elias/oh-my-opencode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(antigravity): sync plugin.ts with PKCE-removed oauth.ts API

Browse Source 
Remove decodeState import and update OAuth flow to use simple state
string comparison for CSRF protection instead of PKCE verifier.
Update exchangeCode calls to match new signature (code, redirectUri,
clientId, clientSecret).
This commit is contained in:
YeonGyu-Kim 2026-01-08 23:31:47 +09:00
parent 1e239e6155
commit 07412deca4
1 changed files with 11 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/auth/antigravity/plugin.ts
View File

@ -33,7 +33,6 @@ import {
exchangeCode, exchangeCode,
startCallbackServer, startCallbackServer,
fetchUserInfo, fetchUserInfo,
decodeState,
} from "./oauth" } from "./oauth"
import { createAntigravityFetch } from "./fetch" import { createAntigravityFetch } from "./fetch"
import { fetchProjectContext } from "./project" import { fetchProjectContext } from "./project"
@ -248,7 +247,7 @@ export async function createGoogleAntigravityAuthPlugin({
*/ */
authorize: async (): Promise<AuthOuathResult> => { authorize: async (): Promise<AuthOuathResult> => {
const serverHandle = startCallbackServer() const serverHandle = startCallbackServer()
const { url, verifier } = await buildAuthURL(undefined, cachedClientId, serverHandle.port) const { url, state: expectedState } = await buildAuthURL(undefined, cachedClientId, serverHandle.port)
const browserOpened = await openBrowserURL(url) const browserOpened = await openBrowserURL(url)
@ -277,15 +276,15 @@ export async function createGoogleAntigravityAuthPlugin({
return { type: "failed" as const } return { type: "failed" as const }
} }
const state = decodeState(result.state) if (result.state !== expectedState) {
if (state.verifier !== verifier) {
if (process.env.ANTIGRAVITY_DEBUG === "1") { if (process.env.ANTIGRAVITY_DEBUG === "1") {
console.error("[antigravity-plugin] PKCE verifier mismatch") console.error("[antigravity-plugin] State mismatch - possible CSRF attack")
} }
return { type: "failed" as const } return { type: "failed" as const }
} }
const tokens = await exchangeCode(result.code, verifier, cachedClientId, cachedClientSecret, serverHandle.port) const redirectUri = `http://localhost:${serverHandle.port}/oauth-callback`
const tokens = await exchangeCode(result.code, redirectUri, cachedClientId, cachedClientSecret)
if (!tokens.refresh_token) { if (!tokens.refresh_token) {
serverHandle.close() serverHandle.close()
@ -343,7 +342,7 @@ export async function createGoogleAntigravityAuthPlugin({
if (!addAnother) break if (!addAnother) break
const additionalServerHandle = startCallbackServer() const additionalServerHandle = startCallbackServer()
const { url: additionalUrl, verifier: additionalVerifier } = await buildAuthURL( const { url: additionalUrl, state: expectedAdditionalState } = await buildAuthURL(
undefined, undefined,
cachedClientId, cachedClientId,
additionalServerHandle.port additionalServerHandle.port
@ -373,24 +372,23 @@ export async function createGoogleAntigravityAuthPlugin({
continue continue
} }
const additionalState = decodeState(additionalResult.state) if (additionalResult.state !== expectedAdditionalState) {
if (additionalState.verifier !== additionalVerifier) {
additionalServerHandle.close() additionalServerHandle.close()
await client.tui.showToast({ await client.tui.showToast({
body: { body: {
message: "Verification failed, skipping...", message: "State mismatch, skipping...",
variant: "warning", variant: "warning",
}, },
}) })
continue continue
} }
const additionalRedirectUri = `http://localhost:${additionalServerHandle.port}/oauth-callback`
const additionalTokens = await exchangeCode( const additionalTokens = await exchangeCode(
additionalResult.code, additionalResult.code,
additionalVerifier, additionalRedirectUri,
cachedClientId, cachedClientId,
cachedClientSecret, cachedClientSecret
additionalServerHandle.port
) )
if (!additionalTokens.refresh_token) { if (!additionalTokens.refresh_token) {