docs: add a complete auth example app and sharpen authentication-vs-authorization framing - #7010
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Merging this PR will not alter performance
Comparing 
Footnotes
|
Greptile SummaryThe PR adds a complete enterprise authentication example and links it from the auth overview, secure-by-default guide, and sidebar.
Confidence Score: 3/5The PR is not yet safe to merge because the shared-board example grants unrelated authenticated users access to the same mutable notes state. Every dashboard session links to the identical shared-state token without deriving or authorizing a team identifier, allowing cross-team reads and mutations in deployments serving more than one organization. Files Needing Attention: docs/enterprise/auth/example-app.md
|
| Filename | Overview |
|---|---|
| docs/enterprise/auth/example-app.md | Adds the complete auth example, but its constant shared-state token does not isolate notes between teams or organizations. |
| docs/app/reflex_docs/templates/docpage/sidebar/sidebar_items/enterprise.py | Adds the new example page to the enterprise authentication sidebar. |
| docs/enterprise/auth/overview.md | Clarifies authentication versus authorization and links to the complete example. |
| docs/enterprise/auth/secure-by-default.md | Adds a related-page link to the complete example. |
Reviews (8): Last reviewed commit: "docs: cover app-owned roles and where th..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
9c26f49 to
e55401c
Compare
Add docs/enterprise/auth/example-app.md: one small, complete app (public landing page, protected dashboard, admin-only action) showing the whole rxe.AuthPlugin pattern — authentication owned by the plugin, authorization expressed with auth= checks — plus the common failure modes (rx.App() vs rxe.App(), blank-when-logged-out, redirect_uri_mismatch, the deprecated register_auth_endpoints). Link it from the overview and secure-by-default pages and add it to the enterprise sidebar after Secure by Default.
e55401c to
6b6dc33
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9c26f49272
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
…ent state explicit The landing page now renders dark_mode (button label, page colors), so the public field and handler have a visible effect, and the example states that Reflex state is per-client — each user sees their own notes — instead of presenting itself as a shared notepad.
masenf
left a comment
masenf
left a comment
There was a problem hiding this comment.
left a few comments. overall i think the example is good. but we want to make sure we're not demonstrating less-than-desirable style
…ark mode Per review: NotesState is now an rx.SharedState linked to one team token from the dashboard's on_load (behind the page guard), so signed-in users share one live board; the landing page's public surface is a dismissible promo banner instead of a hand-rolled dark-mode toggle that shadowed the framework's color-mode support.
masenf
left a comment
masenf
left a comment
There was a problem hiding this comment.
few more things, but i like this example modifications a lot more!
The linked-token underscore rule lives in the Shared State doc this page links to, and the SharedState version note is moot when the auth plugin already requires a newer reflex.
Some providers serialize the groups claim as one string, and Python's 'in' on a string is a substring test, so both example checks now require a list before testing membership; a short note explains the guard.
The example only showed a role the identity provider already manages, which is the cheapest check there is but also the case an app rarely has. Roles like author/editor/reviewer are the app's own, and promoting someone from inside the app is impossible against an IdP -- there is no write-back. With no guidance for that, the natural next step is a check that opens a database session, and a check runs on every gated event. Adds the variant: load the member's row into a state at sign-in and have an async check read it through get_state, keyed on sub (or provider_name+sub, since sub is unique only per issuer) rather than the optional email claim. Also states where the claims actually come from. extra_scopes asks for a scope, but a check reads whatever the provider's userinfo endpoint returns -- _get_userinfo prefers _fetch_userinfo and uses its response verbatim, falling back to ID token claims only when the issuer advertises no userinfo endpoint. A groups claim mapped only into the ID token therefore never reaches the check, which returns False for everyone with nothing in the logs to explain it. The 30-minute claim cache is noted beside it, since it is the same surprise arriving later.
2 participants
All Submissions:
Type of change
Changes To Core Features:
Docs-only change (ENG-10954, follow-up to the initial auth docs). The builder agent retrieves these pages during memory retrieval, so this is the knowledge layer behind generating correct
rxe.AuthPlugincode.docs/enterprise/auth/example-app.md— one small, complete app (public landing page, protected dashboard, admin-only action) showing the whole pattern in ~100 lines: plugin config with placeholderOIDC_*vars, checks in oneauthz.pymodule, state withauth=Falseopt-outs and anauth=is_adminaction,rxe.App(), and a run walkthrough. Ends with the best-practice rules and the failure modes (rx.App()vsrxe.App(), blank-when-logged-out,redirect_uri_mismatch, the deprecatedregister_auth_endpoints).auth=) and a decision table for picking theauth=value; the overview gains a matching paragraph.Docs app tests pass locally (
tests/test_sidebar.py,test_doc_links.py,test_routes.py,test_urls.py,test_frontmatter_meta.py,test_doc_description.py,test_breadcrumbs.py).Linear: ENG-10954
Generated by Claude Code