Skip to content

feat: OAuth and permissions for mobile app #43037

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
a-lider merged 9 commits into from
Dec 19, 2025
Merged

feat: OAuth and permissions for mobile app #43037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
92b8527
Update redirect URI for OAuth
a-lider Dec 9, 2025
6cd6480
Merge branch 'master' into feat/mobile-app
jonathanlab Dec 9, 2025
31907f6
Keep just posthog redirect URI for mobile app
a-lider Dec 9, 2025
e4f1af8
feat: scopes
skoob13 Dec 9, 2025
24d082c
Merge branch 'feat/mobile-app' of github.com:PostHog/posthog into fea…
skoob13 Dec 9, 2025
b7afa16
test(backend): update query snapshots
github-actions[bot] Dec 9, 2025
caaa319
Merge branch 'master' of github.com:PostHog/posthog into feat/mobile-app
skoob13 Dec 10, 2025
cd6852c
Merge branch 'master' into feat/mobile-app
a-lider Dec 10, 2025
490abe2
Merge branch 'feat/mobile-app' of github.com:PostHog/posthog into fea…
skoob13 Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ee/api/conversation.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ def validate(self, data):


class ConversationViewSet(TeamAndOrgViewSetMixin, ListModelMixin, RetrieveModelMixin, GenericViewSet):
scope_object = "INTERNAL"
scope_object = "conversation"
Copy link
Copy Markdown
Contributor Author

@a-lider a-lider Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@skoob13 Is this ok to merge?

Copy link
Copy Markdown
Contributor

@skoob13 skoob13 Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep

serializer_class = ConversationSerializer
queryset = Conversation.objects.all()
lookup_url_kwarg = "conversation"
Expand Down
1 change: 1 addition & 0 deletions posthog/api/test/__snapshots__/test_api_docs.ambr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
# name: TestAPIDocsSchema.test_api_docs_generation_warnings_snapshot
list([
'',
'/home/runner/work/posthog/posthog/ee/api/conversation.py: Warning [ConversationViewSet]: could not derive type of path parameter "project_id" because model "ee.models.assistant.Conversation" contained no such field. Consider annotating parameter with @extend_schema. Defaulting to "string".',
'/home/runner/work/posthog/posthog/ee/api/dashboard_collaborator.py: Warning [DashboardCollaboratorViewSet]: could not derive type of path parameter "project_id" because model "ee.models.dashboard_privilege.DashboardPrivilege" contained no such field. Consider annotating parameter with @extend_schema. Defaulting to "string".',
"/home/runner/work/posthog/posthog/ee/api/max_tools.py: Error [MaxToolsViewSet]: exception raised while getting serializer. Hint: Is get_serializer_class() returning None or is get_queryset() not working without a request? Ignoring the view for now. (Exception: 'MaxToolsViewSet' should either include a `serializer_class` attribute, or override the `get_serializer_class()` method.)",
'/home/runner/work/posthog/posthog/ee/api/max_tools.py: Warning [MaxToolsViewSet]: could not derive type of path parameter "project_id" because model "ee.models.assistant.Conversation" contained no such field. Consider annotating parameter with @extend_schema. Defaulting to "string".',
Expand Down
1 change: 1 addition & 0 deletions posthog/scopes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
"batch_export",
"batch_import",
"cohort",
"conversation",
"dashboard",
"dashboard_template",
"dataset",
Expand Down
4 changes: 2 additions & 2 deletions posthog/settings/web.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -527,9 +527,9 @@ def static_varies_origin(headers, path, url):
"*": "Full access to all scopes",
**get_scope_descriptions(),
},
# Allow both http and https schemes to support localhost callbacks
# Allow http, https, and custom schemes to support localhost callbacks and native mobile apps
# Security validation in OAuthApplication.clean() ensures http is only allowed for loopback addresses (localhost, 127.0.0.0/8) in production
"ALLOWED_REDIRECT_URI_SCHEMES": ["http", "https"],
"ALLOWED_REDIRECT_URI_SCHEMES": ["http", "https", "posthog"],
"AUTHORIZATION_CODE_EXPIRE_SECONDS": 60 * 5,
# client has 5 minutes to complete the OAuth flow before the authorization code expires
"DEFAULT_SCOPES": ["openid"],
Expand Down
Loading