FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Adding production OAuth login to Control Center
Letting a human administrator authenticate safely with PKCE and a fixed callback
Purpose
Connecting production Control Center to the database required a login flow where a human administrator could authenticate without embedded secrets and could handle cancellation and return.
Implementation
The OAuth flow uses the system browser authentication session and validates state, the PKCE challenge and verifier, and one fixed custom callback. An administrator starts it explicitly, can see progress and cancel, and the application returns to the foreground with the outcome after authentication or cancellation.
The implementation consumes a pending OAuth attempt once, exchanges its PKCE code and verifier, then requires a human administrator. URL schemes and request details are omitted.
Rendering diagram…
What was confirmed
Verification results
Targeted tests confirmed state and PKCE handling, callback validation, cancellation, and progress state.
At the cutoff, completing login with the live production identity provider had not been verified.
Basis for completion
The work was complete when human-initiated OAuth login was implemented in Control Center and the PKCE, callback, cancellation, and foreground-return boundaries were verified.