OAuth callback does not update wizard state — tokens stored but unusable #8

New issue

Closed

opened 2026-05-09 05:18:21 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 05:18:21 +00:00

Owner

Severity: Medium

Files: src/components/wizard/OAuthCallback.tsx, src/lib/oauth.ts

Issue: The OAuth flow works through these steps:

User clicks OAuth switch → initiateOAuthFlow() redirects to provider
Provider redirects back to /oauth/callback
handleOAuthCallback() exchanges the code for tokens and stores them via storeTokens()
User is redirected back to the wizard (window.location.origin + pathname)

Problem: After step 4, the wizard state still has:

state.useOAuth === false (because the OAuthCallback never calls updateState({ useOAuth: true }))
state.apiKey === (no API key was entered, OAuth was used instead)

This means the ProviderStep will show as unconfigured, and downstream LLM calls won't find the OAuth tokens. The getAuthToken() function in oauth.ts does check for stored tokens, but the shouldUseOAuth() function depends on state.useOAuth being true.

Fix: The OAuthCallback component should call the wizard's updateState to set useOAuth: true after a successful token exchange. Currently OAuthCallback is rendered outside the WizardProvider context in App.tsx.

**Severity:** Medium **Files:** `src/components/wizard/OAuthCallback.tsx`, `src/lib/oauth.ts` **Issue:** The OAuth flow works through these steps: 1. User clicks OAuth switch → `initiateOAuthFlow()` redirects to provider 2. Provider redirects back to `/oauth/callback` 3. `handleOAuthCallback()` exchanges the code for tokens and stores them via `storeTokens()` 4. User is redirected back to the wizard (`window.location.origin + pathname`) **Problem:** After step 4, the wizard state still has: - `state.useOAuth === false` (because the OAuthCallback never calls `updateState({ useOAuth: true })`) - `state.apiKey === ` (no API key was entered, OAuth was used instead) This means the ProviderStep will show as unconfigured, and downstream LLM calls won't find the OAuth tokens. The `getAuthToken()` function in oauth.ts does check for stored tokens, but the `shouldUseOAuth()` function depends on `state.useOAuth` being true. **Fix:** The OAuthCallback component should call the wizard's `updateState` to set `useOAuth: true` after a successful token exchange. Currently OAuthCallback is rendered outside the WizardProvider context in App.tsx.