Repository navigation
Add comprehensive SSO provider support with email confirmation - #900
aXenDeveloper wants to merge 2 commits into
Conversation
…confirmation Adds Apple, Atlassian, GitLab, Kick, LinkedIn, Microsoft, PayPal, Reddit, Slack, TikTok, Twitch and Twitter (X) adapters under @vitnode/core/api/adapters/sso/*. Shared changes: - Sign-in state is a server-side, single-use attempt bound to the browser and provider, carrying a PKCE verifier and OIDC nonce. - ID tokens are validated with jose (signature, alg, iss, aud, exp, nonce). - Returning identities sign in by provider account id, without an email. - Identities without a trusted email confirm an address with a one-time code before an account is created or linked. - Apple's form_post callback is turned into a same-URL GET by the Start middleware, without relaxing cookie or CSRF rules. - Connecting a new account from Settings needs a sign-in within the hour. - Migration adds core_sso_attempts, core_sso_pending and PKCE/nonce columns on core_users_sso_operations. Docs: one guide per provider, an email confirmation page, and corrected Discord, Google, Facebook, custom adapter and connected-accounts guides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S9WHKDMZd6SGLUjdYbi4hT
|
Hey there and thank you for opening this pull request! 👋🏼 We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted. Details: |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
React Doctor found no new issues. 🎉 Reviewed by React Doctor for commit |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d77f3950e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const pending = await this.sso.flowStore.consumePending({ | ||
| now, | ||
| tokenHash, | ||
| }); |
There was a problem hiding this comment.
If an email-change request runs concurrently with code verification after the resend cooldown, countCodeAttempt() can return the code hash for address A, then setPendingCode() can replace the stored email and hash with address B before consumePending() runs. The old code passes verification, but the subsequent delete returns address B, which is then passed to signUpOrOfferLink() as verified. This allows a visitor who controls A to create an email-verified account for an unowned address B. Make consumption conditional on the exact code hash and email that were checked, or perform verification and consumption under a transaction with row locking.
Useful? React with 👍 / 👎.
…ogos - Replace the six-digit code with an emailed confirmation link, matching VitNode's existing email verification. The link works for 30 minutes, once, and only in the browser that started the sign-in (prevents account pre-hijacking); a link opened elsewhere explains why. - Rework the pending table (confirmHash/confirmExpiresAt/...) and regenerate the unreleased migration. - Reddit and GitLab become neutral buttons with their colored mark, Kick uses its black and green, Slack gets its four-color logo, so no button label ends up dark-on-color. - Center the "Check your email" state, add a mail icon to the email input and icons to "Send a new link" and "Use a different email". - Update docs and screenshots for the link flow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S9WHKDMZd6SGLUjdYbi4hT
Description
What?
This PR adds support for 12 new SSO providers (Apple, Microsoft, GitLab, PayPal, Reddit, Slack, TikTok, Twitch, Twitter/X, LinkedIn, Atlassian, and Kick) with a complete refactor of the SSO authentication flow. Key changes include:
sso-protocol.ts): Centralized utilities for PKCE, JWT verification, secret hashing, and timing-safe comparisonssso-flow-store.ts): Database-backed storage for OAuth state and pending operations with automatic cleanupcore_sso_attemptsandcore_sso_pendingto track OAuth flows securelyWhy?
The previous SSO implementation was limited to 3 providers (Google, Discord, Facebook) with a basic OAuth flow. This expansion:
The refactored flow separates concerns: protocol handling, provider-specific logic, and UI flows are now cleanly isolated.
Test Plan
sso-protocol.tscovering PKCE, JWT verification, and secret hashingproviders.test.ts) covering token exchange, user info retrieval, and error handling for all 12 providerssso-flow-store.tscovering state/nonce validation and cleanuphttps://claude.ai/code/session_01S9WHKDMZd6SGLUjdYbi4hT