mirror of
https://github.com/brunopostle/ifcurl.git
synced 2026-07-12 10:18:14 +00:00
Bruno Postle
fee3008b60
The select-documents picker queried the Forgejo API with only the browser's session cookie (credentials: 'include'), so an OpenCDE client that authenticated via OAuth2 saw only public repositories. Thread the access token presented on the select-documents request through to the picker UI (query param) and have its JS send it as Authorization: Bearer on every Forgejo API call, falling back to cookie auth when no token is supplied. Add a no-referrer policy so the token in the page URL does not leak via Referer on API fetches or the callback redirect. Closes ifcurl-i5c. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| data | ||
| __init__.py | ||
| __main__.py | ||
| auth.py | ||
| bcf.py | ||
| bcf_api.py | ||
| checkout.py | ||
| diff.py | ||
| discover.py | ||
| documents_api.py | ||
| foundation_api.py | ||
| git.py | ||
| open.py | ||
| py.typed | ||
| register.py | ||
| render.py | ||
| render_service.py | ||
| sandbox.py | ||
| service.py | ||
| url.py | ||