Skip to content

[22/33] fix(auth): restore issuer clients and verify public OAuth metadata - #216

Draft
mmattbtw wants to merge 5 commits into
feature/obbpr-21-scrobble-editingfrom
feature/obbpr-22-oauth-recovery
Draft

mmattbtw wants to merge 5 commits into
feature/obbpr-21-scrobble-editingfrom
feature/obbpr-22-oauth-recovery

Conversation

@mmattbtw

@mmattbtw mmattbtw commented Sep 10, 2026

Copy link
Copy Markdown
Member

Restore issuer clients and verify public oauth metadata. This groups the existing commits by chronology and the area they change.

Part 22 of 33 replacing #113. Review this PR against feature/obbpr-21-scrobble-editing. Merge the stack from oldest to newest. The original obbpr branch remains unchanged at d3cf209d6ab5ae6d3b2b7ac353b3dbb7d54fe133 for rollback.

Commits in this group:

  • fdc5c11 chore: verify oauth tunnel metadata
  • 37f7696 docs: record oauth preflight qa
  • 952dc36 fix(amethyst): restore oauth clients from issuer
  • 5c0ddcc docs(todo): remove popfeed from active branch
  • db86627 docs(preview): publish stable preview workflow

Validation: checked the branch ancestry and confirmed that the final stack tree exactly matches obbpr. This split preserves existing commits and merge history; no source edits or new build/test runs. Intermediate snapshots have not been independently validated, so these PRs start as drafts. Historical main merges are preserved.

Stack navigation:

mmattbtw added 5 commits June 14, 2026 19:42
Strengthen the stable preview verifier to validate OAuth client metadata values, DPoP settings, and latest-play JSON shape.

Document the stricter verifier and update todo.md with the current OAuth preflight evidence.
Document that the stable preview can resolve a handle and reach the account provider authorization page with the sigilyph client metadata. The remaining OAuth QA now explicitly requires credentialed callback and session-restore verification.
Persist the resolved OAuth issuer and rebuild callback/restore clients from the callback issuer so non-bsky PDS sign-ins do not reuse the initial client after redirect.
Move Popfeed work to feature/popfeed-sync and remove the Popfeed tracker entry from the active feature branch handoff.
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant