refactor(gui): react-doctor cleanup for Providers

[Wibias]

Summary

• Split Providers + AddProviderModal into fetch/OAuth/CRUD hooks and panes.
• Harden provider-workspace fetch/loading paths; add missing type="button".

Stack

• Depends on fix(gui): react-doctor shared foundations #466 (foundations).

Test plan

• bun x tsc -b in gui/
• Providers: list/add/oauth, account pools, JSON editor, workspace settings save

[coderabbitai]

Warning

Review limit reached

@Wibias, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 30 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 66e7efbb-11bd-4009-bc72-ef7ff6e805f0

📥 Commits

Reviewing files that changed from the base of the PR and between 803807a and e616590.

📒 Files selected for processing (18)

• gui/src/components/AddProviderModal.tsx
• gui/src/components/add-provider-form-pane.tsx
• gui/src/components/add-provider-modal-field.tsx
• gui/src/components/add-provider-modal-reducer.ts
• gui/src/components/add-provider-oauth-pane.tsx
• gui/src/components/provider-workspace/ProviderSettings.tsx
• gui/src/components/provider-workspace/ProviderWorkspaceShell.tsx
• gui/src/components/use-add-provider-oauth.ts
• gui/src/pages/Providers.tsx
• gui/src/pages/providers-page-modals.tsx
• gui/src/pages/providers-page-utils.ts
• gui/src/pages/providers-shared.ts
• gui/src/pages/use-providers-crud.ts
• gui/src/pages/use-providers-fetch.ts
• gui/src/pages/use-providers-oauth.ts
• gui/tests/rail-hover-delete.test.ts
• tests/oauth-tos-warning.test.ts
• tests/provider-workspace-auth.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Wibias]

Review follow-up (Codex findings)

Rebased onto upstream/dev and dropped foundations commit 9c7e922e (already merged via #466). Classic Providers UI is gone on dev, so the extract was re-applied onto the workspace-only page.

Finding	Status
1. Clear manualCode / manualCodeMsg between OAuth attempts	Skipped (obsolete) — classic OAuthPanel + Providers-page manual paste state were removed with Classic. Remaining Add Provider paste flow already clears on login start / back / use-API-key (use-add-provider-oauth + reducer).
2. choicesStatus stuck at "loading"` on non-OK presets	Fixed — ProviderSettings now sets "error"whenreadJsonIfOkreturnsnull`.
3. Seam tests for extracted modules	Fixed — oauth-tos-warning / provider-workspace-auth now include providers-page-modals / use-providers-oauth / related extracts; classic assertions removed.

Verification

• bun test tests/oauth-tos-warning.test.ts tests/provider-workspace-auth.test.ts — 20 pass
• bun run lint:gui — pass
• bun x tsc -p gui/tsconfig.app.json --noEmit — no errors in PR files (3 pre-existing upstream errors remain: client-resource.ts, CodexAccountPool.tsx, Dashboard.tsx)

HEAD: 333b42ef

[Wibias]

Re-review (HEAD e616590c) — no code changes

Verdict

Approve for functional / extract correctness (no reproducible code bug or credential leak found in the Providers/OAuth extract). Prior Codex findings on this PR are addressed or obsolete after the classic UI removal.

Reviewed the extract seams (use-providers-oauth, use-add-provider-oauth, use-providers-fetch / use-providers-crud, Add Provider modal/reducer/panes, Providers page modals). OAuth login/cancel/status polling and manual redirect paste stay on local management API calls; API keys use type="password"; no logging/serialization of tokens, API keys, or account identifiers in the moved code. Manual paste state is cleared on login start / back / use-API-key in the Add Provider path.

Verification

Check	Result
bun test tests/oauth-tos-warning.test.ts tests/provider-workspace-auth.test.ts	20 pass
bun test ./gui/tests/rail-hover-delete.test.ts	4 pass
bun run privacy:scan	passed
gh pr checks 474	all green (ubuntu/macos/windows, npm-global, react-doctor, label)

Maintainer security review — still required

This PR moves authentication / OAuth credential-handling UI (login, logout, reauth, manual redirect/code paste, API-key form fields). Per MAINTAINERS.md and AGENTS.md, authentication and credential-handling changes require explicit maintainer security review before merge.

This re-review does not constitute that security approval. Please treat maintainer security review as a remaining merge gate.

[Wibias]

Security Review: PR #474

Pull request: lidge-jun/opencodex#474
Reviewed head: e616590cfc3f12eddf6b5478e1468b216eac7eb1
Verdict: APPROVED

The pull request is open, non-draft, and mergeable.

Result

No reportable security vulnerability, credential leak, or authentication regression was found in this diff.

Verified Security Boundaries

Provider secrets remain server-side

/api/config exposes only metadata such as hasApiKey and hasHeaders. It removes URL usernames, passwords, query strings, and fragments. The extracted GUI types contain no raw API-key or header fields.

API keys are not accidentally round-tripped or overwritten

New keys are handled through password inputs and dedicated credential endpoints. Provider settings cannot patch apiKey, so ordinary settings saves cannot erase or replace stored credentials.

OAuth state remains provider-scoped and race-protected

Login generations invalidate stale attempts. Cancellation clears matching login information. Reauthentication verifies that the requested account is present, and mismatched or still-invalid accounts are rejected.

Manual OAuth data does not leak into later attempts

The Add Provider flow clears the pasted redirect or authorization code and its status whenever a login starts. It clears the code again after successful submission.

The unresolved review comment claiming that stale manual redirect data survives between attempts is not reproducible at the reviewed head.

OAuth terms-of-service warnings remain enforced

Providers marked as carrying additional terms-of-service risk are intercepted before login in both the main Providers page and the Add Provider modal. Login continues only after explicit confirmation.

Server-side SSRF protections remain authoritative

New providers default to allowPrivateNetwork: false.

The server performs resolved-destination validation when providers are created. Provider settings updates are validated after merging the requested changes with the existing provider configuration.

No new credential exposure surfaces

No new instance was found of:

• raw-secret logging;
• credential persistence in localStorage;
• credentials transported through query strings;
• unsafe HTML rendering of server-controlled content;
• raw API keys or OAuth tokens returned through the provider configuration DTO.

CI Verification

The reviewed head passed:

• React Doctor;
• cross-platform CI;
• type checking;
• unit tests;
• GUI tests;
• GUI builds;
• packaging jobs;
• privacy scans on Ubuntu, macOS, and Windows.

Security Sign-off

The explicit authentication and security review requirement is satisfied for:

e616590cfc3f12eddf6b5478e1468b216eac7eb1

No security changes are required before merge.