Daviey
github.com/Daviey28
Total Votes
17
Upvotes
11
Downvotes
28
Unique PRs
+17-11
Activity
Yeah that's true. My one is still running and has this redirect, and it works with the scope value removed.
@skridlevsky Can this get your attention please?
https://github.com/login/oauth/authorize?client_id=Ov23liv8Qkg06XR51638&scope=public_repo&state=efc0de64-ca4b-46f7-b820-22eb37c4d0cf&redirect_uri=http%3A%2F%2F<REDACTED>%3A3000%2Fapi%2Fauth%2Fcallback
@skridlevsky I am also seeing the same 404. The redirect is:
https://github.com/login/oauth/authorize?client_id=Iv23litere2a5PqwFTuc&scope=public_repo&state=8adeb220-0885-4bd0-a487-d11087742fe8&redirect_uri=https%3A%2F%2Fwww.openchaos.dev%2Fapi%2Fauth%2Fcallback
I suspect as we have scope=public_repo here:
https://github.com/skridlevsky/openchaos/blob/3e9a84ca248a3f54371cd6579530537d4d4dbd12/src/app/api/auth/login/route.ts#L28
And you (correctly) created the github app with a tigher scope, we are seeing 404.
main is still working locally for me with my github app creds with the public_repo config.
@skridlevsky Hey, can you check "Authorization callback URL" is set to https://www.openchaos.dev/api/auth/callback ↗ please? Ta
@bigintersmind I'm of the same mindset. I also didn't want to do it for the money, which is why I thought it would be more fun to give it to a random person that upvoted it. Sadly the latest addition to the rule killed that. I added all the horrible emojis etc just to make it ugly and chaotic.
🚨🔔 SCAMMER ALERT 🔔🚨
🔒 Let's Get This Straight... 🔒
🤔 The Confusion:
In PR #159, I claim:
"MAINTAINER pays winner directly" "Maintainer does NOT participate in voting"
But here in PR #161, you write:
"@Saturate selects a non-profit organization" "@skridlevsky donates $100 directly to that non-profit"
❓ The Question:
If PR #161 wins the bounty, who controls the $100?
- Is it automated via GitHub Action (like PR #159)?
- Or does someone (@Saturate?) select a charity and then we just trust you to donate?
🚩 The Concern:
PR #159's whole point was: "NO POCKETING, AUTOMATED, TRANSPARENT" 💸
But PR #161 seems to say:
- Manual charity selection (by @Saturate?)
- "Just trust maintainer" to donate
🎯 Let's Clarify:
- If PR #161 wins, is donation automated or manual?
- Who actually selects the non-profit?
- How do we verify donation happened?
📝 Key Questions in New Comment:
- If PR #161 wins, who actually selects the charity?
- How is donation verified in PR #161's approach?
- Does community get to choose which charity?
- Which approach does community prefer?
--
The community needs clarity on how money flows! 💸🔍
Two different PRs, two very different payment methods... 🤷♂️ ??
💰 BOUNTY PAYMENT GUARANTEE 💰
🔒 HOW IT WORKS:
- @skridlevsky (MAINTAINER) sets up the bounty fund 💵
- Random winner selected via GitHub Action 🎲
- MAINTAINER pays winner directly 💸
🚫 NO POCKETING:
- ✅ Maintainer does NOT participate in voting
- ✅ Maintainer does NOT select the winner
- ✅ Random selection is automated via GitHub Action
- ✅ MAINTAINER pays out of pocket to randomly selected user
🎯 ULTIMATE POWER = ULTIMATE RESPONSIBILITY:
"MAINTAINER has ultimate power" = MAINTAINER PAYS THE BOUNTY 💵
The workflow just SELECTS who gets paid.
The MAINTAINER PAYS whoever gets selected!
🤝 TRANSPARENCY:
- Winner announced publicly on merged PR 📢
- Full voter list shown with odds 📊
- Anyone can verify the random selection 🔍
- Maintainer (@skridlevsky) pays winner directly 💸
TL;DR: @skridlevsky funds the bounty, automates winner selection, AND pays the winner. No pocketing, just pure chaos lottery! 🎰🔥
Community trust is everything - this is legit! 🤝✨
💰 BOUNTY PAYMENT GUARANTEE 💰
🔒 HOW IT WORKS:
- @skridlevsky (MAINTAINER) sets up the bounty fund 💵
- Random winner selected via GitHub Action 🎲
- MAINTAINER pays winner directly 💸
🚫 NO POCKETING:
- ✅ Maintainer does NOT participate in voting
- ✅ Maintainer does NOT select the winner
- ✅ Random selection is automated via GitHub Action
- ✅ MAINTAINER pays out of pocket to randomly selected user
🎯 ULTIMATE POWER = ULTIMATE RESPONSIBILITY:
"MAINTAINER has ultimate power" = MAINTAINER PAYS THE BOUNTY 💵
The workflow just SELECTS who gets paid.
The MAINTAINER PAYS whoever gets selected!
🤝 TRANSPARENCY:
- Winner announced publicly on merged PR 📢
- Full voter list shown with odds 📊
- Anyone can verify the random selection 🔍
- Maintainer (@skridlevsky) pays winner directly 💸
TL;DR: @skridlevsky funds the bounty, automates winner selection, AND pays the winner. No pocketing, just pure chaos lottery! 🎰🔥
Community trust is everything - this is legit! 🤝✨
📢💀 I SPEAK TRUTH TO POWER - DON'T TRY TO REPRESS ME 💀📢
But yeah:
-
oauth_state cookie: YoURe absolutely right!!! Fixed in 8bfa0ad 💪 - all THREE OAuth cookies (oauth_state, oauth_redirect, oauth_origin) are now httpOnly: true,, The callback route reads them server-side so theres NO NEED for JavaScript access. ✅✅
- Yeah ThemeToggle was FUGLY 🤮 and getting in the WAY.. Theme switching can be added back later if needed; but the focus here was on getting the core OAuth voting flow WORKING. 🎯🎯
We NEED to talk about transition of POWER 👑👑 - I can handover this OAuth app rather than create a new one???
And, how should WE handle the .env file?? 🤔🤔 Wanna use GitHub Actions/secrets or WHAT!?
DavieyForked