Implement OAuth state passing; PKCE; and pushed authentication requests #210

irenes commented 2026年03月11日 07:43:08 +01:00

These are three standard OAuth features which are mandatory in many common configurations. I did my best to separate these out into individual commits, for ease of reviewing. I believe these each work individually. I've tested these against Authelia, configured with its recommended strict settings, having gamja act as a "public" oauth client (since it runs in the browser, it has no way to protect a client secret). I did my best to stick to the RFCs, and I expect it will work in other configurations and with other software, but I haven't tested it.

There's also a commit in here that adds a version number to package.json. I did that because my infrastructure uses nix and the nix build tooling for JavaScript prefers to have a version number there. I don't have strong feelings about that one, I'm happy to exclude it from the PR if you prefer.

These are three standard OAuth features which are mandatory in many common configurations. I did my best to separate these out into individual commits, for ease of reviewing. I believe these each work individually. I've tested these against Authelia, configured with its recommended strict settings, having gamja act as a "public" oauth client (since it runs in the browser, it has no way to protect a client secret). I did my best to stick to the RFCs, and I expect it will work in other configurations and with other software, but I haven't tested it. There's also a commit in here that adds a version number to package.json. I did that because my infrastructure uses nix and the nix build tooling for JavaScript prefers to have a version number there. I don't have strong feelings about that one, I'm happy to exclude it from the PR if you prefer.

irenes commented 2026年03月11日 07:47:38 +01:00

I see that there's lint failures, but I'll wait for feedback before addressing that.

I see that there's lint failures, but I'll wait for feedback before addressing that.

irenes commented 2026年03月23日 02:23:15 +01:00

it looks like this was closed by an automated system; I would like to reaffirm that I still think it would be awesome for this to be merged. I realize there's a lint failure, and the reason I haven't addressed that is that I also wanted feedback on the overall approach to be sure it's what upstream wants before I worry about formatting.

from looking at the history of PR discussion on here, it kind of looks like nothing big ever really gets merged. so I've diverted my own efforts to maintaining a private fork, which has additional features, not just this PR. I have been grappling with whether it would be rude of me to make it a public fork; thoughts on that topic are welcome.

I think gamja is a cool project that I enjoy using! that's why I'm attempting to contribute to it. I'm just making the call that there's no point in trying to do that unless there's some form of communication about it. I wish you all the best, whatever you decide.

it looks like this was closed by an automated system; I would like to reaffirm that I still think it would be awesome for this to be merged. I realize there's a lint failure, and the reason I haven't addressed that is that I also wanted feedback on the overall approach to be sure it's what upstream wants before I worry about formatting. from looking at the history of PR discussion on here, it kind of looks like nothing big ever really gets merged. so I've diverted my own efforts to maintaining a private fork, which has additional features, not just this PR. I have been grappling with whether it would be rude of me to make it a public fork; thoughts on that topic are welcome. I think gamja is a cool project that I enjoy using! that's why I'm attempting to contribute to it. I'm just making the call that there's no point in trying to do that unless there's some form of communication about it. I wish you all the best, whatever you decide.

emersion commented 2026年03月23日 18:49:25 +01:00

Not sure what would trigger PRs to be closed automatically, nothing should.

My attention is spread across many projects, so it may take me time to get to this one. I'm definitely interested in reviewing. Feel free to ping me every two weeks or so for feedback.

Please have a look at other PRs, some have some overlap with this one. If you want to make your PR easier to review for me, guidelines in CONTRIBUTING.md could help.

Not sure what would trigger PRs to be closed automatically, nothing should. My attention is spread across many projects, so it may take me time to get to this one. I'm definitely interested in reviewing. Feel free to ping me every two weeks or so for feedback. Please have a look at other PRs, some have some overlap with this one. If you want to make your PR easier to review for me, guidelines in [CONTRIBUTING.md](https://github.com/emersion/.github/blob/main/CONTRIBUTING.md) could help.

This pull request can be merged automatically.

You are not authorized to merge this pull request.