fix(oauth): use registered redirect_uri for Codex on remote access - #75
Conversation
When accessing OmniRoute remotely (e.g. llms.omniroute.online), the Codex OAuth redirect_uri was incorrectly set to http://localhost:443/callback. OpenAI only accepts the registered http://localhost:1455/auth/callback. This caused 'unknown_error' on auth.openai.com for remote users. Other providers (Google-based: Antigravity, Gemini) are unaffected as Google OAuth accepts any localhost port.
|
@codex review |
Summary of ChangesHello @diegosouzapw, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request resolves a critical authentication problem for Codex (OpenAI) when users attempt to access OmniRoute remotely. By ensuring the correct, pre-registered Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
To use Codex here, create a Codex account and connect to github. |
There was a problem hiding this comment.
Pull request overview
This PR fixes a bug in the Codex OAuth flow when accessing OmniRoute remotely. Previously, when remote users attempted to authenticate, the redirect URI was incorrectly constructed as http://localhost:443/callback, which is not registered with OpenAI. The fix ensures Codex always uses the correct registered redirect URI: http://localhost:1455/auth/callback.
Changes:
- Updated OAuthModal to use the fixed registered redirect URI for Codex OAuth flows
- Added provider-specific logic to distinguish between Codex (requiring fixed port 1455) and other providers (accepting dynamic ports)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // Codex (OpenAI) requires exactly http://localhost:1455/auth/callback — the registered URI. | ||
| // Other providers (Antigravity/Gemini via Google OAuth) accept any localhost port. | ||
| let redirectUri: string; | ||
| if (provider === "codex" || provider === "openai") { |
There was a problem hiding this comment.
The condition checks for provider === "openai", but "openai" is not a registered provider in the PROVIDERS map (src/lib/oauth/providers/index.ts) or in the provider constants (src/shared/constants/providers.ts). Only "codex" exists as an OAuth provider. This check is unreachable dead code and should be removed. The condition should simply be if (provider === "codex").
| if (provider === "codex" || provider === "openai") { | |
| if (provider === "codex") { |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly fixes an OAuth issue for the Codex provider during remote access by using the registered redirect_uri. The change also applies this fix to the openai provider, which is a reasonable approach since both use OpenAI's authentication system. The implementation is sound, but I have a minor suggestion to improve the code's maintainability for the provider check.
| if (provider === "codex" || provider === "openai") { | ||
| redirectUri = "http://localhost:1455/auth/callback"; | ||
| } else { | ||
| const port = window.location.port || (window.location.protocol === "https:" ? "443" : "80"); | ||
| redirectUri = `http://localhost:${port}/callback`; | ||
| } |
There was a problem hiding this comment.
To improve readability and future maintainability, it's better to use an array with includes() for checking the provider. This approach is more scalable if you need to add more providers that require this specific redirect URI in the future. I'd also recommend extracting the hardcoded redirect URI into a constant defined at a suitable scope.
| if (provider === "codex" || provider === "openai") { | |
| redirectUri = "http://localhost:1455/auth/callback"; | |
| } else { | |
| const port = window.location.port || (window.location.protocol === "https:" ? "443" : "80"); | |
| redirectUri = `http://localhost:${port}/callback`; | |
| } | |
| if (["codex", "openai"].includes(provider)) { | |
| redirectUri = "http://localhost:1455/auth/callback"; | |
| } else { | |
| const port = window.location.port || (window.location.protocol === "https:" ? "443" : "80"); | |
| redirectUri = `http://localhost:${port}/callback`; | |
| } |
fix(oauth): use registered redirect_uri for Codex on remote access
When accessing OmniRoute remotely, Codex OAuth redirect_uri was set to http://localhost:443/callback — not registered with OpenAI. Now uses http://localhost:1455/auth/callback.