bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(hermes): recover expired chat callbacks

Browse Source
This commit is contained in:
jenkins 2026-08-09 13:33:36 -03:00
parent fcef1f79f5
commit a9b86d4cc4
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
services/hermes/oauth2-proxy.yaml
View File

@ -22,7 +22,7 @@ data:
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1"> <meta name="viewport" content="width=device-width,initial-scale=1">
<title>{{.StatusCode}} {{.Title}}</title> <title>{{.StatusCode}} {{.Title}}</title>
{{if eq .StatusCode 500}}<meta http-equiv="refresh" content="0;url={{.ProxyPrefix}}/sign_in?rd=/">{{end}} {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}<meta http-equiv="refresh" content="0;url={{.ProxyPrefix}}/sign_in?rd=/">{{end}}
<style> <style>
body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f5f5f5;color:#333;font:16px/1.5 system-ui,sans-serif} body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f5f5f5;color:#333;font:16px/1.5 system-ui,sans-serif}
main{width:min(560px,calc(100% - 40px));box-sizing:border-box;padding:36px;border:1px solid #ddd;border-radius:14px;background:#fff;text-align:center;box-shadow:0 12px 45px #0002} main{width:min(560px,calc(100% - 40px));box-sizing:border-box;padding:36px;border:1px solid #ddd;border-radius:14px;background:#fff;text-align:center;box-shadow:0 12px 45px #0002}
@ -31,9 +31,9 @@ data:
</head> </head>
<body> <body>
<main> <main>
{{if eq .StatusCode 500}} {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}
<h1>Signing you back in…</h1> <h1>Signing you back in…</h1>
<p class="detail">The previous one-time login callback was already used. Hermes is starting a fresh sign-in automatically.</p> <p class="detail">The previous one-time login callback expired or was already used. Hermes is starting a fresh sign-in automatically.</p>
<a href="{{.ProxyPrefix}}/sign_in?rd=/">Continue now</a> <a href="{{.ProxyPrefix}}/sign_in?rd=/">Continue now</a>
{{else}} {{else}}
<h1>{{.StatusCode}} {{.Title}}</h1> <h1>{{.StatusCode}} {{.Title}}</h1>
@ -276,7 +276,7 @@ spec:
labels: labels:
app: oauth2-proxy-hermes-chat app: oauth2-proxy-hermes-chat
annotations: annotations:
ai.bstein.dev/config-rev: "20260809-consumed-callback-recovery" ai.bstein.dev/config-rev: "20260809-expired-callback-recovery"
vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/agent-pre-populate-only: "true"
vault.hashicorp.com/role: hermes-chat vault.hashicorp.com/role: hermes-chat

2
testing/tests/test_hermes_chat_quality.py
View File

@ -111,6 +111,8 @@ def test_chat_oauth_allows_stale_service_worker_retirement():
and document["metadata"]["name"] == "hermes-chat-oauth-templates" and document["metadata"]["name"] == "hermes-chat-oauth-templates"
)["data"]["error.html"] )["data"]["error.html"]
assert 'http-equiv="refresh"' in template assert 'http-equiv="refresh"' in template
assert "Unable to find a valid CSRF token" in template
assert "expired or was already used" in template
assert "/sign_in?rd=/" in template assert "/sign_in?rd=/" in template