Repository navigation
feat: Add comprehensive SSO provider support with email confirmation - #900
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
React Doctor found no new issues. 🎉 Reviewed by React Doctor for commit |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d77f3950e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const pending = await this.sso.flowStore.consumePending({ | ||
| now, | ||
| tokenHash, | ||
| }); |
There was a problem hiding this comment.
If an email-change request runs concurrently with code verification after the resend cooldown, countCodeAttempt() can return the code hash for address A, then setPendingCode() can replace the stored email and hash with address B before consumePending() runs. The old code passes verification, but the subsequent delete returns address B, which is then passed to signUpOrOfferLink() as verified. This allows a visitor who controls A to create an email-verified account for an unowned address B. Make consumption conditional on the exact code hash and email that were checked, or perform verification and consumption under a transaction with row locking.
Useful? React with 👍 / 👎.
53b551f to
fc7cc1b
Compare
aXenDeveloper
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc7cc1b1d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| <SSOCallbackContent | ||
| errorActions={errorActions} | ||
| onLink={linkSso} | ||
| providerId={providerId} | ||
| providers={ssoProvidersOf(config)} | ||
| showResetPassword={authMethodsOf(config).resetPassword} |
There was a problem hiding this comment.
When a confirmed address belongs to an existing account, this screen renders the link form without onRequestReset, even though showResetPassword can be true. SSOLinkFormContent gates both password recovery and setting an initial password on usePasswordReset().canRequest, which is false without that callback. Consequently, users who forgot their password or have a passwordless account cannot use the recovery flow offered by the normal SSO callback screen. Pass requestPasswordResetAction and config.captcha here as well.
Useful? React with 👍 / 👎.
| > | ||
| {t("email_completion.start_again")} | ||
| </Button> |
There was a problem hiding this comment.
The new invalid-confirmation screen renders a “start again” action without an icon; the expired-pending screen in sso-email-completion.tsx does the same. AGENTS.md explicitly requires a leading, aria-hidden lucide-react icon on every action button, including retry and sign-in actions, with an exception only for dismiss controls. Add an appropriate icon before both restart labels.
AGENTS.md reference: AGENTS.md:L83-L83
Useful? React with 👍 / 👎.
…confirmation Adds Apple, Atlassian, GitLab, Kick, LinkedIn, Microsoft, PayPal, Reddit, Slack, TikTok, Twitch and Twitter (X) adapters under @vitnode/core/api/adapters/sso/*. Shared changes: - Sign-in state is a server-side, single-use attempt bound to the browser and provider, carrying a PKCE verifier and OIDC nonce. - ID tokens are validated with jose (signature, alg, iss, aud, exp, nonce). - Returning identities sign in by provider account id, without an email. - Identities without a trusted email confirm an address through an emailed link before an account is created or linked. The link works for 30 minutes, once, and only in the browser that started the sign-in (prevents account pre-hijacking); a link opened elsewhere explains why. - Apple's form_post callback is turned into a same-URL GET by the Start middleware, without relaxing cookie or CSRF rules. - Connecting a new account from Settings needs a sign-in within the hour. - Migration adds core_sso_attempts, core_sso_pending and PKCE/nonce columns on core_users_sso_operations. UI: - Reddit and GitLab are neutral buttons with their colored mark, Kick uses its black and green, Slack gets its four-color logo, so no button label ends up dark-on-color. - Centered "Check your email" state, a mail icon on the email input and icons on "Send a new link" and "Use a different email". Docs: one guide per provider, an email confirmation page, and corrected Discord, Google, Facebook, custom adapter and connected-accounts guides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
e535e27 to
d299f04
Compare
Description
What?
This PR adds support for 12 new SSO providers (Apple, Microsoft, GitLab, PayPal, Reddit, Slack, TikTok, Twitch, Twitter/X, LinkedIn, Atlassian, and Kick) with a complete refactor of the SSO authentication flow. Key changes include:
sso-protocol.ts): Centralized utilities for PKCE, JWT verification, secret hashing, and timing-safe comparisonssso-flow-store.ts): Database-backed storage for OAuth state and pending operations with automatic cleanupcore_sso_attemptsandcore_sso_pendingto track OAuth flows securelyWhy?
The previous SSO implementation was limited to 3 providers (Google, Discord, Facebook) with a basic OAuth flow. This expansion:
The refactored flow separates concerns: protocol handling, provider-specific logic, and UI flows are now cleanly isolated.
Test Plan
sso-protocol.tscovering PKCE, JWT verification, and secret hashingproviders.test.ts) covering token exchange, user info retrieval, and error handling for all 12 providerssso-flow-store.tscovering state/nonce validation and cleanuphttps://claude.ai/code/session_01S9WHKDMZd6SGLUjdYbi4hT