feat: Oauth github and google by deadlyjack · Pull Request #43 · Acode-Foundation/acode.app

deadlyjack · 2026-05-14T22:21:50Z

No description provided.

greptile-apps · 2026-05-14T22:25:22Z

Greptile Summary

This PR adds GitHub and Google OAuth login/registration, replaces the old registerUser/loginUser pages with unified account/login components, introduces social profile fields (x, linkedin, avatar_url), and refactors routing (/user → /profile, /edit-user → /profile/edit).

OAuth flow: State-cookie CSRF protection, server-side redirect validation via validatedRedirect, and token expiry enforcement in getLoggedInUser are all correctly implemented. Several previously flagged issues (missing redirect roundtrip, stale route paths, raw OAuth ID exposure, missing email guards) appear addressed.
Profile page: User avatar now correctly references the profile owner; social links render inline. LinkedIn URL construction assumes a stored path value (/in/johndoe) but has no validation — a user entering a full URL will produce a broken link.
Schema: github_id and google_id gain unique indexes via updateSchema.js; safeColumns returns boolean expressions for OAuth IDs rather than the raw values.

Confidence Score: 3/5

The core OAuth flow looks sound but real behavioral defects exist in the profile rendering and deep-link path that should be fixed before shipping.

The LinkedIn URL construction silently produces a broken profile link for any user who enters a full URL, and the getCookie token call in the login page means the acode deep-link never carries the real token through the OAuth path.

client/pages/user/index.js (LinkedIn URL), client/pages/login/index.js (httpOnly token + app deep-link), server/lib/oauth.js (missing secure cookie flag)

Security Review

The session token cookie lacks secure: true in server/lib/oauth.js, making it transmissible over plain HTTP.
The oauth_state, oauth_intent, and oauth_redirect cookies in server/apis/oauth.js also lack secure: true.
No other injection, credential leakage, or auth-bypass issues were identified.

Important Files Changed

Filename	Overview
server/apis/oauth.js	New OAuth routes for GitHub and Google — state cookie CSRF protection is in place, redirect validation added. Previously flagged issues appear resolved.
server/lib/oauth.js	Token issuance, provider helpers, and state generation. `httpOnly` added to token cookie; `secure` flag is missing.
server/apis/user.js	Adds GitHub/Google unlink endpoints and new social fields. Contains a truncated 'User already' error message.
server/entities/user.js	Adds OAuth ID columns, avatar_url, social fields. `safeColumns` returns boolean expressions for github_id/google_id.
client/pages/account/index.js	New combined register/edit profile page with OAuth link/unlink buttons. Error handling looks correct.
client/pages/login/index.js	New login page with OAuth buttons. `getCookie('token')` always returns null due to httpOnly flag (previously flagged).
client/pages/user/index.js	Refactored profile page. LinkedIn link construction breaks if user stores a full URL instead of a path.
client/lib/helpers.js	Adds user cache, `invalidateLoggedInUser`, and `withRedirect`. `withRedirect` does not URL-encode the redirect parameter.
server/updateSchema.js	Adds migration queries for new OAuth columns with correct unique indexes.
server/lib/helpers.js	Adds server-side token expiry check in `getLoggedInUser` — correct improvement.
client/main.js	Route updates and OAuth wildcard route added. Logout invalidates client-side user cache correctly.

_{Reviews (6): Last reviewed commit: "feat: enhance OAuth account linking, imp..." | Re-trigger Greptile}

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

…ng alerts

…pp into ajit/feat-oauth

deadlyjack · 2026-05-14T22:50:32Z

@greptile_apps review again

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

…pp into ajit/feat-oauth

deadlyjack · 2026-05-14T23:07:57Z

@greptile_apps review once more

deadlyjack · 2026-05-14T23:40:19Z

@greptile_apps review once more

greptile-apps · 2026-05-14T23:52:13Z

    <section id='user'>
      <div className='profile'>
-        <img ref={img} src={userImage} alt='' className='profile-image' />
+        <img src={loggedInUser.avatar_url || gravatar(user.github)} alt={loggedInUser.email} className='profile-image' />


Wrong user's avatar shown; crash when viewing another user's profile while logged out

The newly-added img element reads from loggedInUser instead of user. When any visitor navigates to /profile/123 without a session, loggedInUser is null and loggedInUser.avatar_url throws a TypeError before the component renders. Even when the viewer is logged in, they see their own avatar on another person's profile page. Both avatar_url and the alt attribute should reference user, the profile owner.

…component

…t/feat-oauth

deadlyjack · 2026-05-16T18:57:29Z

@greptile_apps review the changes

…er profile fields

deadlyjack · 2026-05-16T20:50:50Z

@greptile_apps review the changes

greptile-apps · 2026-05-16T20:56:33Z

Want your agent to iterate on Greptile's feedback? Try greploops.

greptile-apps · 2026-05-16T20:56:37Z

+          <div className='socials' data-show-sensitive-info={String(shouldShowSensitiveInfo)}>
+            {user.website && (
+              <a href={user.website} target='_blank' rel='noopener'>
+                <span className='icon earth' />
+                <span className='label'>{user.website}</span>


Broken link when user stores a full LinkedIn URL

The link is built as `https://linkedin.com${user.linkedin}`, expecting a stored value of /in/johndoe. If a user enters the full URL (https://linkedin.com/in/johndoe) in the edit form — which has no client- or server-side validation — the rendered href becomes https://linkedin.comhttps://linkedin.com/in/johndoe, producing a broken link on their public profile with no error surfaced to them.

…ation, fix LinkedIn profile link

feat: Oauth github and google

c6dab6a

greptile-apps Bot reviewed May 14, 2026

View reviewed changes

Comment thread server/updateSchema.js

Comment thread server/apis/oauth.js Outdated

Comment thread client/lib/helpers.js

Comment thread server/lib/oauth.js

Comment thread server/apis/oauth.js Outdated

deadlyjack and others added 4 commits May 15, 2026 04:03

Update server/lib/oauth.js

f7d8687

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Update client/lib/helpers.js

8002fe3

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

feat: enhance OAuth flow with redirect handling and update user linki…

fc40b41

…ng alerts

Merge branch 'ajit/feat-oauth' of github.com:Acode-Foundation/acode.a…

2f518c2

…pp into ajit/feat-oauth

greptile-apps Bot reviewed May 14, 2026

View reviewed changes

Comment thread server/apis/oauth.js

Comment thread server/lib/oauth.js

Comment thread client/pages/account/index.js

deadlyjack requested review from RohitKushvaha01, UnschooledGamer and bajrangCoder May 14, 2026 23:00

deadlyjack and others added 4 commits May 15, 2026 04:31

Apply suggestion from @greptile-apps[bot]

00d554e

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Apply suggestion from @greptile-apps[bot]

65b9661

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

feat: improve redirect validation in OAuth flow

678b55e

Merge branch 'ajit/feat-oauth' of github.com:Acode-Foundation/acode.a…

bfe5cbe

…pp into ajit/feat-oauth

greptile-apps Bot reviewed May 14, 2026

View reviewed changes

Comment thread server/lib/oauth.js

Ajit Kumar added 2 commits May 15, 2026 05:06

feat: update user avatar handling and improve OAuth error messaging

853bd86

feat: enhance OAuth error handling and validate Google user email

308dfeb

greptile-apps Bot reviewed May 14, 2026

View reviewed changes

Ajit Kumar added 3 commits May 15, 2026 11:21

fix: initialize user variable and update avatar image source in User …

31d7e8f

…component

Merge branch 'main' of github.com:Acode-Foundation/acode.app into aji…

6760a5c

…t/feat-oauth

fix: UI/UX

66bc863

chore: remove redundant destructuring

930df96

greptile-apps Bot reviewed May 16, 2026

View reviewed changes

Comment thread server/entities/user.js

Comment thread server/apis/oauth.js Outdated

feat: enhance OAuth account linking, improve logout UX, and expand us…

1b86659

…er profile fields

greptile-apps Bot reviewed May 16, 2026

View reviewed changes

Ajit Kumar added 2 commits May 17, 2026 02:45

fix: add X/LinkedIn ID validators, remove github/website from registr…

517cde7

…ation, fix LinkedIn profile link

fix: harden auth cookie security and sanitize OAuth error messages

911f02b

deadlyjack merged commit 15aa19e into main May 16, 2026

deadlyjack deleted the ajit/feat-oauth branch May 16, 2026 21:46

Conversation

deadlyjack commented May 14, 2026

Uh oh!

greptile-apps Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 3/5

Security Review

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deadlyjack commented May 14, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

deadlyjack commented May 14, 2026

Uh oh!

Uh oh!

deadlyjack commented May 14, 2026

Uh oh!

greptile-apps Bot May 14, 2026

Choose a reason for hiding this comment

Uh oh!

deadlyjack commented May 16, 2026

Uh oh!

Uh oh!

Uh oh!

deadlyjack commented May 16, 2026

Uh oh!

greptile-apps Bot commented May 16, 2026

Uh oh!

greptile-apps Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

greptile-apps Bot commented May 14, 2026 •

edited

Loading