Limit OAuth to 37signals staff while it's piloted by jeremy · Pull Request #3249 · basecamp/fizzy

jeremy · 2026-10-27T03:53:51Z

Supersedes #3246 for ordering: the staff gate now lands before the consent design (#3212), so main never carries #3212 without the gate. Same change as #3246's final head (c32b732), applied to #3229's head; #3212 now merges this branch and sits on top of it.

Stacked on #3214.

OAUTH_STAFF_ONLY=true limits OAuth to staff (Identity#staff?), whichever client asks. Oauth::Availability's acceptance, issuance and pilot switches choose clients; this one chooses people, and composes with them: a request has to pass both.

This works like Basecamp's, where only staff can authorize an agent for now, and anyone else is told so, not shown a 404.

What's gated

Where	Staff	Anyone else
Consent screen (GET and approve)	as today	403 page: "Only 37signals staff can connect apps to Fizzy for now." No code.
Declining at consent	as today	still declines, so the app hears no
Code redemption	as today	`invalid_grant`, even for a code issued while they were staff
Refresh	as today	`invalid_grant`. The grant stays, for its owner to revoke.
An OAuth token at the API, delegated tokens included	as today	`invalid_token`, via `Identity::AccessToken#honored?`
Delegation exchange	as today	subject refused, via the same `honored?`
Personal access tokens	untouched	untouched
Connected Apps, revocation	open	open

Gating honored? means someone who stops being staff loses what they connected on their next request. That's the only part that runs per request, and it reads the identity, which is already loaded to authenticate.

Turning it on

OAUTH_STAFF_ONLY: "true" is set in the clear env of the production, staging and beta deploy configs, so OAuth lands staff-gated everywhere it might be lit. Opening it up means removing those lines. Anything but exactly "true" is off, and OSS installs never set it.

Tests

test/integration/oauth_staff_only_test.rb covers:

staff connect;
anyone else is refused at consent, both showing and approving, but can still decline;
a de-staffed code doesn't redeem;
a de-staffed grant stops authenticating and refreshing;
personal access tokens work for anyone.

The exchange test covers a de-staffed subject and its delegated token. Oauth::AvailabilityTest covers admits? and exact-true parsing.

I removed each of the four gates in turn, and each removal fails at least one of these tests.

Stacking note

The personal-access-token exemption reads oauth_client_id.nil? here, as C does. #3205 moves PATs onto a first-party client and adds personal?. When the two meet, this check becomes personal?, or every PAT would be gated.

The staff gate from #3246, reordered to land before the consent design (#3212). It carries #3246's net change against #3212 as one commit on #3229's head, with no dependency on #3212.

chatgpt-codex-connector · 2026-10-27T03:54:00Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T04:42:16.735844Z	`e28fd3b`	Manual request
🔒 Security Review	✅ Completed 2026-10-27T04:43:43.329953Z	`e28fd3b`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

jeremy · 2026-10-27T03:54:21Z

🤖 @codex review

Copilot

🔵 Needs a closer look

Security-sensitive OAuth admission and replay-revocation changes need human validation because runtime behavior was not verified during review.

No open issues 🎉

What changed in this PR

Adds a staff-only OAuth pilot gate before the consent-screen rollout. The gate restricts people independently of existing client controls while preserving personal access tokens and grant management.

Changes:

Enforces staff admission for consent, code redemption, refresh, OAuth token use, delegation, and app push delivery.
Preserves replay-triggered revocation and adds coverage for loss of staff status and personal-token exemptions.
Enables the gate in production, staging, and beta deployments.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
`test/test_helpers/oauth_availability_test_helper.rb`	Adds staff-only configuration isolation for tests.
`test/models/oauth/availability_test.rb`	Tests identity admission and strict boolean configuration.
`test/integration/oauth_token_exchange_test.rb`	Tests delegation refusal after staff status is removed.
`test/integration/oauth_staff_only_test.rb`	Covers consent, redemption, refresh, replay revocation, and personal-token exemptions.
`test/integration/oauth_delegate_resources_test.rb`	Tests push-delivery gating and avoids identity loading when disabled.
`saas/config/deploy.staging.yml`	Enables staff-only OAuth in staging.
`saas/config/deploy.production.yml`	Enables staff-only OAuth in production.
`saas/config/deploy.beta.yml`	Enables staff-only OAuth in beta.
`config/environments/production.rb`	Parses the staff-only environment switch.
`app/views/oauth/authorizations/staff_only.html.erb`	Adds the staff-only consent refusal page.
`app/models/push/subscription.rb`	Stops app push delivery for nonstaff while gated.
`app/models/oauth/availability.rb`	Defines and documents staff admission checks.
`app/models/identity/access_token.rb`	Gates OAuth token use and extracts code-replay handling.
`app/controllers/oauth/tokens_controller.rb`	Gates issuance while preserving replay-triggered revocation.
`app/controllers/oauth/authorizations_controller.rb`	Refuses nonstaff consent requests while allowing denial.

_{Review effort: Balanced}

chatgpt-codex-connector · 2026-10-27T03:57:59Z

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 14fbb6d7ab

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 14fbb6d7ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…revoke it once

jeremy · 2026-10-27T04:24:17Z

🤖 @codex review

chatgpt-codex-connector · 2026-10-27T04:26:34Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 5ed10fae85

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-27T04:28:05Z

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 5ed10fae85

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Copilot

🔵 Needs a closer look

Security-sensitive admission and replay-locking changes need human review with MySQL-backed validation, particularly because the replay-lock assertion remains too broad.

1 open issue

Matcher misses initial authorization code lookup lock · New

_{Review effort: Balanced}

… lock clause from logged SQL

jeremy · 2026-10-27T04:40:13Z

🤖 @codex review

chatgpt-codex-connector · 2026-10-27T04:42:15Z

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: e28fd3b959

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

🔵 Needs a closer look

Security-sensitive replay transaction and locking changes need human review and database-backed concurrency verification.

No open issues 🎉

1 resolved since last review

Matcher misses initial authorization code lookup lock

_{Review effort: Balanced}

chatgpt-codex-connector · 2026-10-27T04:43:42Z

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: e28fd3b959

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Limit OAuth to 37signals staff while it's piloted

14fbb6d

The staff gate from #3246, reordered to land before the consent design (#3212). It carries #3246's net change against #3212 as one commit on #3229's head, with no dependency on #3212.

Copilot AI balanced review requested due to automatic review settings October 27, 2026 03:53

jeremy mentioned this pull request Oct 27, 2026

Limit OAuth to 37signals staff while it's piloted #3246

Closed

Copilot started reviewing on behalf of jeremy October 27, 2026 03:54

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Oct 27, 2026

View reviewed changes

Comment thread app/models/identity/access_token.rb Outdated

Read a replayed code's grant under a row lock, so concurrent replays …

5ed10fa

…revoke it once

jeremy requested a balanced review from Copilot October 27, 2026 04:24

Copilot started reviewing on behalf of jeremy October 27, 2026 04:24

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Comment thread test/integration/oauth_audit_test.rb Outdated

Test the replay's row lock on the relation, since redaction hides the…

e28fd3b

… lock clause from logged SQL

jeremy requested a balanced review from Copilot October 27, 2026 04:40

Copilot started reviewing on behalf of jeremy October 27, 2026 04:40

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

Base automatically changed from oauth-dcr-allowlist to main October 27, 2026 06:30

jeremy merged commit 4df6538 into main Oct 27, 2026
15 of 22 checks passed

jeremy deleted the oauth-staff-gate-before-consent branch October 27, 2026 06:30

Conversation

jeremy commented Oct 27, 2026

What's gated

Turning it on

Tests

Stacking note

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

jeremy commented Oct 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

🛡️ Codex Security Review · Automatically triggered

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

jeremy commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

🛡️ Codex Security Review · Automatically triggered

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

jeremy commented Oct 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

chatgpt-codex-connector Bot commented Oct 27, 2026

🛡️ Codex Security Review · Automatically triggered

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chatgpt-codex-connector Bot commented Oct 27, 2026 •

edited

Loading