fix(config)!: remove the legacy OAuth client-id fallback #745
No reviewers
Labels
No labels
breaking
bug
documentation
enhancement
epic
good first issue
help wanted
refactoring
resolution/duplicate
resolution/invalid
resolution/wontfix
security
severity/critical
severity/high
severity/low
severity/medium
status/abandoned
status/blocked
status/needs-decision
status/needs-info
status/needs-verification
testing
upstream
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
sixfold-space/madtea!745
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue-712-remove-legacy-oauth-fallback"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
ReadOAuthClientID fell back to the pre-host-keyed bare key
madtea.oauth-client-idwith a non-globalgit config --get, which reads the merged config, including a repo's --local value. A repo-localmadtea.oauth-client-idcould then steer which OAuth application id the authorize URL names. Severity is low: it steers only the application id, captures no token (PKCE S256, loopback redirect, no secret), and git clone does not copy a repo's local config.ReadOAuthClientID now reads only the host-keyed --global key. The legacy bare-key fallback and its constant are removed. A test proves a repo-local madtea.oauth-client-id is not read.
BREAKING CHANGE: the pre-host-keyed legacy OAuth key is no longer read. A pre-host-keyed install that logs in through the MCP tool, and never ran the CLI setup (which migrates the key), must re-register its OAuth application.
Closes #712