Migrate Nexus auth to OAuth 2.0 PKCE#18
Merged
spikehockey75 merged 7 commits intomainfrom Mar 12, 2026
Merged
Conversation
Migrate Nexus Mods authentication from legacy API key + WebSocket SSO to industry-standard OAuth 2.0 with PKCE for improved security and future-proofing against API key deprecation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the deprecated API key + WebSocket SSO flow with industry-standard OAuth 2.0 PKCE for desktop apps. Short-lived access tokens with automatic refresh replace the old permanent API key. Bearer token auth on all API requests, JWT-based user info extraction, and localhost callback server on port 9876 for the authorization code exchange. - Add app/services/nexus_oauth.py (PKCE flow, callback server, token refresh) - Remove app/services/nexus_sso.py (deprecated WebSocket SSO) - Update config_manager with OAuth token storage and legacy migration - Update nexus_service with Bearer auth and auto-refresh - Rewrite nexus_widget OAuth dialog and token validation - Update all API consumers (mods_tab, add_mod_dialog, main_window, settings_dialog) - Remove websocket-client dependency - Update README to reflect OAuth 2.0 changes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Auto-open the OAuth dialog on first launch when not logged in, with an info banner explaining that update checks, trending mods, and Nexus downloads require sign-in. Fix deadlock when cancelling the auth dialog by replacing server.shutdown() with server_close() to unblock the handle_request() loop. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add User-Agent header to OAuth token requests to prevent Cloudflare error 1010 blocking Python's default urllib agent string - Fetch user avatar via Nexus v2 GraphQL API after login since the JWT and v1 validate endpoint don't provide it - Fix QThread destroyed-while-running crash by adding _start_bg_work helper that waits for previous threads before starting new ones Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add periodic silent renew timer (every 5 min) that refreshes the OAuth token when it's within 10 minutes of expiry - Show info message when user skips first-launch sign-in, explaining that update checks, trending mods, and downloads require auth - Fetch user avatar via Nexus v2 GraphQL API using member ID from JWT - Remove debug print statements from OAuth and widget code Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Check installed ME3 version against latest GitHub release on startup - Show clickable "Update to vX.Y.Z" button in sidebar when outdated - Add ME3 Update dialog with download progress bar - Add "Check for ME3 Updates" button in Settings dialog - Fix version normalization to handle "me3 0.x.x" prefix from CLI - Show green version labels in sidebar when app and ME3 are up to date - Check app version against latest release on startup Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nexus_oauth.pyhandles PKCE code challenge, browser-based authorization, token exchange, JWT user info extraction, and token refresh — replaces deletednexus_sso.pynexus_api_keyconfig entries auto-migrated on startupwebsocket-clientdependencyChanged Files
app/services/nexus_oauth.pyapp/services/nexus_sso.pyapp/config/config_manager.pyapp/services/nexus_service.py_ensure_token()app/ui/nexus_widget.pyapp/ui/tabs/mods_tab.pyapp/ui/dialogs/add_mod_dialog.pyapp/ui/main_window.pyapp/ui/dialogs/settings_dialog.pybuild/build.pyrequirements.txtREADME.mdTest plan
🤖 Generated with Claude Code