From bcca5a112e4c5a138b70c5f38df93fb7c8df4dc8 Mon Sep 17 00:00:00 2001 From: Michiel de Jong Date: Tue, 29 Sep 2026 15:07:49 +0200 Subject: [PATCH 1/2] Require atomic-integration-proxy 0.2.2 (Notion connect fix) 0.2.2 (ontola/atomic-plugins branch claude/proxy-notion-connect-redirect) continues from the consent page to the provider with a page instead of a 303, so a provider whose authorization endpoint redirects to another of its own origins (Notion: api.notion.com -> app.notion.com) is no longer blocked by the consent page's CSP form-action. NOT READY TO MERGE: Cargo.lock still resolves 0.2.1. Once 0.2.2 is on crates.io, run `cargo update -p atomic-integration-proxy` and `cargo build --release --locked`, and commit Cargo.lock here. Also: README's deploy section no longer describes the retired git pin. Co-Authored-By: Claude Opus 5.5 --- Cargo.toml | 2 +- README.md | 11 ++++------- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 4eb9517..5b14a89 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -17,7 +17,7 @@ publish = false # Published to crates.io from ontola/atomic-plugins' integration-proxy/. # Bump this (and run `cargo update -p atomic-integration-proxy`) to deploy a # new release. -atomic-integration-proxy = "0.2" +atomic-integration-proxy = "0.2.2" tokio = { version = "1", features = ["rt-multi-thread", "macros"] } [profile.release] diff --git a/README.md b/README.md index f470ceb..a3e149a 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ What is here: | File | Purpose | | --- | --- | | `src/main.rs` | `atomic_integration_proxy::run().await`, nothing else. | -| `Cargo.toml` | Package/binary `auth-proxy`, depending on `atomic-integration-proxy`. Until the crate is on crates.io this is a git dependency pinned to an `ontola/atomic-plugins` commit (`rev`). | +| `Cargo.toml` | Package/binary `auth-proxy`, depending on `atomic-integration-proxy` from crates.io, with the lowest release this deployment needs as the version requirement. | | `Cargo.lock` | The exact versions Heroku builds. Commit it with every bump. | | `Procfile` | `web: target/release/auth-proxy`. | | `rust-toolchain` | `stable`, read by the `emk/rust` Heroku buildpack. | @@ -20,8 +20,9 @@ What is here: ## Deploying a newer proxy -While the dependency is a git pin: set `rev` in `Cargo.toml` to the -`ontola/atomic-plugins` commit to deploy, then +Once the release is on crates.io (`ontola/atomic-plugins` publishes it from +a tag `integration-proxy-v`), set the version requirement in +`Cargo.toml` to it when this deployment depends on its behaviour, then ```sh cargo update -p atomic-integration-proxy @@ -30,10 +31,6 @@ cargo build --release --locked and commit `Cargo.toml` and `Cargo.lock`. Merging to `main` deploys. -Once `atomic-integration-proxy` is published, replace the git dependency with -`atomic-integration-proxy = "0.1"`, and bump releases with -`cargo update -p atomic-integration-proxy` alone. - ## Running locally ```sh From a005f40fc33b4bf1863cbe9bc6bceb0710f9beff Mon Sep 17 00:00:00 2001 From: Michiel de Jong Date: Tue, 29 Sep 2026 15:16:02 +0200 Subject: [PATCH 2/2] Lock atomic-integration-proxy 0.2.2 from crates.io 0.2.2 continues to the OAuth provider with a page instead of a redirect, so providers whose authorize URL hops origins (Notion: api.notion.com -> app.notion.com) are no longer blocked by the consent page's form-action. ontola/atomic-plugins#207. Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 05f8977..2818a83 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -59,9 +59,9 @@ dependencies = [ [[package]] name = "atomic-integration-proxy" -version = "0.2.1" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b2ce5ec037f1c43ebd06fdaef2cb8d9c7cd7137672cc9da5cd6a9b433283c61" +checksum = "3c1ee40c7094bf54d715c032d2e7896e765ea87e246c9197dbdb844ee82e6229" dependencies = [ "axum", "axum-extra",