Repository navigation
feat(auth): add personal GitHub sign-in and Sealos preview - #231
Draft
PeterGuy326 wants to merge 6 commits into
Draft
PeterGuy326 wants to merge 6 commits into
PeterGuy326 wants to merge 6 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if prior, _, err := s.resolveBrowser(r); err == nil { | ||
| _ = s.Auth.RevokeSession(r.Context(), prior.ID) | ||
| } | ||
| http.SetCookie(w, auth.SessionCookie(plain, cfg, cfg.AbsoluteExpiry)) |
| writeError(w, 503, "github_unavailable", "Try again later") | ||
| return | ||
| } | ||
| http.SetCookie(w, &http.Cookie{Name: s.flowCookieName(), Value: state + "." + verifier, Path: "/", MaxAge: 600, HttpOnly: true, Secure: s.browserConfig().Secure, SameSite: http.SameSiteLaxMode}) |
|
|
||
| func (s *Server) handleGitHubCallback(w http.ResponseWriter, r *http.Request) { | ||
| w.Header().Set("Cache-Control", "no-store") | ||
| http.SetCookie(w, &http.Cookie{Name: s.flowCookieName(), Value: "", Path: "/", MaxAge: -1, HttpOnly: true, Secure: s.browserConfig().Secure, SameSite: http.SameSiteLaxMode}) |
| if prior, _, err := s.resolveBrowser(r); err == nil { | ||
| _ = s.Auth.RevokeSession(r.Context(), prior.ID) | ||
| } | ||
| http.SetCookie(w, auth.SessionCookie(plain, cfg, cfg.AbsoluteExpiry)) |
| writeError(w, 503, "logout_unavailable", "Try again later") | ||
| return | ||
| } | ||
| http.SetCookie(w, auth.ClearSessionCookie(s.browserConfig())) |
| if session, _, err := s.resolveBrowser(r); err == nil { | ||
| _ = s.Auth.RevokeSession(r.Context(), session.ID) | ||
| } | ||
| http.SetCookie(w, auth.ClearSessionCookie(s.browserConfig())) |
sun-970
reviewed
Oct 9, 2026
sun-970
left a comment
sun-970
left a comment
Contributor
There was a problem hiding this comment.
Reviewed from outside — no write access on this repository, so this is a comment, not an approval. The security-relevant parts read well.
What I verified:
- PKCE S256 with a one-use, hashed, 10-minute
statechallenge (oauth_challengesstores onlyHashToken(state), consumed byDELETE … RETURNING); the provider token lives only for the exchange and is never persisted. - Identity is keyed on the immutable numeric GitHub subject, not login/email. Email never authorizes a link (existing email →
ErrExplicitLinkRequired) and a subject can never move between users (ErrIdentityConflict). That is the correct call. - Linking requires proof of a live session: the session row must belong to the linking user, be unrevoked/unexpired with
last_activewithin 2h, selectedFOR UPDATE; enrolment is serialized against first-user bootstrap withpg_advisory_xact_lock. - The migration is defensive: CHECK on subject format, PK (provider, subject), UNIQUE (user_id, provider), the intent/session consistency CHECK, and a Down that refuses to drop while GitHub-only users exist.
- Config fails closed:
MEM_PUBLIC_URLmust be an exact HTTPS origin (no userinfo/path/query/fragment), allowed IDs must be unique numerics, and bootstrap requires registration disabled. githubJSONrejects trailing JSON and caps the body at 64 KiB — nice hardening.
Questions before this leaves Draft:
users.password_hash = '!github-only'is a sentinel, not a bcrypt hash. Please confirm the password-login path treats a compare error as an invalid credential (it should) and that nothing can ever write a value matching that literal.BeginOAuth's cap —… WHERE (SELECT count(*) FROM oauth_challenges) < 10000— is evaluated per-insert without a lock, so concurrent requests can momentarily exceed it. Benign for a DoS bound, but if it is meant to be hard it needs the same advisory lock or a unique-index trick.web/src/hooks/useAuth.tsxsetstokento the literal'cookie-session'as a UI marker. Anything that forwardstokeninto anAuthorizationheader would then send a bogus credential; worth an assertion or a grep to guarantee the marker can never reach a request.oauth_challengesis swept only insideBeginOAuth; if OAuth is configured but idle, expired rows linger. The expiry index plus a periodic sweep is probably enough — just calling it out.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #65. This implements the personal preview subset of the authentication roadmap.
Adds GitHub sign-in and explicit account binding, with a stable numeric allowlist and verified primary email. Browser sessions use HttpOnly cookies and CSRF checks; existing machine Bearer credentials remain supported. Personal preview enrollment is closed to passwords, and the allowed GitHub owner can bootstrap once.
Binding rejects state replay, identity conflicts, logout or account switching during authorization. The Web client clears an old Bearer credential before reading the GitHub session and prevents stale requests from logging out a newer identity.
The native Sealos template includes private PostgreSQL with pgvector, Redis, a private managed object bucket and one model-free CPU Worker. Preview image builds use commit tags, linux/amd64 and a job-scoped GitHub token; runtime credentials are excluded from images. Web renders the shared nginx template into its writable
/tmpclaim from single-line Pod environment values. This fixes the real platform's unresolved instance expression in a ConfigMap block scalar while preserving UID 101, read-only root, dropped capabilities and callback access-log filtering.Validation: Go full-suite race and owned PostgreSQL integration tests, vet and build passed. Web 119 tests, lint, production build and five Playwright acceptance suites passed. Worker tests passed with actual visual-model evaluation skipped. Migration checks covered a populated upgrade through 0027 and refusal to downgrade OAuth-only users. The complete evidence and limitations are in the validation ledger.
The PostgreSQL gate checks migration 0027. The lifecycle gate builds its unavailable MinIO test dependencies from fixed official source commits, and the Web lockfile resolves two development dependency advisories without reducing the audit threshold. The existing deployment-image gate now starts the native Web recipe under nonroot/read-only constraints and verifies real nginx syntax, health, SPA routing, runtime substitution and preserved nginx variables. Its fresh-image local smoke and the updated native Template API dry-run passed.
At application revision
62b47e1affcdf7d7f01ffee49ef72ed6c4a7be5e, all 24 PR checks passed, including CI, security, integration and browser acceptance, and three image publications. The packages remain private. The live images were copied into a regional private registry with manifest/blob SHA checks and a host-specific read-only pull credential.The recipe follow-up
dfeafa93516537b49b797bda16f494d61736564fcorrectslocal_fast_v2to the compiledlocal-fast-v2profile, uses a private 0700 transfer subdirectory and gives Worker exec probes time for Python/gRPC startup. These actual startup failures were reproduced before focused recovery. The new native runtime regression passed on the exact deployed 62b images under the preview security/resource constraints and joins the existing deployment-image gate. Revision-specific evidence is in CI, security, and Agent-memory/browser acceptance. Application code and live image provenance stay at 62b; the redundant optional image-publication run was cancelled.Real Sealos dry-run/admission/deployment and generic Web startup passed. All five workloads are Ready, all 7Gi of claims are bound, migration 27 and pgvector are active, authenticated bucket access succeeds and anonymous access returns 403. The operator completed real GitHub authorization, uploaded and previewed a nonsensitive fixture, reloaded it, confirmed the bound identity and retained the file after logout/relogin. Read-only checks found one user/identity and the expected owned file/SHA. An isolated Chromium download using the real downloadFile module passed event, filename and byte equality checks. Cloud in-app-browser download completion and live memory write/recall remain unverified. This PR stays a draft; it does not complete or close the broader hosted-SaaS roadmap.