mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-10-16 04:33:16 +00:00
328bddea33
GitHub's App Manifest endpoint rejects `redirect_url` values that carry a query string with "invalid redirect_uri", leaving the web wizard stuck: the 10-minute pending-setup guard then blocked every retry for ten minutes. Move the CSRF state out of `redirect_url` and into a hidden `state` form field on the auto-submit — GitHub preserves it on the callback, matching the CLI's working Manifest flow. Drop the retry conflict so a fresh POST to /install/github/app/manifest always replaces the pending entry and mints a new state token; stale callbacks are already rejected by the existing state-match check on the redirect handler. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| app | ||
| public | ||
| scripts | ||
| .dockerignore | ||
| .gitignore | ||
| index.template.html | ||
| package.json | ||
| tsconfig.json | ||