fix(coinbase): modernize OAuth integration - #1901
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1901 +/- ##
==========================================
+ Coverage 87.17% 87.29% +0.11%
==========================================
Files 352 352
Lines 13624 13696 +72
Branches 671 674 +3
==========================================
+ Hits 11877 11956 +79
+ Misses 1504 1495 -9
- Partials 243 245 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 23bb3fd2e4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Coinbase's legacy OAuth contract and unversioned user requests can cause otherwise valid logins to fail with 403 responses. Adopt the current endpoints, scopes, version header, and revocation parameters, and treat provider 403s as authentication failures. Closes python-social-auth#1036
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa515797ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ACCESS_TOKEN_URL = "https://api.coinbase.com/oauth/token" | ||
| REVOKE_TOKEN_URL = "https://api.coinbase.com/oauth/revoke" | ||
| SCOPE_SEPARATOR = "," | ||
| DEFAULT_SCOPE = ["wallet:user:read"] |
There was a problem hiding this comment.
Preserve email access in the default scope
For Coinbase applications that rely on the backend's default scopes, wallet:user:read does not grant access to the separately protected email field, so get_user_details() now returns email="" where the legacy user scope returned the user's email. This breaks email-required pipelines and can prevent email-based association for otherwise valid logins; include wallet:user:email in the defaults to preserve the backend's existing behavior.
Useful? React with 👍 / 👎.
Coinbase's legacy OAuth contract and unversioned user requests can cause otherwise valid logins to fail with 403 responses. Adopt the current endpoints, scopes, version header, and revocation parameters, and treat provider 403s as authentication failures.
Closes #1036