Improve Notion OAuth HTTPS error guidance (#26)

Co-authored-by: leoxyang <leoxyang@tencent.com>

Author: Pandakingxbc

dashboard/src/locales/en.json

@@ -74,6 +74,7 @@
     "CHANNEL_NAME_TAKEN": "This channel name is already in use. Please choose another.",
     "CONNECTOR_NOT_FOUND": "Connector not found.",
     "CONNECTOR_INVALID_CREDENTIALS": "Invalid connector credentials.",
+    "CONNECTOR_OAUTH_HTTPS_REQUIRED": "Octop is currently being accessed over public HTTP, but Notion OAuth callbacks require HTTPS. Use HTTPS, or access Octop locally through localhost or 127.0.0.1.",
     "CONNECTOR_KIND_UNSUPPORTED": "Unsupported connector type.",
     "CONNECTOR_NOT_BOUND": "Connector is not bound to this agent.",
     "CONNECTOR_ALREADY_BOUND": "Connector is already bound.",

dashboard/src/locales/zh.json

@@ -74,6 +74,7 @@
     "CHANNEL_NAME_TAKEN": "该通道名称已被使用，请换一个名称。",
     "CONNECTOR_NOT_FOUND": "未找到连接器。",
     "CONNECTOR_INVALID_CREDENTIALS": "连接器凭证无效。",
+    "CONNECTOR_OAUTH_HTTPS_REQUIRED": "当前通过公网 HTTP 访问 Octop，Notion 授权回调地址需要 HTTPS。请改用 HTTPS，或通过 localhost、127.0.0.1 在本机访问 Octop。",
     "CONNECTOR_KIND_UNSUPPORTED": "不支持的连接器类型。",
     "CONNECTOR_NOT_BOUND": "连接器未绑定到此 Agent。",
     "CONNECTOR_ALREADY_BOUND": "连接器已绑定。",

src/octop/api/routers/connectors.py

@@ -7,6 +7,7 @@
 import logging
 import secrets
 from typing import Any
+from urllib.parse import urlparse
 
 from fastapi import APIRouter, Depends, Query, Request
 from fastapi.responses import HTMLResponse
@@ -226,6 +227,12 @@ async def _run() -> None:
     asyncio.create_task(_run())
 
 
+def _is_public_http_uri(uri: str) -> bool:
+    parsed = urlparse(uri)
+    host = (parsed.hostname or "").lower()
+    return parsed.scheme == "http" and host not in {"localhost", "127.0.0.1", "::1"}
+
+
 @router.get("/connectors/catalog", summary="Connector catalog")
 async def get_catalog(
     user: Any = Depends(current_user),
@@ -695,6 +702,11 @@ async def oauth_start(
     state_id = new_ulid()
     base = str(request.base_url).rstrip("/")
     redirect_uri = f"{base}/api/connectors/oauth/callback"
+    if kind == "notion" and _is_public_http_uri(redirect_uri):
+        raise OctopError(
+            ErrorCode.CONNECTOR_OAUTH_HTTPS_REQUIRED,
+            "Notion OAuth callbacks require HTTPS for non-loopback addresses",
+        )
 
     try:
         authorize_url, verifier, ctx = await start_oauth(

src/octop/i18n/en.json

@@ -296,6 +296,7 @@
     "CHANNEL_NAME_TAKEN": "This channel name is already in use. Please choose another.",
     "CONNECTOR_NOT_FOUND": "Connector not found.",
     "CONNECTOR_INVALID_CREDENTIALS": "Invalid connector credentials.",
+    "CONNECTOR_OAUTH_HTTPS_REQUIRED": "Octop is currently being accessed over public HTTP, but Notion OAuth callbacks require HTTPS. Use HTTPS, or access Octop locally through localhost or 127.0.0.1.",
     "CONNECTOR_KIND_UNSUPPORTED": "Unsupported connector type.",
     "CONNECTOR_NOT_BOUND": "Connector is not bound to this agent.",
     "CONNECTOR_ALREADY_BOUND": "Connector is already bound.",

src/octop/i18n/zh.json

@@ -296,6 +296,7 @@
     "CHANNEL_NAME_TAKEN": "该通道名称已被使用，请换一个名称。",
     "CONNECTOR_NOT_FOUND": "未找到连接器。",
     "CONNECTOR_INVALID_CREDENTIALS": "连接器凭证无效。",
+    "CONNECTOR_OAUTH_HTTPS_REQUIRED": "当前通过公网 HTTP 访问 Octop，Notion 授权回调地址需要 HTTPS。请改用 HTTPS，或通过 localhost、127.0.0.1 在本机访问 Octop。",
     "CONNECTOR_KIND_UNSUPPORTED": "不支持的连接器类型。",
     "CONNECTOR_NOT_BOUND": "连接器未绑定到此 Agent。",
     "CONNECTOR_ALREADY_BOUND": "连接器已绑定。",

src/octop/infra/errors.py

@@ -33,6 +33,7 @@ class ErrorCode(StrEnum):
     CHANNEL_NAME_TAKEN = "CHANNEL_NAME_TAKEN"
     CONNECTOR_NOT_FOUND = "CONNECTOR_NOT_FOUND"
     CONNECTOR_INVALID_CREDENTIALS = "CONNECTOR_INVALID_CREDENTIALS"
+    CONNECTOR_OAUTH_HTTPS_REQUIRED = "CONNECTOR_OAUTH_HTTPS_REQUIRED"
     CONNECTOR_KIND_UNSUPPORTED = "CONNECTOR_KIND_UNSUPPORTED"
     CONNECTOR_NOT_BOUND = "CONNECTOR_NOT_BOUND"
     CONNECTOR_ALREADY_BOUND = "CONNECTOR_ALREADY_BOUND"
@@ -80,6 +81,7 @@ class ErrorCode(StrEnum):
     ErrorCode.CHANNEL_NAME_TAKEN: 409,
     ErrorCode.CONNECTOR_NOT_FOUND: 404,
     ErrorCode.CONNECTOR_INVALID_CREDENTIALS: 400,
+    ErrorCode.CONNECTOR_OAUTH_HTTPS_REQUIRED: 400,
     ErrorCode.CONNECTOR_KIND_UNSUPPORTED: 400,
     ErrorCode.CONNECTOR_NOT_BOUND: 400,
     ErrorCode.CONNECTOR_ALREADY_BOUND: 409,

tests/integration/test_connectors_api.py

@@ -2,8 +2,13 @@
 
 from __future__ import annotations
 
+from pathlib import Path
+from unittest.mock import AsyncMock, patch
+
 import pytest
 
+from tests.support.app import octop_client, write_octop_config
+from tests.support.auth import auth_header, bootstrap_admin
 from tests.support.http import ws_chat_turn
 
 
@@ -165,6 +170,26 @@ async def test_auth_info(env):
     assert data["auth_hint"]
 
 
+async def test_oauth_start_public_http_notion_error_is_actionable(tmp_octop_home: Path):
+    write_octop_config(tmp_octop_home)
+    async with octop_client(tmp_octop_home) as (c, _srv):
+        await bootstrap_admin(c, tmp_octop_home)
+        auth = await auth_header(c)
+        mocked_start = AsyncMock()
+        with patch("octop.api.routers.connectors.start_oauth", mocked_start):
+            r = await c.post(
+                "/api/connectors/oauth/notion/start",
+                headers={**auth, "host": "58.87.70.170"},
+                json={"redirect_after": "/connectors"},
+            )
+    assert r.status_code == 400
+    body = r.json()
+    assert body["error"]["code"] == "CONNECTOR_OAUTH_HTTPS_REQUIRED"
+    assert "Notion" in body["error"]["message"]
+    assert "HTTPS" in body["error"]["message"]
+    mocked_start.assert_not_awaited()
+
+
 async def test_patch_instance_status(env):
     c, _, auth, _ = env
     r = await c.post(