fix(core): dynamically resolve Cloud Workstations proxy redirect URI for OAuth flows - #28688
fix(core): dynamically resolve Cloud Workstations proxy redirect URI for OAuth flows#28688amelidev wants to merge 6 commits into
Conversation
|
📊 PR Size: size/L
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses authentication failures encountered when running OAuth 2.0 flows within Google Cloud Workstations. By replacing static 'localhost' redirect URIs with a dynamically resolved URL that accounts for the workstation's proxy gateway, the changes enable seamless authentication for remote development environments. The solution is applied selectively to ensure that sensitive flows, such as Google Code Assist, remain unaffected by these changes. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for Google Cloud Workstations by dynamically resolving the OAuth redirect URI to the workstation's proxy URL when running in a workstation environment. It introduces a helper function getRedirectUri and updates the OAuth provider and flow utilities to use it, accompanied by corresponding unit tests. The reviewer pointed out a critical edge case where an explicitly configured localhost or 127.0.0.1 redirect URI would bypass the workstation proxy resolution, leading to connection failures in the browser, and provided a robust code suggestion to handle this scenario.
gemini-cli
Bot
added
priority/p3
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a helper function getRedirectUri to handle OAuth redirect URIs when running inside Google Cloud Workstations, mapping local addresses to the Cloud Workstations proxy URL, and adds corresponding unit tests. The review feedback suggests improving getRedirectUri by mutating the URL object directly to preserve query parameters, hashes, and other URL components, as well as adding support for IPv6 loopback addresses.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request adds support for Google Cloud Workstations proxy redirect URIs during OAuth flows by introducing a getRedirectUri helper in packages/core/src/utils/oauth-flow.ts and updating MCPOAuthProvider and the OAuth utilities to use it. It also adds comprehensive tests and reformats some skill documentation files. The review feedback correctly identifies a critical issue where prioritizing the configured port over the active redirectPort in getRedirectUri can cause the workstation proxy to forward callbacks to an inactive port. The reviewer suggests always using the active redirectPort and updating the corresponding unit tests to expect this port.
| parsed.hostname === '127.0.0.1' || | ||
| parsed.hostname === '[::1]' | ||
| ) { | ||
| const port = parsed.port || String(redirectPort); |
There was a problem hiding this comment.
In Google Cloud Workstations, the reverse proxy gateway maps external requests of the form https://<port>-<web_host> strictly to the internal port <port> on the workstation VM.
If config.redirectUri is configured with a port (e.g., 8080) but the local callback server is actually listening on a different port (e.g., 3000 or a port specified by OAUTH_CALLBACK_PORT), prioritizing parsed.port over redirectPort will result in a redirect URI with the wrong port (e.g., https://8080-... instead of https://3000-...). The gateway will then forward the callback to port 8080 where no server is listening, causing the OAuth flow to fail.
To ensure the redirect URI always routes to the active callback server, we should always use the actual redirectPort the server is listening on, rather than falling back to parsed.port.
| const port = parsed.port || String(redirectPort); | |
| const port = String(redirectPort); |
| 'https://8080-my-workstation.cluster.workstations.cloud.google.com/custom/callback', | ||
| ); | ||
| }); |
There was a problem hiding this comment.
Since we should always use the actual redirectPort the server is listening on (to ensure the Cloud Workstations Gateway correctly routes the callback to the active server), this test should expect port 3000 (the redirectPort passed to buildAuthorizationUrl) instead of 8080.
Please also update the other similar tests below (lines 258, 276, 294) to expect port 3000 instead of their configured ports.
expect(parsed.searchParams.get('redirect_uri')).toBe(
'https://3000-my-workstation.cluster.workstations.cloud.google.com/custom/callback',
);References
- In tests, prefer using hardcoded literal values instead of importing constants to ensure tests are self-contained and less brittle.
- Strict URL matching in test helpers is acceptable if it meets the current testing needs and flexibility is not required.
1 participant
Summary
This PR resolves an issue where OAuth 2.0 authentication flows inside Google
Cloud Workstations VMs fail because they are statically configured to redirect
back to
localhost(e.g.,http://localhost:\${redirectPort}/oauth/callback).Since the developer's web browser runs locally on their physical laptop, the
browser cannot navigate the
localhostloopback back to the remote VM context,leading to connection refusal.
This fix dynamically detects the Google Cloud Workstations environment context
(via
GOOGLE_CLOUD_WORKSTATIONSandWEB_HOSTenvironment variables) andconstructs the correct authenticated reverse proxy callback URL format
(
https://\${redirectPort}-\${process.env['WEB_HOST']}/oauth/callback), routingthe authentication response securely back to the workstation VM.
Details
getRedirectUriinpackages/core/src/utils/oauth-flow.tsto encapsulate the environmentdetection and dynamic URL resolution logic.
(
packages/core/src/mcp/oauth-provider.tsandpackages/core/src/utils/oauth-flow.ts) where third-party IDPs (such asAuth0 configured by customers like CME Group) are used.
packages/core/src/code_assist/oauth2.ts) wasintentionally left unchanged. Google's official "Desktop App" client ID
strictly prohibits non-loopback redirect URIs and throws
redirect_uri_mismatchif dynamic proxy domains are supplied. The CodeAssist flow continues to safely utilize the manual code copy-paste
out-of-band (
authWithUserCode) flow in headless or remote VM environments.REDIRECT_PATHinoauth-provider.ts) to avoid compilation issues.Related Issues
Fixes #23711
How to Validate
Automated Unit Tests
Run the newly added unit tests that simulate and verify the Google Cloud
Workstations proxy callback resolution:
Manual Verification
8090).https://8090-<WEB_HOST>/oauth/callback) to your laptop browser.Workstation Gateway proxy, routing the request down to the workstation VM to
complete the login seamlessly.
Pre-Merge Checklist