fix(desktop): local-session 403 no longer forces register/login - #87
Closed
XYAIStudio wants to merge 1 commit into
Closed
XYAIStudio wants to merge 1 commit into
XYAIStudio wants to merge 1 commit into
Conversation
Packaged WebView retries of POST /api/auth/local-session were returning 403 when the existing ~/.freeos DB had more than one user or OCTOP_DESKTOP was shadowed on Windows, then AuthGuard dropped into register/login. Issue a studio JWT on this device (loopback, *.localhost, Origin, or desktop env), overlay launch env so Windows keeps OCTOP_DESKTOP=1, and remember ?desktop=1 before the SPA replaces / with /projects. Co-authored-by: XYAI Labs <haoboy8@gmail.com>
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Desktop 0.0.4 still showed the old register/login wall because
POST /api/auth/local-sessionreturned 403 Forbidden (userhost.log: repeated 403s, then AuthGuard fell through to/login).Root cause: the endpoint only auto-picked an existing user when
OCTOP_DESKTOPwas visible. Returning~/.freeosDBs often have extra rows (org-mapped users). On Windows, a leftoverOCTOP_DESKTOP=0in the parent env also shadowed the shell’s=1(CreateProcess keeps the first duplicate). Separately, React Router replaced/?desktop=1with/projectsbefore AuthGuard could remember the Wails shell, so retries were not treated as desktop.What changed
*.localhost/ Origin-or-Referer-on-this-device always adopt a studio session (guest or preferred existing admin). Remote clients still get 403.OCTOP_DESKTOP=1wins.?desktop=1at boot and preserves it on/→/projects; desktop shell never navigates to login.Authorization: Beareris no longer forwarded to organization identity (theIllegal header value b'Bearer 'noise).Before / after
/chat/main~/.freeos, no JWTHost: example.comTest plan
uv run pytest tests/unit/users/test_local_session.py tests/integration/test_local_session.py tests/unit/api/test_jwt_auth_middleware.py tests/unit/api/test_org_identity.py tests/unit/test_org_integration.pynpx vitest runAuthGuard / Login / desktopShell / request.setupnpx tsc --noEmitindashboard/make all(not run in this agent; CI on the PR)Packaging / Windows rebuild is left to the coordinator after merge.
Target branch
main(urgent desktop hotfix; user-requested)