Skip to content

fix(auth): rewrite stale MiniMax OAuth approval URL - #19461

Open
LeonSGP43 wants to merge 1 commit into
NousResearch:mainfrom
LeonSGP43:codex/minimax-oauth-verification-uri
Open

fix(auth): rewrite stale MiniMax OAuth approval URL#19461
LeonSGP43 wants to merge 1 commit into
NousResearch:mainfrom
LeonSGP43:codex/minimax-oauth-verification-uri

Conversation

@LeonSGP43

@LeonSGP43 LeonSGP43 commented May 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • rewrite stale MiniMax OAuth approval URLs from www.minimax.io/oauth-authorize to platform.minimax.io/oauth-authorize
  • preserve the original path, query parameters, and unrelated verification URLs
  • cover the rewrite and preservation behavior in the MiniMax OAuth tests

Why

Fixes #19337. The current MiniMax OAuth code trusts the portal response verification URL directly. Live checks show https://www.minimax.io/oauth-authorize?user_code=TEST&client=OpenClaw redirects away to the homepage with 307, while https://platform.minimax.io/oauth-authorize?user_code=TEST&client=OpenClaw returns 200.

Test

  • scripts/run_tests.sh tests/test_minimax_oauth.py

@teknium1

Copy link
Copy Markdown
Contributor

Thanks for the focused regression fix. I found no blocking correctness or completeness issue in this diff.

Current main still returns the MiniMax verification_uri unchanged from _minimax_request_user_code (hermes_cli/auth.py:7450), then prints and opens it in the CLI (hermes_cli/auth.py:7567-7575). The dashboard invokes that same helper (hermes_cli/web_server.py:8787) and exposes its raw verification_uri (hermes_cli/web_server.py:8834). The proposed shared-boundary normalization therefore covers both paths, while its tests cover the stale-host rewrite and unrelated URLs.

This is an automated hermes-sweeper review.

@teknium1 teknium1 added sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform labels Jul 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/auth Authentication, OAuth, credential pools comp/cli CLI entry point, hermes_cli/, setup wizard P3 Low — cosmetic, nice to have provider/minimax MiniMax (Anthropic transport) sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform sweeper:risk-security-boundary Sweeper risk: may affect sandboxing, auth, credentials, or sensitive data type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MiniMax OAuth returns stale verification_uri pointing to deleted /oauth-authorize page on www.minimax.io

3 participants