feat: deprecate the oauth2 experiment in favor of CODER_OAUTH2_PROVIDER_ENABLE - #29257
feat: deprecate the oauth2 experiment in favor of CODER_OAUTH2_PROVIDER_ENABLE#29257BobbyHo wants to merge 3 commits into
Conversation
c66852f to
88c6c3e
Compare
…ER_ENABLE The oauth2 experiment no longer does anything. ReadExperiments drops it from the result and logs one warning per process naming the flag, so an admin whose OAuth2 clients start getting 404s after upgrading sees why. The constant stays known for one release so the warning can be specific; the next release removes it.
88c6c3e to
f4747c9
Compare
|
/coder-agents-review |
|
Chat: Review in progress (14/14 reviewers complete) | View chat deep-review v0.9.0 | Round 1 | Last posted: Round 1, 8 findings (3 P3, 2 Nit, 3 Note), COMMENT. Review Finding inventoryFinding inventory - PR #29257Findings
Round logRound 1Netero-only first pass: no findings, mechanical floor clean. Panel of 13 (Bisky, Hisoka, Mafu-san, Mafuuu, Pariston, Komugi, Gon, Leorio, Ging-go, Ryosuke, Takumi, Chopper, + Meruem wildcard). No P0-P2 confirmed. 3 P3, 2 Nit, 3 Note posted; 1 process nit in body; 3 design-preference notes dropped. Reviewed against 43812d8..f4747c9. Event: COMMENT. Downgrade notes:
About deep-reviewCRF = Coder Review Finding (P0-P4, Nit, Note)
|
There was a problem hiding this comment.
First full-panel pass (Netero first-pass came back clean, then 13 reviewers). This is a tight, well-scoped deprecation: 27 production lines, 75.9% test density, no drive-by refactor. The panel confirmed the important invariants hold. The value is dropped at the parse chokepoint so GET /api/v2/experiments, telemetry, and every Enabled() check see it off; lower-casing is hoisted above the switch, which quietly closes a real case-sensitivity hole where CODER_EXPERIMENTS=OAuth2 used to enable the provider; ExperimentsSafe is empty, so CODER_EXPERIMENTS=* cannot resurrect oauth2 through the wildcard; and the once-per-process warning is justified (coder server reads the experiment list four times at startup). The injectable sync.Once seam keeps the once-only test deterministic without leaking test state into production.
As Hisoka put it: "I came to fight this code. It fought back clean."
No P0-P2 confirmed. Findings: 3 P3, 2 Nit, 3 Note. The two P3s worth attention before this opens a release window: the published OAuth2 docs still tell operators to enable the provider with CODER_EXPERIMENTS=oauth2, which this PR turns into a warned no-op, and the warning text hard-commits removal "in the next release" with no linked ticket in the stated plan.
Process note: the commit subject and PR title run 78 characters, over the project's 72-char convention. Consider tightening (e.g. "feat(coderd): make the oauth2 experiment a no-op") and letting the body carry the flag name, which it already does well. Neither the orchestrator nor the author-agent can accept the two P3 gaps as permanent; each needs a human decision (fix here, or link a tracking ticket and confirm the docs correction lands before any release is cut from main).
docs/admin/integrations/oauth2-provider.md:11
P3 [CRF-1] The published OAuth2 provider docs still instruct operators to enable the provider with the oauth2 experiment, which this PR turns into a warned no-op. (Mafuuu P3, Leorio P3)
Same stale instruction at oauth2-provider.md:11, 20, 25, 28, 34, 401 and docs/ai-coder/mcp-server.md:108, 114, 186, 238 (coder server --experiments oauth2, "Requires the oauth2 experiment flag"). After this merges, the provider is gated on CODER_OAUTH2_PROVIDER_ENABLE, so an operator who follows these docs sets a deprecated value, sees a startup warning, and OAuth2 still does not turn on.
The PR description says "After this merges, main is safe to cut a release from," and lists docs as a later PR in the stack. So the release window opens with this merge, not the docs merge, and anyone reading a shipped doc in that window is instructed toward a dead flag. The runtime warning mitigates it (it names the real flag), which is why this is P3 and not higher. Either move the one-line doc correction into this PR, or make the ordering explicit: confirm the docs PR precedes any release cut from main and link its ticket.
🤖
🤖 This review was automatically generated with Coder Agents.
The deprecation warning promised removal in the next release, which no ticket backed. Removal is now tracked in PLAT-635, so the message says a future release and the code comment names the ticket. Co-Authored-By: Claude Fable 5.1 <[email protected]>
Trim the doc comment on the message constant to its purpose so it cannot drift from the literal. Assert the deprecation warning by count instead of an exact warn slice, which coupled the test to the safety classification of an unrelated experiment, and check explicitly that no unknown-experiment warning leaks. Co-Authored-By: Claude Fable 5.1 <[email protected]>
| ExperimentNotifications Experiment = "notifications" // Sends notifications via SMTP and webhooks following certain events. | ||
| ExperimentWorkspaceUsage Experiment = "workspace-usage" // Enables the new workspace usage tracking. | ||
| ExperimentOAuth2 Experiment = "oauth2" // Enables OAuth2 provider functionality. | ||
| ExperimentOAuth2 Experiment = "oauth2" // Deprecated: has no effect; use CODER_OAUTH2_PROVIDER_ENABLE. |
TL;DR
Third of five for PLAT-492.
CODER_EXPERIMENTS=oauth2is now a no-op. The server logs one warning namingCODER_OAUTH2_PROVIDER_ENABLEand never reports the experiment as enabled. After this merges,mainis safe to cut a release from.oauth2experiment a no-op with a startup warning.ReadExperimentsafter this ships; a leftover value then falls to the generic unknown-experiment warning.Implementation Details
ReadExperimentslower-cases each value, then matchesoauth2before the default branch. It logs the warning and does not append the value, soGET /api/v2/experiments, telemetry and everyExperiments.Enabledcheck see it as off.sync.Once.coder serverreads the experiment list several times during startup and each read would otherwise repeat the line.ReadExperimentsmoved intoparseExperiments, which takes thesync.Onceas a parameter. Tests pass their own guard, so they stay parallel and never touch the package-level one.codersdk.ExperimentOAuth2gains aDeprecatedcomment pointing at the flag. The generated swagger carries the same text.Tests
TestReadExperimentsDeprecatedOAuth2feedsoauth2andmcp-server-http, asserts the result is exactlymcp-server-http, and asserts the deprecation line is logged once across two reads. The second read usesOAuth2to cover the lower-casing.Test_Experimentsgains a subtest: acoderdtestserver configured withoauth2never lists it fromGET /api/v2/experimentsandEnabled(ExperimentOAuth2)is false.