fix(ci): load Figma file pages over pinned REST - #1032
Conversation
Cursor Cloud Agents cannot complete Figma MCP OAuth. Record the 401 challenge, the official Cloud-unsupported decision, and a REST FIGMA_ACCESS_TOKEN whoami helper that never prints the secret. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Semgrep p/default flagged urllib.request.urlopen in figma_rest_auth.py as dynamic-urllib-use-detected. Open api.figma.com over TLS with a literal host and path, and refuse any other URL. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Cloud Agents still cannot finish Figma MCP OAuth. After whoami succeeds, load one file at GET /v1/files/:key?depth=1 so the next action is a named page rather than a token-only check. Pin headers to X-Figma-Token, cap response bodies, and record APA 7th citations for the REST fallback. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Do not merge this draft in parallel with #1034.
The --file page inventory, body caps, Host refusal, plan-token doctoring, CWE-22, and live unauthenticated /v1/me check are the right security extras. They are now on #1034 (b332f91d) together with allowlisted /v1/files/{key}/nodes and /v1/images/{key}, Figma URL + node-id parse, and a separate figma_rest_file.py so whoami stays argument-free.
Keep #1028 and this PR draft. Landing vehicle is #1034. Next operator action after merge: store FIGMA_ACCESS_TOKEN, then python3 scripts/ci/figma_rest_auth.py and python3 scripts/ci/figma_rest_file.py <file-key-or-url>.
Sent by Cursor Automation: Fix Issues
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| connection = http.client.HTTPSConnection( | ||
| FIGMA_API_HOST, | ||
| timeout=REQUEST_TIMEOUT_SECONDS, | ||
| ) |
|
Closing as superseded by the current-head Figma REST/auth implementation in #1146, which consolidates the file/page loading, Cloud Agent auth fallback, design fields, and branch-key contract coverage. |
|
Superseded by #1146. |
3 participants
Summary
Successor to #1028. Cloud Agents still cannot finish Figma MCP OAuth. Whoami alone leaves the buyer unable to read a design file. This helper now verifies
FIGMA_ACCESS_TOKENand loads one file atGET /v1/files/:key?depth=1so the next action is a named page, node, or image request.http.client.HTTPSConnection("api.figma.com")(nourllib.request.urlopen).X-Figma-Tokenheader so aHostoverride cannot retarget TLS..., slashes, and query characters (CWE-22).AGENTS.md,ARCHITECTURE.md, andCHANGELOG.mdrecord the two-path auth and APA 7th citations.Prefer this PR over #1028. Do not merge #1028 in parallel.
Developer experience
python3 scripts/ci/figma_rest_auth.pystill proves the secret without printing it.python3 scripts/ci/figma_rest_auth.py --file FILE_KEYprints page names plus component and style counts.dynamic-urllib-use-detectedstays inapplicable.User experience
FIGMA_ACCESS_TOKENis set.--filerun: pick a page and request that node or its images over REST.Test plan
tests/test_figma_rest_auth.py— missing/empty token, 200/401/403/404/503, refused non-whoami and non-file URLs, Host header refusal, body cap, invalid file keys, CLI usage, token never echoedGET /v1/meagainstapi.figma.comreturns HTTP 401/403coverage run -m pytest tests— 1145 passed, 100% onscripts/ciinterrogate— 100% onscripts/ciFIGMA_ACCESS_TOKENis added, rerun whoami and--fileon a Cloud Agent with a real file key