6f71d639 · zzmq.dev@gmail.com/zz
Commit
6f71d639708b28980caad19c22f051727893e91a
OAuth verified live: both providers, real accounts, real consent screens Both Cloudflare and Google OAuth clients now have real credentials (Worker secrets) and were driven through an actual browser end to end: real consent screens, real token exchange, real account creation, landing on /profile with a working session cookie. Fixed the one thing flagged as unverified: Cloudflare's userinfo response (confirmed live via a one-off decrypt-and-refetch diagnostic, /dev-cf-userinfo-raw) is just {sub, iss, aud, ...} -- no email or name at all under "user-details.read", despite the scope's name. Not a parsing bug; a real platform limitation. parseUserInfo now reflects that directly instead of guessing at alternate field shapes, and displayName falls back to a short "cf-<sub prefix>" instead of the raw 32-char hash. Google's response needed no fix -- confirmed {sub, email, name} as expected on the first real login. Also exercised, live, through the real browser session: agent creation, agent token minting (plaintext shown once), and the prior curl-based coverage of repo creation/RBAC grants/explore still holds under a real human account instead of a synthetic test row. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Troy Howard <thoward37@gmail.com> -- 2026-10-12T01:33:30.000Z