Add server-side QR code to pairing key page#35
Conversation
Merge develop into main
Add REPL auth, device flow UI, TODO management, and requirements ingestion
Replace CDN-dependent JavaScript QR code generation with server-side SVG rendering using QRCoder. The /pair/qr endpoint generates the QR code image, which works on LAN-only environments without internet. When a tunnel provider is active, the QR code encodes the tunnel's public URL. When external Keycloak OIDC is configured, the QR code points to the identity server proxy login page through the tunnel. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a44f077968
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| var authority = oidc.Authority.TrimEnd('/'); | ||
| if (Uri.TryCreate(authority, UriKind.Absolute, out var authorityUri)) | ||
| { | ||
| loginUrl = $"{baseUrl}/auth/ui{authorityUri.AbsolutePath}"; |
There was a problem hiding this comment.
In the OIDC+tunnel branch, the QR code encodes .../auth/ui{authorityPath} (for example /auth/ui/realms/myrealm), which does not point to the device verification/login page used by this server’s OIDC proxy flow. The proxy logic elsewhere builds verification URLs as .../auth/ui{authorityPath}/device (see AuthConfigController), so scans in this configuration can land on a non-login endpoint (realm metadata or 404) and fail the intended mobile pairing/login path.
Useful? React with 👍 / 👎.
1 participant
Summary
/pair/qrendpoint that generates QR code images, works on LAN-only environments without internetTest plan
/pair/keyafter login/pair/qrreturns 302 redirect when not authenticated🤖 Generated with Claude Code