From 3d831ef27380d6a3b78cd91c5add351d85df1094 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Tue, 21 Apr 2026 12:13:07 -0400 Subject: [PATCH] fix(auth): restrict CLI start session reuse to GitHub auth Dev-token sessions now carry a non-empty IdpIdentity, so filtering by identity presence alone let the CLI start flow auto-resume under a dev-token session. Tighten eligibility to GitHub-authenticated sessions and update the auth_harness test helper to pass auth_mode by reference to match the current build_router_with_options signature. Co-Authored-By: Claude Opus 4.7 (1M context) --- lib/crates/fabro-cli/tests/it/support/auth_harness.rs | 2 +- lib/crates/fabro-server/src/auth/cli_flow.rs | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/crates/fabro-cli/tests/it/support/auth_harness.rs b/lib/crates/fabro-cli/tests/it/support/auth_harness.rs index 0dddaa93a..4a51758df 100644 --- a/lib/crates/fabro-cli/tests/it/support/auth_harness.rs +++ b/lib/crates/fabro-cli/tests/it/support/auth_harness.rs @@ -92,7 +92,7 @@ impl RealAuthHarness { let github_base = github_base_url(&twin.base_url); let router = build_router_with_options( state, - auth_mode, + &auth_mode, Arc::new(IpAllowlistConfig::default()), RouterOptions { web_enabled: true, diff --git a/lib/crates/fabro-server/src/auth/cli_flow.rs b/lib/crates/fabro-server/src/auth/cli_flow.rs index 0865ff03d..e5507cb0f 100644 --- a/lib/crates/fabro-server/src/auth/cli_flow.rs +++ b/lib/crates/fabro-server/src/auth/cli_flow.rs @@ -754,7 +754,9 @@ fn session_cookie_secure(state: &AppState) -> bool { } fn eligible_session(session: Option<&SessionCookie>) -> Option<&SessionCookie> { - session.filter(|session| session.identity.is_some()) + session.filter(|session| { + session.identity.is_some() && session.auth_method == RunAuthMethod::Github + }) } fn valid_state_token(state: &str) -> bool {