Refactor authentication to use separate auth and exchange URLs#4
Closed
sripathikrishnan wants to merge 2 commits into
Closed
Refactor authentication to use separate auth and exchange URLs#4sripathikrishnan wants to merge 2 commits into
sripathikrishnan wants to merge 2 commits into
Conversation
The client now accepts two explicit endpoint URLs instead of a base server URL with hardcoded paths. This allows organizations implementing the API specification to use their own URL structure. Changes: - CredentialsManager now takes auth_url and exchange_url parameters - Environment variables changed from EXTRASUITE_SERVER_URL to AUTH_URL and EXCHANGE_URL - gateway.json now stores AUTH_URL and EXCHANGE_URL with full paths - Install scripts updated to write new gateway.json format - Updated tests, examples, and documentation https://claude.ai/code/session_01KfphVfs8NqMPUgPTZFAiVY
sripathikrishnan
force-pushed
the
claude/auth-api-spec-KXlKh
branch
from
f987e61 to
8c21aa7
Compare
Rename AUTH_URL and EXCHANGE_URL environment variables to EXTRASUITE_AUTH_URL and EXTRASUITE_EXCHANGE_URL to avoid potential conflicts with other tools that may use generic AUTH_URL variable names. Also fix pyright errors: - Add assertion for _exchange_url in _exchange_auth_code method - Add type: ignore comments for gspread imports (runtime dependency) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
sripathikrishnan
added a commit
that referenced
this pull request
Feb 9, 2026
Bug #4: Remove cell- prefix filter in engine.py that prevented cell style definitions from reaching _generate_cell_style_request(). Bug #12: Detect tab title changes in differ.py and emit updateDocumentTabProperties in walker.py. Bug #3: Generate content insertion requests for new tab bodies in walker.py. Move addDocumentTab to batch 1 in push.py and rewrite placeholder tab IDs to real IDs from the API response. All three fixes verified with live push + re-pull round-trip. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sripathikrishnan
added a commit
that referenced
this pull request
Feb 27, 2026
Security: - Move session_token from POST body to Authorization: Bearer header to prevent proxy/access log exposure (#1) - Atomic ownership check in revoke_session_token via expected_email param, eliminating TOCTOU race (#2) - Redact full session_hash from list_sessions when admin views another user's sessions; self-service callers retain it (#3) - Fix X-Forwarded-For to use rightmost (infra-injected) IP instead of first (spoofable) entry (#7) Correctness: - Ensure service account is provisioned at session establishment time (exchange_auth_code_for_session), enforcing the invariant that SA always exists for any v2 session; remove downstream or-"" fallbacks and 500 guard (#6) - Validate _server_base_url before opening browser to avoid post-auth failure when server URL is not configured (#4) - Raise ValueError instead of silently dropping extra scopes in v2 get_oauth_token (#5) - Apply SA_TOKEN_CACHE_SECONDS cap client-side for SA tokens (#8) UX: - Prompt for confirmation before revoking an existing valid session in auth login; skip prompt when stdin is not a tty (#9) - Use timezone.utc in all datetime.fromtimestamp calls in CLI output (#10) Fakes / tests: - Fix FakeDatabase.retrieve_auth_code to check flow_type and expiry before popping, preventing silent code destruction on type mismatch (#11) - Update FakeDatabase.revoke_session_token to accept expected_email (#2) Docs: - Fix stale pseudo_scope field name in database.py docstring (#12) - Document _explicit_auth_urls v2 activation edge case (#13) - Add type safety / None discipline principle to CLAUDE.md files Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR refactors the ExtraSuite authentication system to use separate, explicit endpoint URLs instead of a single server URL. This change makes the protocol more flexible and implementation-agnostic, allowing organizations to implement the authentication specification using their own infrastructure.
Key Changes
API Refactoring: Changed from single
--serverparameter to separate--auth-urland--exchange-urlparametersauth_url: Points to the authentication initiation endpoint (e.g.,https://server.com/api/token/auth)exchange_url: Points to the token exchange endpoint (e.g.,https://server.com/api/token/exchange)Environment Variables: Updated from
EXTRASUITE_SERVER_URLtoAUTH_URLandEXCHANGE_URLGateway Configuration: Updated
gateway.jsonformat to store both endpoint URLs instead of a single server URLinstall.shandinstall.ps1) to generate the new formatDocumentation: Added comprehensive
auth-spec.mddefining the ExtraSuite authentication protocolCode Updates:
CredentialsManagerto accept and use separate URLsbasic_usage.pyexample to demonstrate new parameter usageImplementation Details
_load_gateway_config()method now returns a dictionary with both URLs instead of a single stringauth_urlandexchange_urlare provided together (both required)auth_urldirectly without appending/api/token/authexchange_urldirectly without appending/api/token/exchangeBenefits
auth-spec.mdprovides a complete, implementation-agnostic protocol definition