mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 09:13:14 +00:00
cb4c643e43
* feat: open Slack-triggered PRs as the triggering user Route the Slack per-user GitHub token through the dashboard OAuth store (the backend the self-service link prompt populates) and block runs that lack a valid user token, prompting the user to (re-)link. Per-user OAuth now wins over bot-token-only mode for mapped Slack/dashboard users. Flip commit/PR authorship across all sources: the triggering user is the commit author (via repo-local git identity using their resolvable GitHub noreply email) and open-swe[bot] is the Co-authored-by collaborator. * fix: address PR review — shell-escape commit identity, fix token cache impersonation - Shell-escape the triggering user's name/email with shlex.quote before embedding them in the repo-setup `git config` command, so a name like O'Connor (or a crafted one) can't break or inject into the command. - Stop consulting the shared thread-metadata token cache in _resolve_dashboard_user_token. Slack thread ids are shared across the conversation, so a cached token from a prior triggering user could be returned for the current github_login. Always resolve by login from the dashboard OAuth store instead. * feat: dashboard self-service user mapping + UI cleanup - Add session-scoped GET/PUT /dashboard/api/my-mapping so users can set their own work email / Slack member ID (keyed by their GitHub login, source=self). - Slack account-link prompt now redirects to Profile Settings after auth. - Rename "My Settings" -> "Profile Settings" and "Cloud Agents" -> "Open SWE Agent"; remove the Integrations tab/section (folded out, low value for now) and redirect /integrations to Profile Settings. - Add a "User mapping" section to Profile Settings (work email used by Slack and Linear, optional Slack member ID). - Make dashboard auth cookies scheme-aware: Secure;SameSite=None over HTTPS, non-Secure;SameSite=Lax over http://localhost so local login works. * feat: self-service Slack account linking via Sign in with Slack (OIDC) Replace the spoofable manual work-email/Slack-ID form with a verified "Sign in with Slack" flow so a logged-in GitHub user can only ever link their own Slack identity. - New agent/dashboard/slack_oauth.py: OIDC authorize URL, code exchange, userInfo identity parse, optional workspace gate, configured check. - routes.py: session-gated GET /slack/login and /slack/callback that upsert the mapping from Slack-verified user_id + email (source=slack_oauth). Remove the spoofable PUT /my-mapping; expose slack_oauth_enabled on /me. - UI: drop the editable inputs; add a Connect Slack button + status to the User mapping section. Admin-managed mappings are unaffected and still resolve at trigger time.
36 lines
1.1 KiB
Python
36 lines
1.1 KiB
Python
from __future__ import annotations
|
|
|
|
from agent.utils.authorship import (
|
|
OPEN_SWE_BOT_EMAIL,
|
|
OPEN_SWE_BOT_NAME,
|
|
add_bot_coauthor_trailer,
|
|
resolve_triggering_user_identity,
|
|
)
|
|
|
|
_BOT_TRAILER = f"Co-authored-by: {OPEN_SWE_BOT_NAME} <{OPEN_SWE_BOT_EMAIL}>"
|
|
|
|
|
|
def test_add_bot_coauthor_trailer_appends_bot() -> None:
|
|
result = add_bot_coauthor_trailer("fix: thing")
|
|
assert result == f"fix: thing\n\n{_BOT_TRAILER}"
|
|
|
|
|
|
def test_add_bot_coauthor_trailer_is_idempotent() -> None:
|
|
once = add_bot_coauthor_trailer("fix: thing")
|
|
assert add_bot_coauthor_trailer(once) == once
|
|
|
|
|
|
def test_resolve_identity_from_config_uses_user_noreply_email() -> None:
|
|
config = {
|
|
"configurable": {
|
|
"source": "slack",
|
|
"github_login": "mason-gh",
|
|
"github_user_id": 4321,
|
|
"slack_thread": {"triggering_user_name": "Mason"},
|
|
}
|
|
}
|
|
identity = resolve_triggering_user_identity(config)
|
|
assert identity is not None
|
|
assert identity.commit_name == "Mason"
|
|
assert identity.commit_email == "4321+mason-gh@users.noreply.github.com"
|
|
assert identity.github_login == "mason-gh"
|