Add logged-in interface for Tidal authentication and playlist selection #132
Conversation
|
Try again @copilot |
Co-authored-by: tsmarvin <[email protected]>
Co-authored-by: tsmarvin <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| [Route( "tidal/callback" )] | ||
| public async Task<IActionResult> Callback( [FromQuery] string? code, [FromQuery] string? error ) { | ||
| if (!string.IsNullOrEmpty( error )) { | ||
| _logger.LogError( "Tidal OAuth error: {Error}", error ); |
Check failure
Code scanning / CodeQL
Log entries created from user input High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 16 days ago
To fix the problem, we need to sanitize the user-supplied error string before it is logged. Since the log entry is written as plain text, we should remove (or replace) newlines and other characters likely to disrupt log formatting. The simplest, safest method is to use String.Replace(Environment.NewLine, "") and also .Replace("\n", "") and .Replace("\r", "") for extra coverage. For clarity, the sanitized value should be used in the log entry instead of the raw user input.
This means:
- In
Callback, before logging, define a sanitized version oferror(removing newlines). - Use the sanitized version in the logger call on line 72.
No other parts of the file need to change.
| @@ -69,7 +69,8 @@ | ||
| [Route( "tidal/callback" )] | ||
| public async Task<IActionResult> Callback( [FromQuery] string? code, [FromQuery] string? error ) { | ||
| if (!string.IsNullOrEmpty( error )) { | ||
| _logger.LogError( "Tidal OAuth error: {Error}", error ); | ||
| string sanitizedError = error.Replace("\r", "").Replace("\n", ""); | ||
| _logger.LogError( "Tidal OAuth error: {Error}", sanitizedError ); | ||
| return RedirectToAction( "Index" ); | ||
| } | ||
|
|
I've implemented the Tidal authentication and playlist selection interface. The feature includes: ✅ OAuth Authentication Flow: Users can connect their Tidal account via OAuth 2.0 authorization code flow Access the feature at The implementation is functional-focused as requested. Database migration Note: Tokens are stored in plaintext in the database for this internal testing feature. For production use, token encryption should be added. |
|
Can you rebase this off develop @copilot |
I'm unable to perform a git rebase in this environment because force push is not available to me. To rebase this branch off develop, you would need to run locally: git fetch origin develop
git checkout copilot/add-tidal-authentication-interface
git rebase origin/develop
git push --force-with-lease origin copilot/add-tidal-authentication-interfaceAlternatively, if there are merge conflicts or updates needed from develop, I can help resolve those once the rebase is done manually. |
Implements a new internal interface for Tidal user authentication and playlist management accessible at
/tidalfor logged-in users.<issue_title>Add logged-in internal interface for Tidal authentication and playlist selection</issue_title>
Implementation Details
Features Implemented:
/tidalTechnical Changes:
ApplicationUsermodel with three new fields:TidalAccessToken,TidalRefreshToken,TidalTokenExpiryAddTidalTokensToUserfor token storageTidalUserAuthHandlerfor OAuth authorization code flow with automatic token refreshTidalUserAuthHandlerto public properties ofTidalCredentialsclass to support user authenticationTidalControllerwith routes:GET /tidal- Main page (requires authentication)GET /tidal/connect- Initiates OAuth flowGET /tidal/callback- Handles OAuth callbackPOST /tidal/disconnect- Removes stored tokensGET /tidal/playlists- Fetches user's playlistsSecurity Considerations:
[Authorize]attribute requiring user authenticationThis implementation prioritizes functional completeness for internal testing as specified in the requirements.
Original prompt
💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.