Skip to content

Add option to enable eager authentication#1837

Draft
thepatrickchin wants to merge 19 commits intoNVIDIA:developfrom
thepatrickchin:feat/eager-auth
Draft

Add option to enable eager authentication#1837
thepatrickchin wants to merge 19 commits intoNVIDIA:developfrom
thepatrickchin:feat/eager-auth

Conversation

@thepatrickchin
Copy link
Copy Markdown
Member

@thepatrickchin thepatrickchin commented Apr 2, 2026

Description

This PR adds a use_eager_auth option in auth provider configurations to trigger authentication flow at WebSocket connection time. This is an opt-in feature that preserves the existing behavior of triggering auth flow when the workflow requires credentials when use_eager_auth is false (default).

If the user cancels or declines the initial authentication request, the authorization flow will still be triggered when the workflow requires credentials.

Closes #1836

By Submitting this PR I confirm:

  • I am familiar with the Contributing Guidelines.
  • We require that all contributors "sign-off" on their commits. This certifies that the contribution is your original work, or you have rights to submit it under the same license, or a compatible license.
    • Any contribution which contains commits that are not Signed-Off will not be accepted.
  • When the PR is ready for review, new or existing tests cover these changes.
  • When the PR is ready for review, the documentation is up to date with these changes.

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
- "same-page" may be misleading as the popup is what keeps the user on the same page.

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
- Fail fast when redirect auth has no validated return URL.
- Handle redirect-mode failures the same way as redirect-mode success.
- Properly handle wildcard "*" in allow_origins

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
- Only treat access_denied as a user cancellation.

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
- Gate cancellation UX with use_redirect_auth, not return_url.
- Add a popup-mode regression test when return_url is present.

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
- This makes pre-authentication an opt-in feature
- When True, authentication for the provider is triggered at WebSocket connection time before any user message is submitted.
- When False (default), authentication only occurs when the workflow explicitly requires it.

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot bot commented Apr 2, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 2, 2026

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9c354038-ea2b-450e-a85d-58ec291e0d32

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Signed-off-by: Patrick Chin <8509935+thepatrickchin@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add option to enable eager authentication

1 participant