Skip to content

Implement loopback OAuth flow for GitHub login in Avalonia#4916

Merged
Gabriel Dufresne (GabrielDuf) merged 2 commits into
mainfrom
fix/avalonia-github-login-loopback
Jun 12, 2026
Merged

Implement loopback OAuth flow for GitHub login in Avalonia#4916
Gabriel Dufresne (GabrielDuf) merged 2 commits into
mainfrom
fix/avalonia-github-login-loopback

Conversation

@GabrielDuf

Copy link
Copy Markdown
Contributor

This pull request implements a new OAuth login flow for GitHub authentication in the Avalonia app, switching from the device flow to a local loopback HTTP server that captures the OAuth redirect and authorization code. It also adds support for securely providing the GitHub client secret, improves error handling, and updates the secrets generation scripts to handle the new secret. The most important changes are:

GitHub OAuth Login Flow

  • Added a new GHAuthApiRunner class which implements a lightweight loopback HTTP server using TcpListener to capture the GitHub OAuth redirect and extract the authorization code, removing the dependency on ASP.NET Core for Avalonia. (src/UniGetUI.Avalonia/Infrastructure/GHAuthApiRunner.cs)
  • Refactored GitHubAuthService to use the new OAuth code flow via the loopback server, including event handling for login and cancellation, and a timeout for the login process. The device flow code and related events were removed. (src/UniGetUI.Avalonia/Infrastructure/GitHubAuthService.cs)

Secrets Handling

  • Updated secrets generation scripts (generate-secrets.ps1 and generate-secrets.sh) and the Secrets class to support a GetGitHubClientSecret() method, allowing the client secret to be securely injected at build time. (src/UniGetUI.Avalonia/Infrastructure/generate-secrets.ps1, src/UniGetUI.Avalonia/Infrastructure/generate-secrets.sh, src/UniGetUI.Avalonia/Infrastructure/Secrets.cs)

Error Handling and User Feedback

  • Improved error and cancellation handling in both the OAuth HTTP server and the login flow, including distinguishing between user cancellation and other errors, and surfacing appropriate messages to the UI. (src/UniGetUI.Avalonia/Infrastructure/GHAuthApiRunner.cs, src/UniGetUI/Pages/SettingsPages/GeneralPages/Backup.xaml.cs)

WinUI Service Parity

  • Synced changes to the WinUI service implementation to support the new cancellation event and improved callback handling in the background login API. (src/UniGetUI/Services/BackgroundLoginApi.cs, src/UniGetUI/Services/GitHubAuthService.cs)

Project File Update

  • Registered the new GHAuthApiRunner.cs in the Avalonia project file so it is included in the build. (src/UniGetUI.Avalonia/UniGetUI.Avalonia.csproj)

@GabrielDuf Gabriel Dufresne (GabrielDuf) merged commit c9958ab into main Jun 12, 2026
11 checks passed
@GabrielDuf Gabriel Dufresne (GabrielDuf) deleted the fix/avalonia-github-login-loopback branch June 12, 2026 12:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants