Skip to content

Harden Discord bot auth with user-link flow#731

Draft
RSO wants to merge 4 commits intomainfrom
only-run-discord-bot-requests
Draft

Harden Discord bot auth with user-link flow#731
RSO wants to merge 4 commits intomainfrom
only-run-discord-bot-requests

Conversation

@RSO
Copy link
Contributor

@RSO RSO commented Mar 2, 2026

Summary

  • remove the Discord bot-user auth fallback and only authorize message processing as linked Kilo users
  • add a Discord account-link flow for existing installs (including a deep-link route that enforces Kilo sign-in and owner/org access before redirecting to Discord OAuth)
  • show an actionable "Link My Discord Account" button in Discord replies when the requester is not linked

Testing

  • pnpm test -- src/lib/discord/auth.test.ts src/lib/discord/authorized-users.test.ts
  • pnpm typecheck

RSO added 3 commits March 3, 2026 15:14
Route unlinked Discord users through a secure link button flow that enforces Kilo sign-in and owner/org access before redirecting to Discord OAuth. This lets org members authorize themselves without falling back to an internal bot user.
Redirect Discord link OAuth completions to a standalone confirmation screen with a prominent success state, so users can close the tab after linking without returning to settings.
Carry signed Discord message context through the link OAuth state and replay the original mention after the user links their account. This keeps the user flow seamless while preserving ownership and author validation checks.
@RSO RSO force-pushed the only-run-discord-bot-requests branch from 8eea696 to f714a30 Compare March 3, 2026 14:14
The link flow now ends on a dedicated success page, so integration pages only need to treat install callbacks as success states.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant