[Prospector]

No description provided.

[github-actions]

Note

This changelog has been merged into the changelog for #8142

Pull request changelog

App

Added

Changed

Deprecated

Removed

Fixed

Security

Website

Added

Changed

Deprecated

Removed

Fixed

Security

Hosting

Added

Changed

Deprecated

Removed

Fixed

Security

[greptile-apps]

Confidence Score: 4/5

[High impact] The change reaches OAuth sign-in across the website and launcher.

The backend response-type requirement must be satisfied before merging; no new blocking behavior was found.

Summary

This PR replaces OAuth redirect session tokens with short-lived, one-use login codes bound to a browser-held verifier.

• OAuth callbacks now send a short-lived code instead of a session.
• The sign-in page proves its tab before exchanging an OAuth code.
• Search indexing keeps its current behavior.

_{Reviews (2) · Last reviewed commit: "one-time auth codes instead of handing s..." · Reviewed by Greptile}

[greptile-apps]

Response type hides JSON

exchange_login_code returns only JSON on success, but declares HttpResponse. The backend guide requires web::Json<T> when possible. Return web::Json<AuthSession> and finish with Ok(web::Json(session)) so Rust can check the response type. This repository requirement must be satisfied before merging.

Context Used: apps/labrinth/AGENTS.md (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/labrinth/src/routes/internal/flows.rs
Line: 1605

Comment:
**Response type hides JSON**

`exchange_login_code` returns only JSON on success, but declares `HttpResponse`. The backend guide requires `web::Json<T>` when possible. Return `web::Json<AuthSession>` and finish with `Ok(web::Json(session))` so Rust can check the response type. This repository requirement must be satisfied before merging.

**Context Used:** apps/labrinth/AGENTS.md ([source](https://github.com/modrinth/code/blob/main/apps/labrinth/AGENTS.md))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue). If it does not match the queue conditions yet, it enters the queue once it does.

• Queue this pull request