ProviderStep allows proceeding with OAuth providers before authentication is complete #7

New issue

Closed

opened 2026-05-09 05:18:11 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 05:18:11 +00:00

Owner

Severity: Medium

File: src/components/wizard/ProviderStep.tsx lines 25-29

Issue: The validation logic for enabling the "Next" button is:

const isValid = isDefault || isOllama || isOAuthProvider || state.useOAuth || 
  (isOpenAICompatible 
    ? state.openaiCompatibleEndpoint.trim().length > 0
    : state.apiKey.trim().length > 0
  );

The condition isOAuthProvider evaluates to true simply because the selected provider supports OAuth (e.g., Anthropic, Google, GitHub Copilot). The user can click "Next" without:

Actually initiating the OAuth flow
Having any valid tokens
Entering an API key as fallback

This means the user can proceed to the Models step with no valid authentication credential, and the LLM calls will fail downstream.

Fix: Either:

Require state.useOAuth === true instead of just isOAuthProvider
Or require an API key when OAuth is not enabled
Or validate that valid OAuth tokens exist after the flow completes

**Severity:** Medium **File:** `src/components/wizard/ProviderStep.tsx` lines 25-29 **Issue:** The validation logic for enabling the "Next" button is: ```typescript const isValid = isDefault || isOllama || isOAuthProvider || state.useOAuth || (isOpenAICompatible ? state.openaiCompatibleEndpoint.trim().length > 0 : state.apiKey.trim().length > 0 ); ``` The condition `isOAuthProvider` evaluates to `true` simply because the selected *provider supports OAuth* (e.g., Anthropic, Google, GitHub Copilot). The user can click "Next" without: - Actually initiating the OAuth flow - Having any valid tokens - Entering an API key as fallback This means the user can proceed to the Models step with no valid authentication credential, and the LLM calls will fail downstream. **Fix:** Either: 1. Require `state.useOAuth === true` instead of just `isOAuthProvider` 2. Or require an API key when OAuth is not enabled 3. Or validate that valid OAuth tokens exist after the flow completes