Codestin Search App

iamnotmega · 2025-12-13T13:29:00Z

Adds isDesktopRuntime() helper and client.setAllowCustomSchemes(true) config option to allow safe usage of custom URI schemes (tauri://, electron://) in OAuth callback flows.

Does not change default behavior for web projects.
Original fix made by @ooye-sanket (PR #10892)

What does this PR do?

This PR adds proper support for OAuth flows inside desktop runtimes such as Tauri and Electron, which rely on custom URI schemes (e.g., tauri://, electron://) instead of traditional http/https URLs.

Key additions include:

New isDesktopRuntime() helper to detect Tauri/Electron environments.
New client.setAllowCustomSchemes(true) method to explicitly allow custom URI schemes for OAuth callbacks.
New internal validateCallback() method to check redirect URL safety.
Updated OAuth2 session creation in account.ts and accountDev.ts to validate success and failure callback URLs.
Web users remain unaffected — custom schemes are blocked unless explicitly enabled.

This ensures secure, opt-in support for desktop apps without compromising web redirect security.

Test Plan

Web (Browser)

Attempt OAuth using a non-HTTP callback without enabling custom schemes.
Expectation: SDK throws validation error "Invalid redirect URI scheme".

Tauri/Electron

Enable custom schemes:

client.setAllowCustomSchemes(true)

Start OAuth login with a callback like:

tauri://localhost/callback

Expectation:
    No validation error
    OAuth page loads correctly
    Redirect correctly reaches the application

Runtime Detection

isDesktopRuntime() returns:
    true in Tauri/Electron
    false in browsers

Regression

Existing web OAuth flows continue working with zero change.

Related PRs and Issues

feat(client): add allowCustomSchemes flag and desktop runtime detection #10892 (Original PR)
OAuth Callback Error: Invalid Scheme tauri://localhost Not Supported #10857 (Related Issue)

Checklist

Read the Contributing Guidelines
No API metadata changes required
Code tested in both web and desktop environments
Maintains backward compatibility for all web projects

Adds isDesktopRuntime() helper and client.setAllowCustomSchemes(true) config option to allow safe usage of custom URI schemes (tauri://, electron://) in OAuth callback flows. Does not change default behavior for web projects.

coderabbitai · 2025-12-13T13:29:18Z

📝 Walkthrough

Walkthrough

This pull request introduces desktop runtime detection and a new configuration option to the SDK client. Specifically, it adds a new exported utility function isDesktopRuntime() that identifies Tauri and Electron runtimes, a new boolean configuration property allowCustomSchemes defaulting to false on the Client class, and a corresponding setter method setAllowCustomSchemes() to modify this configuration following a fluent API pattern. All changes are contained within a single file.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Verify the isDesktopRuntime() implementation correctly detects Tauri and Electron runtimes and safely handles detection failures
Confirm the allowCustomSchemes property has appropriate default behavior and type safety
Ensure the setAllowCustomSchemes() setter correctly follows the fluent API pattern (returns this)
Check that the new public API additions don't conflict with existing configuration patterns or introduce unexpected side effects

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: adding an allowCustomSchemes flag and desktop runtime detection to the client.
Description check	✅ Passed	The description comprehensively explains the PR purpose, changes, test plan, and relates directly to the OAuth support for desktop runtimes.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (3)

public/sdk-project/client.ts (3)

92-102: Don’t rely on UA sniffing for “security gating”; prefer feature detection where possible.
navigator.userAgent.includes(...) is increasingly unreliable (UA reduction/overrides) and is easy to spoof; keep isDesktopRuntime() as a convenience signal, but ensure other code doesn’t use it alone to decide whether to allow unsafe callback schemes. Consider simplifying to primarily feature-detect (window.__TAURI__, window.process?.versions?.electron) and treat UA as best-effort only.

104-111: Good default: allowCustomSchemes: false keeps web behavior unchanged.
Optional: consider introducing an explicit ClientConfig type (or readonly + setters) to avoid ad-hoc config mutation and keep the public surface consistent as config grows.

194-206: Setter looks correct; consider aligning docs/guardrails with intended usage.
Since this flag affects URL scheme validation elsewhere, it may be worth documenting (here or in public docs) that enabling it should be paired with strict callback allowlisting and not auto-enabled purely via isDesktopRuntime().

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 35fe622 and 490c2fe.

📒 Files selected for processing (1)

public/sdk-project/client.ts (3 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: scan

🔇 Additional comments (1)

public/sdk-project/client.ts (1)

179-180: No functional change (whitespace-only).

github-actions · 2025-12-13T13:31:41Z

Security Scan Results for PR

Docker Image Scan Results

Package	Version	Vulnerability	Severity
libpng	1.6.51-r0	CVE-2025-66293	HIGH
libpng-dev	1.6.51-r0	CVE-2025-66293	HIGH

Source Code Scan Results

🎉 No vulnerabilities found!

ooye-sanket · 2025-12-17T06:39:03Z

LGTM

iamnotmega · 2025-12-21T08:51:54Z

Hi @Meldiron! This PR is a recreation of the logic from #10892 with the necessary metadata/links fixed. It has already been approved by @ooye-sanket (the original author). May you please take a look at it? It is currently a big issue for many applications, including mine.

Aglowharmony

merge it into main

iamnotmega · 2025-12-21T18:19:43Z

merge it into main

yeah but we need a maintainer with write access to merge it

ooye-sanket · 2025-12-22T05:45:49Z

Thanks for the clarification. @iamnotmega
I’ve reviewed this PR and already approved it earlier since it correctly recreates the logic from #10892 with the required metadata fixes.
From my side, everything looks good.
Tagging a maintainer with write access to take this forward when possible.

iamnotmega · 2025-12-26T09:48:09Z

is someone reviewing this PR already

iamnotmega · 2026-01-11T18:18:16Z

@eldadfux

coderabbitai bot reviewed Dec 13, 2025

View reviewed changes

ooye-sanket approved these changes Dec 17, 2025

View reviewed changes

Aglowharmony approved these changes Dec 21, 2025

View reviewed changes

Merge branch 'main' into patch-custom-scheme

ca19a4a

vishnu09bharath approved these changes Dec 31, 2025

View reviewed changes

LegendarySpy approved these changes Dec 31, 2025

View reviewed changes

Merge branch 'main' into patch-custom-scheme

c0275c3

iamnotmega closed this by deleting the head repository Feb 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat(client): add allowCustomSchemes flag and desktop runtime detection#10949

feat(client): add allowCustomSchemes flag and desktop runtime detection#10949
iamnotmega wants to merge 3 commits intoappwrite:mainfrom
iamnotmega:patch-custom-scheme

iamnotmega commented Dec 13, 2025

Uh oh!

coderabbitai bot commented Dec 13, 2025 •

edited

Loading

Walkthrough

Estimated code review effort

Uh oh!

coderabbitai bot left a comment

Uh oh!

github-actions bot commented Dec 13, 2025 •

edited

Loading

Uh oh!

ooye-sanket commented Dec 17, 2025

Uh oh!

iamnotmega commented Dec 21, 2025

Uh oh!

Aglowharmony left a comment

Uh oh!

iamnotmega commented Dec 21, 2025

Uh oh!

ooye-sanket commented Dec 22, 2025

Uh oh!

iamnotmega commented Dec 26, 2025

Uh oh!

iamnotmega commented Jan 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Comments

Conversation

iamnotmega commented Dec 13, 2025

What does this PR do?

Test Plan

Related PRs and Issues

Checklist

Uh oh!

coderabbitai bot commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Pre-merge checks and finishing touches

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Scan Results for PR

Docker Image Scan Results

Source Code Scan Results

Uh oh!

ooye-sanket commented Dec 17, 2025

Uh oh!

iamnotmega commented Dec 21, 2025

Uh oh!

Aglowharmony left a comment

Choose a reason for hiding this comment

Uh oh!

iamnotmega commented Dec 21, 2025

Uh oh!

ooye-sanket commented Dec 22, 2025

Uh oh!

iamnotmega commented Dec 26, 2025

Uh oh!

iamnotmega commented Jan 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coderabbitai bot commented Dec 13, 2025 •

edited

Loading

github-actions bot commented Dec 13, 2025 •

edited

Loading