From 578ad74e76afd66d9b3e9363fed7d1d5dc7ba1d8 Mon Sep 17 00:00:00 2001
From: Aaron Liang <76561968+AaronL725@users.noreply.github.com>
Date: Wed, 15 Jul 2026 00:12:51 +0800
Subject: [PATCH] fix: scope OIDC postcheck migration edit

---
 tools/fix_remaining_patch_oidc_scope.py | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 tools/fix_remaining_patch_oidc_scope.py

diff --git a/tools/fix_remaining_patch_oidc_scope.py b/tools/fix_remaining_patch_oidc_scope.py
new file mode 100644
index 0000000..730439d
--- /dev/null
+++ b/tools/fix_remaining_patch_oidc_scope.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+from pathlib import Path
+
+script = Path(__file__).resolve().with_name("apply_remaining_hardening.py")
+text = script.read_text(encoding="utf-8")
+old = '''oauth = replace_once(oauth, "                status = int(getattr(response, \\\"status\\\", 200) or 200)\\n", "                status = int(getattr(response, \\\"status\\\", 200) or 200)\\n            _check_cancel(cancel)\\n", "post postcheck")'''
+new = '''post_start = oauth.find("def _post_form")
+post_end = oauth.find("def request_device_code", post_start)
+if post_start < 0 or post_end < 0:
+    raise RuntimeError("post postcheck: _post_form boundaries not found")
+post_block = oauth[post_start:post_end]
+post_block = replace_once(
+    post_block,
+    "                status = int(getattr(response, \\\"status\\\", 200) or 200)\\n",
+    "                status = int(getattr(response, \\\"status\\\", 200) or 200)\\n            _check_cancel(cancel)\\n",
+    "post postcheck",
+)
+oauth = oauth[:post_start] + post_block + oauth[post_end:]'''
+count = text.count(old)
+if count != 1:
+    raise RuntimeError(f"OIDC postcheck patch anchor expected once, got {count}")
+script.write_text(text.replace(old, new, 1), encoding="utf-8")
+print("OIDC postcheck migration edit scoped to _post_form")