[lilyshen0722]

This adds one section to docs/security-patterns.md on what an OAuth callback that arrives with no session may trust. The short answer is its state, and only when the server signed that state with the user and the resource. The pattern comes from #3436, the Discord install, which is live.

The section covers:

• the threat: an attacker's code paired with the victim's resource id;
• the rules:
  • mint the state where authority over the resource was already checked;
  • refuse any other state before the code exchange;
  • bind whatever the callback hands back to that same user;
  • still check authority over the resource at the write;
  • give each token its own purpose claim;
• the reference implementation and its test.

Also in this change:

• a quick-reference row;
• a sources line for fix(discord): the install link returns to the callback, and Connectors offers Discord #3436;
• the file header now covers authorization shapes as well as CodeQL ones.

Tier 0, docs only.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MDs9DT6tbhKm6UhsmFhLk9

[lilyshen0722]

Review at dd9b583. One subagent review (Sonnet), tier 0, docs only.

• Code claims: every one matches the code as merged in #3436:
  • the purpose claims (discord-install-state and discord-install), with no id or user claim in either, so neither reads as a session;
  • install-link mints only after canManagePod;
  • the callback refuses a bad state before the token exchange;
  • the user-bound proof is checked at /channels and at hasDiscordGuildAuthority;
  • the creator-or-admin check on bind runs before the guild check.
• Anchor: the quick-reference anchor resolves to the new heading.
• Infra and ids: no infra identifiers and no internal ledger ids.
• Nits from the review, all fixed in the second commit:
  • the order of the sources list;
  • the summary-exposure line now cites discordCommandService.handleSummaryCommand;
  • the file header now covers authorization shapes.

GATE: PASS

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords: 1

• security

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Team-Commonly/commonly
• Branch: main
• File: .coderabbit.yaml
• Commit: 23019d4
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: 503ae1d7-5843-46f1-b793-ebfec8a80a0e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts