fix(oauth): recover instead of locking out when a reused grant lacks event_definition:write - #1067
Draft
posthog[bot] wants to merge 1 commit into
Draft
Conversation
…event_definition:write A Wizard authorization issued before event_definition:write became required (#914) is reused by PostHog on re-login: it skips the consent screen and reissues the old, narrower scope set. The login flow hard-asserted the scope and called abort(), dead-ending the run at login with a manual "revoke and rerun" instruction. Now the flow forces the consent screen once (prompt=consent) to widen the grant, and if that still doesn't yield the scope it degrades — the run continues and only the end-of-session event-definition creation is skipped. Also fingerprint the degraded-path capture ($exception_fingerprint) so it collapses into a single error-tracking issue instead of fragmenting across each user's npx cache path in the stack trace. Generated-By: PostHog Code Task-Id: 6b4d17fb-4d90-4775-bea4-c3fd0222637c
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Results will be posted here when complete. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
event_definition:writebecame required (fix(oauth): request event definition write scope #914,1474bc7, 2026-07-20). PostHog reuses that approval and skips the consent screen, so the new token comes back with the old, narrower scope set.assertWizardCompletionScopehard-throws on the missing scope and the login call site responds withawait abort()— the run dies before any setup work, and the only self-service recovery is manually revoking the authorization in PostHog settings.performLoginand the agent-runnerauthenticatepath), on Windows and Linux alike.$exception_fingerprint, so error tracking fingerprinted off the stack trace — which embeds each user's npx cache path and the per-release content-hashed bundle name — shattering one bug across ~10 issues, none showing more than 9 events.Changes
event_definition:write, force the consent screen once withprompt=consentto widen the grant.OAuthConfiggains apromptConsentflag;performOAuthFlowsetsprompt=consenton the authorize request when it's set.prompt=consent, or the user declines): continue the run and skip only the end-of-session event-definition creation, with a warning — a degraded run beats a total block on onboarding.$exception_fingerprint: 'wizard_oauth_missing_completion_scope', mirroringsrc/utils/oauth.ts) so it collapses into one issue that reports its real severity. Because the path no longerabort()s +process.exit()s immediately after capture, the event flushes normally with itsstepcontext instead of racing shutdown.assertWizardCompletionScopeis refactored onto a new non-throwinghasWizardCompletionScope; the login flow uses the latter to branch (retry → degrade) instead of the assertion's hard throw.Note
prompt=consentis a best-effort optimization — not relied upon. If the PostHog OAuth server honors it (standard OAuth2/OIDC param), the affected user gets a fully-scoped token and full functionality restored; if not, the degrade path still unblocks the run. Either way the lockout is gone.Test plan
pnpm build && pnpm test— 1732 pass / 122 files.pnpm lint— 0 errors (only pre-existing warnings).hasWizardCompletionScopedetects presence/absence without throwing.promptConsent: true) when a reused grant lacks the scope, and captures nothing when consent widens it.step/missing_scopecontext.Important
Overlaps with #1060 (
fix(oauth): degrade instead of dying when a scope predates its ceiling edit), which touches the same files. That PR fixes a different failure mode — a scope missing from the OAuth app's server-side ceiling, which fails the whole authorize request withinvalid_scopebefore consent — by dropping pending scopes. This PR fixes a granted-but-narrow reused token (scope is in the ceiling; the old approval is reused and returns the narrower set), which #1060's scope-dropping does not clear. The two are complementary; whoever merges second should expect a small conflict insrc/utils/oauth.tsaround the authorize-URL params.LLM context
Investigated and implemented by a PostHog coding agent (Claude). The
prompt=consentround trip was not exercised against a live PostHog OAuth server; the scope-branch logic and the degrade path are unit-tested.Created with PostHog Desktop from this inbox report.