feat(webui): support remote Codex OAuth login (#5174)

nanobot/webui/settings_routes.py

@@ -85,7 +85,8 @@ _CHANNEL_VALUES_HEADER_MAX_BYTES = 64 * 1024
 _API_SERVICE_VALUES_HEADER = "X-Nanobot-API-Service-Values"
 _API_SERVICE_VALUES_HEADER_MAX_BYTES = 8 * 1024
 _OAUTH_CODE_HEADER = "X-Nanobot-OAuth-Code"
-_OAUTH_CODE_HEADER_MAX_BYTES = 8 * 1024
+_OAUTH_CALLBACK_HEADER = "X-Nanobot-OAuth-Callback"
+_OAUTH_RESPONSE_HEADER_MAX_BYTES = 8 * 1024
 
 _SKIP_FIELD = object()
 _CHANNEL_CONNECT_ACTIONS = frozenset({"start", "poll", "cancel"})
@@ -471,16 +472,22 @@ class WebUISettingsRouter:
             if action == "login":
                 payload = await asyncio.to_thread(login_oauth_provider, query)
             elif action == "complete":
-                authorization_code = case_insensitive_header(
+                authorization_response = case_insensitive_header(
+                    request.headers,
+                    _OAUTH_CALLBACK_HEADER,
+                ) or case_insensitive_header(
                     request.headers,
                     _OAUTH_CODE_HEADER,
                 )
-                if len(authorization_code.encode("utf-8")) > _OAUTH_CODE_HEADER_MAX_BYTES:
-                    raise WebUISettingsError("OAuth authorization code is too large")
+                if (
+                    len(authorization_response.encode("utf-8"))
+                    > _OAUTH_RESPONSE_HEADER_MAX_BYTES
+                ):
+                    raise WebUISettingsError("OAuth authorization response is too large")
                 payload = await asyncio.to_thread(
                     complete_oauth_provider,
                     query,
-                    authorization_code or None,
+                    authorization_response or None,
                 )
             else:
                 payload = await asyncio.to_thread(logout_oauth_provider, query)