Skip to content

fix(app): recover when a sign-in proxy session expires - #52223

Closed
sbaidon wants to merge 2 commits into
anomalyco:devfrom
sbaidon:pwa-auth-gate
Closed

fix(app): recover when a sign-in proxy session expires#52223
sbaidon wants to merge 2 commits into
anomalyco:devfrom
sbaidon:pwa-auth-gate

Conversation

@sbaidon

@sbaidon sbaidon commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Issue for this PR

Part of #50481: expired-session recovery behind whole-site sign-in proxies. Callback-path exclusions are separate.

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Behind a sign-in proxy that gates every path, like Dev Tunnels, the app stays on "Loading" after the proxy session expires. The service worker serves navigations from cache, so the proxy never gets a chance to redirect to sign-in.

When a same-origin request fails (other than an abort), the web fetch checks /api/info without following redirects. If that is a redirect, it reloads the current page with ?reauth=1, which the service worker lets through to the network. After that it won't reload again until a same-origin request succeeds, so a proxy that keeps rejecting API requests after sign-in can't cause a reload loop.

Desktop is unaffected. Proxies that only gate /api aren't handled here.

How did you verify your code works?

  • New e2e/service-worker/sign-in-proxy.spec.ts with a fake proxy modelled on Dev Tunnels, and a ?reauth case in cache.spec.ts
  • bun run test:service-worker and bun run check
  • Recordings below: production build behind a fake proxy, headless Chromium with mobile emulation

Screenshots / recordings

Before

before.webm

After

after.webm

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

@github-actions

github-actions Bot commented Sep 30, 2026

Copy link
Copy Markdown
Contributor

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

  1. Open an issue describing the bug/feature (if one doesn't exist)
  2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.

@github-actions

github-actions Bot commented Sep 30, 2026

Copy link
Copy Markdown
Contributor

The following comment was made by an LLM, it may be inaccurate:

This was referenced Sep 30, 2026
Open
Closed
@thdxr
thdxr changed the base branch from v2 to dev October 10, 2026 19:24
@opencode-agent opencode-agent Bot mentioned this pull request Oct 21, 2026
Closed
@0xf3cd

0xf3cd commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Another whole-site proxy case from #57649: Caddy + Authelia in front of OpenCode 2.1.1. After the tab loses content without navigating to sign-in, signing in to Authelia separately restores the content.

Unauthenticated curl probes against the protected origin returned:

Request Response
GET /api/info, Accept: application/json 401 with Location pointing to the Authelia login
GET /, Accept: text/html 302 to the same login

I tested fetchThroughSignInProxy from f03f43b in isolated Chromium against a local HTTP fixture, removing only its two TypeScript annotations:

  • A cross-origin 302 caused one /api/info probe and navigation to sign-in.
  • A 401 + Location resolved normally, with no probe or navigation. A normal OpenCode-style 401 also stayed on the page.
  • Starting with ?reauth=1 suppressed recovery on another failed fetch; a successful same-origin request re-enabled it.

This tests the wrapper, not the full app or generated service worker. Another failing request could still recover this deployment, but the 401 + Location response alone doesn't trigger it.

Would an explicit 401 + Location case and a regression test fit this PR? I'd be happy to contribute those. Ordinary OpenCode 401 responses should keep their existing sign-in handling.

@0xf3cd 0xf3cd mentioned this pull request Oct 21, 2026
Open
3 of 6 tasks
@opencode-agent opencode-agent Bot mentioned this pull request Oct 21, 2026
Open
3 of 6 tasks
@github-actions

github-actions Bot commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

  • The PR was created more than 1 month ago
  • The PR had fewer than 2 positive reactions
  • Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.

@github-actions github-actions Bot closed this Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Hona Hona Awaiting requested review from Hona
@Brendonovich Brendonovich Awaiting requested review from Brendonovich

Assignees

No one assigned

Labels

automated-pr-cleanup

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sbaidon @0xf3cd