Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

New Login Flow vs code#12

Merged
Ibrahimrahhal merged 4 commits intomainCorgea/vs_code_plugin:mainfrom
new_loginCorgea/vs_code_plugin:new_loginCopy head branch name to clipboard
Oct 11, 2025
Merged

New Login Flow vs code#12
Ibrahimrahhal merged 4 commits intomainCorgea/vs_code_plugin:mainfrom
new_loginCorgea/vs_code_plugin:new_loginCopy head branch name to clipboard

Conversation

@Ibrahimrahhal
Copy link
Member

Recording.2025-08-29.163654.mp4

@corgea-staging
Copy link

🐕 Corgea found the following SCA issues in the codebase:

Package CVE Severity Version Fixed Version Ecosystem Summary
form-data CVE-2025-7783 CRITICAL 4.0.1 4.0.4 npm form-data uses unsafe random function in form-data for choosing boundary
tmp CVE-2025-54798 LOW 0.2.3 0.2.4 npm tmp allows arbitrary temporary file / directory write via symbolic link dir parameter
axios CVE-2025-27152 HIGH 1.7.9 0.30.0 npm axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
brace-expansion CVE-2025-5889 LOW 1.1.11 4.0.1 npm brace-expansion Regular Expression Denial of Service vulnerability
esbuild N/A MEDIUM 0.21.5 0.25.0 npm esbuild enables any website to send any requests to the development server and read the response
tar-fs CVE-2025-48387 HIGH 2.1.2 3.0.9 npm tar-fs can extract outside the specified dir with a specific tarball
undici CVE-2025-47279 LOW 6.21.1 7.5.0 npm undici Denial of Service attack via bad certificate data
xml2js CVE-2023-0842 MEDIUM 0.4.23 0.5.0 npm xml2js is vulnerable to prototype pollution

Showing 8 out of 9 findings. See full results

@asadeddin
Copy link
Contributor

@greptileai

Copy link

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Greptile Summary

This PR implements a comprehensive OAuth-based authentication system for the Corgea VS Code extension, replacing the previous manual API key entry method. The changes introduce three authentication methods: standard OAuth login, enterprise OAuth with custom scope support, and fallback API key login.

The core authentication flow is handled by significant updates to AuthService, which now manages OAuth state, generates callback URIs using the extension context, and processes OAuth callbacks through a new URI navigation event handler. The service supports both public Corgea instances and enterprise deployments with custom domain scopes (e.g., company-name.corgea.app).

The UI components have been completely redesigned with a new multi-state authentication container that displays different interfaces based on the authentication method selected. The AuthContainer component now handles OAuth loading states, enterprise form validation with regex pattern matching, and provides proper error handling and user feedback.

New VS Code commands have been registered (corgea.oauthLogin, corgea.submitEnterpriseLogin, corgea.loginWithApiKey, corgea.cancelOAuth) along with URI handling capabilities to process OAuth callbacks. The extension's package.json has been updated with the onUri activation event and URI handler configuration to support the OAuth callback flow.

The authentication state is managed through the existing VulnerabilitiesContext, which has been extended with OAuth loading states and enterprise form visibility tracking. The webview provider has been updated to handle the new authentication message types and communicate loading states back to the UI.

A new exchangeOAuthCode method in APIManager handles the OAuth code-to-token exchange, though it bypasses the existing client infrastructure for simplicity. The extension's initialization logic has been modified to conditionally initialize services that require the extension context.

Confidence score: 2/5

  • This PR contains critical security issues that make it unsafe to merge, particularly the hardcoded Sentry DSN in production code
  • Score lowered due to security vulnerabilities, potential type safety issues with service casting, and OAuth implementation concerns
  • Pay close attention to ErrorHandlingManager.ts (hardcoded secrets), extension.ts (type safety bypass), and authService.ts (OAuth state management)

Context used:

Style Guide - Corgea Docs (link)

10 files reviewed, 8 comments

Edit Code Review Bot Settings | Greptile

Comment on lines +17 to +19
if ((service as any).initialize) {
(service as any).initialize(context);
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style: Using (service as any) bypasses TypeScript's type safety. Consider defining a common interface with an optional initialize method.

Comment on lines +567 to +579
public static async exchangeOAuthCode(code: string, corgeaUrl: string): Promise<{status: string, user_token?: string}> {
try {
const response = await axios.get(`${corgeaUrl}/api/${this.apiVersion}/authorize`, {
params: { code },
timeout: 10000
});

return response.data;
} catch (error: any) {
DebugManager.log(`OAuth code exchange failed: ${error.message}`);
throw new Error(`Failed to exchange OAuth code: ${error.response?.data?.error || error.message}`);
}
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style: This method bypasses the established getBaseClient() pattern used throughout the class. Consider using the existing infrastructure for consistency, even with throwOnMissingToken: false to handle the unauthenticated nature of this endpoint.

Comment on lines +83 to +96
.loading-spinner {
width: 24px;
height: 24px;
border: 3px solid var(--vscode-input-border);
border-top: 3px solid var(--vscode-button-background);
border-radius: 50%;
animation: spin 1s linear infinite;
margin-bottom: 0.5rem;
}

@keyframes spin {
0% { transform: rotate(0deg); }
100% { transform: rotate(360deg); }
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style: Custom spinner implementation duplicates existing LoadingSpinner component functionality. Consider reusing the existing component for consistency.

@@ -1,17 +1,98 @@
import React from 'react';
import { useVulnerabilities } from '../../context/VulnerabilitiesContext';
import LoadingSpinner from '../LoadingSpinner/LoadingSpinner';
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style: LoadingSpinner component imported but not used - using custom div instead

Suggested change
import LoadingSpinner from '../LoadingSpinner/LoadingSpinner';
<LoadingSpinner />

{scopeError && <div className="form-error">{scopeError}</div>}
</div>
<div className="form-buttons">
<button type="button" className="btn btn-secondary" onClick={handleCancel}>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

syntax: Missing indentation - should align with other button at line 76

Context Used: Style Guide - Corgea Docs (link)

import VulnerabilityHighlightingService from "./vulnerabilityHighlightingService";
import scanningService from "./scanningService";

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style: Unnecessary trailing whitespace should be removed

Context Used: Style Guide - Corgea Docs (link)

Comment on lines 213 to 233
login: () => {
vscode.postMessage({ type: 'login' });
vscode.postMessage({ type: 'oauthLogin' });
},
oauthLogin: () => {
vscode.postMessage({ type: 'oauthLogin' });
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style: both login and oauthLogin now do identical operations - the login method could simply call oauthLogin() instead of duplicating the message posting

Comment on lines +92 to +108
const checkInterval = setInterval(() => {
if (!AuthService._isOAuthInProgress) {
clearInterval(checkInterval);
resolve();
}
}, 1000);

// Set a timeout for the authentication
setTimeout(() => {
if (AuthService._isOAuthInProgress) {
clearInterval(checkInterval);
AuthService._isOAuthInProgress = false;
AuthService._oauthCancelToken?.dispose();
AuthService._oauthCancelToken = null;
reject(new Error("Authentication timed out. Please try again."));
}
}, 300000); // 5 minutes timeout
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

logic: The polling mechanism creates potential memory leaks - the interval continues running even after timeout, and multiple intervals could accumulate if authentication is retried quickly

@asadeddin
Copy link
Contributor

asadeddin commented Sep 6, 2025

@Ibrahimrahhal looks good overall. Is the greptile comment correct on the security issue? Why did we hardcode the DSN?

@Ibrahimrahhal
Copy link
Member Author

@greptile-apps

Copy link

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Greptile Summary

This PR implements a comprehensive new OAuth-based authentication flow for the Corgea VS Code extension, replacing the previous simple API key authentication. The changes introduce three distinct authentication methods: OAuth login (now the default), enterprise login with custom scope configuration, and traditional API key login for backward compatibility.

The implementation spans the entire authentication stack:

  • Frontend UI (AuthContainer): Now supports three states - OAuth loading with cancellation, enterprise form with scope validation, and default login options with separate buttons for OAuth and enterprise authentication
  • State Management (VulnerabilitiesContext): Extended to handle OAuth loading states, enterprise form visibility, and new authentication action types while maintaining backward compatibility
  • Backend Services (AuthService): Completely rewritten to support OAuth 2.0 authorization code flow with proper state management, callback handling, and enterprise authentication for custom Corgea deployments
  • API Integration (apiManager): Added exchangeOAuthCode method to handle OAuth token exchange
  • Extension Integration: Updated command registration in package.json and message handling in vulnerabilitiesWebviewProvider to support the new authentication flows
  • Styling (AuthContainer.css): Significantly expanded to accommodate multiple authentication methods, loading states, form controls, and proper VS Code theme integration

The OAuth flow follows standard practices: users are redirected to Corgea's authorization server via browser, authenticate there, and are redirected back to VS Code with an authorization code that gets exchanged for an API token. Enterprise users can specify custom scopes/domains before initiating OAuth. The system includes proper error handling, user feedback through VS Code notifications, and cancellation mechanisms for improved UX.

Confidence score: 3/5

  • This PR introduces complex authentication logic with potential runtime issues from type casting and polling mechanisms
  • Score reflects the complexity of OAuth implementation and several architectural concerns that could cause problems
  • Pay close attention to src/services/authService.ts for memory leak risks and src/extension.ts for type safety bypasses

Context used:

Style Guide - Corgea Docs (link)

10 files reviewed, no comments

Edit Code Review Bot Settings | Greptile

Copy link
Contributor

@asadeddin asadeddin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix login to not be 2 buttons

Copy link
Contributor

@asadeddin asadeddin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Ibrahimrahhal Ibrahimrahhal merged commit 8f85ab3 into main Oct 11, 2025
2 checks passed
@Ibrahimrahhal Ibrahimrahhal deleted the new_login branch October 11, 2025 07:44
@@ -1,17 +1,104 @@
import React from 'react';
import { useVulnerabilities } from '../../context/VulnerabilitiesContext';
import LoadingSpinner from '../LoadingSpinner/LoadingSpinner';
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assignment to Variable without Use ( ⚪ Low ) - The variable's value is assigned but never used, making it a dead store. View in Corgea ↗

More Details
🎟️Issue Explanation: The import "LoadingSpinner" is declared but never used in the code, making it a dead store. This means the variable occupies memory without purpose.

- Dead stores increase code clutter, reducing maintainability and readability of the file.
- Unused imports can slow down build tools and increase bundle size, impacting performance.
- It confuses engineers by implying "LoadingSpinner" is needed, adding cognitive load.

We could not generate a fix for this.

const [showRightIndicator, setShowRightIndicator] = useState(false);

const scanningMode = state.isInScanningMode;
const handleTabClick = (tab: 'code' | 'sca' | 'scanning') => {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exposure of Resource to Wrong Sphere ( 🟠 Medium ) - The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. View in Corgea ↗

More Details
🎟️Issue Explanation: The code permits switching tabs based on "state.ideScanningEnabled", but doesn't restrict access control elsewhere, potentially exposing the "scanning" tab's resource to unauthorized actors.

- Improper access control on "scanning" tab means unintended users could interact with sensitive data or features.
- Using UI state guard ("state.ideScanningEnabled") alone doesn't prevent backend or deeper access issues.
- This can cause maintenance challenges as team members may assume UI restrictions imply security, leading to hidden vulnerabilities.

We could not generate a fix for this.

@corgea-staging
Copy link

🐕 Corgea found the following new SCA issues in the codebase:

Package CVE Severity Version Fixed Version Ecosystem Summary
tar-fs CVE-2025-59343 HIGH 2.1.2 1.16.6 npm tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

Showing 1 out of 1 findings. See full results

Comment on lines +10 to 11
dsn: "DSN_PLACEHOLDER",
// Setting this option to true will send default PII data to Sentry.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assignment to Variable without Use ( 🟠 Medium ) - The variable's value is assigned but never used, making it a dead store. View in Corgea ↗

More Details
🎟️Issue Explanation: The code assigns the string "DSN_PLACEHOLDER" to the variable "dsn" but never uses its value anywhere. This results in a dead store, which is unnecessary code execution and memory usage.

- Dead stores in "dsn: "DSN_PLACEHOLDER"" increase code clutter, reducing readability for developers.
- Unused assignments consume memory and processing without benefits, impacting performance subtly.
- Accumulation of dead code can confuse engineers on the actual program flow, slowing debugging and maintenance.

🪄Fix Explanation: Replacing the hardcoded DSN with an environment variable improves flexibility and security by removing sensitive data from the source code and enabling configuration without code changes.
"dsn: "DSN_PLACEHOLDER"" was replaced with "dsn: process.env.SENTRY_DSN || """ to externalize configuration.
This avoids exposing sensitive credentials in the codebase, enhancing security and maintainability.
Using "process.env.SENTRY_DSN || """ ensures the app gracefully handles missing environment variables by defaulting to an empty string.
This approach supports different deployment environments without modifying code, improving consistency and flexibility.

💡Important Instructions: Ensure the environment variable SENTRY_DSN is properly set in all deployment environments for Sentry integration to work as expected.
Suggested change
dsn: "DSN_PLACEHOLDER",
// Setting this option to true will send default PII data to Sentry.
dsn: process.env.SENTRY_DSN || "",

@corgea
Copy link

corgea bot commented Oct 11, 2025

🐕 Corgea found the following new SCA issues in the codebase:

Package CVE Severity Version Fixed Version Ecosystem Summary
tar-fs CVE-2025-59343 HIGH 2.1.2 1.16.6 npm tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

Showing 1 out of 1 findings. See full results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.