Add SIWC OAuth flow (sign in with ChatGPT)

Lee Tickettrequested to merge
gitlab-community/gitlab-org/gitlab:siwc-flow into master

What does this MR do and why?

Adds the Sign in with ChatGPT (SIWC) OAuth flow for the ChatGPT connector installation.

When ChatGPT sends an unauthenticated user to GitLab's OAuth authorize endpoint (/oauth/authorize) with target_flow=chatgpt_siwc, GitLab now redirects them into the ChatGPT OmniAuth sign-in instead of showing the generic GitLab login page. ChatGPT authenticates the user and returns them to the original authorize request (preserved in session[:user_return_to]), which then completes the OAuth grant as usual. Users already signed in to GitLab are unaffected and proceed straight to the grant.

The flow is gated behind the chatgpt_siwc_login_redirect feature flag (gitlab_com_derisk, default disabled).

References

  • Work item: gitlab-com/partners/strategy-product-partnerships/product-partnerships#92

Screenshots or screen recordings

How to set up and validate locally

The change only fires for unauthenticated users, so validate in an incognito window (or sign out first). And validate when signed in the redirect to ChatGPT does not occur.

1. Set up the chatgpt OmniAuth provider

This flow builds on the ChatGPT OmniAuth provider added in !239762 (merged) (GitLab as OAuth consumer of OpenAI). Add it to your config/gitlab.yml under development.omniauth.providers:

development:
  omniauth:
    providers:
      - { name: 'chatgpt',
          app_id: 'YOUR_APP_ID',
          app_secret: 'YOUR_APP_SECRET' }

Obtain the app_id / app_secret from the Engineering 1Password vault: ChatGPT Dev OAuth Application. Restart GDK, then confirm the provider is enabled:

# rails console
Gitlab::Auth::OAuth::Provider.enabled?("chatgpt") # => true

2. Enable the feature flags

# rails console
# Required: enables the SIWC login-page bypass this MR adds
Feature.enable(:chatgpt_siwc_login_redirect)

# Recommended: also shows the "ChatGPT" button on the sign-in page (added in !239762).
# Not required for the SIWC redirect itself, but useful for a complete/realistic setup.
Feature.enable(:chatgpt_oauth_sign_in)

3. Register a Doorkeeper OAuth application to stand in for the ChatGPT connector

The final authorize request needs a Doorkeeper client_id (GitLab as OAuth provider). Create a test application via User settings → Applications (or the snippet below), with:

  • Redirect URI: https://chatgpt.com/connector_platform_oauth_redirect/
  • Scope: read_user
  • Confidential: unchecked
# rails console
org = Organizations::Organization.default_organization
app = Doorkeeper::Application.create!(
  name: "ChatGPT Connector (test)",
  redirect_uri: "https://chatgpt.com/connector_platform_oauth_redirect/",
  scopes: "read_user",
  confidential: false,
  organization_id: org.id
)
app.uid # => copy this as the client_id below

4. Trigger the flow (signed out / incognito)

Visit the authorize URL, substituting your app's client_id:

http://gdk.test:3000/oauth/authorize?client_id=<YOUR_CLIENT_ID>&response_type=code&redirect_uri=https://chatgpt.com/connector_platform_oauth_redirect/&scope=read_user&target_flow=chatgpt_siwc

Expected:

  1. You are redirected to ChatGPT (auth.openai.com) instead of the GitLab login page.
  2. After signing in to ChatGPT, you are returned to GitLab, now authenticated.
  3. GitLab shows the standard OAuth authorization (consent) screen for the application.
  4. Authorizing completes the grant and redirects to the app's redirect URI.

5. Verify the negative paths (each should show the normal GitLab login page)

  • No target_flow — remove &target_flow=chatgpt_siwc from the URL → generic login page.
  • Different target_flow — e.g. &target_flow=something_else → generic login page.
  • Feature flag disabled — Feature.disable(:chatgpt_siwc_login_redirect) then retry the full URL → generic login page.

Notes

  • If you hit "unknown client", the client_id is not a registered Doorkeeper application UID (don't use the OmniAuth app_id).
  • If you hit "invalid scope", the scope in the URL must be a subset of the test application's scopes (enforce_configured_scopes is on).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 This content was generated by GitLab Duo.

Edited by Lee Tickett

Merge request reports