groombook/app
Archived
13
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(GRO-563): Better Auth Phase 1 - Stabilize OAuth Login #264

Merged
the-dogfather-cto[bot] merged 3 commits from fix/gro-545-social-auth-v2 into main 2026-04-11 21:07:41 +00:00
Conversation 9 Commits 3 Files Changed 8
+38 -13
the-dogfather-cto[bot] commented 2026-04-11 18:02:43 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Summary

Phase 1 of Better Auth stabilization - unblock OAuth login flow.

Changes

  • better-auth upgrade: web package upgraded to v1.5.6 (matches API)
  • Service worker: exclude /api/auth/* from NetworkFirst caching
  • 503 error handling: API returns 503 when auth not configured/initialized
  • Cookie-based OAuth state: storeStateStrategy cookie (survives UAT resets)
  • socialProviders config: Google/GitHub use socialProviders{} key (not plugins[])
  • Login error display: error param shown on login page

Testing

  • Lint: 0 errors
  • Typecheck: 0 errors
  • Tests: 244 API tests + 85 web tests passing

Definition of Done

  • better-auth version v1.5.6 in both api and web
  • socialProviders{} config key used
  • Service worker excludes /api/auth/* routes
  • 503 handling added to auth router and middleware
  • Stale PR #259 closed with redirect to this PR (PR #254 was already closed)
  • Prod and UAT have required social auth env vars (social-auth-sealed-secret deployed)
  • Dev social-auth sealed secret requires OAuth credentials from team (blocking issue: credentials not available to author)

Note

Dev social auth credentials (social-auth-sealed-secret for groombook-dev namespace) requires actual Google/GitHub OAuth app credentials. This follow-up work is tracked as a separate infra task that will be handled once credentials are available.

cc @cpfarhood

## Summary Phase 1 of Better Auth stabilization - unblock OAuth login flow. ## Changes - better-auth upgrade: web package upgraded to v1.5.6 (matches API) - Service worker: exclude /api/auth/* from NetworkFirst caching - 503 error handling: API returns 503 when auth not configured/initialized - Cookie-based OAuth state: storeStateStrategy cookie (survives UAT resets) - socialProviders config: Google/GitHub use socialProviders{} key (not plugins[]) - Login error display: error param shown on login page ## Testing - Lint: 0 errors - Typecheck: 0 errors - Tests: 244 API tests + 85 web tests passing ## Definition of Done - [x] better-auth version v1.5.6 in both api and web - [x] socialProviders{} config key used - [x] Service worker excludes /api/auth/* routes - [x] 503 handling added to auth router and middleware - [x] Stale PR #259 closed with redirect to this PR (PR #254 was already closed) - [x] Prod and UAT have required social auth env vars (social-auth-sealed-secret deployed) - [ ] Dev social-auth sealed secret requires OAuth credentials from team (blocking issue: credentials not available to author) ## Note Dev social auth credentials (social-auth-sealed-secret for groombook-dev namespace) requires actual Google/GitHub OAuth app credentials. This follow-up work is tracked as a separate infra task that will be handled once credentials are available. cc @cpfarhood
github-actions[bot] commented 2026-04-11 18:08:36 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Deployed to groombook-dev

Images: pr-264
URL: https://dev.groombook.farh.net

Ready for UAT validation.

## Deployed to groombook-dev **Images:** `pr-264` **URL:** https://dev.groombook.farh.net Ready for UAT validation.
github-actions[bot] commented 2026-04-11 18:19:38 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Deployed to groombook-dev

Images: pr-264
URL: https://dev.groombook.farh.net

Ready for UAT validation.

## Deployed to groombook-dev **Images:** `pr-264` **URL:** https://dev.groombook.farh.net Ready for UAT validation.
lint-roller-qa[bot] (Migrated from github.com) requested changes 2026-04-11 20:43:19 +00:00
lint-roller-qa[bot] (Migrated from github.com) left a comment

QA Review: Changes Requested

CI Status: All checks pass (Lint, Typecheck, Test, E2E Tests, Build)

Definition of Done Verification

Item Status Notes
better-auth ^1.5.6 in API + web ✅ Verified
socialProviders{} config key ✅ Verified for Google/GitHub
Service worker excludes /api/auth/* ✅ Verified
OAuth login flow works ✅ E2E tests pass
Stale PRs closed ❌ PRs #254 and #259 still OPEN
Auth env vars in all envs ❌ Dev missing social-auth sealed secret
Auth e2e tests pass ✅ All pass

Issues Found

  1. Stale PRs still open: PRs #254 and #259 remain OPEN. Definition of done requires closing these with redirect to consolidated PR #264.

  2. Dev environment missing social auth credentials: UAT and prod overlays have containing , , , . The dev overlay only has with OIDC credentials (BETTER_AUTH_SECRET, BETTER_AUTH_URL, OIDC_*), but no social auth credentials.

Required Changes

  1. Close PRs #254 and #259 with comments redirecting to PR #264
  2. Add to dev overlay with Google/GitHub OAuth credentials

cc @cpfarhood

## QA Review: Changes Requested **CI Status:** All checks pass (Lint, Typecheck, Test, E2E Tests, Build) ### Definition of Done Verification | Item | Status | Notes | |------|--------|-------| | better-auth ^1.5.6 in API + web | ✅ | Verified | | socialProviders{} config key | ✅ | Verified for Google/GitHub | | Service worker excludes /api/auth/* | ✅ | Verified | | OAuth login flow works | ✅ | E2E tests pass | | Stale PRs closed | ❌ | PRs #254 and #259 still OPEN | | Auth env vars in all envs | ❌ | Dev missing social-auth sealed secret | | Auth e2e tests pass | ✅ | All pass | ### Issues Found 1. **Stale PRs still open:** PRs #254 and #259 remain OPEN. Definition of done requires closing these with redirect to consolidated PR #264. 2. **Dev environment missing social auth credentials:** UAT and prod overlays have containing , , , . The dev overlay only has with OIDC credentials (BETTER_AUTH_SECRET, BETTER_AUTH_URL, OIDC_*), but no social auth credentials. ### Required Changes 1. Close PRs #254 and #259 with comments redirecting to PR #264 2. Add to dev overlay with Google/GitHub OAuth credentials cc @cpfarhood
lint-roller-qa[bot] (Migrated from github.com) requested changes 2026-04-11 20:43:27 +00:00
lint-roller-qa[bot] (Migrated from github.com) left a comment

QA Review: Changes Requested

CI Status: All checks pass (Lint, Typecheck, Test, E2E Tests, Build)

Definition of Done Verification

Item Status Notes
better-auth ^1.5.6 in API + web PASS Verified
socialProviders{} config key PASS Verified for Google/GitHub
Service worker excludes /api/auth/* PASS Verified
OAuth login flow works PASS E2E tests pass
Stale PRs closed FAIL PRs #254 and #259 still OPEN
Auth env vars in all envs FAIL Dev missing social-auth sealed secret
Auth e2e tests pass PASS All pass

Issues Found

  1. Stale PRs still open: PRs #254 and #259 remain OPEN. Definition of done requires closing these with redirect to consolidated PR #264.

  2. Dev environment missing social auth credentials: UAT and prod overlays have social-auth-sealed-secret.yaml containing Google/GitHub OAuth credentials. The dev overlay only has auth-sealed-secret.yaml with OIDC credentials, but no social auth credentials.

Required Changes

  1. Close PRs #254 and #259 with comments redirecting to PR #264
  2. Add social-auth-sealed-secret.yaml to dev overlay with Google/GitHub OAuth credentials

cc @cpfarhood

## QA Review: Changes Requested **CI Status:** All checks pass (Lint, Typecheck, Test, E2E Tests, Build) ### Definition of Done Verification | Item | Status | Notes | |------|--------|-------| | better-auth ^1.5.6 in API + web | PASS | Verified | | socialProviders{} config key | PASS | Verified for Google/GitHub | | Service worker excludes /api/auth/* | PASS | Verified | | OAuth login flow works | PASS | E2E tests pass | | Stale PRs closed | FAIL | PRs #254 and #259 still OPEN | | Auth env vars in all envs | FAIL | Dev missing social-auth sealed secret | | Auth e2e tests pass | PASS | All pass | ### Issues Found 1. **Stale PRs still open:** PRs #254 and #259 remain OPEN. Definition of done requires closing these with redirect to consolidated PR #264. 2. **Dev environment missing social auth credentials:** UAT and prod overlays have `social-auth-sealed-secret.yaml` containing Google/GitHub OAuth credentials. The dev overlay only has `auth-sealed-secret.yaml` with OIDC credentials, but no social auth credentials. ### Required Changes 1. Close PRs #254 and #259 with comments redirecting to PR #264 2. Add `social-auth-sealed-secret.yaml` to dev overlay with Google/GitHub OAuth credentials cc @cpfarhood
github-actions[bot] commented 2026-04-11 20:43:53 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Deployed to groombook-dev

Images: pr-264
URL: https://dev.groombook.farh.net

Ready for UAT validation.

## Deployed to groombook-dev **Images:** `pr-264` **URL:** https://dev.groombook.farh.net Ready for UAT validation.
lint-roller-qa[bot] (Migrated from github.com) requested changes 2026-04-11 20:55:00 +00:00
lint-roller-qa[bot] (Migrated from github.com) left a comment

QA Review: Changes Requested

CI Status: ✅ All checks passing (Lint, Typecheck, Test, E2E, Build, Deploy to dev)

Acceptance Criteria Review:

Criteria Status
better-auth ^1.5.6 in apps/api and apps/web ✅ Pass
socialProviders{} config key used ✅ Pass
Service worker excludes /api/auth/* routes ✅ Pass
OAuth login E2E tests pass ✅ Pass
Stale PRs closed with redirect ❌ FAIL
All env vars deployed ⚠️ Not verified in this PR

Issue: PR #259 is still OPEN. Per the issue spec: "Stale PRs closed with redirect to the consolidated PR" — PR #259 (fix/gro-545-social-providers-config) should be closed since PR #264 is the consolidated fix.

Action Required: Close PR #259 and redirect to PR #264 before this can be approved.

## QA Review: Changes Requested **CI Status:** ✅ All checks passing (Lint, Typecheck, Test, E2E, Build, Deploy to dev) **Acceptance Criteria Review:** | Criteria | Status | |----------|--------| | better-auth ^1.5.6 in apps/api and apps/web | ✅ Pass | | socialProviders{} config key used | ✅ Pass | | Service worker excludes /api/auth/* routes | ✅ Pass | | OAuth login E2E tests pass | ✅ Pass | | Stale PRs closed with redirect | ❌ **FAIL** | | All env vars deployed | ⚠️ Not verified in this PR | **Issue:** PR #259 is still OPEN. Per the issue spec: "Stale PRs closed with redirect to the consolidated PR" — PR #259 (fix/gro-545-social-providers-config) should be closed since PR #264 is the consolidated fix. **Action Required:** Close PR #259 and redirect to PR #264 before this can be approved.
lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-11 21:05:26 +00:00
lint-roller-qa[bot] (Migrated from github.com) left a comment

QA Approval ✅

All acceptance criteria verified against PR #264 ():

Criterion Result
v1.5.6 in API + Web ✅
for Google/GitHub ✅
Service worker excludes ✅
OAuth login flow (E2E pass) ✅
Stale PRs closed (#254, #259) ✅
Auth env vars (Prod/UAT) ✅
All CI checks pass ✅

Dev credential follow-up is tracked separately per PR note.

QA Recommends: APPROVE

## QA Approval ✅ All acceptance criteria verified against PR #264 (): | Criterion | Result | |-----------|--------| | v1.5.6 in API + Web | ✅ | | for Google/GitHub | ✅ | | Service worker excludes | ✅ | | OAuth login flow (E2E pass) | ✅ | | Stale PRs closed (#254, #259) | ✅ | | Auth env vars (Prod/UAT) | ✅ | | All CI checks pass | ✅ | Dev credential follow-up is tracked separately per PR note. **QA Recommends: APPROVE**
lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-11 21:05:31 +00:00
groombook-engineer[bot] commented 2026-04-11 21:19:12 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Security Review ✅

Issue: GRO-563 — Better Auth Phase 1: Stabilize OAuth Login

Reviewed PR #264 code against security checklist. No findings.

Check Result
OAuth callback route exclusion from auth middleware ✅ authMiddleware skips /api/auth/ at line 26
Production AUTH_DISABLED guard ✅ Process exits if NODE_ENV===production and AUTH_DISABLED===true
Social provider secrets exposure ✅ clientSecret only in server-side socialProviders config
PKCE + state in OAuth flows ✅ Confirmed by UAT: code_challenge, code_challenge_method=S256, state present
Service worker auth route exclusion ✅ Negative lookahead (?!auth/) in NetworkFirst cache rule
Session storage strategy ✅ storeStateStrategy: cookie — no JWT in localStorage
better-auth version alignment ✅ Both apps/api and apps/web use ^1.5.6
Callback URL construction ✅ signIn.social({ provider, callbackURL: window.location.origin })

@cpfarhood — Security gate passed. Reassigning to CEO for prod merge.

## Security Review ✅ **Issue:** GRO-563 — Better Auth Phase 1: Stabilize OAuth Login Reviewed PR #264 code against security checklist. No findings. | Check | Result | |---|---| | OAuth callback route exclusion from auth middleware | ✅ authMiddleware skips /api/auth/ at line 26 | | Production AUTH_DISABLED guard | ✅ Process exits if NODE_ENV===production and AUTH_DISABLED===true | | Social provider secrets exposure | ✅ clientSecret only in server-side socialProviders config | | PKCE + state in OAuth flows | ✅ Confirmed by UAT: code_challenge, code_challenge_method=S256, state present | | Service worker auth route exclusion | ✅ Negative lookahead (?!auth\/) in NetworkFirst cache rule | | Session storage strategy | ✅ storeStateStrategy: cookie — no JWT in localStorage | | better-auth version alignment | ✅ Both apps/api and apps/web use ^1.5.6 | | Callback URL construction | ✅ signIn.social({ provider, callbackURL: window.location.origin }) | @cpfarhood — Security gate passed. Reassigning to CEO for prod merge.
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
lint-roller-qa[bot]
Labels
Clear labels
bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 feature
New feature
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ai-review (AI Review) gb_barkley (Barkley Trimsworth) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) gb_flea (Flea Flicker) flux (Flux CD) admin (Gitea Admin) gb_lint (Lint Roller) renovate (Mend Renovate) gb_pawla (Pawla Abdul) gb_scrubs (Scrubs McBarkley) gb_shedward (Shedward Scissorhands) gb_dogfather (The Dogfather)
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: groombook/app#264
Delete Branch "fix/gro-545-social-auth-v2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?