feat(oauth): add is_public field to OIDC client schemas#1356
feat(oauth): add is_public field to OIDC client schemas#1356
Conversation
Add is_public boolean to OAuthClientSchema, OAuthClientCreateRequestSchema, and OAuthClientUpdateRequestSchema so the app API proxy's zValidator passes the field through to Ion instead of stripping it.
|
The latest Agentuity deployment details.
|
📝 WalkthroughWalkthroughA new Changes
🚥 Pre-merge checks | ✅ 1✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
📦 Canary Packages Publishedversion: PackagesInstallAdd to your {
"dependencies": {
"@agentuity/opencode": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-opencode-2.0.9-1bb3457.tgz",
"@agentuity/react": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-react-2.0.9-1bb3457.tgz",
"@agentuity/schedule": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-schedule-2.0.9-1bb3457.tgz",
"@agentuity/sandbox": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-sandbox-2.0.9-1bb3457.tgz",
"@agentuity/queue": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-queue-2.0.9-1bb3457.tgz",
"@agentuity/claude-code": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-claude-code-2.0.9-1bb3457.tgz",
"@agentuity/cli": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-cli-2.0.9-1bb3457.tgz",
"@agentuity/email": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-email-2.0.9-1bb3457.tgz",
"@agentuity/evals": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-evals-2.0.9-1bb3457.tgz",
"@agentuity/keyvalue": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-keyvalue-2.0.9-1bb3457.tgz",
"@agentuity/db": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-db-2.0.9-1bb3457.tgz",
"@agentuity/runtime": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-runtime-2.0.9-1bb3457.tgz",
"@agentuity/task": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-task-2.0.9-1bb3457.tgz",
"@agentuity/core": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-core-2.0.9-1bb3457.tgz",
"@agentuity/workbench": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-workbench-2.0.9-1bb3457.tgz",
"@agentuity/auth": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-auth-2.0.9-1bb3457.tgz",
"@agentuity/postgres": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-postgres-2.0.9-1bb3457.tgz",
"@agentuity/schema": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-schema-2.0.9-1bb3457.tgz",
"@agentuity/webhook": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-webhook-2.0.9-1bb3457.tgz",
"@agentuity/coder": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-coder-2.0.9-1bb3457.tgz",
"@agentuity/frontend": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-frontend-2.0.9-1bb3457.tgz",
"@agentuity/migrate": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-migrate-2.0.9-1bb3457.tgz",
"@agentuity/server": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-server-2.0.9-1bb3457.tgz",
"@agentuity/coder-tui": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-coder-tui-2.0.9-1bb3457.tgz",
"@agentuity/drizzle": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-drizzle-2.0.9-1bb3457.tgz",
"@agentuity/vector": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-vector-2.0.9-1bb3457.tgz"
}
}Or install directly: bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-opencode-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-react-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-schedule-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-sandbox-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-queue-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-claude-code-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-cli-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-email-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-evals-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-keyvalue-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-db-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-runtime-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-task-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-core-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-workbench-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-auth-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-postgres-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-schema-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-webhook-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-coder-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-frontend-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-migrate-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-server-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-coder-tui-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-drizzle-2.0.9-1bb3457.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/2.0.9-1bb3457/agentuity-vector-2.0.9-1bb3457.tgz |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/core/src/services/oauth/types.ts`:
- Line 23: The response schema unconditionally defaults OAuthClientSchema's
is_public to true, which is unsafe; update the OAuthClientSchema definition (the
is_public field) to stop defaulting to true—either remove the .default(true) and
use .optional() to mirror request schemas or explicitly set .default(false) if
you need a default, so missing backend values aren't implicitly treated as
public.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 09ad128e-fbc5-4289-a494-67dd54d07735
📒 Files selected for processing (1)
packages/core/src/services/oauth/types.ts
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)
- GitHub Check: Agentuity Deployment
- GitHub Check: Template Integration Tests
- GitHub Check: SDK Integration Test Suite
- GitHub Check: Cloud Deployment Tests
- GitHub Check: Sandbox CLI Tests
- GitHub Check: Windows WSL CLI Smoke Test
- GitHub Check: Build
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Biome as code formatter with tabs (width 3), single quotes, semicolons, lineWidth 100, and trailingCommas es5
Files:
packages/core/src/services/oauth/types.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use TypeScript Strict mode with ESNext target and bundler moduleResolution
UseStructuredErrorfrom@agentuity/corefor error handling
Files:
packages/core/src/services/oauth/types.ts
packages/core/src/**/*.ts
📄 CodeRabbit inference engine (packages/core/AGENTS.md)
packages/core/src/**/*.ts: Build TypeScript withbun run buildcommand
Run TypeScript type checking withbun run typecheckcommand
Ensure runtime compatibility with both Browser and Node/Bun environments with no runtime-specific code
Build target must be ESNext with TypeScript declaration files
Prefer interfaces for public APIs
Use generics for reusable type utilities
Ensure no side effects in all exports - all exports must be pure with no global mutations
All relative imports in TypeScript files MUST include the.tsextension
Runbun run buildbefore publishing to compile TypeScript
Files:
packages/core/src/services/oauth/types.ts
🧠 Learnings (1)
📚 Learning: 2025-12-21T00:31:41.858Z
Learnt from: jhaynie
Repo: agentuity/sdk PR: 274
File: packages/cli/src/cmd/build/vite/server-bundler.ts:12-41
Timestamp: 2025-12-21T00:31:41.858Z
Learning: In Bun runtime, BuildMessage and ResolveMessage are global types and are not exported from the bun module. Do not import { BuildMessage } from 'bun' or similar; these types are available globally and should be used without import. This applies to all TypeScript files that target the Bun runtime within the repository.
Applied to files:
packages/core/src/services/oauth/types.ts
🔇 Additional comments (1)
packages/core/src/services/oauth/types.ts (1)
54-54: Good parity on create/update validators foris_public.Line 54 and Line 82 correctly make
is_publicaccepted on both request schemas, which matches the passthrough objective and prevents field stripping.Also applies to: 82-82
| id_token_lifetime_seconds: z.number().optional(), | ||
| allowed_user_ids: z.array(z.string()), | ||
| internal: z.boolean().optional().default(false), | ||
| is_public: z.boolean().default(true), |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether any OAuth response producers/consumers still omit `is_public`
# and would rely on the schema default.
rg -nP --type=ts -C3 '\bOAuthClientSchema\b|\bOAuthClientListItemSchema\b|APIResponseSchema\('
rg -nP --type=ts -C3 '\bis_public\b|\bclient_type\b' packages/core/src/services/oauthRepository: agentuity/sdk
Length of output: 50369
🏁 Script executed:
# Read the OAuth types file to see the exact schema definition
cat -n packages/core/src/services/oauth/types.ts | head -50Repository: agentuity/sdk
Length of output: 2179
🏁 Script executed:
# Search for where is_public is used/accessed in the codebase
rg -nP --type=ts 'is_public' --max-count=30 -B2 -A2Repository: agentuity/sdk
Length of output: 1202
🏁 Script executed:
# Search for OAuth handlers and API functions
rg -nP --type=ts 'OAuth.*[Cc]lient.*[Ss]chema|OAuthClientListItemSchema|OAuthClientCreateDataSchema|OAuthClientUpdateDataSchema' packages/core/src/services/oauth -B3 -A3Repository: agentuity/sdk
Length of output: 21797
🏁 Script executed:
# Search for code that accesses is_public after parsing responses
rg -nP --type=ts 'client\.is_public|item\.is_public|\bis_public\b' --max-count=20 -B2 -A2Repository: agentuity/sdk
Length of output: 1202
🏁 Script executed:
# Search for test files related to OAuth clients
find packages/core -name '*.test.ts' -o -name '*.spec.ts' | xargs grep -l -i oauth 2>/dev/null | head -5Repository: agentuity/sdk
Length of output: 95
🏁 Script executed:
# Check the OAuth test file
cat packages/core/test/env-example.test.ts | head -100Repository: agentuity/sdk
Length of output: 3734
🏁 Script executed:
# Search for any tests that might parse OAuth responses or mention is_public
find packages -name '*.test.ts' -o -name '*.spec.ts' | xargs grep -l 'OAuthClient' 2>/dev/nullRepository: agentuity/sdk
Length of output: 41
🏁 Script executed:
# Check for any comments or documentation about is_public in the OAuth service
rg -nP --type=ts 'is_public' packages/core/src/services/oauth -B5 -A1 | head -60Repository: agentuity/sdk
Length of output: 1901
Avoid defaulting a security-sensitive flag to true in response schemas.
Line 23 applies z.boolean().default(true) to the is_public field in OAuthClientSchema, which will silently coerce missing values to true. This asymmetry with request schemas—where is_public is .optional() without defaults—creates a defensive coding gap for a security-relevant field. If the backend ever omits or partially returns client data, misclassification to public becomes automatic rather than explicit.
Suggested change
- is_public: z.boolean().default(true),
+ is_public: z.boolean(),📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| is_public: z.boolean().default(true), | |
| is_public: z.boolean(), |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/core/src/services/oauth/types.ts` at line 23, The response schema
unconditionally defaults OAuthClientSchema's is_public to true, which is unsafe;
update the OAuthClientSchema definition (the is_public field) to stop defaulting
to true—either remove the .default(true) and use .optional() to mirror request
schemas or explicitly set .default(false) if you need a default, so missing
backend values aren't implicitly treated as public.
1 participant
Summary
is_public: z.boolean()toOAuthClientSchema(defaulttrue),OAuthClientCreateRequestSchema(optional), andOAuthClientUpdateRequestSchema(optional)zValidatorpassesis_publicthrough to Ion instead of stripping itRelated PRs
Summary by CodeRabbit