fix(auth): use standalone PKCE for Vercel compatibility#72
Merged
Conversation
Remove @cosmonexus/oauth-* packages and .npmrc (requires local Verdaccio). Revert to standalone PKCE implementation in OAuthPkce.res. Comment out @CosmoNexus bindings in OAuthPkce.res and OAuthReact.res for future swap-in when packages are published to npm.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 52 minutes and 25 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR removes the Changes
Sequence Diagram(s)sequenceDiagram
actor User
participant Browser
participant App as App/AuthContext
participant OAuthPkce
participant AuthServer as Auth Server
participant TokenServer as Token Server
User->>Browser: Click Login
Browser->>App: Trigger login()
App->>OAuthPkce: startAuth(config)
OAuthPkce->>OAuthPkce: generateRandomString() → state
OAuthPkce->>OAuthPkce: generateRandomString() → code_verifier
OAuthPkce->>OAuthPkce: generateCodeChallenge(code_verifier)
OAuthPkce->>OAuthPkce: Store state, code_verifier in sessionStorage
OAuthPkce-->>App: Return authorize URL
App->>Browser: Redirect to authorize URL
Browser->>AuthServer: GET /authorize?code_challenge=...&state=...
AuthServer->>Browser: Show login/consent screen
User->>AuthServer: Authenticate & consent
AuthServer->>Browser: Redirect to callback?code=AUTH_CODE&state=STATE
Browser->>App: Load callback page with code & state
App->>OAuthPkce: exchangeCode(config, code)
OAuthPkce->>OAuthPkce: Retrieve code_verifier from sessionStorage
OAuthPkce->>TokenServer: POST /token (code, code_verifier, client_id)
TokenServer-->>OAuthPkce: Return accessToken, tokenType, expiresIn
OAuthPkce->>OAuthPkce: Clear sessionStorage (code_verifier, state)
OAuthPkce-->>App: Return tokenSet
App->>App: Update state: LoggedIn(tokenSet)
Browser->>User: Redirect to authenticated app
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Show a caption below the sign-in button explaining that the OAuth flow requires the mock server running locally.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/bindings/OAuthPkce.res`:
- Around line 73-107: exchangeCode currently always returns a tokenSet even when
the token endpoint fails; update exchangeCode to validate and throw on errors:
first read the codeVerifier from sessionStorage and if it's empty throw; after
fetchRaw check the response status (response.ok) and if not OK parse the
response body (json) and throw an Error including status and any
json.error/details; once OK parse json and validate required fields
json["access_token"], json["token_type"], and json["expires_in"] and throw if
any are missing; still remove sessionStorage pkce items
(sessionStorage.removeItem) before throwing or returning; finally return the
token shape only when all validations pass. Include references to exchangeCode,
fetchRaw, and the sessionStorage pkce keys so you edit the right code.
In `@src/context/AuthContext.res`:
- Around line 56-77: The callback currently only extracts `code` in
`parseCode`/`handleCallback` and immediately calls `OAuthPkce.exchangeCode`;
update `parseCode` to also read `state`, then in `handleCallback` compare the
returned `state` to the stored `pkce_state` (the value set by
`OAuthPkce.startAuth`) and abort (do not call `OAuthPkce.exchangeCode`) if they
do not match; ensure the mismatch path logs/handles the error and only proceeds
to call `OAuthPkce.exchangeCode(oauthConfig, c)` and setState when the `state`
check passes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7193cb45-3f2b-4a10-87db-e9ecab2d7d66
⛔ Files ignored due to path filters (2)
bun.lockbis excluded by!**/bun.lockbpackage-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (6)
.npmrcpackage.jsonsrc/App.ressrc/bindings/OAuthPkce.ressrc/bindings/OAuthReact.ressrc/context/AuthContext.res
💤 Files with no reviewable changes (2)
- .npmrc
- package.json
Validate code verifier exists before exchange, check response.ok and throw with status on failure, validate required fields (access_token, token_type, expires_in) in response. Always clean up sessionStorage before throwing or returning.
Compare returned state from callback URL against stored pkce_state in sessionStorage. Abort token exchange and log error on mismatch to prevent CSRF attacks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@cosmonexus/oauth-*packages (require local Verdaccio, unavailable on Vercel).npmrcandpackage-lock.jsonOAuthPkce.resto standalone PKCE implementation@cosmonexusbindings inOAuthPkce.resandOAuthReact.resfor future swap-inAuthContext.resto use standalone flow directlyUserProviderwrapper fromApp.res(no longer needed)The
@cosmonexusbindings are preserved as comments — uncomment when the packages are published to npm.Test plan
bun run res:build— 112 modules, zero warningsbun run build— production build succeeds (no external registry needed)bun run test— all 18 tests passSummary by CodeRabbit
Refactor
Chores