From d1ef06cb5e343c46dc2a354e48e18971a7570491 Mon Sep 17 00:00:00 2001 From: Supra4E8C Date: Fri, 10 Jul 2026 16:17:01 +0800 Subject: [PATCH] fix(oauth): hide completed sessions from legacy getter --- .../api/handlers/management/oauth_sessions.go | 2 +- .../handlers/management/oauth_sessions_test.go | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/internal/api/handlers/management/oauth_sessions.go b/internal/api/handlers/management/oauth_sessions.go index a4318ffd..32c4463e 100644 --- a/internal/api/handlers/management/oauth_sessions.go +++ b/internal/api/handlers/management/oauth_sessions.go @@ -259,7 +259,7 @@ func CompletePluginOAuthSessionsByProvider(provider string) int { func GetOAuthSession(state string) (provider string, status string, ok bool) { session, ok := oauthSessions.Get(state) - if !ok { + if !ok || session.Completed { return "", "", false } return session.Provider, session.Status, true diff --git a/internal/api/handlers/management/oauth_sessions_test.go b/internal/api/handlers/management/oauth_sessions_test.go index 8e163d35..17ebdab1 100644 --- a/internal/api/handlers/management/oauth_sessions_test.go +++ b/internal/api/handlers/management/oauth_sessions_test.go @@ -26,6 +26,23 @@ func TestOAuthSessionStoreCompleteKeepsShortLivedSession(t *testing.T) { } } +func TestGetOAuthSessionHidesCompletedSession(t *testing.T) { + store := newOAuthSessionStore(time.Minute) + replaceOAuthSessionStoreForTest(t, store) + store.Register("completed-state", "codex") + store.Complete("completed-state") + + provider, status, ok := GetOAuthSession("completed-state") + if ok { + t.Fatalf("GetOAuthSession() = (%q, %q, true), want completed session hidden", provider, status) + } + + _, _, _, _, completed, detailsOK := GetOAuthSessionDetails("completed-state") + if !detailsOK || !completed { + t.Fatalf("GetOAuthSessionDetails() completed/ok = %t/%t, want true/true", completed, detailsOK) + } +} + func TestGetAuthStatusRejectsUnknownStateAndAcceptsCompletedState(t *testing.T) { store := newOAuthSessionStore(time.Minute) replaceOAuthSessionStoreForTest(t, store)