refactor(fe): one queue for authorization-bearing requests - #4269
Merged
Conversation
sea-snake
added
the
feature:revocable-app-sessions
sea-snake
marked this pull request as ready for review
August 22, 2026 18:16
|
✅ No security or compliance issues detected. Reviewed everything up to 378cf13. Security Overview
Detected Code Changes
|
sea-snake
force-pushed
the
fe/authorization-request-queue
branch
from
August 22, 2026 18:45
55d30b3 to
0c845ae
Compare
sea-snake
force-pushed
the
fe/authorization-request-queue
branch
from
August 22, 2026 19:07
0c845ae to
df54c97
Compare
sea-snake
force-pushed
the
fe/authorization-request-queue
branch
from
August 22, 2026 19:25
df54c97 to
9d2f6d5
Compare
sea-snake
force-pushed
the
fe/authorization-request-queue
branch
from
August 22, 2026 19:49
9d2f6d5 to
d67df85
Compare
MRmarioruci
approved these changes
Sep 2, 2026
…notonic-application-numbers
…al-index-backfill
…ccount-empty-list-is-not-default
…rack-default-accounts
sea-snake
removed this pull request from stack #4277
September 9, 2026 20:32
sea-snake
changed the base branch from
feat/revoke-sessions-from-settings
to
main
September 9, 2026 20:34
sea-snake
added this pull request to stack #4324
September 9, 2026 20:34
sea-snake
removed this pull request from stack #4324
September 9, 2026 20:35
sea-snake
changed the base branch from
main
to
feat/revoke-sessions-from-settings
September 9, 2026 20:35
sea-snake
added this pull request to stack #4323
September 9, 2026 20:38
sea-snake
removed this pull request from stack #4323
September 9, 2026 20:42
sea-snake
added this pull request to stack #4326
September 9, 2026 20:43
MRmarioruci
reviewed
Sep 10, 2026
Moving the origin bound to the write path left the reads behind. `read_account` and `list_accounts` never reach the choke point that mints an application, and the endpoints above them — `get_default_account`, `get_accounts`, `mcp_get_accounts` — check nothing themselves, so an over-long origin flowed through, absence normalised to the derived default, and the canister handed out a principal for an origin it could never persist. They answer nothing now instead of trapping: an origin that cannot be stored has no accounts under it, which is true rather than defensive and holds for callers not yet written. Two integration tests also stopped short of what they name. The delegation one leaned on `verify_delegation`, which builds the message it checks from whatever the reply carries — drop the targets on both sides and the signature still verifies — so the scope and permissions are now asserted outright. The successor-collision one re-signed only one of the two signatures, so the key proof failed first and `SuccessorAlreadyInUse` was never reached. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LVi99RYo2jyi2kCurgovNJ
`a_refresh_for_a_device_the_anchor_never_registered_still_stamps_the_session` built its session with `storage_with_session`, which calls `create_session` and so registers a browser — leaving it a duplicate of the registered-browser refresh above it, under a name claiming the opposite. The state it named is unreachable. A browser is given up only at `MAX_BROWSERS` in `resolve_browser`; the write gate sweeps that browser's sessions in the same write, and `sync_session_index` takes their index entries with them. The session is gone too, so a mint stops at `NoSuchSession` in `find_caller_session` long before the stamp is reached. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LVi99RYo2jyi2kCurgovNJ
An error occurred while trying to automatically change base from
feat/revoke-sessions-from-settings
to
feat/app-revoke-session
September 10, 2026 11:49
sea-snake
removed this pull request from stack #4326
September 10, 2026 12:55
sea-snake
changed the base branch from
feat/revoke-sessions-from-settings
to
main
September 10, 2026 12:55
sea-snake
added this pull request to stack #4328
September 10, 2026 12:55
MRmarioruci
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Design: #4224. Overview: #4230. Groundwork for #4273, which is the second caller.
The delegation handler serialises its own requests so that two consent screens cannot race. The session handler coming in #4273 also authorizes, and it has to share that queue rather than keep one of its own — two queues would let one request paint over the other's screen.
Lifts the queue out of the delegation handler into
serialize.tsasserializeAuthorizationRequest. No change to what the delegation handler does with it.No tests:
handleDelegationRequesthas no unit coverage today, and the extracted function is a move of the existing queue. Its first test arrives with the second caller in #4273.