fix(auth): select OIDC signing key by kid - #1415
Conversation
|
Warning Review limit reached
Next review available in: 10 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughOIDC session decoding now requires one cached signing key with a matching token ChangesOIDC key verification
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Please perform an independent review for exact current head 3448274. Review only the current diff and current-head checks; do not dismiss reviews, bypass branch protection, update the base, or merge. |
|
Current-head review request for PR #1415. HEAD: 3448274 The OIDC verifier now selects exactly one cached signing key by the unverified Review this exact HEAD against current checks and active ruleset. Do not reuse approvals or failures from an earlier SHA; provide concrete findings with path:line evidence, regression verification, and a merge recommendation. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head3448274b080cffb4c59e67f76f128f9d61c77e89. -
Head SHA:
3448274b080cffb4c59e67f76f128f9d61c77e89 -
Workflow run: 32255885315
-
Workflow attempt: 1
Coverage evidence
Coverage evidence job did not run or did not publish coverage evidence.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Backend (2 files)"]
S1 --> I1["API and service runtime"]
I1 --> R1["Review risk: Backend (2 files)"]
R1 --> V1["backend tests"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage evidence job did not run or did not publish coverage evidence. Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Backend (2 files)"]
S1 --> I1["API and service runtime"]
I1 --> R1["Review risk: Backend (2 files)"]
R1 --> V1["backend tests"]
|
|
PR governance metadata gate is not ready for
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Revalidated current head |
|
Current head |
ada12ff to
e0a1f16
Compare
Stale review: cited a coverage-evidence/required-check failure on an earlier commit; current head has been verified (gh pr checks) to pass coverage-evidence and all other non-metadata-gate required checks, with no current-head review from this reviewer. Dismissing as superseded per AGENTS.md stale-review guidance.
opencode-agent
Bot
added
area: auth
|
Caution Review failedAn error occurred during the review process. Please try again later. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Important Approval pendingCodeRabbit has no unresolved comments, but it has not reviewed the latest commit. Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Exact-head maintenance evidence
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 2 new potential issues.
⚠️ 1 issue in files not directly in the diff
⚠️ Percent escapes corrupt attachment names
Any valid percent escape in an attachment name is decoded by unquote, although MIME filenames treat percent signs literally. Users see renamed attachments, and encoded separators can change extension-based parser selection.
1 participant
Summary
kidheader before signature verification.kidnever invokes JWT decoding, even when decoy cached keys exist.This remains intentionally isolated from unrelated provider/model work; the effective PR diff is only
backend/api/auth.pyandbackend/tests/test_auth_real.py.Current exact candidate
develop@042b0c70531b229af3acbd0421a2f23098d848b3f576eefce98bdc44dc03eed88510f60c3e6cccd9developinto the existing branch.develop...HEAD: behind 0; effective diff remains the two OIDC files above.Focused verification
The established focused commands remain:
The current exact head has recreated hosted checks. Queued jobs are not passing evidence; predecessor-head checks/reviews do not transfer after this base refresh.
Merge boundary
Merge only if this unchanged exact head satisfies every then-live required CI/security/coverage/container/workflow gate, all actionable review threads are resolved, and the effective protected-branch/ruleset review policy is satisfied. Do not self-approve or bypass protection. Queued, pending, skipped-required, cancelled, absent, stale, predecessor-head, status-only, author-only, or model-only evidence is non-passing.
Summary by CodeRabbit