fix: stop shadowing base_host() in the Spaces OAuth callbacks

[zerodarkzone]

Description

The Google, GitHub and GitLab Spaces callbacks each open with:

base_host = request.session.get("host")

That shadows the base_host() imported at the top of the same module. Python binds the name to the function's local scope, so every later base_host(request=..., is_space=True) in that method calls a string:

TypeError: 'str' object is not callable

Eight call sites per file are affected — the success redirect, both guard branches, the allowed-host fallback and the exception handler — so any request reaching these callbacks returns a 500 instead of the intended redirect.

Demonstrated in isolation:

before: TypeError: 'str' object is not callable
after:  https://example.com/spaces/

The assigned value is never read. Deleting the line is the entire fix; every reference then resolves to the import again.

Why it went unnoticed

Nothing calls these endpoints. The Spaces frontend routes OAuth through the /app endpoints — window.location.assign(${API_BASE_URL}/auth/google/…) — so /auth/spaces/<provider>/ has been unreachable dead code, and a total crash inside code nothing executes stays invisible.

That is changing: #1 points the Spaces OIDC button at its own /auth/spaces/oidc/ flow, which makes this worth fixing rather than deleting. (space/oidc.py does not carry the shadow, so OIDC itself is unaffected.)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Improvement (change that would cause existing functionality to not work as expected)
• Code refactoring
• Performance improvements
• Documentation update

Screenshots and Media (if applicable)

Test Scenarios

Static: parsed each file with ast — assignments to base_host went 1 → 0, while the 8 calls per file remain, so every reference now resolves to the import.

Behavioural: reproduced the shadowing in isolation (above) to confirm the failure mode and the fix.

Regression: backend unit suite matches the preview baseline exactly — 305 passed, with the same 36 database-dependent errors present on preview when Postgres is not running. ruff check and ruff format clean.

Manual, once #1 lands: trigger any error branch on a Spaces OAuth callback — e.g. open /auth/spaces/google/callback/?code=x&state=y with no matching session — and confirm it redirects with an error code rather than raising a 500.

References

Found by Copilot on #3, where it was filed as a suppressed (low-confidence) comment. It is neither low-confidence nor caused by that PR: the assignment predates it and is untouched there.

Worth noting #3 partially fixes this by accident — replacing the f-string redirect with space_redirect_url() removes one shadowed call from the success path — so the two are complementary and merge in either order.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The change is a minimal, targeted removal of an unused local assignment that was definitively breaking these callbacks at runtime.

Pull request overview

Fixes a runtime crash in the Spaces OAuth callback endpoints caused by shadowing the imported base_host() helper with a session string, which would otherwise raise TypeError: 'str' object is not callable on redirect/error paths.

Changes:

• Removes the unused base_host = request.session.get("host") assignment from Spaces OAuth callbacks so base_host(...) resolves to the imported function.
• Restores correct redirect/error handling behavior for Google, GitHub, and GitLab Spaces OAuth callbacks by preventing the shadowing-induced 500s.

File summaries

File	Description
apps/api/plane/authentication/views/space/google.py	Removes local base_host shadow to ensure callback redirects use the imported base_host() helper.
apps/api/plane/authentication/views/space/github.py	Removes local base_host shadow to prevent TypeError during callback redirect/error handling.
apps/api/plane/authentication/views/space/gitlab.py	Removes local base_host shadow to keep callback redirect/error paths functional.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.