Bug: Config Management Overrides

[jlewi]

Lots of sharp edges with using web.runme.dev with a custom drive client and OAuth provider.

• You need to remember to do

app.disableConfigOverridesOnLoad()

• To prevent overloading the configuration when page loads;

  • We added automatic overload because the config kept changing and we wanted to push new configuration to the clients

• Overloads/overwrites don't work as expected

  • I think for some configuration we have merge behavior
  • For example if the new OIDC configuration doesn't set a clientSecret but the old config did then client secret remains set to the old client secret and the OIDC login flow won't work.

[jlewi]

Even when I delete oidcConfig from local storage and then call

// Run this to set your configuration.
app.disableConfigOverridesOnLoad()
console.log(
  await app.setConfigFromYaml(
`oidc:
  clientExchange: true
  generic:
    clientID: app_something
    clientSecret: ""
    discoveryURL: https://auth.openai.com/v2.0/.well-known/openid-configuration
    scopes:
      - "openid"
      - "email"
      - "offline_access"
      - "api.responses.read"
      - "api.responses.write"
      - "model.request"
    issuer: "https://auth.openai.com"

googleDrive:
  clientID: "577-something.apps.googleusercontent.com"
  authFlow: "implicit"
  authUxMode: "redirect"

chatkit:
  domainKey: "domain_pk_68f"
`,
    "inline://app-configs.yaml"
  )
);
oidc.setClientSecret("")

Without the oidcSetClientSecret clientSecret was still getting reset. I think it was getting set tot the client secret from the google drive client. So I think its due to reusing the OAuth client for Google Drive with OIDC by default somewhere in the initialization path.

[jlewi-openai]

Cleanup review: this remains applicable. Current main still exposes disableConfigOverridesOnLoad() and OidcConfigManager still merges persisted configuration, including clientSecret, with runtime/default config. I did not find a later PR that defines replacement-vs-merge semantics or removes the manual override-disable requirement. Keeping open.