = ({
showRedirectNotice={showRedirectNotice}
hasPreviousStep={hasPreviousStep}
hasNextStep={hasNextStep}
authorizeDisabled={cannotSubmit}
onAuthorize={onAuthorize}
onBack={onBack}
onCancel={onCancel}
fluxer_app/src/features/auth/components/pages/oauth_authorize_page/state/useAuthorizeFlow.ts
+3 -3
View File
@@ -306,7 +306,7 @@ export function useAuthorizeFlow(options: UseAuthorizeFlowOptions = {}): Authori
() => destinations.options.find((option) => option.value === selectedDestinationKey) ?? null,
[destinations.options, selectedDestinationKey],
);
const cannotSubmit = hasBotScope && !selectedDestination;
const cannotSubmit = scopeSelection.selected.size === 0 || (hasBotScope && !selectedDestination);
const needsPermissionsStep =
hasBotScope && selectedDestination?.kind !== 'group_dm' && permissionSelection.requestedKeys.length > 0;
const hasRequestedBotPermissions =
@@ -350,9 +350,9 @@ export function useAuthorizeFlow(options: UseAuthorizeFlowOptions = {}): Authori
setSubmitError(null);
setSubmitting('approve');
try {
const scopeToSend = scopeSelection.toScopeString() || params.scope;
const scopeToSend = scopeSelection.toScopeString();
const sendsBotScope = scopeToSend.split(/[\s+]+/).includes('bot');
if (sendsBotScope && !selectedDestination) {
if (!scopeToSend || (sendsBotScope && !selectedDestination)) {
setSubmitting(null);
return;
}