Skip to content

bug(antigravity): manual OAuth callbacks discard authorization denial #587

Description

@ooiuuii

Problem

Antigravity's manual OAuth callback path does not recognize provider denial URLs. A pasted callback containing error=access_denied and the current login's state is discarded because it has no code. The login requests another manual input instead of reporting the denial. If the user stops responding, the original failure is eventually replaced by a cancellation or timeout.

The localhost HTTP callback path already rejects the same matching-state response with Authorization failed: access_denied.

Observed against main f6b49ae59605b1276b8267f2886d22c03f01533c, Node 22.22.3 on Windows, using the real loginAntigravity entry point and localhost callback server with synthetic OAuth data. No live account was used.

Value

Users relying on manual callback entry, including browser/terminal sessions on different machines, should get the original authorization failure promptly. A rejected sign-in is not another request for an authorization code.

Approach

Keep the existing OAuth owner and both input paths. Recognize an error response in manual callback parsing and reject only when its state exactly matches this login. Keep mismatched or missing-state denial URLs non-terminal, and preserve successful callback and raw-code behavior.

No provider routing, credentials, refresh policy, or new authentication surface is needed.

Validation

Reproduction using the real login function:

  1. Capture the generated authorization URL's redirect_uri and state from onAuth.
  2. Return <redirect_uri>?error=access_denied&state=<current-state> from onManualCodeInput without sending an HTTP callback.
  3. Record whether the manual input callback is invoked again and whether token exchange runs.

Expected: one prompt, rejection with Authorization failed: access_denied, no token exchange.

Before fix: the second prompt is reached. A deterministic test aborts there to avoid waiting for the login deadline and observes Login cancelled, failing the expected original error assertion. The five success/state controls pass on the unchanged code.

The regression suite should also retain raw authorization codes, successful callback URLs with and without state, and ignoring denial URLs with wrong or absent state until valid input arrives.

Impact

  • User-visible: preserves the original matching authorization denial instead of asking repeatedly or timing out.
  • Model-visible context/tools: none.
  • Runtime/lifecycle: the manual path should terminate the existing callback/input race on an authenticated denial, using its existing cleanup.
  • Persisted config/data: none.
  • Compatibility/risk: successful manual inputs stay compatible; only an exact matching-state error may terminate the login.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions